@kendoo.agentdesk/agentdesk 0.25.1 → 0.26.0

package/README.md

@@ -123,6 +123,7 @@ agentdesk team <TASK-ID>               Run a team session on an existing task
 agentdesk team -d "..."                Describe what you want — task created automatically
 agentdesk <agent> -d "..."             Run a single agent (jane, dennis, sam, bart, vera, luna, mark, nora)
 agentdesk daemon                       Start daemon for remote sessions
+agentdesk security-check [-d <dir>]    Multi-surface security audit (server / CLI / UI / prompts)
 agentdesk update                       Update to the latest version
 ```
 

package/bin/agentdesk.mjs

@@ -74,6 +74,7 @@ if (!command || command === "help" || command === "--help") {
     agentdesk team -d "..."                Create a task and run a session
     agentdesk <agent> -d "..."             Run a single agent (jane, dennis, sam, bart, vera, luna, mark, nora)
     agentdesk daemon                       Start daemon for remote sessions
+    agentdesk security-check [-d <dir>]    Multi-surface security audit (server / CLI / UI / prompts)
     agentdesk update                       Update to the latest version
 
   Options:
@@ -207,6 +208,13 @@ else if (command === "daemon") {
   await runDaemon();
 }
 
+else if (command === "security-check") {
+  const { runSecurityCheck, parseSecurityCheckArgs } = await import("../cli/security-check.mjs");
+  const opts = parseSecurityCheckArgs(args.slice(1));
+  const code = await runSecurityCheck(opts);
+  process.exit(code);
+}
+
 else if (command === "update") {
   const { execSync } = await import("child_process");
   const currentVersion = pkg.version;

package/cli/screenshot.mjs

@@ -31,9 +31,27 @@ async function loadPuppeteer() {
   try {
     return await import("puppeteer");
   } catch {
-    console.log("Installing puppeteer...");
-    const { execSync } = await import("child_process");
-    execSync("npm install --no-save puppeteer", { stdio: "inherit" });
+    // AD-50: require explicit consent before installing puppeteer (a ~200 MB
+    // dependency that pulls in a Chromium download). Previously this ran
+    // silently on first screenshot — surprising, and a supply-chain compromise
+    // of puppeteer would have applied transparently.
+    if (process.env.AGENTDESK_SCREENSHOT_AUTO_INSTALL === "1") {
+      console.log("Installing puppeteer (AGENTDESK_SCREENSHOT_AUTO_INSTALL=1)...");
+    } else if (process.stdin.isTTY) {
+      const { createInterface } = await import("readline");
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const answer = await new Promise(resolve =>
+        rl.question("Screenshot requires puppeteer (~200 MB). Install now? [y/N] ", resolve)
+      );
+      rl.close();
+      if (!/^y(es)?$/i.test(String(answer).trim())) {
+        throw new Error("Puppeteer install declined. Re-run with AGENTDESK_SCREENSHOT_AUTO_INSTALL=1 to skip this prompt.");
+      }
+    } else {
+      throw new Error("puppeteer is not installed and no terminal is available to confirm. Set AGENTDESK_SCREENSHOT_AUTO_INSTALL=1 to install non-interactively.");
+    }
+    const { execFileSync } = await import("child_process");
+    execFileSync("npm", ["install", "--no-save", "puppeteer"], { stdio: "inherit" });
     return await import("puppeteer");
   }
 }

package/cli/security-check.mjs

@@ -0,0 +1,187 @@
+// `agentdesk security-check` — runs a multi-surface security audit on a
+// codebase by spawning a Claude process scoped to the target directory.
+//
+// The audit pattern: identify which surfaces exist (server / CLI / UI /
+// prompts), spawn parallel investigators per surface via Claude's Agent
+// tool, return one triaged punch list (Critical / High / Medium / Low)
+// with file:line citations and concrete fix recommendations.
+//
+// This is a batch full-codebase audit, NOT a PR/diff review. For diff
+// review use Claude Code's built-in `/security-review` skill instead.
+
+import { spawn } from "child_process";
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { resolve, join } from "path";
+
+const PROMPT = `You are running a multi-surface security audit on the codebase in the current working directory.
+
+Goal: produce one triaged punch list of security findings (Critical / High / Medium / Low) with file:line citations and concrete fix recommendations.
