@opencode-cockpit/trust 0.0.0-stage → 0.8.0

package/dist/core/adapt/v2.js

@@ -0,0 +1,109 @@
+/**
+ * OpenCode 2's events, as what Trust takes from them.
+ *
+ * `ctx.data.listen` hands over `{ name, details: { data } }`. Shapes measured on 2.0.18
+ * (docs/opencode/permissions.md) and read from its own schema (`Permission.Request`):
+ *
+ *   permission.asked    { id, sessionID, action: "shell", resources, save, metadata, message,
+ *                         source: { type: "tool", messageID, id } }
+ *   permission.replied  { sessionID, requestID, reply }
+ *   session.tool.called { sessionID, assistantMessageID, id, input }   — a shell call's `command`, `cwd`
+ *   session.created     { sessionID, agent }
+ *   session.agent.selected { sessionID, agent }
+ *   config.updated      {}
+ *
+ * The request carries no agent (v2's schema has none), so it comes from the session's events.
+ */
+
+import { canonical } from "../rules.js";
+import { isReply, obj, str, strings } from "./seen.js";
+export function fromV2Event(raw) {
+  const event = obj(raw);
+  const name = str(event.name) ?? str(event.type);
+  const details = obj(event.details);
+  /** `details.data`, as measured; the bare payload too, for a request read from a list. */
+  const data = obj(details.data ?? event.data ?? event.properties);
+  switch (name) {
+    case "permission.asked":
+      {
+        const id = str(data.id);
+        const sessionID = str(data.sessionID);
+        const action = str(data.action) ?? str(data.permission);
+        if (!id || !sessionID || !action) return [];
+        const source = obj(data.source);
+        const call = source.type === "tool" ? str(source.id) : undefined;
+        return [{
+          type: "asked",
+          request: {
+            id,
+            sessionID,
+            permission: canonical(action),
+            patterns: strings(data.resources ?? data.patterns),
+            always: strings(data.save ?? data.always),
+            ...(call ? {
+              call
+            } : {}),
+            ...(str(source.messageID) ? {
+              messageID: str(source.messageID)
+            } : {})
+          }
+        }];
+      }
+    case "permission.replied":
+      {
+        const sessionID = str(data.sessionID);
+        const requestID = str(data.requestID);
+        const reply = data.reply ?? data.decision;
+        return sessionID && requestID && isReply(reply) ? [{
+          type: "replied",
+          sessionID,
+          requestID,
+          reply
+        }] : [];
+      }
+    case "session.tool.called":
+      {
+        const sessionID = str(data.sessionID);
+        const call = str(data.id);
+        const input = obj(data.input);
+        if (!sessionID || !call || Object.keys(input).length === 0) return [];
+        const messageID = str(data.assistantMessageID) ?? str(data.messageID);
+        return [{
+          type: "call",
+          sessionID,
+          call,
+          ...(messageID ? {
+            messageID
+          } : {}),
+          input
+        }];
+      }
+    case "session.created":
+    case "session.agent.selected":
+      {
+        const sessionID = str(data.sessionID);
+        const agent = str(data.agent);
+        return sessionID && agent ? [{
+          type: "agent",
+          sessionID,
+          agent
+        }] : [];
+      }
+    case "config.updated":
+      return [{
+        type: "config"
+      }];
+    default:
+      return [];
+  }
+}
+
+/** A pending request from a list, in the same shape as the event's data. */
+export function fromV2Pending(list) {
+  return (Array.isArray(list) ? list : []).flatMap(request => fromV2Event({
+    name: "permission.asked",
+    details: {
+      data: request
+    }
+  }));
+}

package/dist/core/config.js

@@ -0,0 +1,93 @@
+/**
+ * Trust's settings, through the same merge every bay uses (docs/building/a-new-bay.md):
+ *
+ *   ~/.config/opencode-cockpit/config.json  →  <project>/.cockpit.json  →  plugin-entry options
+ *
+ * Only the `trust` section of a file is read. A file without one says nothing about Trust — reading
+ * the whole file as Trust's settings is the trap that page warns about. An unreadable or invalid file
+ * is ignored rather than fatal: a typo in a config should never cost you the interface.
