@jaguilar87/gaia 5.1.0 → 5.1.1

package/hooks/modules/security/approval_grants.py

@@ -47,7 +47,7 @@ The current model is:
     pending approval via AskUserQuestion. It carries a semantic signature
     (base command + semantic tokens + normalized flags), is **session-agnostic**
     (see check_db_semantic_grant in gaia.store.writer), and lives for
-    ``APPROVAL_GRANT_TTL_MINUTES`` (60 minutes, the value reflected by
+    ``APPROVAL_GRANT_TTL_MINUTES`` (5 minutes, the value reflected by
     DEFAULT_GRANT_TTL_MINUTES above).
 
 2.  The grant is **consumed on the matching retry**, NOT at SubagentStop and
@@ -71,9 +71,9 @@ Each command in the set is approved explicitly by the user and consumed
 individually.  The legacy verb_family path has been removed.
 
 NOTE: the filesystem helpers below (write_pending_approval, the
-grant-{session}-*.json scanners, consume_session_grants) are the DEPRECATED
-fallback plane retained for grants created before the DB cutover. The active
-flow runs through the DB plane in gaia.store.writer.
+grant-{session}-*.json scanners) are the DEPRECATED fallback plane retained for
+grants created before the DB cutover. The active flow runs through the DB plane
+in gaia.store.writer.
 """
 
 from __future__ import annotations
@@ -115,7 +115,7 @@ def _grant_ttl_minutes() -> int:
     without a circular import (writer never imports this module back). We resolve
     it lazily here, mirroring every other gaia.store import in this file, because
     the hooks package can be imported before the `gaia` package is on sys.path;
-    a module-level import would crash hook load in that window. The 60-minute
+    a module-level import would crash hook load in that window. The 5-minute
     fallback equals the canonical value, so the two never disagree even if the
     lazy import is briefly unavailable.
     """
@@ -123,12 +123,13 @@ def _grant_ttl_minutes() -> int:
         from gaia.store.writer import APPROVAL_GRANT_TTL_MINUTES as _ttl
         return _ttl
     except Exception:
-        return 60
+        return 5
 
 
-# Default GRANT TTL in minutes -- the active-grant retry window. Moved 5 -> 60
-# (Change 3a) so a cross-session human-in-the-loop approval does not expire
-# before it is consumed; sourced from APPROVAL_GRANT_TTL_MINUTES in writer.
+# Default GRANT TTL in minutes -- the active-grant retry window (approvals
+# redesign, M1). The grant is consumed AT THE MATCH, so a short 5-minute window
+# is enough to cover the block -> approve -> retry round trip; sourced from
+# APPROVAL_GRANT_TTL_MINUTES in writer (the single point of truth).
 DEFAULT_GRANT_TTL_MINUTES = _grant_ttl_minutes()
 
 # Default PENDING TTL in minutes (24 hours). DELIBERATELY distinct from the grant
@@ -556,76 +557,6 @@ def consume_grant(command: str, session_id: str = None) -> bool:
     return False
 
