@ngockhoale/ukit 3.4.26 → 3.4.28

package/template_project/.omp/hooks/pre/ukit-bridge.js

@@ -751,6 +751,12 @@ function normalizeToolInput(toolName, input) {
     const paths = Array.isArray(normalized.paths) ? normalized.paths.filter(Boolean) : [];
     normalized.file_path = normalized.path || paths[0] || undefined;
   }
+  // omp's eval tool carries `{language, code}` (no `command`), but block-dangerous and the
+  // secret guard only read tool_input.command. Surface the code as the command so the same
+  // Bash chain scans it; otherwise an eval payload would reach the gate as an empty command.
+  if (toolName === 'Bash' && typeof normalized.command !== 'string' && typeof normalized.code === 'string') {
+    normalized.command = normalized.code;
+  }
   return normalized;
 }
 
@@ -789,8 +795,39 @@ function sendContext(pi, context, deliverAs, { display = false } = {}) {
   pi.sendMessage(hookContextMessage(content, { display }), { deliverAs });
 }
 
-export async function runToolCall(pi, event, { projectRoot, context: extensionContext = {} }) {
+// eval threat model (F2): the Bash chain is a text matcher over a command string. It cannot
+// prove that arbitrary Python/JS is safe (shutil.rmtree, fs.rmSync, pathlib loops, dynamic
+// strings all pass it — verified in a sentinel sandbox). So eval is DENIED by the bridge unless
+// the user opted in with orchestration.allowUnsafeEval=true in .ukit/storage/config.json,
+// independent of .omp/config.yml tools.approval.eval. When opted in, the Bash chain still runs
+// as best-effort defence in depth; it is NOT a safety guarantee for eval code.
+async function readAllowUnsafeEval(projectRoot) {
+  try {
+    const parsed = JSON.parse(
+      await fs.promises.readFile(path.join(projectRoot, '.ukit', 'storage', 'config.json'), 'utf8'),
+    );
+    return parsed?.orchestration?.allowUnsafeEval === true;
+  } catch {
+    return false; // missing/corrupt config → fail closed
+  }
+}
+
+export async function runToolCall(pi, event, { projectRoot, context: extensionContext = {}, allowUnsafeEval } = {}) {
   const rawToolName = event.toolName ?? event.tool;
+  if (String(rawToolName ?? '').trim().toLowerCase() === 'eval') {
+    const allowed = allowUnsafeEval ?? await readAllowUnsafeEval(projectRoot);
+    if (!allowed) {
+      return {
+        block: true,
+        toolName: 'Bash',
+        invoked: [],
+        context: [],
+        reason: 'UKit denies the omp eval tool: arbitrary Python/JS cannot be verified by the shell guard. '
+          + 'Use the bash tool for commands (guarded), or opt in explicitly with orchestration.allowUnsafeEval=true '
+          + 'in .ukit/storage/config.json (unsafe; the guard is best-effort for eval).',
+      };
+    }
+  }
   const mappedToolName = mapToolName(rawToolName);
   // An unmapped tool that LOOKS like a file mutation must not sail past the guards — but
   // hard-blocking it froze the run whenever omp renamed or added a tool, because the model
@@ -811,9 +848,16 @@ export async function runToolCall(pi, event, { projectRoot, context: extensionCo
     toolUseId: event.toolCallId,
     ...metadata,
   });
-  // Only Edit|Write stays fail-closed on a bridge/runner transport failure; Bash and
-  // Read|Grep|Glob fail open so diagnosis/recovery tools are never bricked by a runner outage.
-  const failClosedOnTransportError = matcherGroupFor(toolName) === 'Edit|Write';
+  // F4: Edit|Write and Bash (which also carries omp's `eval`) are security-critical and fail
+  // CLOSED on a bridge/runner transport failure — an unverifiable shell/eval call is not
+  // allowed to proceed. Read|Grep|Glob stay fail-open (documented limit: the secret-read guard
+  // is advisory on a runner outage) so diagnosis tools are not bricked. Recovery for a Bash
+  // outage is a user action, not a model one: the user exports UKIT_OMP_BASH_FAIL_OPEN=1 (or
+  // fixes Node/PATH) and restarts omp. This only affects PreToolUse; the Stop gate is separate,
+  // so a blocked Bash call cannot create a Stop-hook loop.
+  const group = matcherGroupFor(toolName);
+  const bashFailOpenOverride = process.env.UKIT_OMP_BASH_FAIL_OPEN === '1';
+  const failClosedOnTransportError = group === 'Edit|Write' || (group === 'Bash' && !bashFailOpenOverride);
   const result = await runScriptChain(pi, scriptsForToolCall(toolName), payload, {
     projectRoot,
     failClosedOnTransportError,