@kal-elsam/kairo-runtime 0.16.0 → 0.18.0

package/src/global/conversation/sanitized-snapshot.js

@@ -0,0 +1,169 @@
+// The real defense the Bootstrap Analyst runs against: never the real
+// project directory. A read-only sandbox (Codex) or an unrestricted
+// permission mode (Claude, today) only ever governs WRITES — neither
+// stops the model provider's own backend from receiving the real
+// CONTENT of whatever the model reads as part of normal inference.
+// "Read-only" is not "secret-safe".
+//
+// This builds a real temporary copy of the project's real text files,
+// with every real matched secret redacted (secret-scanner.js) and every
+// path context-compiler.js's own isPrivatePath already excludes from
+// context skipped outright — the analyst's `cwd` points at THIS copy,
+// so a normal investigation (listing/reading files within its working
+// directory, which is how these agents actually explore) never sees an
+// unredacted secret.
+//
+// HONEST LIMIT, verified empirically against the real Codex CLI, not
+// assumed: `codex exec --sandbox read-only` does NOT confine file READS
+// to cwd — a real test run against a real absolute path outside the
+// snapshot successfully read that file's content. This is not a bug in
+// Codex; "read-only" there means "no writes", full-disk read access is
+// the documented default. So THIS MODULE is not a hard filesystem
+// sandbox by itself, and must never be described as one.
+//
+// For Codex specifically, that gap is now closed by a real, empirically
+// proven OS-level boundary: see codex-sandbox.js, which wraps Bootstrap
+// Analysis's Codex invocation in an external macOS sandbox-exec (SBPL)
+// profile confined to this module's snapshotRoot. conversation/service.js's
+// runBootstrapAnalysis routes Codex through that wrapper, never through
+// plain askProvider, and fails closed (isolation_unavailable) rather than
+// silently degrading on a platform without a verified boundary.
+//
+// For every other provider (Claude today) and for Codex on a non-macOS
+// platform, the remaining mitigation is still redaction-only: the analyst
+// is never told the real project's absolute path (buildAnalystPrompt only
+// ever passes profile.projectName, never a path), and .git is always
+// excluded (no remote URL or other path hints to reconstruct it from) —
+// so escaping requires the model to already know or guess a path it was
+// never given, not merely wanting to. Closing that gap for other
+// providers/platforms needs their own verified OS-level boundary; there
+// is none today.
+
+import { mkdtemp, mkdir, readdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, relative, dirname } from "node:path";
+import { isPrivatePath } from "../intelligence/context-compiler.js";
+import { redactSecrets } from "./secret-scanner.js";
+
+// Directories that are never real source the analyst needs to read, and
+// are often huge (vendor code, build output, VCS internals) — skipped
+// outright rather than wastefully copied and scanned.
+const EXCLUDED_DIR_NAMES = new Set([
+  ".git", "node_modules", ".next", "dist", "build", ".turbo", ".cache", "coverage",
+  ".codegraph", "graphify-out", ".venv", "__pycache__", ".pnpm"
+]);
+
+// A conservative allowlist of real source/text extensions — binary files
+// (images, fonts, compiled artifacts) are never copied; there's nothing
+// for the analyst to usefully read in them, and skipping avoids wasting
+// the file/byte budget below on files that can't meaningfully leak text
+// secrets anyway (a real secret embedded in a binary is a much rarer,
+// separate risk this module doesn't attempt to solve).