+ *
+ * This is Cockpit's config, not OpenCode's. What OpenCode allows, denies and asks about is read from
+ * OpenCode itself (`rules.ts`), and never written by Trust.
+ */
+
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const DEFAULTS = {
+  enabled: true,
+  threshold: 3,
+  dangerExtra: 5,
+  expireDays: 30,
+  sidebar: false,
+  sidebarRows: 3
+};
+export const CONFIG_FILE = "config.json";
+export const PROJECT_FILE = ".cockpit.json";
+const KEYS = ["enabled", "threshold", "dangerExtra", "expireDays", "sidebar", "sidebarRows", "sidebarOrder", "keybinds"];
+export function globalConfigPath(env = process.env) {
+  const base = env.XDG_CONFIG_HOME ?? join(env.HOME ?? homedir(), ".config");
+  return join(base, "opencode-cockpit", CONFIG_FILE);
+}
+
+/** The `trust` section of a config file. */
+export function trustSection(raw) {
+  if (!raw || typeof raw !== "object") return {};
+  const section = raw.trust;
+  return section && typeof section === "object" ? pick(section) : {};
+}
+
+/**
+ * Plugin-entry options: a whole cockpit config (`{ trust: {...} }`) or Trust's own keys, because the
+ * bundle hands each bay its own section and a standalone entry carries them directly.
+ */
+export function asTrustConfig(input) {
+  if (!input || typeof input !== "object") return {};
+  const raw = input;
+  if (raw.trust && typeof raw.trust === "object") return pick(raw.trust);
+  return pick(raw);
+}
+function pick(raw) {
+  const own = {};
+  for (const key of KEYS) if (raw[key] !== undefined) Object.assign(own, {
+    [key]: raw[key]
+  });
+  return own;
+}
+export function mergeTrust(base, over) {
+  const merged = {
+    ...base,
+    ...over
+  };
+  if (base.keybinds || over.keybinds) merged.keybinds = {
+    ...base.keybinds,
+    ...over.keybinds
+  };
+  return merged;
+}
+async function readSection(path) {
+  try {
+    return trustSection(JSON.parse(await readFile(path, "utf8")));
+  } catch {
+    return {};
+  }
+}
+
+/** Reads and merges every source, without blocking the interface thread. */
+export async function loadTrustConfig(directory, options, env = process.env) {
+  const [global, project] = await Promise.all([readSection(globalConfigPath(env)), readSection(join(directory, PROJECT_FILE))]);
+  return mergeTrust(mergeTrust(global, project), asTrustConfig(options));
+}
+const whole = (value, fallback, least) => typeof value === "number" && Number.isFinite(value) ? Math.max(least, Math.floor(value)) : fallback;
+
+/** Settings with every gap filled and every number made sensible: a threshold of 0 would trust anything. */
+export function resolveSettings(config) {
+  return {
+    enabled: config.enabled !== false,
+    threshold: whole(config.threshold, DEFAULTS.threshold, 1),
+    dangerExtra: whole(config.dangerExtra, DEFAULTS.dangerExtra, 0),
+    expireDays: whole(config.expireDays, DEFAULTS.expireDays, 0),
+    sidebar: config.sidebar === true,
+    sidebarRows: whole(config.sidebarRows, DEFAULTS.sidebarRows, 0)
+  };
+}

package/dist/core/danger.js

@@ -0,0 +1,366 @@
+/**
+ * Which commands cost more trust.
+ *
+ * Nothing here blocks anything. A dangerous command still earns trust like any other; it needs the
+ * normal threshold *plus* `dangerExtra` approvals in a row (docs/roadmap/trust.md, "Decided"). So a
+ * miss in this list is never a hole — the command still had to be approved `threshold` times — it is
+ * only a command that became automatic sooner than it should have. A false alarm costs a few more
+ * approvals and nothing else, which is why every doubt below is settled towards "dangerous".