 
-def consume_session_grants(session_id: str = None) -> int:
-    """Proactively consume confirmed DB grants for a session at session end.
-
-    Called at SubagentStop as a defense-in-depth measure.  Since G3 cutover
-    the authoritative grant plane is the DB only; this function sweeps all
-    PENDING approval_grants rows whose confirmed=1 and marks them CONSUMED
-    so unused grants cannot be replayed after the session closes.
-
-    The primary replay guard remains consume-on-retry (bash_validator calls
-    consume_db_semantic_grant after each allowed command) -- this function
-    is a secondary sweep that catches any confirmed but unused DB grants that
-    were never retried in the session.
-
-    Args:
-        session_id: Session ID to scope consumption (defaults to env var).
-
-    Returns:
-        Number of DB grants consumed (0 when none found or on error).
-    """
-    if not session_id:
-        session_id = _get_session_id()
-
-    consumed_count = 0
-    try:
-        from gaia.store.writer import consume_db_semantic_grant
-        import gaia.store.writer as _sw
-
-        con = _sw._connect()
-        try:
-            # Find all PENDING, confirmed semantic grants (session-scoped
-            # for this sweep -- we only clean up what this session created).
-            cur = con.execute(
-                """
-                SELECT approval_id
-                FROM approval_grants
-                WHERE scope = 'SCOPE_SEMANTIC_SIGNATURE'
-                  AND status = 'PENDING'
-                  AND confirmed = 1
-                  AND (session_id = ? OR session_id IS NULL)
-                """,
-                (session_id,),
-            )
-            rows = cur.fetchall()
-        finally:
-            con.close()
-
-        for row in rows:
-            approval_id = row[0] if isinstance(row, tuple) else row.get("approval_id")
-            if not approval_id:
-                continue
-            try:
-                consumed = consume_db_semantic_grant(approval_id)
-                if consumed:
-                    consumed_count += 1
-                    logger.info(
-                        "Grant consumed at SubagentStop (DB): approval_id=%s",
-                        approval_id[:16],
-                    )
-            except Exception as _ce:
-                logger.debug(
-                    "consume_session_grants: DB consume failed for %s (non-fatal): %s",
-                    approval_id[:16], _ce,
-                )
-
-    except Exception as e:
-        logger.error("Error consuming session grants (DB): %s", e)
-
-    return consumed_count
-
-
 def confirm_grant(command: str, session_id: str = None) -> bool:
     """Set confirmed=1 on the first PENDING DB grant matching command.
 
@@ -873,11 +804,11 @@ def write_pending_approval_for_file(
     DB-primary since Task E of the approval redesign: persists to
     gaia.approvals.store (gaia.db) first using insert_requested() with
     approval_id = "P-" + nonce.  The filesystem write is removed entirely --
-    scan_pending_db() surfaces file-path pendings exactly like T3 command
-    pendings now that the DB carries them.
+    file-path pendings live in the DB exactly like T3 command pendings and are
+    read on demand via `gaia approvals`.
 
     The sealed_payload uses:
-      - exact_content  = file_path          (surfaced as "command" by scan_pending_db)
+      - exact_content  = file_path          (the blocked file path)
       - operation      = "FILE_WRITE command intercepted: write"
       - scope          = SCOPE_FILE_PATH constant
       - scope_signature = serialised ApprovalSignature for check/activation
@@ -1014,9 +945,9 @@ def find_pending_for_file(
     if not stripped:
         return None
 
-    # DB path: query all pending rows (all_sessions=True -- see scan_pending_db
-    # for the rationale: the host session id inside a subagent is the subagent's
-    # id, not the orchestrator's, so session-scoping would silently miss the row).
+    # DB path: query all pending rows (all_sessions=True). The host session id
+    # inside a subagent is the subagent's id, not the orchestrator's, so
+    # session-scoping would silently miss the row.
     try:
         from gaia.approvals.store import list_pending
         rows = list_pending(all_sessions=True)
@@ -1291,7 +1222,8 @@ def activate_db_pending_by_prefix(
         # consume side is unchanged; this is the create side that was orphaned.
         #
         # Precondition: ``command_set`` in the payload is already pre-filtered to
-        # mutative commands by ``_intake_command_set_pending`` (handoff_persister,
+        # mutative commands by the compound-command intake in bash_validator
+        # (``_validate_compound_command`` -> ``decide_t3_outcome(command_set=...)``,
         # the only producer of these pending records in production). Activation
         # therefore assumes every item is consumable and does NOT re-filter here;
         # do not add a filtering step at this site -- it would silently drop items
@@ -1532,12 +1464,12 @@ def activate_db_pending_by_prefix(
 # string and requires fresh approval. Each item in the set is single-use.
 
