@klhapp/skillmux 1.9.2 → 1.9.3

package/src/config.ts

@@ -87,10 +87,15 @@ const configSchema = z.object({
       enabled: z.boolean(),
       token_env: z.string().min(1),
     }).strict().optional(),
+    max_body_bytes: z.number().int().positive().optional(),
+    max_concurrent_requests: z.number().int().min(0).optional(),
   }).strict().optional(),
   audit: z.object({
     retention_days: z.number().int().min(0).default(90),
   }).strict().default({ retention_days: 90 }),
+  egress: z.object({
+    allowed_hosts: z.array(z.string().min(1)).optional(),
+  }).strict().optional(),
 }).strict().refine((cfg) => {
   const hasReranker = cfg.inference.mode === "remote" && !!cfg.inference.reranker;
   if (hasReranker && cfg.output.max_top_k > cfg.recall.k_rerank) {

package/src/db.ts

@@ -1,4 +1,5 @@
 import { Database } from "bun:sqlite";
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import type { AuditCandidate, AuditRow } from "./types";
@@ -48,6 +49,14 @@ export function openAudit(stateDir: string): Database {
     resolve_audit_id INTEGER,
     rank_at_resolve INTEGER
   )`);
+  db.run(`CREATE TABLE IF NOT EXISTS admin_audit (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    ts TEXT NOT NULL,
+    changes TEXT NOT NULL,
+    resulting_revision TEXT NOT NULL,
+    row_hash TEXT NOT NULL,
+    prev_row_hash TEXT
+  )`);
   adoptAuditFromIndex(db, stateDir);
   return db;
 }
@@ -382,32 +391,131 @@ export function insertFetch(db: Database, row: FetchInsert): void {
 export interface PruneResult {
   audit_deleted: number;
   fetch_deleted: number;
+  admin_audit_deleted: number;
 }
 
 /**
- * Deletes resolve and fetch rows with ts before `cutoffIso`, each by its own
- * timestamp; no FK ties them, so a fetch outliving its resolve row simply
- * reads back uncorrelated (AC7's existing null path). Reclaims the freed
+ * Deletes resolve, fetch, and admin_audit rows with ts before `cutoffIso`,
+ * each by its own timestamp; no FK ties them, so a fetch outliving its
+ * resolve row simply reads back uncorrelated (AC7's existing null path).
+ * admin_audit shares this cutoff rather than a separate retention config
+ * (AC10) — its hash chain is unaffected since pruning only ever removes the
+ * oldest rows, never rows in the middle of the chain. Reclaims the freed
  * pages with an incremental vacuum, which only touches audit.sqlite3 (AC16).
  */
 export function pruneAuditBefore(db: Database, cutoffIso: string): PruneResult {
   const auditResult = db.run("DELETE FROM audit WHERE ts < ?", [cutoffIso]);
   const fetchResult = db.run("DELETE FROM fetch WHERE ts < ?", [cutoffIso]);
+  const adminAuditResult = db.run("DELETE FROM admin_audit WHERE ts < ?", [cutoffIso]);
   db.run("PRAGMA incremental_vacuum");
 
-  return { audit_deleted: auditResult.changes, fetch_deleted: fetchResult.changes };
+  return {
+    audit_deleted: auditResult.changes,
+    fetch_deleted: fetchResult.changes,
+    admin_audit_deleted: adminAuditResult.changes,
+  };
 }
 
 /** AC12: retentionDays <= 0 disables pruning entirely. */
 export function pruneAudit(db: Database, retentionDays: number, now: Date = new Date()): PruneResult {
-  if (retentionDays <= 0) return { audit_deleted: 0, fetch_deleted: 0 };
+  if (retentionDays <= 0) return { audit_deleted: 0, fetch_deleted: 0, admin_audit_deleted: 0 };
   const cutoff = new Date(now.getTime() - retentionDays * 86_400_000).toISOString();
   return pruneAuditBefore(db, cutoff);
 }
 
