@klarkxy/dsh-safe-auto 0.1.0-rc.6 → 0.2.0

package/src/ui-host.js

@@ -1,4 +1,6 @@
 import { createControl, CHANNEL, REVIEW_FIELDS } from './control.js';
+import { registerHostRpc } from '@klarkxy/dsh-plugin-kit/host-rpc';
+import { registerModelSettings, notifyModelSettingsChanged } from '@klarkxy/dsh-plugin-kit/model-settings';
 
 export const name = 'dsh-safe-auto-ui-host';
 // Register on this fiber. connection.rpc.handle mounts routes on connection's
@@ -9,62 +11,77 @@ const MAX_REQUEST_BYTES = 64 * 1024;
 
 /** Connection-compatible POST /dsh-safe-auto/<endpoint>. Missing auth policy fails closed. */
 export function registerControlRoute(ctx, call) {
-  return ctx.webServer.register({ kind: 'prefix', path: CHANNEL, handler: async (req, res) => {
-    if (typeof ctx.connection.requestRejection !== 'function') { res.writeHead(503); res.end(); return; }
-    const rejection = ctx.connection.requestRejection(req);
-    if (rejection !== undefined) { res.writeHead(rejection); res.end(rejection === 401 ? 'unauthorized' : 'forbidden'); return; }
-    const pathname = new URL(req.url ?? '/', 'http://dsh.internal').pathname;
-    const endpoint = pathname.startsWith(`${CHANNEL}/`) ? pathname.slice(CHANNEL.length + 1) : '';
-    if (req.method !== 'POST' || !ENDPOINT.test(endpoint) || endpoint.includes('/')) { res.writeHead(404); res.end(); return; }
-    if (String(req.headers['content-type'] ?? '').split(';', 1)[0].trim().toLowerCase() !== 'application/json') {
-      res.writeHead(415); res.end(); return;
-    }
-    const controller = new AbortController();
-    res.on('close', () => { if (!res.writableEnded) controller.abort(); });
-    try {
-      const chunks = [];
-      let size = 0;
-      for await (const chunk of req) {
-        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += bytes.length;
-        if (size > MAX_REQUEST_BYTES) { res.writeHead(413, { connection: 'close' }); res.end(); req.destroy(); return; }
-        chunks.push(bytes);
-      }
-      let message;
-      try { message = JSON.parse(Buffer.concat(chunks).toString('utf8')); }
-      catch { res.writeHead(400); res.end(); return; }
-      if (!message || typeof message !== 'object' || Array.isArray(message)
-          || message.type !== 'client-request' || typeof message.rpcId !== 'string'
-          || message.method !== endpoint || !Object.hasOwn(message, 'payload')) {
-        res.writeHead(400); res.end(); return;
+  return registerHostRpc(ctx, CHANNEL, (endpoint, payload, signal) =>
+    call(endpoint, payload, signal, { interaction: endpoint === 'approval.list' || endpoint === 'approval.answer' }), {
+    maxBodyBytes: MAX_REQUEST_BYTES,
+    isEndpoint: endpoint => ENDPOINT.test(endpoint),
+    caseInsensitiveContentType: true,
+    requirePayload: true,
+    errorBody: status => status === 401 ? 'unauthorized' : status === 403 ? 'forbidden' : undefined,
+    beforeBody: (req, endpoint) => {
+      // Host admission is authoritative; this metadata gate protects the two
+      // browser approval endpoints, including Desktop's forwarded requests.
+      const interaction = endpoint === 'approval.list' || endpoint === 'approval.answer';
+      const site = req.headers['sec-fetch-site'];
+      const desktopRequest = site === undefined && req.headers.origin === undefined;
+      const trustedSite = ['same-origin', 'same-site'].includes(site) || desktopRequest;
+      const trustedDestination = req.headers['sec-fetch-dest'] === 'empty'
+        || (desktopRequest && req.headers['sec-fetch-dest'] === undefined && req.headers['sec-fetch-mode'] === 'cors');
+      if (interaction && (!['cors', 'same-origin'].includes(req.headers['sec-fetch-mode']) ||
+          !trustedSite || !trustedDestination)) {
+        return { status: 403, body: 'browser confirmation required' };
       }
-      const result = await call(endpoint, message.payload, controller.signal);
-      if (!res.destroyed) {
-        res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
-        res.end(JSON.stringify({ type: 'server-response', rpcId: message.rpcId, result }));
-      }
-    } catch {
-      if (!res.destroyed) { res.writeHead(500); res.end('rpc request failed'); }
-    }
-  } });
+    },
+  });
 }
 