 # COMMAND_SET grant TTL in minutes. Aligned to the singular active-grant TTL
-# (DEFAULT_GRANT_TTL_MINUTES / APPROVAL_GRANT_TTL_MINUTES = 60) so a batch of
-# commands approved under one consent gets the same cross-session retry window
-# as a single approved command -- the block-approve-retry flow legitimately
-# spans sessions, and a shorter window would expire the batch before the
-# subagent could consume every item.
-DEFAULT_COMMAND_SET_TTL_MINUTES = 60
+# (DEFAULT_GRANT_TTL_MINUTES / APPROVAL_GRANT_TTL_MINUTES = 5) so a batch of
+# commands approved under one consent gets the same short retry window as a
+# single approved command -- the block-approve-retry flow is same-session and
+# single-use, so 5 minutes is enough to consume every item while keeping the
+# grant's live window tight.
+DEFAULT_COMMAND_SET_TTL_MINUTES = 5
 
 
 def create_command_set_grant(

package/hooks/modules/security/gaia_db_write_guard.py

@@ -8,8 +8,13 @@ Pattern detected:
     sqlite3\\s+.*(gaia\\.db|~/\\.gaia/.*\\.db).*(INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|REPLACE)
     case-insensitive, inside quotes / heredocs.
 
-Read-only SQL (SELECT) is allowed. Bypass is possible via T3 approval grant
-for legitimate cases (manual migrations, debug ops).
+Read-only SQL (SELECT) is allowed. The write block is categorical and NOT
+approvable -- like blocked_commands.py, it denies with SecurityTier.T3_BLOCKED
+and no approval_id, so there is no T3 grant that lifts it. Legitimate cases
+go through the sanctioned paths instead:
+    - DDL / migrations: scripts/bootstrap_database.sh and tools/migration/*
+    - data writes: the `gaia context` CLI / update_contracts, backed by the
+      typed API in gaia/store/writer.py (which enforces _is_authorized())
 
 Public API:
     is_db_write_attempt(command: str) -> bool

package/hooks/modules/security/mutative_verbs.py

@@ -408,21 +408,35 @@ _SCRIPT_FILE_INTERPRETERS: FrozenSet[str] = frozenset({
     "node", "ruby", "perl", "php",
 })
 
+# Non-shell, non-Python interpreters: their script files are SOURCE CODE in a
+# programming language, not shell command lists.  Their content lane is "code"
+# rather than "shell" so the regex classifier suppresses camelCase subcommand
+# splitting -- a camelCase token in JS/Ruby/etc. (``execPath``, ``setState``)
+# is a language identifier, not a CLI subcommand.  Suppressing it removes only
+# false positives: whole-token verbs and command aliases (``rm``/``cp`` used
+# bare), dangerous flags, and blocked-command patterns are still scanned, and
+# camelCase multi-word tokens embedded inside a quoted string argument were
+# never matched anyway (the quote makes the whole string a single token).
+_NON_SHELL_SCRIPT_INTERPRETERS: FrozenSet[str] = frozenset({
+    "node", "ruby", "perl", "php",
+})
+
 # File extensions whose interpreter is implied by ``./script`` (no explicit
 # interpreter token).  Maps the extension to the analysis lane used for its
 # content: "python" routes through the AST analyzer, "shell" through the
-# blocked/mutative regex layer.
+# blocked/mutative regex layer, "code" through the same regex layer but with
+# camelCase subcommand splitting suppressed (non-shell source languages).
 _SHEBANG_EXT_LANES: Dict[str, str] = {
     ".py": "python",
     ".sh": "shell",
     ".bash": "shell",
     ".zsh": "shell",
-    ".js": "shell",
-    ".mjs": "shell",
-    ".cjs": "shell",
-    ".rb": "shell",
-    ".pl": "shell",
-    ".php": "shell",
+    ".js": "code",
+    ".mjs": "code",
+    ".cjs": "code",
+    ".rb": "code",
+    ".pl": "code",
+    ".php": "code",
 }
 
 # Cap on bytes read from a script file during classification.  A script larger
@@ -563,6 +577,101 @@ _UNIVERSAL_DANGEROUS_PATTERNS: Tuple[Tuple[_re.Pattern, str, str], ...] = (
     (_re.compile(r"\bfs\.chmod(Sync)?\s*\("), "fs-chmod", "PERMISSION_MOD"),
 )
 
