@memnox/interceptors 0.1.1

package/dist/interceptor-cli.js

@@ -0,0 +1,530 @@
+#!/usr/bin/env node
+import {
+  buildHold,
+  loadHookGate,
+  log,
+  readHookConfig
+} from "./chunk-SB27OD2T.js";
+
+// src/interceptor-cli.ts
+import { spawnSync } from "child_process";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { basename as basename2 } from "path";
+
+// src/breaker-seam.ts
+import {
+  breachIn,
+  DEFAULT_THRESHOLDS,
+  describePause,
+  outcomesFrom,
+  REPLAY_LIMIT,
+  SessionPauses,
+  SqliteEventStore
+} from "@memnox/core";
+async function pauseHolding(home, sessionId) {
+  if (sessionId === void 0 || sessionId === "") return null;
+  try {
+    return await new SessionPauses(home).inForce(sessionId);
+  } catch {
+    return null;
+  }
+}
+function pauseMessage(pause) {
+  return [
+    `Paused by Memnox: ${describePause(pause)}`,
+    `Resume with "memnox resume ${pause.sessionId}".`
+  ].join("\n");
+}
+async function resumedAt(home, sessionId) {
+  try {
+    const pause = await new SessionPauses(home).read(sessionId);
+    return pause?.resumedAt ?? null;
+  } catch {
+    return null;
+  }
+}
+async function observeSession(options) {
+  const { home, sessionId } = options;
+  if (sessionId === void 0 || sessionId === "") return null;
+  try {
+    const since = await resumedAt(home, sessionId);
+    const store = SqliteEventStore.forHome(home);
+    let events;
+    try {
+      events = await store.query({
+        sessionId,
+        limit: REPLAY_LIMIT,
+        ...since === null ? {} : { since }
+      });
+    } finally {
+      store.close();
+    }
+    const breach = breachIn(
+      outcomesFrom(events),
+      options.thresholds ?? DEFAULT_THRESHOLDS
+    );
+    if (breach === null) return null;
+    const last = events[events.length - 1];
+    const pause = {
+      sessionId,
+      signal: breach.signal,
+      reason: breach.reason,
+      reached: breach.reached,
+      ceiling: breach.ceiling,
+      pausedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...last === void 0 ? {} : { lastAction: last.operation }
+    };
+    await new SessionPauses(home).pause(pause);
+    return pause;
+  } catch {
+    return null;
+  }
+}
+
+// src/interceptor-cli.ts
+import {
+  DECISION_EFFECT as DECISION_EFFECT3,
+  isBrowserLauncher,
+  overlaysInForce,
+  provenanceOf,
+  SESSION_VAR,
+  splitCommandLine,
+  SqliteEventStore as SqliteEventStore2,
+  urlArgumentIn
+} from "@memnox/core";
+
+// src/interceptor.ts
+import { basename, delimiter, join } from "path";
+import {
+  DECISION_EFFECT,
+  describeHold,
+  digest,
+  evidenceFor,
+  HOLD_OUTCOME,
+  isAllowed as holdAllowed,
+  MEMNOX_HOME,
+  refusalShapeFor,
+  renderEvidence,
+  resolveAction
+} from "@memnox/core";
+var INTERCEPTOR_DIR = "bin";
+function interceptorDirFor(home) {
+  return join(home, MEMNOX_HOME, INTERCEPTOR_DIR);
+}
+function realPath(path, home) {
+  const ours = interceptorDirFor(home);
+  return path.split(delimiter).filter((entry) => entry !== "" && entry !== ours).join(delimiter);
+}
+var INTERCEPT_BINARY = "memnox-intercept";
+function invokedFor(argv) {
+  const binary = argv[2];
+  if (binary === void 0 || basename(binary) === INTERCEPT_BINARY) return null;
+  return { binary: basename(binary), args: [...argv.slice(3)] };
+}
+async function ruleOnCommand(binary, args, deps) {
+  const verdict = verdictFor(binary, args, deps.env ?? {});
+  const argsDigest = digest(args.join(" "));
+  const base = {
+    allowed: true,
+    binary,
+    args: [...args],
+    action: verdict.action,
+    class: verdict.class,
+    argsDigest,
+    ...verdict.target === void 0 ? {} : { target: verdict.target }
+  };
+  const gate = deps.gate;
+  if (gate === void 0) return base;
+  const decision = gate.evaluate({
+    action: verdict.action,
+    ...verdict.target === void 0 ? {} : { target: verdict.target }
+  });
+  if (decision.effect === DECISION_EFFECT.ALLOW) return base;
+  const shown = renderEvidence(
+    evidenceFor({
+      matched: decision.matchedPolicies,
+      moment: (/* @__PURE__ */ new Date()).toISOString(),
+      ...deps.overlays === void 0 ? {} : { overlays: deps.overlays }
+    })