+
+Step 1 — Survey what's here:
+- Server-shaped dirs: server/, api/, backend/, services/, plus *.py / *.go / *.rs / *.mjs / *.ts that look like HTTP/WS server entrypoints.
+- CLI-shaped dirs: bin/, cli/, cmd/, top-level scripts.
+- UI-shaped dirs: src/, app/, web/, frontend/, components/, index.html.
+- Prompts / config inlined into LLM calls: prompts/, .claude/, CLAUDE.md, MCP configs, agent skill files.
+
+Tell the user which surfaces you'll cover before launching investigators. Skip any that don't exist.
+
+Step 2 — Spawn parallel investigators (one per existing surface) via the Agent tool with subagent_type "general-purpose". Send them in a single message with multiple tool calls so they run concurrently.
+
+Each investigator gets the surface path and a focused checklist:
+
+Server / API — auth bypass (missing auth gates, JWT weaknesses, CSRF, session fixation), authorization / IDOR on every :id route, input validation / injection (SQL via string concat, command injection, path traversal, SSRF, eval, prototype pollution), credential handling (encryption mode, IV reuse, key derivation, leak surfaces), rate limiting on auth endpoints, WebSocket auth (auth-by-message is non-standard), dependency vulns, secret exposure, error handling that leaks stack traces.
+
+CLI / daemon — command injection (every exec/execSync template-literal sink), path traversal in fs.writeFile / path.join, sandbox claims vs implementation (denylists are usually wrong), credential exposure (tokens in logs/argv/errors/temp files), URL parsing SSRF, prompt-injection vectors when CLI feeds external content into an LLM, daemon-push abuse (signed? confirmation required?), config/credential precedence bugs.
+
+UI / frontend / prompts — XSS in any dangerouslySetInnerHTML or markdown render of user-controlled content (agent output is untrusted), JWT/secrets in localStorage, bundled VITE_/NEXT_PUBLIC env vars in the public bundle, CSRF / SameSite, open redirect / clickjacking / missing frame-ancestors, <a href> without scheme allowlist (javascript: URLs run same-origin), prompt-injection robustness (untrusted-data delimiters? hard system rule against following directives in user content?), dependency vulns, CSP / security headers.
+
+Each investigator returns a triaged list (Critical / High / Medium / Low) with file:line citations and concrete fix recommendations. Cap their responses at ~700 words; tell them to prioritize ruthlessly.
+
+Step 3 — Synthesize:
+- Group findings by severity (not by surface — the user wants the queue, not the org chart).
+- Look for chains where a Medium reaches a Critical — note them.
+- Identify the 2-3 structural patterns driving the findings (e.g., "untrusted data treated as trusted across boundaries", "sandbox claim doesn't match implementation"). These root causes are more useful than per-line fixes.
+- Propose a triage plan in dependency order (which fixes ship together, what order minimizes the exposure window).
+
+Step 4 — Present:
+
+# Security audit — <project name> — <date>
+
+## Headline numbers
+- N Critical (exploitable as-is)
+- N High (real risk, needs a chain or specific condition)
+- N Medium (defense-in-depth gaps)
+- N Low (hardening opportunities)
+
+## The N things to fix this week
+<top items with file:line + why-exploitable + concrete fix>
+
+## Full punch list (compact)
+### CRITICAL
+- file.ext:LL — short description. Why exploitable: ... Suggested fix: ...
+### HIGH ...
+### MEDIUM ...
+### LOW ...
+
+## The pattern
+<2-3 sentence root-cause analysis>
+
+## Suggested triage plan
+<ordered plan with rough day-by-day>
+
+Important:
+- Do NOT fix anything. Audit and report only.
+- Be honest about scope — a real audit is days. This one pass produces a focused triage list.
+- For any CHANGELOG entry referencing security work, use NEUTRAL phrasing ("Security improvements. No action required.") — never name the bug class on public release notes.