+ *
+ * It sees one command at a time: `git add -A && git push --force` arrives as two, and only the second
+ * is dangerous. `cwd` is already part of the signature; this is about what the words do.
+ *
+ * The answer is a reason rather than a yes, because the ledger shows it: "git push" says why a rule
+ * needs eight approvals where `true` would leave the person guessing.
+ */
+
+import { posix } from "node:path";
+/* ─── the tables ─────────────────────────────────────────────────────────────────────────────── */
+
+/**
+ * Programs that destroy, stop or rewrite whatever they are pointed at, whatever their arguments.
+ * `truncate` empties files; `shred` and `srm` exist to make data unrecoverable.
+ */
+const ALWAYS = new Set(["rm", "rmdir", "unlink", "shred", "srm", "dd", "fdisk", "sfdisk", "parted", "wipefs", "kill", "killall", "pkill", "truncate", "shutdown", "reboot", "halt", "poweroff"]);
+
+/** `mkfs`, `mkfs.ext4`, `mkfs.vfat`…: every variant formats a disk. */
+const ALWAYS_PREFIX = ["mkfs"];
+
+/** Permission and ownership changes are only dangerous when they reach a whole tree. */
+const RECURSIVE_ONLY = new Set(["chmod", "chown", "chgrp"]);
+
+/**
+ * Flags that are dangerous on any program. Only long forms: `-f` means *file* to `tail -f`,
+ * `docker compose -f` and `grep -f`, so a short `-f` is judged per program below, never globally.
+ */
+const FLAGS = new Set(["--force", "--force-with-lease", "--force-if-includes", "--no-preserve-root"]);
+
+/**
+ * Wrappers run the command after them, so the wrapped command is the one judged. Each lists the
+ * flags that take a separate value, so `timeout -s KILL 5 rm x` finds `rm` rather than `KILL`.
+ * `sudo` and `doas` are dangerous in themselves: whatever runs, runs as root.
+ */
+
+export const WRAPPERS = {
+  sudo: {
+    values: ["-u", "-g", "-h", "-p", "-C", "-D", "-r", "-t", "-U", "-T"],
+    dangerous: "sudo"
+  },
+  doas: {
+    values: ["-u", "-C"],
+    dangerous: "doas"
+  },
+  env: {
+    values: ["-u", "-C", "-S", "--unset", "--chdir", "--split-string"]
+  },
+  time: {
+    values: ["-o", "-f", "--output", "--format"]
+  },
+  nohup: {},
+  timeout: {
+    values: ["-s", "-k", "--signal", "--kill-after"],
+    positionals: 1
+  },
+  nice: {
+    values: ["-n", "--adjustment"]
+  },
+  ionice: {
+    values: ["-c", "-n", "-p", "--class", "--classdata"]
+  },
+  stdbuf: {
+    values: ["-i", "-o", "-e"]
+  },
+  command: {},
+  builtin: {},
+  xargs: {
+    values: ["-I", "-i", "-n", "-P", "-L", "-l", "-d", "-E", "-e", "-s", "-a", "--max-args", "--max-procs"]
+  }
+};
+
+/**
+ * Programs with subcommands. `globals` are the flags before the subcommand that take a separate
+ * value — without them `docker compose -p prod down -v` would read `prod` as the subcommand.
+ * `judge` sees the subcommand words and everything after them.