+export interface AdminAuditChange {
+  key: string;
+  old_value: unknown;
+  new_value: unknown;
+}
+
+export interface AdminAuditInsert {
+  ts: string;
+  changes: AdminAuditChange[];
+  resulting_revision: string;
+}
+
+export interface AdminAuditRow {
+  id: number;
+  ts: string;
+  changes: AdminAuditChange[];
+  resulting_revision: string;
+  row_hash: string;
+  prev_row_hash: string | null;
+}
+
+function computeAdminAuditRowHash(
+  prevRowHash: string | null,
+  fields: { ts: string; changes: AdminAuditChange[]; resulting_revision: string },
+): string {
+  const payload = JSON.stringify({ prev_row_hash: prevRowHash, ...fields });
+  return createHash("sha256").update(payload).digest("hex");
+}
+
+/**
+ * Appends one tamper-evident admin_audit row, chaining its hash to the
+ * previous row's hash (or null for the first row) so any out-of-band
+ * edit/delete breaks the chain — see verifyAdminAuditChain.
+ */
+export function insertAdminAuditRow(db: Database, row: AdminAuditInsert): AdminAuditRow {
+  const prevRow = db
+    .query("SELECT row_hash FROM admin_audit ORDER BY id DESC LIMIT 1")
+    .get() as { row_hash: string } | null;
+  const prevRowHash = prevRow?.row_hash ?? null;
+  const rowHash = computeAdminAuditRowHash(prevRowHash, row);
+
+  db.run(
+    `INSERT INTO admin_audit (ts, changes, resulting_revision, row_hash, prev_row_hash)
+     VALUES (?, ?, ?, ?, ?)`,
+    [row.ts, JSON.stringify(row.changes), row.resulting_revision, rowHash, prevRowHash],
+  );
+
+  const inserted = db.query("SELECT last_insert_rowid() AS id").get() as { id: number };
+  return {
+    id: inserted.id,
+    ts: row.ts,
+    changes: row.changes,
+    resulting_revision: row.resulting_revision,
+    row_hash: rowHash,
+    prev_row_hash: prevRowHash,
+  };
+}
+
+export interface AdminAuditChainResult {
+  valid: boolean;
+  broken_at_id: number | null;
+}
+
+/** Walks admin_audit in insertion order and reports whether the hash chain is unbroken. */
+export function verifyAdminAuditChain(db: Database): AdminAuditChainResult {
+  const rows = db
+    .query("SELECT id, ts, changes, resulting_revision, row_hash, prev_row_hash FROM admin_audit ORDER BY id ASC")
+    .all() as { id: number; ts: string; changes: string; resulting_revision: string; row_hash: string; prev_row_hash: string | null }[];
+
+  let expectedPrevHash: string | null = null;
+  for (const row of rows) {
+    if (row.prev_row_hash !== expectedPrevHash) {
+      return { valid: false, broken_at_id: row.id };
+    }
+    const recomputed = computeAdminAuditRowHash(expectedPrevHash, {
+      ts: row.ts,
+      changes: JSON.parse(row.changes),
+      resulting_revision: row.resulting_revision,
+    });
+    if (recomputed !== row.row_hash) {
+      return { valid: false, broken_at_id: row.id };
+    }
+    expectedPrevHash = row.row_hash;
+  }
+  return { valid: true, broken_at_id: null };
+}
+
 /** Dry-run counterpart of pruneAuditBefore: counts without deleting (AC15). */
 export function countPrunable(db: Database, cutoffIso: string): PruneResult {
   const auditRow = db.query("SELECT count(*) AS n FROM audit WHERE ts < ?").get(cutoffIso) as { n: number };
   const fetchRow = db.query("SELECT count(*) AS n FROM fetch WHERE ts < ?").get(cutoffIso) as { n: number };
-  return { audit_deleted: auditRow.n, fetch_deleted: fetchRow.n };
+  const adminAuditRow = db
+    .query("SELECT count(*) AS n FROM admin_audit WHERE ts < ?")
+    .get(cutoffIso) as { n: number };
+  return { audit_deleted: auditRow.n, fetch_deleted: fetchRow.n, admin_audit_deleted: adminAuditRow.n };
 }

package/src/install.ts

@@ -45,6 +45,21 @@ export function resolveRepoSource(repo: string): RepoSource {
   return rest.length > 0 ? { url, skillPath: rest.join("/") } : { url };
 }
 
+function extractHost(url: string): string {
+  const scpMatch = url.match(/^[^/\s]+@([^/\s]+):/);
+  if (scpMatch) return scpMatch[1]!;
+  return new URL(url).hostname;
+}
+
+export function assertHostAllowed(url: string, allowedHosts: string[] | undefined): void {
+  if (!allowedHosts || allowedHosts.length === 0) return;
+  if (isLocalFileUrl(url)) return;
+  const host = extractHost(url);
+  if (!allowedHosts.map((h) => h.toLowerCase()).includes(host.toLowerCase())) {
+    throw new Error(`refusing to fetch from host "${host}" — not in [egress] allowed_hosts`);
+  }
+}
+
 export function deriveRepoName(url: string): string {
   const cleaned = url.replace(/\.git$/, "");
   const segment = cleaned.split(/[/:]/).filter(Boolean).pop();

package/src/redact.ts

@@ -0,0 +1,52 @@
+const PLACEHOLDER = "[REDACTED]";
+
+// Strips userinfo (user:pass@) from URLs unconditionally, since a
+// credential-bearing git URL (private-repo PAT auth) is typed by the user
+// directly and never resolved from a config `*_env` key, so it can't be
+// caught by the config-driven scrub below.
+const URL_USERINFO = /:\/\/[^/\s@]*@/g;
+
+function redactUrlCredentials(text: string): string {
+  return text.replace(URL_USERINFO, `://${PLACEHOLDER}@`);
+}
+
+/**
+ * Walks the config tree for every string-valued key ending in `_env`
+ * (api_key_env, token_env, auth_token_env, and any future one) and resolves
+ * each to its current environment value.
+ */
+function collectSecretValues(value: unknown): string[] {
+  const secrets: string[] = [];
+  const visit = (node: unknown): void => {
+    if (Array.isArray(node)) {
+      for (const item of node) visit(item);
+      return;
+    }
+    if (node === null || typeof node !== "object") return;
+    for (const [key, val] of Object.entries(node as Record<string, unknown>)) {
+      if (key.endsWith("_env") && typeof val === "string") {
+        const resolved = process.env[val];
+        if (resolved) secrets.push(resolved);
+      } else {
+        visit(val);
+      }
+    }
+  };
+  visit(value);
+  return secrets;
+}
+
+/**
+ * Builds a redactor bound to the currently effective config: a pure
+ * `(text) => text` closure that scrubs any resolved `*_env` secret value.
+ */
+export function buildRedactor(config: unknown): (text: string) => string {
+  const secrets = collectSecretValues(config);
+  return (text: string): string => {
+    let result = redactUrlCredentials(text);
+    for (const secret of secrets) {
+      result = result.split(secret).join(PLACEHOLDER);
+    }
+    return result;
+  };
+}