@nanhara/hara 0.122.0 → 0.122.2

package/dist/security/permissions.js

@@ -10,21 +10,58 @@
 // (deny > ask > allow); anything we can't safely parse fails CLOSED to "ask".
 import { homedir } from "node:os";
 import { join, dirname, resolve } from "node:path";
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { closeSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeFileSync, } from "node:fs";
+import { psArgumentsExposeEnvironment } from "./sensitive-files.js";
+import { projectRepositoryTrustedAtStartup } from "./project-trust.js";
+import { readVerifiedRegularFileSnapshotSync } from "../fs-read.js";
 const PROJECT_ROOT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".hg"];
+const MAX_PROJECT_PERMISSIONS_BYTES = 64 * 1024;
+const projectPermissionWarnings = new Set();
 // Programs that are read-only when run as a plain command (no dangerous flags / redirection — see below).
 const READONLY_PROGRAMS = new Set([
-    "ls", "pwd", "cat", "head", "tail", "wc", "echo", "printf", "grep", "rg", "fd", "stat", "file", "which",
+    "ls", "pwd", "cat", "head", "tail", "wc", "grep", "rg", "fd", "stat", "file", "which",
     "type", "whoami", "id", "date", "tree", "du", "df", "ps", "uname", "hostname", "dirname", "basename",
-    "realpath", "sort", "uniq", "cut", "column", "jq", "true", "false", "env",
+    "realpath", "sort", "uniq", "cut", "column", "jq", "true", "false",
 ]);
 // `git <sub>` is read-only only for these subcommands.
 const GIT_READONLY_SUB = new Set([
-    "status", "log", "diff", "show", "branch", "remote", "tag", "describe", "rev-parse", "ls-files",
-    "ls-remote", "config", "blame", "shortlog", "cat-file", "whatchanged", "grep", "rev-list", "name-rev",
+    "describe", "rev-parse", "ls-files", "shortlog", "rev-list", "name-rev",
 ]);
 // Flags that can turn an otherwise-read-only command destructive → disqualify from autorun.
 const DANGER_FLAG = /(^|\s)(-i\b|-o\b|--output\b|--exec\b|-delete\b|-fprint\b|--write\b|-w\b|--in-place\b)/;
+function gitPatchOutputRequested(args) {
+    for (const arg of args) {
+        if (arg === "--")
+            break;
+        if (/^-[^-]*[mpucUW]/u.test(arg))
+            return true;
+        if (/^(?:--patch|--patch-with-raw|--patch-with-stat|--unified|--word-diff|--word-diff-regex|--color-words|--cc|--combined-all-paths|--diff-merges|--remerge-diff|--binary|--check|--function-context|--inter-hunk-context)(?:=|$)/u.test(arg))
+            return true;
+    }
+    return false;
+}
+function gitDiffIsMetadataOnly(args) {
+    let metadata = false;
+    for (const arg of args) {
+        if (arg === "--")
+            break;
+        if (gitPatchOutputRequested([arg]))
+            return false;
+        if (/^--(?:stat(?:=.*)?|name-only|name-status|numstat)$/u.test(arg)) {
+            metadata = true;
+            continue;
+        }
+        if (/^(?:-z|--cached|--staged|--merge-base|--no-renames|--no-ext-diff|--no-textconv)$/u.test(arg)
+            || /^--(?:relative|ignore-submodules|submodule|diff-filter|stat-width|stat-name-width|stat-graph-width|stat-count|abbrev)(?:=|$)/u.test(arg))
+            continue;
+        // Revisions and pathspecs are positional. Unknown options may enable content or external helpers, so
+        // a metadata flag does not make them safe automatically.
+        if (arg.startsWith("-"))
+            return false;
+    }
+    return metadata;
+}
 /** Unwrap shell wrappers and strip leading env/wrappers to get the command's essential form. Lossy on
  *  purpose — used only for matching/classification, never for execution. */
 export function canonicalize(command) {
@@ -51,12 +88,54 @@ export function isReadOnlyCommand(canonical) {
         return false;
     if (/[>]/.test(canonical))
         return false; // any output redirection → not read-only
+    if (/\$(?:\{)?[A-Za-z_][A-Za-z0-9_]*/.test(canonical))
+        return false; // variable expansion may print a credential
+    if (/^jq\b[\s\S]*(?:\benv\b|\$ENV\b)/.test(canonical))
+        return false;
     if (DANGER_FLAG.test(canonical))
         return false;
     const parts = canonical.split(" ");
     const prog = parts[0];
-    if (prog === "git")
-        return GIT_READONLY_SUB.has(parts[1] ?? "");
+    // `ps` is normally read-only, but BSD/GNU environment display modifiers turn it into a credential
+    // disclosure command. It must never inherit readonly auto-approval (the shell boundary also hard-denies it).