+ */
+
+const has = (args, ...flags) => args.some(arg => flags.includes(arg) || flags.some(flag => flag.startsWith("--") && arg.startsWith(`${flag}=`)));
+
+/** A short flag inside a cluster: `-fd` has `-f`. Only for programs where the letter is known. */
+const short = (args, letter) => args.some(arg => /^-[A-Za-z]+$/.test(arg) && arg.includes(letter));
+const recursive = args => has(args, "--recursive") || short(args, "R");
+const GIT_GLOBALS = ["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env"];
+const DOCKER_GLOBALS = ["-H", "--host", "-c", "--context", "--config", "-l", "--log-level"];
+export const COMPOSE_GLOBALS = ["-f", "--file", "-p", "--project-name", "--profile", "--env-file", "--project-directory", "--ansi", "--progress", "--parallel"];
+const KUBE_GLOBALS = ["-n", "--namespace", "--context", "--cluster", "--kubeconfig", "-s", "--server", "--user", "--token"];
+
+/** Container engines share one vocabulary; `podman` and `nerdctl` copied Docker's. */
+function container(words) {
+  const [sub, next] = words;
+  if (sub === "compose") {
+    const [action, ...after] = subcommand(words.slice(1), COMPOSE_GLOBALS);
+    if (action === "down" && (has(after, "--volumes", "--rmi") || short(after, "v"))) return "compose down -v";
+    if (action === "rm") return "compose rm";
+    return undefined;
+  }
+  if (sub === "rm" || sub === "rmi" || sub === "kill") return sub;
+  // `docker container rm`, `docker volume prune`, `docker image rm`…: the object, then what to do.
+  if (next === "prune" || next === "rm" || next === "kill") return `${sub} ${next}`;
+  if (sub === "system" && next === "reset") return "system reset";
+  return undefined;
+}
+
+/** SQL that throws data away, wherever it appears in a client's arguments. */
+const DESTRUCTIVE_SQL = /\b(drop|truncate)\b|\bdelete\s+from\b|\balter\s+table\b[^;]*\bdrop\b/i;
+function sql(_words, all) {
+  const found = all.join(" ").match(DESTRUCTIVE_SQL);
+  return found ? found[0].toLowerCase().split(/\s+/)[0] : undefined;
+}
+const publish = words => {
+  const [sub] = words;
+  return sub === "publish" || sub === "unpublish" || sub === "deprecate" ? sub : undefined;
+};
+const TOOLS = {
+  git: {
+    globals: GIT_GLOBALS,
+    judge([sub, ...args]) {
+      switch (sub) {
+        case "push":
+          return "git push";
+        case "clean":
+          return "git clean";
+        case "reset":
+          return has(args, "--hard", "--merge", "--keep") ? "git reset --hard" : undefined;
+        case "checkout":
+          // `git checkout -- a.ts` and `git checkout .` throw away work in the tree; `-f` too.
+          return args.includes("--") || args.includes(".") || short(args, "f") ? "git checkout over files" : undefined;
+        case "switch":
+          return has(args, "--discard-changes") || short(args, "f") ? "git switch -f" : undefined;
+        case "restore":
+          {
+            // Unstaging touches nothing on disk; anything that writes the working tree does.
+            const staged = has(args, "--staged") || short(args, "S");
+            const tree = has(args, "--worktree") || short(args, "W");
+            return staged && !tree ? undefined : "git restore";
+          }
+        case "branch":
+          return short(args, "D") || has(args, "--delete", "-d") && has(args, "--force") ? "git branch -D" : undefined;
+        case "stash":
+          return args[0] === "drop" || args[0] === "clear" ? `git stash ${args[0]}` : undefined;
+        case "rebase":
+        case "filter-branch":
+        case "filter-repo":
+          return `git ${sub}`;
+        case "update-ref":