+# ---------------------------------------------------------------------------
+# Exec-sink string-argument extraction (SHARED: inline code path + script-file
+# code lane)
+# ---------------------------------------------------------------------------
+# ``_scan_exec_sink_string_args`` is the single detector both the inline
+# ``-c``/``-e`` path (``_check_inline_code``) and the script-file "code" lane
+# (``_classify_script_content_by_regex``) call, so exec-sink detection cannot
+# diverge between them.
+#
+# The problem it closes: a command handed to a subprocess sink as a STRING
+# LITERAL -- ``execSync("kubectl delete deployment foo")`` -- is invisible to
+# the verb scanner because the quotes make the whole command a single token.
+# The inline path caught the sink CALL via ``_UNIVERSAL_DANGEROUS_PATTERNS``,
+# but the script-file lane never ran those patterns, so ``node deploy.js`` with
+# an ``execSync(...)`` mutation slipped through as READ_ONLY.
+#
+# False-positive mitigation (required): this is the PROCESS_EXECUTION subset of
+# the universal patterns -- ONLY the call forms that take a command string --
+# NOT the full pattern set (which would flag every legitimate fs.writeFile /
+# fetch / URL literal in a real source file).  Escalation is gated on the
+# EXTRACTED INNER command itself classifying mutative/blocked, so a benign
+# ``execSync("ls")`` is not escalated.
+#
+# ``exec``/``system`` are intentionally generic (they match ruby/perl/php
+# ``system(...)`` and node ``exec(...)``); the inner-command gate keeps the
+# false-positive cost near zero -- ``regex.exec("literal")`` extracts
+# ``literal``, which is not a mutative command, so nothing escalates.
+_EXEC_SINK_STRING_ARG_RE = _re.compile(
+    r"\b(?:execSync|execFileSync|execFile|spawnSync|spawn|shell_exec|passthru|"
+    r"proc_open|system|popen|Popen|exec)\s*\(\s*"
+    r"(?P<q>['\"])(?P<cmd>(?:[^'\"\\]|\\.)*)(?P=q)"
+)
+# Backtick / ``%x{...}`` shell execution (ruby / perl / php): the body IS the
+# command handed to the shell.
+_EXEC_SINK_BACKTICK_RE = _re.compile(r"`([^`\n]{2,})`")
+_EXEC_SINK_PERCENT_X_RE = _re.compile(r"%x[\{\(\[]([^\}\)\]\n]{2,})[\}\)\]]")
+
+
+def _scan_exec_sink_string_args(code: str, family: str) -> "Optional[MutativeResult]":
+    """Extract shell commands handed to exec sinks and re-classify them.
+
+    Shared by ``_check_inline_code`` (inline ``-c``/``-e`` payloads) and
+    ``_classify_script_content_by_regex`` (``node deploy.js`` script files) so
+    exec-sink detection cannot diverge between the two lanes.
+
+    For each exec-sink call whose first argument is a string literal
+    (``execSync("...")``, ``system("...")``, ``spawn("...")``, ...) and for each
+    backtick / ``%x{}`` shell body, the extracted command is re-classified with
+    ``is_blocked_command`` and ``detect_mutative_command``.  A MUTATIVE result
+    is returned ONLY when the inner command is itself blocked or mutative -- a
+    benign inner command (``execSync("ls")``) yields ``None`` (false-positive
+    mitigation).
+    """
+    candidates: List[str] = []
+    for m in _EXEC_SINK_STRING_ARG_RE.finditer(code):
+        candidates.append(m.group("cmd"))
+    for m in _EXEC_SINK_BACKTICK_RE.finditer(code):
+        candidates.append(m.group(1))
+    for m in _EXEC_SINK_PERCENT_X_RE.finditer(code):
+        candidates.append(m.group(1))
+
+    for raw_inner in candidates:
+        inner = raw_inner.strip()
+        if not inner:
+            continue
+        if _is_blocked_command is not None:
+            blocked = _is_blocked_command(inner)
+            if blocked.is_blocked:
+                return MutativeResult(
+                    is_mutative=True,
+                    category=CATEGORY_MUTATIVE,
+                    verb="exec-sink-blocked-cmd",
+                    cli_family=family,
+                    confidence="high",
+                    reason=(
+                        f"exec-sink argument is a blocked command: "
+                        f"{blocked.category}"
+                    ),
+                )
+        inner_result = detect_mutative_command(inner)
+        if inner_result.is_mutative:
+            return MutativeResult(
+                is_mutative=True,
+                category=CATEGORY_MUTATIVE,
+                verb=inner_result.verb,
+                dangerous_flags=inner_result.dangerous_flags,
+                cli_family=family,
+                confidence=inner_result.confidence,
+                reason=(
+                    f"exec-sink argument '{inner}' -> {inner_result.reason}"
+                ),
+            )
+    return None
+
+
 # ---------------------------------------------------------------------------
 # Layer 3: Heuristic safety classification
 # ---------------------------------------------------------------------------
@@ -1043,7 +1152,9 @@ def _is_subcommand_identifier(token: str) -> bool:
 # ============================================================================
 
