@oyasmi/pipiclaw 0.5.5 → 0.5.6

package/dist/security/command-guard.js

@@ -0,0 +1,447 @@
+import { basename } from "node:path";
+const WHITESPACE = /\s+/;
+function stripNullAndNormalize(text) {
+    return text.replace(/\0/g, "").normalize("NFKC");
+}
+function stripComments(command) {
+    let result = "";
+    let inSingle = false;
+    let inDouble = false;
+    let escaped = false;
+    for (let i = 0; i < command.length; i++) {
+        const char = command[i];
+        if (escaped) {
+            result += char;
+            escaped = false;
+            continue;
+        }
+        if (!inSingle && char === "\\") {
+            result += char;
+            escaped = true;
+            continue;
+        }
+        if (!inDouble && char === "'") {
+            inSingle = !inSingle;
+            result += char;
+            continue;
+        }
+        if (!inSingle && char === '"') {
+            inDouble = !inDouble;
+            result += char;
+            continue;
+        }
+        if (!inSingle && !inDouble && char === "#") {
+            break;
+        }
+        result += char;
+    }
+    return result;
+}
+function splitCommandChain(command) {
+    const atoms = [];
+    const normalized = stripComments(stripNullAndNormalize(command));
+    function pushAtom(atom) {
+        const trimmed = atom.trim();
+        if (trimmed) {
+            atoms.push(trimmed);
+        }
+    }
+    function walk(input) {
+        let buffer = "";
+        let inSingle = false;
+        let inDouble = false;
+        let escaped = false;
+        let parenDepth = 0;
+        for (let i = 0; i < input.length; i++) {
+            const char = input[i];
+            const next = input[i + 1];
+            if (escaped) {
+                buffer += char;
+                escaped = false;
+                continue;
+            }
+            if (char === "\\") {
+                buffer += char;
+                escaped = true;
+                continue;
+            }
+            if (!inDouble && char === "'") {
+                inSingle = !inSingle;
+                buffer += char;
+                continue;
+            }
+            if (!inSingle && char === '"') {
+                inDouble = !inDouble;
+                buffer += char;
+                continue;
+            }
+            if (!inSingle && char === "`") {
+                let j = i + 1;
+                let inner = "";
+                let innerEscaped = false;
+                while (j < input.length) {
+                    const innerChar = input[j];
+                    if (innerEscaped) {
+                        inner += innerChar;
+                        innerEscaped = false;
+                        j++;
+                        continue;
+                    }
+                    if (innerChar === "\\") {
+                        inner += innerChar;
+                        innerEscaped = true;
+                        j++;
+                        continue;
+                    }
+                    if (innerChar === "`") {
+                        break;
+                    }
+                    inner += innerChar;
+                    j++;
+                }
+                if (j < input.length) {
+                    walk(inner);
+                    buffer += "`subshell`";
+                    i = j;
+                    continue;
+                }
+            }
+            if (!inSingle && char === "$" && next === "(") {
+                let j = i + 2;
+                let inner = "";
+                let depth = 1;
+                let innerSingle = false;
+                let innerDouble = false;
+                let innerEscaped = false;
+                while (j < input.length) {
+                    const innerChar = input[j];
+                    if (innerEscaped) {
+                        inner += innerChar;
+                        innerEscaped = false;
+                        j++;
+                        continue;
+                    }
+                    if (innerChar === "\\") {
+                        inner += innerChar;
+                        innerEscaped = true;
+                        j++;
+                        continue;
+                    }
+                    if (!innerDouble && innerChar === "'") {
+                        innerSingle = !innerSingle;
+                        inner += innerChar;
+                        j++;
+                        continue;
+                    }
+                    if (!innerSingle && innerChar === '"') {
+                        innerDouble = !innerDouble;
+                        inner += innerChar;
+                        j++;
+                        continue;
+                    }
+                    if (!innerSingle && !innerDouble && innerChar === "(") {
+                        depth++;
+                        inner += innerChar;
+                        j++;
+                        continue;
+                    }
+                    if (!innerSingle && !innerDouble && innerChar === ")") {
+                        depth--;
+                        if (depth === 0) {
+                            break;
+                        }
+                        inner += innerChar;
+                        j++;