 export async function apply(ctx) {
   // Loaded only by the separate UI row; the safety guard keeps its original minimal dependencies.
   const [{ defineDomain, domainTable }, { z }] = await Promise.all([import('@deepseek-ai/dsh-storage-domain'), import('zod')]);
+  // No strict(): rows saved by 0.1.x carry retired keys (fastProvider, approvalReview, …),
+  // which strip on load instead of breaking the panel; the reviewer simply falls back to defaults.
   const domain = await ctx.storageDomain.open(defineDomain({ name: 'dsh_safe_auto', version: 1, tables: {
     settings: domainTable(z.object({ revision: z.number().int().nonnegative(),
-      values: z.object({ ...Object.fromEntries(REVIEW_FIELDS.map(k => [k, z.string().max(4096).optional()])), approvalReview: z.boolean().optional() }).strict(),
+      values: z.object(Object.fromEntries(REVIEW_FIELDS.map(k => [k, z.string().max(4096).optional()]))),
     }).strict()),
   } }));
-  ctx.effect(() => () => domain.close());
-  const control = createControl(ctx.safeAutoRuntime.base, { table: domain.table('settings'), presets: ctx.permissionPresets,
-    sandboxPolicy: ctx.sandboxPolicy, sessions: ctx.sessions });
+  let control;
+  ctx.effect(() => async () => { await control?.dispose(); await domain.close(); });
+  control = createControl(ctx.safeAutoRuntime.base, { table: domain.table('settings'), presets: ctx.permissionPresets,
+    sandboxPolicy: ctx.sandboxPolicy, sessions: ctx.sessions, onChange: () => ctx.safeAutoRuntime.invalidateApprovals?.(),
+    onSettingsChanged: revision => notifyModelSettingsChanged(ctx, '@klarkxy/dsh-safe-auto', revision) });
   // Validate stored settings before publishing any UI endpoint.
   control.settingsView();
+  ctx.effect(() => registerModelSettings(ctx, {
+    ns: '@klarkxy/dsh-safe-auto', title: { zh: '安全自动', en: 'Safe Auto' },
+    read(signal) {
+      signal.throwIfAborted(); control.signal.throwIfAborted();
+      const { revision, values } = control.settingsView();
+      const current = { provider: values.provider, model: values.model,
+        ...(values.reasoningEffort ? { reasoningEffort: values.reasoningEffort } : {}) };
+      return { revision, fields: [{ path: ['model'], label: { zh: '审查模型', en: 'Reviewer model' }, current,
+        followLabel: { zh: '当前会话模型', en: 'Current conversation model' }, allowFollow: true }] };
+    },
+    async write(path, route, expectedRevision, signal) {
+      if (path.length !== 1 || path[0] !== 'model') throw new Error('Unknown Safe Auto model setting');
+      return control.call('settings.save', { values: { provider: route.provider, model: route.model,
+        reasoningEffort: route.reasoningEffort || '' }, expectedRevision }, signal);
+    },
+  }));
   ctx.effect(() => ctx.safeAutoRuntime.attach(control));
-  ctx.effect(() => registerControlRoute(ctx, async (endpoint, payload, signal) => {
-    try { return { ok: true, value: await control.call(endpoint, payload, signal) }; }
+  ctx.effect(() => registerControlRoute(ctx, async (endpoint, payload, signal, source) => {
+    try {
+      control.signal.throwIfAborted();
+      if (endpoint === 'approval.list' || endpoint === 'approval.answer') {
+        if (!source?.interaction) throw new Error('Browser confirmation required');
+        signal.throwIfAborted();
+        if (!payload || typeof payload !== 'object' || Array.isArray(payload)) throw new Error('Invalid approval payload');
+        const value = endpoint === 'approval.list' ? ctx.safeAutoRuntime.listApprovals(payload.sessionId)
+          : ctx.safeAutoRuntime.answerApproval(payload);
+        return { ok: true, value };
+      }
+      return { ok: true, value: await control.call(endpoint, payload, signal) };
+    }
     catch (error) { return { ok: false, error: { code: 'safe-auto/rejected', message: error instanceof Error ? error.message : 'Request rejected', details: {} } }; }
   }));
 }