+const TEXT_EXTENSIONS = new Set([
+  ".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".json", ".md", ".mdx", ".yml", ".yaml",
+  ".toml", ".env.example", ".txt", ".css", ".scss", ".html", ".py", ".go", ".rs", ".rb",
+  ".java", ".kt", ".swift", ".sh", ".graphql", ".sql", ".xml", ".vue", ".svelte"
+]);
+
+const DEFAULT_MAX_FILES = 400;
+const DEFAULT_MAX_TOTAL_BYTES = 4 * 1024 * 1024; // 4 MiB — a real, bounded budget, not the whole repo
+const DEFAULT_MAX_FILE_BYTES = 256 * 1024;
+
+function isTextFile(filePath) {
+  for (const ext of TEXT_EXTENSIONS) {
+    if (filePath.endsWith(ext)) return true;
+  }
+  return false;
+}
+
+async function walk(root, dir, budget, report, deps) {
+  let entries;
+  try {
+    entries = await deps.readdir(dir, { withFileTypes: true });
+  } catch {
+    return; // unreadable dir — skip, never throw and abort the whole snapshot
+  }
+  for (const entry of entries) {
+    if (budget.filesCopied >= budget.maxFiles || budget.totalBytes >= budget.maxTotalBytes) return;
+    const absolute = join(dir, entry.name);
+    const rel = relative(root, absolute).replace(/\\/g, "/");
+    if (entry.isDirectory()) {
+      if (EXCLUDED_DIR_NAMES.has(entry.name)) continue;
+      await walk(root, absolute, budget, report, deps);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    if (isPrivatePath(rel)) {
+      report.excludedPrivatePaths.push(rel);
+      continue;
+    }
+    if (!isTextFile(entry.name)) continue;
+    let stats;
+    try {
+      stats = await deps.stat(absolute);
+    } catch {
+      continue;
+    }
+    if (stats.size > budget.maxFileBytes) {
+      report.excludedOversized.push(rel);
+      continue;
+    }
+    let content;
+    try {
+      content = await deps.readFile(absolute, "utf8");
+    } catch {
+      continue; // likely binary despite the extension allowlist, or unreadable — skip, never guess
+    }
+    const { text, redactedCount } = redactSecrets(content);
+    const destination = join(budget.snapshotRoot, rel);
+    await deps.mkdir(dirname(destination), { recursive: true });
+    await deps.writeFile(destination, text, "utf8");
+    report.copiedFiles.push(rel);
+    budget.filesCopied += 1;
+    budget.totalBytes += Buffer.byteLength(text, "utf8");
+    report.filesCopied += 1;
+    report.secretsRedacted += redactedCount;
+    if (redactedCount > 0) report.redactedFiles.push(rel);
+  }
+}
+
+/**
+ * Builds a real, bounded, secret-redacted temporary copy of a project's
+ * real text files — the Bootstrap Analyst's `cwd` must point here, never
+ * at the real project root. Always call the returned `cleanup()` when
+ * done (a `finally` in the caller), even on failure — never leave a
+ * sanitized copy lying around.
+ * @param {string} projectRoot
+ * @param {{maxFiles?: number, maxTotalBytes?: number, maxFileBytes?: number}} [options]
+ * @param {object} [deps] - injectable real fs/promises functions, for tests only (defaults to the real ones)
+ * @returns {Promise<{snapshotRoot: string, filesCopied: number, secretsRedacted: number, redactedFiles: string[], excludedPrivatePaths: string[], excludedOversized: string[], cleanup: () => Promise<void>}>}
+ */
+export async function buildSanitizedSnapshot(projectRoot, options = {}, deps = {}) {
+  const fsDeps = {
+    readdir: deps.readdir ?? readdir, stat: deps.stat ?? stat, readFile: deps.readFile ?? readFile,
+    mkdir: deps.mkdir ?? mkdir, writeFile: deps.writeFile ?? writeFile
+  };
+  const mkdtempImpl = deps.mkdtemp ?? mkdtemp;
+  const snapshotRoot = await mkdtempImpl(join(tmpdir(), "kairo-analyst-snapshot-"));
+  const budget = {
+    snapshotRoot,
+    filesCopied: 0, totalBytes: 0,
+    maxFiles: options.maxFiles ?? DEFAULT_MAX_FILES,
+    maxTotalBytes: options.maxTotalBytes ?? DEFAULT_MAX_TOTAL_BYTES,
+    maxFileBytes: options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES
+  };
+  const report = { filesCopied: 0, secretsRedacted: 0, redactedFiles: [], copiedFiles: [], excludedPrivatePaths: [], excludedOversized: [] };
+  const cleanup = () => rm(snapshotRoot, { recursive: true, force: true }).catch(() => {});
+  // walk() itself only swallows per-entry errors (an unreadable dir/file
+  // is skipped, never abandons the whole snapshot) — but an unexpected
+  // failure (e.g. disk full mid-copy) can still throw. The mkdtemp'd
+  // directory must never be left behind just because building it failed
+  // partway through.