+    if (prog === "ps" && psArgumentsExposeEnvironment(parts.slice(1)))
+        return false;
+    if (prog === "git") {
+        const sub = parts[1] ?? "";
+        const args = parts.slice(2);
+        // Git can expose deleted credential contents without touching the current filesystem. Autorun only
+        // explicit metadata diffs; history commands that inherently print file bodies always require approval.
+        if (sub === "diff")
+            return gitDiffIsMetadataOnly(args);
+        if (sub === "log" || sub === "whatchanged")
+            return !gitPatchOutputRequested(args);
+        if (sub === "status") {
+            return !args.some((arg) => arg === "--verbose" || /^-[^-]*v/u.test(arg));
+        }
+        if (sub === "config")
+            return false; // values may be credentials (http.extraHeader, credential helpers, URLs)
+        if (GIT_READONLY_SUB.has(sub))
+            return true;
+        if (sub === "branch") {
+            if (!args.length)
+                return true;
+            // Bare branch names create/delete/move branches. Autorun only explicit display/query forms.
+            return args.some((arg) => ["--list", "-l", "--show-current", "-a", "--all", "-r", "--remotes", "-v", "-vv", "--contains", "--no-contains", "--merged", "--no-merged", "--points-at", "--format", "--sort"].includes(arg))
+                && !args.some((arg) => ["-d", "-D", "-m", "-M", "-c", "-C", "--delete", "--move", "--copy", "--edit-description", "--set-upstream-to", "--unset-upstream"].includes(arg));
+        }
+        if (sub === "tag") {
+            if (!args.length)
+                return true;
+            return args.some((arg) => ["--list", "-l", "--contains", "--no-contains", "--merged", "--no-merged", "--points-at", "--format", "--sort"].includes(arg))
+                && !args.some((arg) => ["-d", "--delete", "-f", "--force", "-a", "--annotate", "-s", "--sign", "-u", "--local-user"].includes(arg));
+        }
+        if (sub === "remote") {
+            // Bare `git remote` lists names only. Verbose/get-url/show variants can print credential-bearing URLs;
+            // mutating and networked variants are not readonly-autorun candidates either.
+            return args.length === 0;
+        }
+        return false;
+    }
     return READONLY_PROGRAMS.has(prog);
 }
 /** Split a command on top-level shell operators (&&, ||, ;, |, newline), quote-aware. Returns null if the
@@ -149,11 +228,12 @@ export function decideCommand(command, rules) {
     return strictest(parts.map((p) => decideSimple(p, rules)));
 }
 const DEFAULTS = { allow: [], deny: [], readonlyAutorun: true };
-function readRules(p) {
-    if (!existsSync(p))
-        return {};
+function permissionRecord(raw) {
     try {
-        const j = JSON.parse(readFileSync(p, "utf8"));
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        const j = parsed;
         return {
             allow: Array.isArray(j.allow) ? j.allow.filter((x) => typeof x === "string") : undefined,
             deny: Array.isArray(j.deny) ? j.deny.filter((x) => typeof x === "string") : undefined,
@@ -164,6 +244,105 @@ function readRules(p) {
         return {};
     }
 }
+function readGlobalRules(p) {
+    if (!existsSync(p))
+        return {};
+    try {
+        return permissionRecord(readFileSync(p, "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+function warnProjectPermissions(kind, message) {
+    if (projectPermissionWarnings.has(kind))
+        return;
+    projectPermissionWarnings.add(kind);
+    try {
+        process.stderr.write(`hara: ${message}\n`);
+    }
+    catch { /* best effort */ }
+}
+function unsafeProjectPermissions(kind) {
+    warnProjectPermissions(`unsafe-file:${kind}`, `ignored an unsafe project .hara/permissions.json (${kind}); no project permission values were loaded.`);
+    return {};
+}
+/** Read the nearest repository permission file through a bounded O_NOFOLLOW descriptor. The repository's
+ * `.hara` parent is part of the trust boundary too: neither it nor the final file may be an alias, and both
+ * identities are rechecked after the read. */
+function readProjectRules(cwd) {
+    let dir;
+    try {
+        dir = realpathSync.native(resolve(cwd));
+    }
+    catch {
+        dir = resolve(cwd);
+    }
+    for (;;) {
+        const hara = join(dir, ".hara");
+        const file = join(hara, "permissions.json");
+        let parentInfo;
+        try {
+            parentInfo = lstatSync(hara);
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT")
+                return unsafeProjectPermissions("unreadable parent");
+        }
+        if (parentInfo) {
+            if (parentInfo.isSymbolicLink())
+                return unsafeProjectPermissions("symlink parent");