+  );
+  const matched = decision.matchedPolicies[0];
+  const decided = {
+    reason: decision.reason,
+    ...matched === void 0 ? {} : { rule: { name: matched.name, layer: "project", file: "policy" } }
+  };
+  if (decision.effect === DECISION_EFFECT.ASK) {
+    const held = await askPerson(
+      verdict,
+      decision.reason,
+      shown,
+      [binary, ...args],
+      deps
+    );
+    if (held === null) return { ...base, ...decided };
+    if (typeof held !== "string") {
+      return {
+        ...base,
+        ...decided,
+        allowed: false,
+        edited: held.edited,
+        message: held.message
+      };
+    }
+    return { ...base, ...decided, allowed: false, message: held };
+  }
+  return {
+    ...base,
+    ...decided,
+    allowed: false,
+    message: [refusal(verdict, decision), ...shown].join("\n")
+  };
+}
+async function askPerson(verdict, reason, evidence, command, deps) {
+  const hold = deps.hold;
+  const request = {
+    sessionId: deps.sessionId ?? "ses_local",
+    agent: deps.agent ?? "an agent",
+    operation: verdict.action,
+    fingerprint: digest(`${verdict.action}:${verdict.target ?? ""}`),
+    reason,
+    evidence,
+    command: command.join(" "),
+    ...verdict.target === void 0 ? {} : { target: verdict.target }
+  };
+  if (hold === void 0) {
+    return `${reason}
+Nobody could be asked, so it was denied. Run the agent under "memnox run".`;
+  }
+  const result = await hold.hold(request);
+  if (holdAllowed(result)) return null;
+  if (result.outcome === HOLD_OUTCOME.EDITED && result.edited !== void 0) {
+    return { message: describeHold(result, request), edited: result.edited };
+  }
+  return describeHold(result, request);
+}
+function refusal(verdict, decision) {
+  const alternative = decision.alternative;
+  const instead = alternative === void 0 ? "" : `
+Instead: ${alternative.action}${alternative.resource === void 0 ? "" : ` ${alternative.resource}`} \u2014 ${alternative.note}`;
+  const { guidance } = refusalShapeFor(DECISION_EFFECT.DENY, decision.reason);
+  return `Denied by Memnox: ${decision.reason}
+(${verdict.because})${instead}
+${guidance}`;
+}
+function resolveReal(binary, path, exists) {
+  if (basename(binary) === INTERCEPT_BINARY) return null;
+  for (const entry of path.split(delimiter)) {
+    if (entry === "") continue;
+    const candidate = join(entry, binary);
+    if (basename(candidate) === INTERCEPT_BINARY) continue;
+    if (exists(candidate)) return candidate;
+  }
+  return null;
+}
+function verdictFor(binary, args, env = {}) {
+  const resolved = resolveAction(binary, args, env);
+  return {
+    action: resolved.action,
+    class: resolved.class,
+    because: resolved.because,
+    ...resolved.target === void 0 ? {} : { target: resolved.target }
+  };
+}
+
+// src/browser-seam.ts
+import {
+  BrowserHosts,
+  DECISION_EFFECT as DECISION_EFFECT2,
+  describeHold as describeHold2,
+  digest as digest2,
+  isAllowed as holdAllowed2,
+  navigationHost
+} from "@memnox/core";
+var BROWSER_ACTION = "browser.navigate";
+var BrowserSeam = class {
+  constructor(deps = {}) {
+    this.deps = deps;
+    this.hosts = deps.hosts ?? new BrowserHosts();
+  }
+  deps;
+  hosts;
+  async navigate(url) {
+    const host = navigationHost(url);
+    if (host === null) return { allowed: true, host: null };
+    const sessionId = this.deps.sessionId ?? "ses_local";
+    if (this.hosts.seen(sessionId, host)) {
+      return { allowed: true, host, remembered: true };
+    }
+    const gate = this.deps.gate;
+    const verdict = gate === void 0 ? { effect: DECISION_EFFECT2.ALLOW, reason: "no rules configured" } : gate.evaluate({ action: BROWSER_ACTION, target: host });
+    if (verdict.effect === DECISION_EFFECT2.ALLOW) {
+      this.hosts.remember(sessionId, host);
+      return { allowed: true, host };
+    }
+    if (verdict.effect === DECISION_EFFECT2.DENY) {
+      return { allowed: false, host, message: `Denied by Memnox: ${verdict.reason}` };
+    }
+    const request = {
+      sessionId,
+      agent: this.deps.agent ?? "an agent",
+      operation: BROWSER_ACTION,
+      target: host,
+      fingerprint: digest2(`${BROWSER_ACTION}:${host}`),