+  try {
+    await walk(projectRoot, projectRoot, budget, report, fsDeps);
+  } catch (error) {
+    await cleanup();
+    throw error;
+  }
+  return { snapshotRoot, ...report, cleanup };
+}

package/src/global/conversation/secret-scanner.js

@@ -0,0 +1,71 @@
+// A real, local, pattern-based secret scanner — never network I/O, never
+// a provider call. This is the local step of "repo real -> escaneo local
+// de secretos -> snapshot temporal sanitizado -> analista sobre snapshot
+// read-only": nothing containing a matched secret should ever reach a
+// remote model provider unredacted.
+//
+// Honest limitation, stated plainly rather than implied: pattern/regex
+// matching (the same approach tools like gitleaks/detect-secrets use)
+// catches well-known secret SHAPES and generic "key/secret/token =
+// <long string>" assignments — it does NOT catch every possible secret
+// (a custom internal token format with no recognizable shape can still
+// slip through). This is a real, meaningful reduction in exposure, never
+// a guarantee of zero leakage — treat it as a mandatory floor, not a
+// substitute for the user's own judgment about what's sensitive.
+
+const SECRET_PATTERNS = [
+  { name: "aws-access-key-id", pattern: /AKIA[0-9A-Z]{16}/g },
+  { name: "google-api-key", pattern: /AIza[0-9A-Za-z_-]{35}/g },
+  { name: "github-token", pattern: /gh[pousr]_[A-Za-z0-9]{20,}/g },
+  { name: "slack-token", pattern: /xox[baprs]-[0-9A-Za-z-]{10,}/g },
+  { name: "private-key-block", pattern: /-----BEGIN[ A-Z]*PRIVATE KEY-----[\s\S]*?-----END[ A-Z]*PRIVATE KEY-----/g },
+  { name: "jwt", pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+  // The generic catch-all: a variable/key name that reads like a secret,
+  // assigned a long opaque string — this is what actually catches a
+  // hardcoded provider key (Azure, OpenAI, a custom API key) with no
+  // other recognizable shape, which is exactly what the real crm finding was.
+  { name: "generic-credential-assignment", pattern: /(?:api[_-]?key|secret|token|password|passwd|credential|auth[_-]?key)\s*[:=]\s*["']([A-Za-z0-9_\-/+=]{16,})["']/gi }
+];
+
+/**
+ * Scans real text content for known secret shapes. Never mutates, never
+ * touches disk — pure, so it's cheap to run over every file a sanitized
+ * snapshot is about to include.
+ * @param {string} text
+ * @returns {Array<{name: string, index: number, length: number}>}
+ */
+export function scanTextForSecrets(text) {
+  const findings = [];
+  for (const { name, pattern } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    let match;
+    while ((match = pattern.exec(text))) {
+      findings.push({ name, index: match.index, length: match[0].length });
+      if (match[0].length === 0) pattern.lastIndex += 1; // guard against zero-width matches looping forever
+    }
+  }
+  return findings;
+}
+
+/**
+ * Replaces every matched secret span with a fixed-width redaction marker
+ * (never a value derived from the real secret, and never just deleted —
+ * deleting could shift surrounding real code in a way that misleads the
+ * analyst about the file's real structure).
+ * @param {string} text
+ * @returns {{text: string, redactedCount: number}}
+ */
+export function redactSecrets(text) {
+  const findings = scanTextForSecrets(text).sort((a, b) => a.index - b.index);
+  if (!findings.length) return { text, redactedCount: 0 };
+  let result = "";
+  let cursor = 0;
+  for (const finding of findings) {
+    if (finding.index < cursor) continue; // overlapping match already covered
+    result += text.slice(cursor, finding.index);
+    result += "[REDACTED-SECRET]";
+    cursor = finding.index + finding.length;
+  }
+  result += text.slice(cursor);
+  return { text: result, redactedCount: findings.length };
+}