+          return short(args, "d") ? "git update-ref -d" : undefined;
+        case "reflog":
+          return args[0] === "expire" || args[0] === "delete" ? `git reflog ${args[0]}` : undefined;
+        case "tag":
+          return short(args, "d") || has(args, "--delete") ? "git tag -d" : undefined;
+        default:
+          return undefined;
+      }
+    }
+  },
+  docker: {
+    globals: DOCKER_GLOBALS,
+    judge: container
+  },
+  podman: {
+    globals: DOCKER_GLOBALS,
+    judge: container
+  },
+  nerdctl: {
+    globals: DOCKER_GLOBALS,
+    judge: container
+  },
+  "docker-compose": {
+    globals: COMPOSE_GLOBALS,
+    judge: ([sub, ...args]) => sub === "down" && (has(args, "--volumes", "--rmi") || short(args, "v")) ? "compose down -v" : sub === "rm" ? "compose rm" : undefined
+  },
+  kubectl: {
+    globals: KUBE_GLOBALS,
+    judge: ([sub, ...args]) => sub === "delete" || sub === "drain" ? `kubectl ${sub}` : sub === "replace" && has(args, "--force") ? "kubectl replace --force" : undefined
+  },
+  helm: {
+    globals: ["-n", "--namespace", "--kube-context", "--kubeconfig"],
+    judge: ([sub]) => sub === "uninstall" || sub === "delete" || sub === "rollback" ? `helm ${sub}` : undefined
+  },
+  terraform: {
+    globals: [],
+    judge: ([sub, next]) => sub === "destroy" || sub === "apply" || sub === "import" ? `terraform ${sub}` : sub === "state" && (next === "rm" || next === "mv" || next === "push") ? `terraform state ${next}` : undefined
+  },
+  psql: {
+    judge: sql
+  },
+  mysql: {
+    judge: sql
+  },
+  mariadb: {
+    judge: sql
+  },
+  sqlite3: {
+    judge: sql
+  },
+  "clickhouse-client": {
+    judge: sql
+  },
+  "redis-cli": {
+    judge: (_words, all) => {
+      const found = all.find(word => /^(flushall|flushdb)$/i.test(word));
+      return found ? found.toLowerCase() : undefined;
+    }
+  },
+  npm: {
+    judge: publish
+  },
+  pnpm: {
+    judge: publish
+  },
+  bun: {
+    judge: publish
+  },
+  yarn: {
+    judge: words => publish(words[0] === "npm" ? words.slice(1) : words)
+  },
+  cargo: {
+    judge: ([sub]) => sub === "publish" ? "cargo publish" : undefined
+  },
+  gem: {
+    judge: ([sub]) => sub === "push" || sub === "yank" ? `gem ${sub}` : undefined
+  },
+  twine: {
+    judge: ([sub]) => sub === "upload" ? "twine upload" : undefined
+  },
+  gh: {
+    globals: ["-R", "--repo"],
+    // `gh repo delete`, `gh release delete`, `gh secret delete`…: whatever it is, it goes.
+    judge: words => words.includes("delete") ? "gh … delete" : undefined
+  },
+  aws: {
+    globals: ["--profile", "--region", "--endpoint-url", "--output"],
+    judge: ([service, action]) => service === "s3" && (action === "rm" || action === "rb") ? `aws s3 ${action}` : action && /^(delete|terminate|remove|purge)-/.test(action) ? `aws ${action}` : undefined
+  },
+  gcloud: {
+    judge: words => words.includes("delete") ? "gcloud … delete" : undefined
+  },
+  systemctl: {
+    judge: ([sub]) => sub === "stop" || sub === "disable" || sub === "mask" || sub === "kill" ? `systemctl ${sub}` : undefined
+  },
+  launchctl: {
+    judge: ([sub]) => sub === "unload" || sub === "remove" || sub === "bootout" ? `launchctl ${sub}` : undefined
+  },
+  crontab: {
+    judge: (_words, all) => short(all, "r") ? "crontab -r" : undefined
+  },
+  rsync: {
+    judge: (_words, all) => all.some(arg => arg.startsWith("--delete")) ? "rsync --delete" : undefined
+  }
+};
+
+/**
+ * The flags before a tool's subcommand that take a separate value, by program: what family.ts needs
+ * to find `status` in `git -C /x status`. Read from the table above so the two cannot disagree.