+            if (!parentInfo.isDirectory())
+                return unsafeProjectPermissions("non-directory parent");
+            try {
+                if (realpathSync.native(hara) !== hara)
+                    return unsafeProjectPermissions("non-canonical parent");
+                const fileInfo = lstatSync(file);
+                if (fileInfo.isSymbolicLink())
+                    return unsafeProjectPermissions("symlink file");
+                if (!fileInfo.isFile())
+                    return unsafeProjectPermissions("non-regular file");
+                const snapshot = readVerifiedRegularFileSnapshotSync(file, MAX_PROJECT_PERMISSIONS_BYTES, {
+                    action: "read project permissions",
+                    protectSensitive: false,
+                    rejectHardLinks: true,
+                });
+                const parentAfter = lstatSync(hara);
+                if (!parentAfter.isDirectory()
+                    || parentAfter.isSymbolicLink()
+                    || parentAfter.dev !== parentInfo.dev
+                    || parentAfter.ino !== parentInfo.ino
+                    || realpathSync.native(hara) !== hara)
+                    return unsafeProjectPermissions("changed parent");
+                return permissionRecord(snapshot.text);
+            }
+            catch (error) {
+                if (error?.code === "ENOENT") {
+                    // No file in this directory; continue toward the repository root.
+                }
+                else if (error?.code === "HARA_HARD_LINKED_FILE") {
+                    return unsafeProjectPermissions("hard-linked file");
+                }
+                else if (error?.code === "HARA_FILE_TOO_LARGE") {
+                    return unsafeProjectPermissions("oversized file");
+                }
+                else if (/changed while (?:opening|reading)|File changed|path changed/i.test(error?.message ?? "")) {
+                    return unsafeProjectPermissions("changed file");
+                }
+                else {
+                    return unsafeProjectPermissions("invalid file");
+                }
+            }
+        }
+        if (PROJECT_ROOT_MARKERS.some((marker) => existsSync(join(dir, marker))))
+            break;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return {};
+}
 export function globalPermissionsPath() {
     return join(homedir(), ".hara", "permissions.json");
 }
@@ -183,16 +362,34 @@ export function projectPermissionsPath(cwd) {
     }
     return null;
 }
-/** Effective rules: project ∪ global, deny-wins (union of denies); project's readonlyAutorun overrides
- *  global's. Missing/invalid files → safe defaults (read-only autorun on, no allow/deny rules). */
+/** Effective rules: an untrusted repository may only tighten policy (add deny rules or turn readonly
+ * autorun off). Project allow rules and a readonlyAutorun=true expansion require the launch-time trust flag.
+ * Missing/invalid files use safe defaults; every deny remains deny-wins. */
 export function loadPermissionRules(cwd) {
-    const g = readRules(globalPermissionsPath());
-    const projPath = projectPermissionsPath(cwd);
-    const p = projPath ? readRules(projPath) : {};
+    const g = readGlobalRules(globalPermissionsPath());
+    const p = readProjectRules(cwd);
+    const trustedProject = projectRepositoryTrustedAtStartup();
+    const globalReadonly = g.readonlyAutorun ?? DEFAULTS.readonlyAutorun;
+    const privileged = [
+        ...(p.allow?.length ? ["allow"] : []),
+        ...(p.readonlyAutorun === true ? ["readonlyAutorun"] : []),
+    ];
+    if (privileged.length) {
+        const names = privileged.join(", ");
+        if (trustedProject) {
+            warnProjectPermissions(`trusted:${names}`, `trusted project permissions enabled for privileged key(s): ${names}.`);
+        }
+        else {
+            warnProjectPermissions(`ignored:${names}`, `ignored untrusted project permission expansion(s): ${names}. Project deny rules and readonlyAutorun=false still tighten policy. ` +
+                "Set HARA_TRUST_PROJECT_CONFIG=1 before starting hara only for a repository you trust.");
+        }
+    }
     return {
-        allow: [...(g.allow ?? []), ...(p.allow ?? [])],
+        allow: [...(g.allow ?? []), ...(trustedProject ? (p.allow ?? []) : [])],
         deny: [...(g.deny ?? []), ...(p.deny ?? [])],
-        readonlyAutorun: p.readonlyAutorun ?? g.readonlyAutorun ?? DEFAULTS.readonlyAutorun,
+        readonlyAutorun: trustedProject
+            ? (p.readonlyAutorun ?? globalReadonly)
+            : (p.readonlyAutorun === false ? false : globalReadonly),
     };
 }
 const SCAFFOLD = {
@@ -200,9 +397,119 @@ const SCAFFOLD = {
     deny: ["git push", "rm -rf", "sudo", "git reset --hard"],