package/src/escalation.js

@@ -1,118 +0,0 @@
-import { createHash } from 'node:crypto';
-import { lstatSync, realpathSync } from 'node:fs';
-import { dirname, isAbsolute, resolve, sep } from 'node:path';
-import { containsSecret, hardRisk, inspectPath, simpleCommand } from './policy.js';
-
-const verdict = (kind, code, extra = {}) => ({ kind, code, ...extra });
-const TOOLS = new Set(['bash', 'write', 'edit']);
-const SYSTEM_PATH = /^\/(?:etc|proc|sys|dev|boot|root|usr|bin|sbin|lib|lib64|run)(?:\/|$)/;
-
-/** This adapter recognizes only the native, pinned DSH widening vocabulary. */
-export function isNativeEscalation(call) {
-  return TOOLS.has(call.tool) && call.args?.sandbox_permissions === 'danger-full-access';
-}
-
-/** Load-time envelopes are exact, not command prefixes, globs, or directory grants. */
-export function parseEscalationCandidates(value, workspaces) {
-  if (!Array.isArray(value) || value.length > 100) throw new Error('invalid escalationCandidates');
-  return Object.freeze(value.map(rule => {
-    if (!rule || typeof rule !== 'object' || Array.isArray(rule) || !TOOLS.has(rule.tool)) throw new Error('invalid escalation candidate tool');
-    const targetKey = rule.tool === 'bash' ? 'command' : 'filePath';
-    const keys = ['tool', 'cwd', 'mode', targetKey];
-    if (Object.keys(rule).length !== keys.length || Object.keys(rule).some(key => !keys.includes(key))) throw new Error('escalation candidate requires exactly tool, cwd, mode and target');
-    if (rule.mode !== 'danger-full-access' || !workspaces.includes(rule.cwd)) throw new Error('escalation candidate requires an enrolled cwd and explicit danger-full-access mode');
-    if (rule.tool === 'bash') {
-      if (!simpleCommand(rule.command)) throw new Error('escalation command must use the supported simple grammar');
-    } else if (typeof rule.filePath !== 'string' || !isAbsolute(rule.filePath) || resolve(rule.filePath) !== rule.filePath || /[\x00-\x1f\x7f\\:*?]/.test(rule.filePath)) {
-      throw new Error('escalation filePath must be an exact absolute local path');
-    }
-    return Object.freeze({ ...rule });
-  }));
-}
-
-/** Include filesystem identity in the pending decision; do not cache authorization across calls. */
-function fileStamp(path) {
-  const parent = lstatSync(dirname(path));
-  let target;
-  try { target = lstatSync(path); }
-  catch (error) { if (error.code !== 'ENOENT') throw error; }
-  const stamp = s => s ? [s.dev, s.ino, s.mode, s.nlink, s.size, s.mtimeMs, s.ctimeMs] : null;
-  return [stamp(parent), stamp(target)];
-}
-
-/** Does not grant anything: a review result must still pass the native approval seam. */
-export function assessEscalation(call, config) {
-  const args = call.args;
-  if (!args || typeof args !== 'object' || Array.isArray(args)) return verdict('ask', 'INVALID_ARGUMENTS');
-  const hard = hardRisk(call);
-  if (hard) return hard;
-  if (call.sandbox?.mode !== 'workspace-write') return verdict('deny', 'WORKSPACE_SANDBOX_REQUIRED');
-  if (!isNativeEscalation(call)) return verdict('ask', 'UNSUPPORTED_ESCALATION');
-  if (typeof args.justification !== 'string' || !args.justification.trim() || args.justification.length > 4096) return verdict('ask', 'INVALID_JUSTIFICATION');
-  const root = call.sandbox.workspaceRoot;
-  if (!config.workspaceRoots.includes(root) || call.cwd !== root) return verdict('ask', 'UNTRUSTED_WORKSPACE');
-  if (!call.session || call.subagent || call.nested) return verdict('ask', 'NO_DIRECT_USER_AUTHORITY');
-  if (!call.localExecution) return verdict('ask', 'LOCAL_EXECUTION_UNVERIFIED');
-  if (sep !== '/') return verdict('ask', 'UNSUPPORTED_PLATFORM');
-  try {
-    if (realpathSync(root) !== root || !lstatSync(root).isDirectory()) return verdict('ask', 'NONCANONICAL_ROOT');
-  } catch { return verdict('ask', 'PATH_UNAVAILABLE'); }
-  // Full arguments, including file contents, are reviewed verbatim, or refused; never truncate into another action.
-  const serialized = JSON.stringify(args);