+`;
+
+function colorize() {
+  const isTTY = process.stdout.isTTY;
+  const c = (code) => (s) => isTTY ? `\x1b[${code}m${s}\x1b[0m` : s;
+  return { dim: c(2), green: c(32), cyan: c(36), yellow: c(33), red: c(31) };
+}
+
+export async function runSecurityCheck({ cwd, out }) {
+  const { dim, green, cyan, yellow, red } = colorize();
+  const targetDir = resolve(cwd || process.cwd());
+  if (!existsSync(targetDir)) {
+    console.error(`${red("Directory not found:")} ${targetDir}`);
+    return 1;
+  }
+
+  // Default output path: .agentdesk/security-audit-<timestamp>.md inside the audited project.
+  const stamp = new Date().toISOString().replace(/[:T]/g, "-").slice(0, 16);
+  const outPath = resolve(out || join(targetDir, ".agentdesk", `security-audit-${stamp}.md`));
+  mkdirSync(join(outPath, ".."), { recursive: true });
+
+  console.log("");
+  console.log(`  ${green("agentdesk security-check")}`);
+  console.log(`  ${dim("Target:")} ${targetDir}`);
+  console.log(`  ${dim("Report:")} ${outPath}`);
+  console.log("");
+  console.log(`  ${dim("Spawning Claude with the audit prompt. This typically takes 5–15 minutes.")}`);
+  console.log(`  ${dim("Output streams to your terminal AND lands in the report file when done.")}`);
+  console.log("");
+
+  // Spawn `claude -p <prompt>` against the target directory. The prompt tells
+  // Claude to use its Agent tool to fan out to parallel investigators.
+  const child = spawn("claude", ["-p", PROMPT, "--permission-mode", "acceptEdits"], {
+    cwd: targetDir,
+    stdio: ["inherit", "pipe", "inherit"],
+    env: process.env,
+  });
+
+  let captured = "";
+  child.stdout.on("data", (buf) => {
+    const chunk = buf.toString();
+    captured += chunk;
+    process.stdout.write(chunk);
+  });
+
+  return new Promise((resolveExit) => {
+    child.on("error", (err) => {
+      console.error(`\n  ${red("Failed to spawn claude:")} ${err.message}`);
+      console.error(`  ${dim("Is the Claude Code CLI installed and on your PATH? https://claude.ai/code")}`);
+      resolveExit(1);
+    });
+    child.on("close", (code) => {
+      try {
+        const header = [
+          `# Security audit — ${targetDir.split("/").pop()}`,
+          `Generated: ${new Date().toISOString()}`,
+          `Target: \`${targetDir}\``,
+          `Tool: agentdesk security-check`,
+          ``,
+          `---`,
+          ``,
+        ].join("\n");
+        writeFileSync(outPath, header + captured);
+        console.log("");
+        console.log(`  ${green("Report written:")} ${outPath}`);
+        if (code !== 0) {
+          console.log(`  ${yellow("Claude exited with code")} ${code}${dim(" — report may be partial.")}`);
+        }
+      } catch (err) {
+        console.error(`\n  ${red("Failed to write report:")} ${err.message}`);
+      }
+      resolveExit(code === null ? 1 : code);
+    });
+  });
+}
+
+export function parseSecurityCheckArgs(args) {
+  let cwd = null;
+  let out = null;
+  for (let i = 0; i < args.length; i++) {
+    if ((args[i] === "--cwd" || args[i] === "-d") && args[i + 1]) {
+      cwd = args[++i];
+    } else if (args[i] === "--out" && args[i + 1]) {
+      out = args[++i];
+    } else if (args[i] === "--help" || args[i] === "-h") {
+      printHelp();
+      process.exit(0);
+    }
+  }
+  return { cwd, out };
+}
+
+function printHelp() {
+  console.log(`
+  agentdesk security-check — multi-surface security audit
+
+  Usage:
+    agentdesk security-check                Audit the current directory
+    agentdesk security-check -d <dir>       Audit a different directory
+    agentdesk security-check --out <file>   Custom report output path
+
+  Spawns a Claude process scoped to the target directory. Claude surveys
+  the codebase, fans out to parallel investigators (server / CLI / UI /
+  prompts), and returns a triaged punch list with file:line citations.
+
+  Output:
+    Streams to your terminal as Claude works, and saves a copy to:
+    <target>/.agentdesk/security-audit-<timestamp>.md (by default)
+
+  Requires the Claude Code CLI on your PATH. https://claude.ai/code
+`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.25.1",
+  "version": "0.26.0",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {