@optimuslabs/harness-map-staging 1.5.19 → 1.5.21

package/dist/log_config_files/runtime/main_runner.js

@@ -5,6 +5,7 @@ const HOME_DIR = homedir();
 import { getFileCollectionPatterns, FILE_PATH_REGISTRY_FILE_PATTERNS_PATH } from '../../endpoint_client/index.js';
 import { OPTIMUSLABS_LOGS_REL, LOG_GROUP_AUDIT } from '../../bootstrap_constants.js';
 import { runSensitivePathsAudit } from '../../log_sensitive_paths_audit.js';
+import { buildPathPermissionsAuditEntry, grantPathsFromConfig } from '../../log_path_permissions_audit.js';
 import { loadEndpointBase, getEndpointSource } from '../sender/endpoint_config.js';
 import { hookLogReplace, hookRunLog, hookLogError, readHookLog } from './hook_logger.js';
 import { getStoryId, flushBufferedClientEvents, reportFunctionalRun, reportFunctionalFailureAwait, } from './client_event_reporter.js';
@@ -227,6 +228,31 @@ async function addSensitivePathsAudit(endpointBase, configFiles) {
         configFiles.push({ file_type: 'sensitive_paths_audit', file_path: 'sensitive_paths_audit.txt', raw_content: { paths: [] } });
     }
 }
+/** POSIX mode of every collected file, plus granted folders (and their ancestors) and sensitive audit hits within a budget. stat() only. */
+function addPathPermissionsAudit(configFiles) {
+    const visited = [];
+    const grants = [];
+    const sensitive = [];
+    for (const c of configFiles) {
+        if (c.file_type === 'sensitive_paths_audit') {
+            const auditPaths = c.raw_content.paths;
+            if (Array.isArray(auditPaths))
+                sensitive.push(...auditPaths.filter((p) => typeof p === 'string'));
+            continue;
+        }
+        visited.push(c.file_path);
+        grants.push(...grantPathsFromConfig(c.raw_content));
+    }
+    try {
+        const entry = buildPathPermissionsAuditEntry(visited, grants, sensitive);
+        hookRunLog(`path_permissions_audit: ${entry.raw_content.entries.length} path(s) grants=${grants.length} truncated=${entry.raw_content.truncated}`);
+        configFiles.push(entry);
+    }
+    catch (err) {
+        hookRunLog(`path_permissions_audit_error: ${err instanceof Error ? err.message : String(err)}`);
+        hookLogError('path_permissions_audit', err, {});
+    }
+}
 async function sendAllConfigFiles(configFiles, worktreeReport, hardwareUuid, authKey) {
     const hookType = resolveHookTypeFromEnv();
     const manifest = configFiles.map((c) => canonicalCursorUserStateVscdbPath(c.file_path));
@@ -309,6 +335,7 @@ async function main() {
     }
     await addSensitivePathsAudit(endpointBase, configFiles);
     ensureCursorUserSettingsSnapshotInBatch(configFiles);
+    addPathPermissionsAudit(configFiles);
     const fileTypes = [...new Set(configFiles.map((c) => c.file_type))].join(', ');
     hookRunLog(`collected ${configFiles.length} config file(s) file_types=${fileTypes}`);
     for (const c of configFiles) {

package/dist/log_config_files/runtime/remediation_sync.js

@@ -264,16 +264,46 @@ async function fetchManifest(endpointBase, machineUuid, uuids, timeoutMs = 8000)
 // Enforce / remove
 // ---------------------------------------------------------------------------
 function setByPath(obj, path, value) {
-    const parts = path.split('.');
+    const parts = path.split('.').filter((part) => part.length > 0);
+    if (parts.length === 0)
+        return;
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const part = parts[i];
-        if (current[part] == null || typeof current[part] !== 'object' || Array.isArray(current[part])) {
-            current[part] = {};
+        if (Array.isArray(current)) {
+            if (!/^\d+$/.test(part))
+                return;
+            const idx = Number(part);
+            if (idx >= current.length)
+                return;
+            current = current[idx];
+            continue;
         }
-        current = current[part];
+        if (current == null || typeof current !== 'object')
+            return;
+        const rec = current;
+        const next = rec[part];
+        if (Array.isArray(next)) {
+            current = next;
+            continue;
+        }
+        if (next == null || typeof next !== 'object') {
+            rec[part] = {};
+        }
+        current = rec[part];
+    }
+    const leaf = parts[parts.length - 1];
+    if (Array.isArray(current)) {
+        if (!/^\d+$/.test(leaf))
+            return;
+        const idx = Number(leaf);
+        if (idx >= 0 && idx < current.length)
+            current[idx] = value;
+        return;
+    }
+    if (current != null && typeof current === 'object') {
+        current[leaf] = value;
     }
-    current[parts[parts.length - 1]] = value;
 }
 /** Traverse a JSON object using dot-notation path. Returns undefined if any segment is missing. */
 function getByPath(obj, path) {

package/dist/log_config_files/runtime/secret_regex_scan.js

@@ -57,6 +57,9 @@ const KNOWN_SECRET_PATTERNS = [
     { re: /dop_v1_[a-f0-9]{64}/i, label: 'DigitalOcean personal access token' },
     { re: /pat_[a-zA-Z0-9]{22}_[a-fA-F0-9]{59}/i, label: 'Atlassian API token' },
     { re: /Bearer\s+[a-zA-Z0-9\-_.]{20,}/i, label: 'Bearer token' },
+    // Isolated 32-hex (Azure OpenAI). Lookarounds keep a longer hex string from matching.
+    // Same pattern as HardcodedSecretRule — MCP tokens in args (ISO-005) are this shape.
+    { re: /(?<![a-zA-Z0-9])[a-fA-F0-9]{32}(?![a-zA-Z0-9])/, label: 'Azure OpenAI key' },
 ];
 const BASIC_AUTH_IN_URL = /[a-zA-Z0-9._%+-]+:[a-zA-Z0-9._%+-]+@/gi;
 // Hyphens/underscores count as part of one token so hyphenated keys (ctx7sk-..., sk-ant-...)

package/dist/log_path_permissions_audit.js

@@ -0,0 +1,169 @@
+/**
+ * Path permissions audit: POSIX mode of home, `/` and every file the collector uploads,
+ * plus, within MAX_EXTRA_ENTRIES and in this priority order:
+ *
+ *   1. each folder an agent config grants (additionalDirectories, Read()/Edit() allow rules,
+ *      trustedFolders, external_directory) and its ancestors (an ancestor the user can't
+ *      enter makes everything under it unreachable). Never the folder's contents, so a
+ *      grant of ~ or / costs a handful of stats, not a walk of the disk.
+ *   2. sensitive paths audit hits
+ *   3. the direct children of each sensitive directory (e.g. ~/.ssh/id_rsa), capped per dir
+ *
+ * stat()/readdir() only — never reads file contents. Sent in the same batch as the config
+ * files as file_type 'path_permissions_audit'.
+ */
+import { readdirSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join } from 'node:path';
+export const PATH_PERMISSIONS_AUDIT_FILENAME = 'path_permissions_audit.txt';
+export const PATH_PERMISSIONS_AUDIT_FILE_TYPE = 'path_permissions_audit';
+/** Upper bound on entries beyond the collected files, whatever is granted. */
+export const MAX_EXTRA_ENTRIES = 500;
+/** Owner permission triad from st_mode (e.g. 0o640 → "rw-"). */
+export function ownerTriad(mode) {
+    return `${mode & 0o400 ? 'r' : '-'}${mode & 0o200 ? 'w' : '-'}${mode & 0o100 ? 'x' : '-'}`;
+}
+/** Strip virtual suffixes some collectors append (e.g. state.vscdb#composerState). */
+function diskPath(filePath) {
+    const hash = filePath.indexOf('#');
+    return hash >= 0 ? filePath.slice(0, hash) : filePath;
+}
+/**
+ * stat each distinct absolute path, stopping once ``limit`` entries are collected; paths
+ * that no longer exist or can't be stat'd are skipped. ``truncated`` when paths were left.
+ */
+export function collectPathPermissions(paths, limit = Infinity) {
+    const seen = new Set();
+    const entries = [];
+    for (const raw of paths) {
+        const path = diskPath(raw);
+        if (!path || !isAbsolute(path) || seen.has(path))
+            continue;
+        if (entries.length >= limit)
+            return { entries, truncated: true };
+        seen.add(path);
+        try {
+            const st = statSync(path);
+            const perm = st.mode & 0o7777;
+            entries.push({
+                path,
+                is_dir: st.isDirectory(),
+                mode: perm.toString(8).padStart(4, '0'),
+                owner: ownerTriad(perm),
+                uid: st.uid,
+                gid: st.gid,
+            });
+        }
+        catch {
+            // Gone or unreadable since collection; nothing to report.
+        }
+    }
+    return { entries, truncated: false };
+}
+/** Cap per sensitive directory so a large ~/.config can't bloat the upload. */
+export const MAX_CHILDREN_PER_SENSITIVE_DIR = 50;
+/** Direct children of a directory (names only, sorted, capped); [] when not a readable dir. */
+export function sensitiveDirChildren(dir) {
+    try {
+        return readdirSync(dir)
+            .sort()
+            .slice(0, MAX_CHILDREN_PER_SENSITIVE_DIR)
+            .map((name) => join(dir, name));
+    }
+    catch {
+        return [];
+    }
+}
+function stringList(value) {
+    if (typeof value === 'string')
+        return [value];
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+const FILE_RULE = /^\s*(Read|Edit|Write|MultiEdit|NotebookEdit)\((.+)\)\s*$/;
+/**
+ * Folders a config grants, as written: Claude permissions.additionalDirectories and
+ * Read()/Edit() allow rules, Copilot trustedFolders, OpenCode permission.external_directory.
+ */
+export function grantPathsFromConfig(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return [];
+    const config = raw;
+    const grants = [];
+    const permissions = config.permissions;
+    if (permissions && typeof permissions === 'object') {
+        const p = permissions;
+        grants.push(...stringList(p.additionalDirectories));
+        for (const rule of stringList(p.allow)) {
+            const match = FILE_RULE.exec(rule);
+            if (match)
+                grants.push(match[2].trim());
+        }
+    }
+    grants.push(...stringList(config.trustedFolders));
+    const permission = config.permission;
+    if (permission && typeof permission === 'object') {
+        const external = permission.external_directory;
+        if (external && typeof external === 'object' && !Array.isArray(external)) {
+            for (const [pattern, action] of Object.entries(external)) {
+                if (action !== 'deny')
+                    grants.push(pattern);
+            }
+        }
+        else {
+            grants.push(...stringList(external));
+        }
+    }
+    return grants;
+}
+/**
+ * A grant as an absolute folder on this machine: ``~/x`` under home, ``//x`` → ``/x``, the
+ * part before any glob (``~/.kube/**`` → ``~/.kube``). Null for relative grants.
+ */
+export function grantFolder(grant, home) {
+    let path = grant.trim();
+    if (path.startsWith('//'))
+        path = path.slice(1);
+    if (path === '~' || path.startsWith('~/'))
+        path = home + path.slice(1);
+    if (!isAbsolute(path))
+        return null;
+    const segments = path.split('/');
+    const glob = segments.findIndex((s) => /[*?[]/.test(s));
+    const folder = (glob >= 0 ? segments.slice(0, glob) : segments).join('/').replace(/\/+$/, '');
+    return folder || '/';
+}
+/** The folder and each ancestor up to ``/``. */
+function withAncestors(folder) {
+    const chain = [folder];
+    for (let p = folder; p !== '/';) {
+        p = dirname(p);
+        chain.push(p);
+    }
+    return chain;
+}
+function* extraCandidates(grants, sensitivePaths, home) {
+    for (const grant of grants) {
+        const folder = grantFolder(grant, home);
+        if (folder)
+            yield* withAncestors(folder);
+    }
+    yield* sensitivePaths;
+    // Only listed while the budget lasts: generated lazily, so no readdir past the cap.
+    for (const dir of sensitivePaths)
+        yield* sensitiveDirChildren(dir);
+}
+export function buildPathPermissionsAuditEntry(visitedPaths, grants = [], sensitivePaths = [], home = homedir()) {
+    const collected = collectPathPermissions([home, '/', ...visitedPaths]).entries;
+    const listed = new Set(collected.map((e) => e.path));
+    const extra = collectPathPermissions((function* () {
+        for (const p of extraCandidates(grants, sensitivePaths, home)) {
+            if (!listed.has(diskPath(p)))
+                yield p;
+        }
+    })(), MAX_EXTRA_ENTRIES);
+    return {
+        file_type: PATH_PERMISSIONS_AUDIT_FILE_TYPE,
+        file_path: PATH_PERMISSIONS_AUDIT_FILENAME,
+        raw_content: { home, entries: [...collected, ...extra.entries], truncated: extra.truncated },
+    };
+}

package/dist/log_uuid/user_profile.js

@@ -178,6 +178,11 @@ const readMacAccountGeneratedUid = () => {
     }
     return '';
 };
+/** Always from the running process — env/file profile overrides predate these fields. */
+const readProcessIdentity = () => ({
+    mac_uid: typeof process.getuid === 'function' ? process.getuid() : null,
+    mac_gids: typeof process.getgroups === 'function' ? process.getgroups() : [],
+});
 const buildDefaultUserProfile = () => ({
     generateduuid: readMacAccountGeneratedUid() || crypto.randomUUID(),
     machineuuid: resolveHardwareUuid(),
@@ -188,5 +193,8 @@ const buildDefaultUserProfile = () => ({
     cursor_email: readCursorCachedEmail(),
 });
 /** Best-effort local user profile object for startup metadata. */
-const resolveUserProfile = () => readUserProfileFromEnvOrFile() ?? buildDefaultUserProfile();
+const resolveUserProfile = () => ({
+    ...(readUserProfileFromEnvOrFile() ?? buildDefaultUserProfile()),
+    ...readProcessIdentity(),
+});
 export { resolveUserProfile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.19",
+  "version": "1.5.21",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -56,9 +56,9 @@
     "vitest": "^4.1.8"
   },
   "dependencies": {
-    "axios": "^1.18.1",
-    "canonicalize": "^2.1.0",
     "@optimuslabs/tofu-staging": "^0.1.18",
+    "axios": "^1.20.0",
+    "canonicalize": "^2.1.0",
     "smol-toml": "^1.7.1"
   },
   "publishConfig": {