+      reason: verdict.reason
+    };
+    const hold = this.deps.hold;
+    if (hold === void 0) {
+      return {
+        allowed: false,
+        host,
+        message: `${verdict.reason}
+Nobody could be asked, so it was denied. Run the agent under "memnox run".`
+      };
+    }
+    const result = await hold.hold(request);
+    if (!holdAllowed2(result)) {
+      return { allowed: false, host, message: describeHold2(result, request) };
+    }
+    this.hosts.remember(sessionId, host);
+    return { allowed: true, host };
+  }
+};
+
+// src/record.ts
+import { randomUUID } from "crypto";
+import {
+  ACTOR_TYPE,
+  ENFORCEMENT_MODE,
+  EVENT_SCHEMA_VERSION,
+  EVENT_SURFACE,
+  TOOL_CLASS
+} from "@memnox/core";
+var CLASSES = Object.values(TOOL_CLASS);
+function classOf(value) {
+  return CLASSES.includes(value) ? value : TOOL_CLASS.UNKNOWN;
+}
+function eventFor(input) {
+  const { outcome } = input;
+  return {
+    id: `evt_${randomUUID().replace(/-/g, "").slice(0, 20)}`,
+    schemaVersion: EVENT_SCHEMA_VERSION,
+    at: input.at,
+    sessionId: input.sessionId ?? "ses_local",
+    agent: input.agent ?? "an agent",
+    actorType: ACTOR_TYPE.AGENT,
+    surface: outcome.binary === "git" ? EVENT_SURFACE.GIT : EVENT_SURFACE.SHELL,
+    operation: outcome.action,
+    class: classOf(outcome.class),
+    effect: input.effect,
+    mode: ENFORCEMENT_MODE.ENFORCE,
+    reason: input.reason,
+    // A digest, never the arguments: an argument list is where a secret would be.
+    argsDigest: outcome.argsDigest,
+    ...outcome.target === void 0 ? {} : { target: outcome.target },
+    ...input.rule === void 0 ? {} : { rule: input.rule },
+    ...input.policyHash === void 0 ? {} : { policyHash: input.policyHash },
+    ...input.bundleHash === void 0 ? {} : { bundleHash: input.bundleHash },
+    ...input.conditionsInForce === void 0 ? {} : { conditionsInForce: input.conditionsInForce },
+    ...input.exitCode === void 0 ? {} : { exitCode: input.exitCode },
+    ...input.durationMs === void 0 ? {} : { durationMs: input.durationMs }
+  };
+}
+async function record(sink, input) {
+  if (sink === null) return;
+  try {
+    await sink.append(eventFor(input));
+  } catch {
+  }
+}
+
+// src/daemon-client.ts
+import { connect } from "net";
+import {
+  DAEMON_METHOD,
+  decodeResponse,
+  encode,
+  LineReader,
+  socketPathFor
+} from "@memnox/core";
+var DAEMON_TIMEOUT_MS = 250;
+function reportToDaemon(home, options) {
+  return speak(home, options.timeoutMs, {
+    id: 1,
+    method: DAEMON_METHOD.RECORD,
+    action: options.action,
+    ...options.target === void 0 ? {} : { target: options.target },
+    ...options.sessionId === void 0 ? {} : { sessionId: options.sessionId },
+    ...options.exitCode === void 0 ? {} : { exitCode: options.exitCode },
+    ...options.outOfScope === void 0 ? {} : { outOfScope: options.outOfScope },
+    ...options.costUsd === void 0 ? {} : { costUsd: options.costUsd }
+  });
+}
+function speak(home, timeout, message) {
+  const path = socketPathFor(home);
+  const timeoutMs = timeout ?? DAEMON_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(value);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    timer.unref?.();
+    const socket = connect(path, () => {
+      socket.write(encode(message));
+    });
+    const reader = new LineReader();
+    socket.setEncoding("utf8");
+    socket.on("data", (chunk) => {
+      for (const line of reader.push(chunk)) finish(decodeResponse(line));
+    });
+    socket.on("error", () => finish(null));
+  });
+}
+
+// src/interceptor-cli.ts
+async function main() {
+  const invocation = invokedFor(process.argv);
+  if (invocation === null) {
+    process.stderr.write(
+      "memnox-intercept is run through the wrappers in ~/.memnox/bin, not directly.\nUsage: memnox-intercept <binary> [args...]\n"
+    );
+    process.exit(2);
+  }
+  const { binary, args } = invocation;
+  const home = homedir();
+  const config = await readHookConfig(process.env, home);
+  const gate = await loadHookGate(config);
+  const overlays = await overlaysInForce(home);
+  const provenance = await provenanceOf(home, overlays, (/* @__PURE__ */ new Date()).toISOString());