 @functools.lru_cache(maxsize=128)
-def detect_mutative_command(command: str) -> MutativeResult:
+def detect_mutative_command(
+    command: str, from_source_code: bool = False,
+) -> MutativeResult:
     """Analyze a shell command and return a structured mutative assessment.
 
     Simplified algorithm (CLI-agnostic):
@@ -1056,6 +1167,15 @@ def detect_mutative_command(command: str) -> MutativeResult:
 
     Args:
         command: Raw shell command string.
+        from_source_code: True when ``command`` is a single line drawn from a
+            non-shell SOURCE file (``.js``/``.ts``/``.rb``/...) being scanned
+            by the script-content classifier, rather than a shell command line
+            or a line from a shell script.  When True, camelCase subcommand
+            splitting is suppressed: a camelCase token in source is a language
+            identifier (``execPath``, ``setState``), not a CLI subcommand, and
+            splitting it produced spurious mutative matches.  Whole-token and
+            hyphen matching are unaffected.  Defaults to False so shell command
+            lines and shell scripts keep the full camelCase behavior.
 
     Returns:
         MutativeResult with full classification details.
@@ -1577,12 +1697,27 @@ def detect_mutative_command(command: str) -> MutativeResult:
         # semantic_index == 1.  Without this guard, ``pytest
         # tests/test_install.py::TestStop`` splits ``TestStop`` and matches
         # ``stop``, misclassifying the whole command as MUTATIVE.
+        #
+        # Source-code guard (word-boundary discipline for non-shell script
+        # content): camelCase multi-word tokens are split so a CLI subcommand
+        # like ``batchDelete`` -> ``delete`` is caught.  But when the scanned
+        # content is a non-shell SOURCE language (``.js``/``.ts``/``.rb`` etc.,
+        # see ``from_source_code``), a camelCase token is overwhelmingly a
+        # source identifier, not a CLI subcommand -- ``execPath``/``execSync``
+        # -> ``exec``, ``setState`` -> ``set``, ``stopPropagation`` -> ``stop``,
+        # ``postMessage`` -> ``post``, ``createElement`` -> ``create``.
+        # Splitting those forced spurious T3 on read-only scripts.  The guard
+        # fires ONLY for source-code content, so shell command lines and shell
+        # scripts (``aws batchDelete``, ``mytool batchDelete``) are unchanged,
+        # and whole-token / hyphen matching (``mytool install``, ``git tag``)
+        # is never gated.
         raw_token = semantics.semantic_head_tokens_raw[semantic_index] if semantic_index < len(semantics.semantic_head_tokens_raw) else token
         camel_parts = split_camel_case(raw_token)
         if (
             semantic_index == 1
             and len(camel_parts) > 1
             and _is_subcommand_identifier(raw_token)
+            and not from_source_code
         ):
             for part in camel_parts:
                 if part in MUTATIVE_VERBS:
@@ -1826,7 +1961,12 @@ def _resolve_script_argument(
         return None
 
     if base_cmd in _SCRIPT_FILE_INTERPRETERS:
-        lane = "python" if base_cmd in _PYTHON_INTERPRETERS else "shell"
+        if base_cmd in _PYTHON_INTERPRETERS:
+            lane = "python"
+        elif base_cmd in _NON_SHELL_SCRIPT_INTERPRETERS:
+            lane = "code"
+        else:
+            lane = "shell"
         defer_flags = _INTERP_NON_SCRIPT_VALUE_FLAGS.get(base_cmd, frozenset())
         # Walk the args (original casing) and return the first true positional
         # -- the script file.  Standalone interpreter switches (-u, -O, -x, ...)
@@ -1966,11 +2106,17 @@ def _check_script_file(
             )
         # parse_failed -> fall through to the shell/regex lane below.
 