-  if (Buffer.byteLength(serialized) > config.maxInputBytes) return verdict('ask', 'REVIEW_INPUT_TOO_LARGE');
-  if (containsSecret(serialized)) return verdict('deny', 'SENSITIVE_ARGUMENTS');
-  let target;
-  let stamp;
-  if (call.tool === 'bash') {
-    if (!simpleCommand(args.command)) return verdict('ask', 'UNSUPPORTED_SHELL');
-    const allowed = ['command', 'description', 'timeoutMs', 'workdir', 'run_in_background', 'sandbox_permissions', 'justification'];
-    if (Object.keys(args).some(k => !allowed.includes(k))) return verdict('ask', 'UNREVIEWED_ARGUMENTS');
-    if (typeof args.description !== 'string' || !args.description.trim()) return verdict('ask', 'INVALID_DESCRIPTION');
-    if (args.workdir !== undefined && args.workdir !== root) return verdict('ask', 'UNREVIEWED_WORKDIR');
-    if (args.run_in_background !== undefined && args.run_in_background !== false) return verdict('ask', 'BACKGROUND_ESCALATION');
-    // The native bash tool can promote even a foreground call when jobs is composed.
-    if (call.jobsAvailable !== false || call.shellConfined !== true) return verdict('ask', 'PROCESS_LIFETIME_UNVERIFIED');
-    if (!Number.isSafeInteger(args.timeoutMs) || args.timeoutMs <= 0 || args.timeoutMs > config.escalationMaxTimeoutMs) return verdict('ask', 'BOUNDED_TIMEOUT_REQUIRED');
-    target = args.command;
-  } else {
-    const allowed = call.tool === 'write'
-      ? ['file_path', 'content', 'sandbox_permissions', 'justification']
-      : ['file_path', 'old_string', 'new_string', 'replace_all', 'sandbox_permissions', 'justification'];
-    if (Object.keys(args).some(k => !allowed.includes(k))) return verdict('ask', 'UNREVIEWED_ARGUMENTS');
-    target = args.file_path;
-    if (typeof target !== 'string' || !isAbsolute(target) || resolve(target) !== target) return verdict('ask', 'EXACT_ABSOLUTE_PATH_REQUIRED');
-    if (SYSTEM_PATH.test(target)) return verdict('deny', 'SYSTEM_TARGET');
-    if (call.tool === 'write' ? typeof args.content !== 'string' :
-      typeof args.old_string !== 'string' || !args.old_string || typeof args.new_string !== 'string' ||
-      (args.replace_all !== undefined && typeof args.replace_all !== 'boolean')) return verdict('ask', 'INVALID_FILE_ARGUMENTS');
-    const path = inspectPath(dirname(target), target, call.tool === 'write');
-    if (path.kind !== 'allow') return path;
-    // edit also changes a file: its existing target must not be a hard link.
-    if (call.tool === 'edit' && lstatSync(target).nlink > 1) return verdict('ask', 'NONREGULAR_TARGET');
-    try { stamp = fileStamp(target); }
-    catch { return verdict('ask', 'PATH_UNAVAILABLE'); }
-  }
-  const matched = config.escalationCandidates.some(rule => rule.tool === call.tool && rule.cwd === root &&
-    rule.mode === args.sandbox_permissions && (call.tool === 'bash' ? rule.command : rule.filePath) === target);
-  if (!matched) return verdict('ask', 'OUTSIDE_ESCALATION_ENVELOPE');
-  return verdict('review', 'ENROLLED_ESCALATION', {
-    stamp,
-    action: { tool: call.tool, arguments: args, cwd: root,
-      permission: { from: call.sandbox.mode, to: args.sandbox_permissions, scope: 'this-call-only',
-        filesystemConfinement: 'removed-for-this-call', networkIsolation: 'not-provided-by-DSH-file-mode' } },
-  });
-}
-
-/** Both grant and request use the native helper's exact audited reason, not a prefix match. */
-export function escalationReason(call) {
-  return `escalate sandbox to ${call.args.sandbox_permissions}: ${call.args.justification}`;
-}
-
-export function bindingOf(call, assessment) {
-  return createHash('sha256').update(JSON.stringify({
-    tool: call.tool, args: call.args, cwd: call.cwd, sandbox: call.sandbox,
-    task: call.task, intent: call.intent, subagent: call.subagent, nested: call.nested,
-    localExecution: call.localExecution, jobsAvailable: call.jobsAvailable, shellConfined: call.shellConfined,
-    code: assessment.code, stamp: assessment.stamp,
-  })).digest('hex');
-}