+  const sink = openLedger(home);
+  const started = Date.now();
+  const outcome = await ruleOnCommand(binary, args, {
+    ...gate === null ? {} : { gate },
+    overlays,
+    env: process.env,
+    /* Without this an `ask` rule denies instead of asking, which is the difference
+       between an agent that can be left running and one that cannot. */
+    hold: buildHold(),
+    ...process.env[SESSION_VAR] === void 0 ? {} : { sessionId: process.env[SESSION_VAR] },
+    log
+  });
+  const held = await pauseHolding(home, process.env[SESSION_VAR]);
+  if (held !== null) {
+    process.stderr.write(`${pauseMessage(held)}
+`);
+    process.exit(1);
+  }
+  if (!outcome.allowed) {
+    process.stderr.write(`${outcome.message ?? "denied"}
+`);
+    if (outcome.edited !== void 0) {
+      const replacement = splitCommandLine(outcome.edited);
+      const [next, ...rest] = replacement;
+      if (next !== void 0 && basename2(next) !== INTERCEPT_BINARY) {
+        process.stderr.write(`memnox: ruling on the replacement
+`);
+        const again = await ruleOnCommand(basename2(next), rest, {
+          ...gate === null ? {} : { gate },
+          overlays,
+          env: process.env,
+          hold: buildHold(),
+          log
+        });
+        if (again.allowed) {
+          await handAndRecord(
+            basename2(next),
+            rest,
+            home,
+            sink,
+            again,
+            started,
+            provenance
+          );
+          return;
+        }
+        process.stderr.write(`${again.message ?? "denied"}
+`);
+      }
+    }
+    await record(sink, {
+      ...provenance,
+      outcome,
+      effect: DECISION_EFFECT3.DENY,
+      reason: outcome.reason ?? "denied",
+      ...outcome.rule === void 0 ? {} : { rule: outcome.rule },
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      ...process.env[SESSION_VAR] === void 0 ? {} : { sessionId: process.env[SESSION_VAR] }
+    });
+    process.exit(1);
+  }
+  if (isBrowserLauncher(binary)) {
+    const url = urlArgumentIn(args);
+    if (url !== null) {
+      const seam = new BrowserSeam({
+        ...gate === null ? {} : { gate },
+        ...process.env[SESSION_VAR] === void 0 ? {} : { sessionId: process.env[SESSION_VAR] }
+      });
+      const visit = await seam.navigate(url);
+      if (!visit.allowed) {
+        process.stderr.write(`${visit.message ?? "denied"}
+`);
+        process.exit(1);
+      }
+    }
+  }
+  await handAndRecord(binary, args, home, sink, outcome, started, provenance);
+}
+function openLedger(home) {
+  try {
+    return SqliteEventStore2.forHome(home);
+  } catch {
+    return null;
+  }
+}
+async function handAndRecord(binary, args, home, sink, outcome, started, provenance) {
+  const status = hand(binary, args, home);
+  await reportToDaemon(home, {
+    action: outcome.action,
+    exitCode: status,
+    ...outcome.target === void 0 ? {} : { target: outcome.target },
+    ...process.env[SESSION_VAR] === void 0 ? {} : { sessionId: process.env[SESSION_VAR] }
+  });
+  await record(sink, {
+    ...provenance,
+    outcome,
+    effect: DECISION_EFFECT3.ALLOW,
+    reason: outcome.reason ?? "no rule matched",
+    ...outcome.rule === void 0 ? {} : { rule: outcome.rule },
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    exitCode: status,
+    durationMs: Date.now() - started,
+    ...process.env[SESSION_VAR] === void 0 ? {} : { sessionId: process.env[SESSION_VAR] }
+  });
+  const tripped = await observeSession({
+    home,
+    sessionId: process.env[SESSION_VAR]
+  });
+  if (tripped !== null) process.stderr.write(`${pauseMessage(tripped)}
+`);
+  process.exit(status);
+}
+function hand(binary, args, home) {
+  const path = realPath(process.env["PATH"] ?? "", home);
+  const real = resolveReal(binary, path, existsSync);
+  if (real === null) {
+    process.stderr.write(`memnox: ${binary} is not on PATH behind the interceptor
+`);
+    process.exit(127);
+  }
+  const result = spawnSync(real, [...args], {
+    stdio: "inherit",
+    env: { ...process.env, PATH: path }
+  });
+  return result.status ?? 1;
+}
+void main();