-    return _classify_script_content_by_regex(content, script_path, family)
+    # "code" lane (non-shell source: node/ruby/perl/php) suppresses camelCase
+    # subcommand splitting so language identifiers are not read as CLI verbs;
+    # "shell" lane keeps the full command semantics.
+    return _classify_script_content_by_regex(
+        content, script_path, family, from_source_code=(lane == "code"),
+    )
 
 
 def _classify_script_content_by_regex(
     content: str, script_path: str, family: str,
+    from_source_code: bool = False,
 ) -> MutativeResult:
     """Classify shell / non-Python script content via the existing regex layer.
 
@@ -1984,6 +2130,11 @@ def _classify_script_content_by_regex(
       per logical line so a ``kubectl apply`` or ``curl -X POST`` inside the
       file is detected the same way it would be on the command line.
 
+    ``from_source_code`` is forwarded to ``detect_mutative_command`` so that
+    non-shell source content (``.js``/``.rb``/...) suppresses camelCase
+    subcommand splitting -- a source identifier like ``execPath`` must not be
+    read as the CLI verb ``exec``.  Shell-script content leaves it False.
+
     This reuses the existing layers rather than introducing a new parser, per
     the design constraint.
     """
@@ -2007,7 +2158,7 @@ def _classify_script_content_by_regex(
                     ),
                 )
 
-        line_result = detect_mutative_command(line)
+        line_result = detect_mutative_command(line, from_source_code=from_source_code)
         if line_result.is_mutative:
             return MutativeResult(
                 is_mutative=True,
@@ -2022,6 +2173,28 @@ def _classify_script_content_by_regex(
                 ),
             )
 
+        # Exec-sink string-argument re-classification (shared with the inline
+        # code path via ``_scan_exec_sink_string_args``).  A source line like
+        # ``execSync("kubectl delete ...")`` hides a mutative command inside a
+        # string literal the verb scanner cannot see (the quotes make it one
+        # token).  Extract the command handed to a known exec sink and
+        # re-classify it; escalate ONLY when the inner command is itself
+        # mutative/blocked, so a benign ``execSync("ls")`` is not escalated.
+        sink_result = _scan_exec_sink_string_args(line, family)
+        if sink_result is not None and sink_result.is_mutative:
+            return MutativeResult(
+                is_mutative=True,
+                category=sink_result.category,
+                verb=sink_result.verb,
+                dangerous_flags=sink_result.dangerous_flags,
+                cli_family=family,
+                confidence=sink_result.confidence,
+                reason=(
+                    f"Script '{script_path}' exec-sink invokes mutative "
+                    f"command: {sink_result.reason}"
+                ),
+            )
+
     return MutativeResult(
         is_mutative=False,
         category=CATEGORY_READ_ONLY,
@@ -2240,6 +2413,16 @@ def _check_inline_code(command: str, base_cmd: str, family: str, skip_length_che
                 )
             # parse_failed=True -> fall through to regex layer 2b below.
 
+    # ---- Layer 2a: Exec-sink string-argument re-classification ----
+    # Shared with the script-file code lane (``_classify_script_content_by_regex``)
+    # so the two lanes cannot diverge on how a command handed to a subprocess
+    # sink is detected.  Runs before the broader Layer 2b keyword scan.  For a
+    # payload that already parsed cleanly as Python this point is unreachable
+    # (the AST block returned above), so Python behavior is unchanged.
+    sink_result = _scan_exec_sink_string_args(command, family)
+    if sink_result is not None and sink_result.is_mutative:
+        return sink_result
+
     # ---- Layer 2b: Universal dangerous API keyword patterns ----
     for pattern, label, category in _UNIVERSAL_DANGEROUS_PATTERNS:
         if pattern.search(command):