+ */
+export const TOOL_GLOBALS = Object.fromEntries(Object.entries(TOOLS).map(([name, tool]) => [name, tool.globals ?? []]));
+
+/* ─── reading a command ──────────────────────────────────────────────────────────────────────── */
+
+/** The words after the global flags: `[-C, /tmp, push, origin]` → `[push, origin]`. */
+export function subcommand(args, globals = []) {
+  let i = 0;
+  while (i < args.length) {
+    const arg = args[i];
+    if (arg === "--") return args.slice(i + 1);
+    if (!arg.startsWith("-") || arg === "-") break;
+    i += globals.includes(arg) ? 2 : 1;
+  }
+  return args.slice(i);
+}
+
+/**
+ * One wrapper taken off the front: its name, and the words it runs. Undefined when `argv` does not
+ * start with a wrapper. Families (family.ts) keep the wrapper's name — `sudo ls` is not `ls` — and
+ * drop its flags, so this is shared rather than copied.
+ */
+export function unwrapOnce(argv) {
+  const program = argv[0];
+  if (program === undefined) return undefined;
+  const name = posix.basename(program);
+  const wrapper = WRAPPERS[name];
+  if (!wrapper) return undefined;
+  let i = 1;
+  while (i < argv.length) {
+    const word = argv[i];
+    if (word === "--") {
+      i++;
+      break;
+    }
+    // `env NAME=value cmd`: assignments are the wrapper's, not the command.
+    if (name === "env" && /^[A-Za-z_][A-Za-z0-9_]*=/.test(word)) {
+      i++;
+      continue;
+    }
+    if (!word.startsWith("-")) break;
+    i += wrapper.values?.includes(word) ? 2 : 1;
+  }
+  return {
+    wrapper: name,
+    rest: argv.slice(i + (wrapper.positionals ?? 0))
+  };
+}
+
+/** The command a wrapper runs, and whether the wrapper itself already made it dangerous. */
+function unwrap(argv) {
+  let words = argv;
+  let reason;
+  for (let depth = 0; depth < 8; depth++) {
+    const once = unwrapOnce(words);
+    if (!once) break;
+    reason ??= WRAPPERS[once.wrapper]?.dangerous;
+    words = once.rest;
+  }
+  return reason ? {
+    argv: words,
+    reason
+  } : {
+    argv: words
+  };
+}
+
+/** `find … -delete`, or `-exec rm {} ;` judged by the program it runs. */
+function find(args) {
+  if (args.includes("-delete")) return "find -delete";
+  for (let i = 0; i < args.length; i++) {
+    if (!["-exec", "-execdir", "-ok", "-okdir"].includes(args[i])) continue;
+    const end = args.findIndex((word, at) => at > i && (word === ";" || word === "+"));
+    const inner = args.slice(i + 1, end < 0 ? undefined : end);
+    const reason = judge(inner);
+    if (reason) return `find -exec ${reason}`;
+  }
+  return undefined;
+}
+function judge(argv) {
+  const unwrapped = unwrap(argv);
+  const [program, ...args] = unwrapped.argv;
+  if (program === undefined) return unwrapped.reason;
+  const name = posix.basename(program);
+  const reason = (() => {
+    if (ALWAYS.has(name) || ALWAYS_PREFIX.some(prefix => name === prefix || name.startsWith(`${prefix}.`))) return name;
+    if (RECURSIVE_ONLY.has(name)) return recursive(args) ? `${name} -R` : undefined;
+    if (name === "find") return find(args);
+    const tool = TOOLS[name];
+    return tool ? tool.judge(subcommand(args, tool.globals), args) : undefined;
+  })();
+  if (reason) return unwrapped.reason ? `${unwrapped.reason} ${reason}` : reason;
+  const flag = args.find(arg => FLAGS.has(arg.split("=")[0]));
+  if (flag) return unwrapped.reason ? `${unwrapped.reason} ${flag}` : flag.split("=")[0];
+  return unwrapped.reason;
+}
+
+/** Why a command costs more trust, in a few words — or nothing when it costs the usual. */
+export function dangerOf(command) {
+  return judge(command.argv);
+}
+export function dangerous(command) {
+  return dangerOf(command) !== undefined;
+}