     readonlyAutorun: true,
 };
+function verifiedDirectory(path, expected) {
+    const info = lstatSync(path);
+    if (!info.isDirectory()
+        || info.isSymbolicLink()
+        || realpathSync.native(path) !== path
+        || (expected && (info.dev !== expected.dev || info.ino !== expected.ino)))
+        throw new Error(`refusing project permissions write: parent directory identity is unsafe or changed`);
+    return { dev: info.dev, ino: info.ino };
+}
+function existingScaffoldTarget(path) {
+    try {
+        const info = lstatSync(path);
+        if (info.isSymbolicLink())
+            throw new Error("refusing project permissions write: destination is a symlink");
+        if (!info.isFile())
+            throw new Error("refusing project permissions write: destination is not a regular file");
+        if (info.nlink > 1)
+            throw new Error("refusing project permissions write: destination is hard-linked");
+        return true;
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+/** Create project permissions without following `.hara` or replacing any existing directory entry. */
+function scaffoldProjectPermissions(cwd) {
+    const project = realpathSync.native(resolve(cwd));
+    const projectIdentity = verifiedDirectory(project);
+    const parent = join(project, ".hara");
+    try {
+        lstatSync(parent);
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw error;
+        verifiedDirectory(project, projectIdentity);
+        try {
+            mkdirSync(parent, { mode: 0o700 });
+        }
+        catch (mkdirError) {
+            if (mkdirError?.code !== "EEXIST")
+                throw mkdirError;
+        }
+    }
+    const parentIdentity = verifiedDirectory(parent);
+    const target = join(parent, "permissions.json");
+    if (existingScaffoldTarget(target))
+        return null;
+    const temp = join(parent, `.hara-permissions-${process.pid}-${randomUUID()}.tmp`);
+    let fd;
+    let tempIdentity;
+    let committed = false;
+    try {
+        fd = openSync(temp, "wx", 0o600);
+        writeFileSync(fd, JSON.stringify(SCAFFOLD, null, 2) + "\n", "utf8");
+        fsyncSync(fd);
+        const opened = fstatSync(fd);
+        tempIdentity = { dev: opened.dev, ino: opened.ino };
+        closeSync(fd);
+        fd = undefined;
+        verifiedDirectory(parent, parentIdentity);
+        const staged = lstatSync(temp);
+        if (!staged.isFile() || staged.isSymbolicLink() || staged.dev !== tempIdentity.dev || staged.ino !== tempIdentity.ino) {
+            throw new Error("refusing project permissions write: staging file identity changed");
+        }
+        verifiedDirectory(parent, parentIdentity);
+        try {
+            // Hard-link commit is create-if-absent on every supported platform; unlike rename it cannot overwrite
+            // a symlink/hard-link/ordinary file planted after preflight.
+            linkSync(temp, target);
+        }
+        catch (error) {
+            if (error?.code === "EEXIST") {
+                if (existingScaffoldTarget(target))
+                    return null;
+            }
+            throw error;
+        }
+        verifiedDirectory(parent, parentIdentity);
+        const written = lstatSync(target);
+        if (!written.isFile() || written.isSymbolicLink() || written.dev !== tempIdentity.dev || written.ino !== tempIdentity.ino) {
+            throw new Error("refusing project permissions write: committed file identity changed");
+        }
+        unlinkSync(temp);
+        committed = true;
+        return target;
+    }
+    finally {
+        if (fd !== undefined)
+            try {
+                closeSync(fd);
+            }
+            catch { /* best effort */ }
+        if (!committed && tempIdentity) {
+            try {
+                verifiedDirectory(parent, parentIdentity);
+                const current = lstatSync(temp);
+                if (current.isFile() && current.dev === tempIdentity.dev && current.ino === tempIdentity.ino)
+                    unlinkSync(temp);
+            }
+            catch {
+                /* Retain an uncertain private staging file rather than unlinking an attacker-controlled replacement. */
+            }
+        }
+    }
+}
 /** Write a starter permissions.json (global by default). Returns the path, or null if one already exists. */
 export function scaffoldPermissions(cwd, scope = "global") {
-    const p = scope === "project" ? join(resolve(cwd), ".hara", "permissions.json") : globalPermissionsPath();
+    if (scope === "project")
+        return scaffoldProjectPermissions(cwd);
+    const p = globalPermissionsPath();
     if (existsSync(p))
         return null;
     mkdirSync(dirname(p), { recursive: true });