+                        continue;
+                    }
+                    inner += innerChar;
+                    j++;
+                }
+                if (depth === 0) {
+                    walk(inner);
+                    buffer += "$(subshell)";
+                    i = j;
+                    continue;
+                }
+            }
+            if (!inSingle && !inDouble) {
+                if (char === "(") {
+                    parenDepth++;
+                }
+                else if (char === ")" && parenDepth > 0) {
+                    parenDepth--;
+                }
+                const separator = parenDepth === 0 &&
+                    (char === ";" ||
+                        char === "\n" ||
+                        (char === "|" && next === "|") ||
+                        (char === "&" && next === "&") ||
+                        char === "|");
+                if (separator) {
+                    pushAtom(buffer);
+                    buffer = "";
+                    if ((char === "|" && next === "|") || (char === "&" && next === "&")) {
+                        i++;
+                    }
+                    continue;
+                }
+            }
+            buffer += char;
+        }
+        pushAtom(buffer);
+    }
+    walk(normalized);
+    return atoms;
+}
+function parseShellWords(command) {
+    const words = [];
+    let buffer = "";
+    let inSingle = false;
+    let inDouble = false;
+    let escaped = false;
+    function pushWord() {
+        if (buffer) {
+            words.push(buffer);
+            buffer = "";
+        }
+    }
+    for (let i = 0; i < command.length; i++) {
+        const char = command[i];
+        if (escaped) {
+            buffer += char;
+            escaped = false;
+            continue;
+        }
+        if (!inSingle && char === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (!inDouble && char === "'") {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (!inSingle && char === '"') {
+            inDouble = !inDouble;
+            continue;
+        }
+        if (!inSingle && !inDouble && WHITESPACE.test(char)) {
+            pushWord();
+            continue;
+        }
+        buffer += char;
+    }
+    pushWord();
+    return words;
+}
+function parseCommand(command) {
+    const words = parseShellWords(command);
+    if (words.length === 0) {
+        return null;
+    }
+    const normalizedCommand = basename(words[0]).toLowerCase();
+    const args = words.slice(1);
+    return {
+        command: normalizedCommand,
+        args,
+        normalized: [normalizedCommand, ...args].join(" ").trim(),
+    };
+}
+function hasAnyArg(args, values) {
+    return args.some((arg) => values.includes(arg));
+}
+function hasRecursiveFlag(args) {
+    return args.some((arg) => /^-[^-]*r/.test(arg) || arg === "-R" || arg === "--recursive");
+}
+function hasForceFlag(args) {
+    return args.some((arg) => /^-[^-]*f/.test(arg) || arg === "--force");
+}
+function hasDangerousDeletionTarget(args) {
+    return args.some((arg) => ["/", "/*", "~", "~/", "*", "./*", ".", "..", "../", "$HOME", "$HOME/"].includes(arg));
+}
+function joinedArgs(parsed) {
+    return parsed.args.join(" ");
+}
+function matchRule(parsed, config) {
+    const argsText = joinedArgs(parsed);
+    const normalized = parsed.normalized;
+    if (parsed.command === "rm" &&
+        hasRecursiveFlag(parsed.args) &&
+        (hasForceFlag(parsed.args) || hasDangerousDeletionTarget(parsed.args))) {
+        return {
+            category: "destructive-file-op",
+            rule: "rm-recursive-force",
+            reason: "Recursive deletion with force or dangerous targets is not allowed",
+            matchedText: normalized,
+        };
+    }
+    if (parsed.command === "find" && (argsText.includes(" -delete") || /\s-exec\s+rm(?:\s|$)/.test(` ${argsText}`))) {
+        return {
+            category: "destructive-file-op",
+            rule: "find-delete",
+            reason: "Destructive find operations are not allowed",
+            matchedText: normalized,
+        };
+    }
+    if (["shred", "mkfs", "wipefs"].includes(parsed.command)) {
+        return {
+            category: "destructive-file-op",
+            rule: parsed.command,
+            reason: "Irreversible destructive commands are not allowed",
+            matchedText: normalized,
+        };
+    }
+    if (["shutdown", "reboot", "halt", "poweroff"].includes(parsed.command)) {
+        return {
+            category: "system-manipulation",
+            rule: parsed.command,
+            reason: "System power control commands are not allowed",
+            matchedText: normalized,
+        };
+    }
+    if ((parsed.command === "systemctl" && hasAnyArg(parsed.args, ["stop", "disable", "mask", "reboot", "poweroff"])) ||
+        (parsed.command === "service" && hasAnyArg(parsed.args, ["stop", "restart"])) ||
+        (parsed.command === "launchctl" && hasAnyArg(parsed.args, ["unload", "remove", "bootout"])) ||
+        (parsed.command === "sysctl" && parsed.args.includes("-w"))) {
+        return {
+            category: "system-manipulation",
+            rule: parsed.command,
+            reason: "System service or kernel mutation commands are not allowed",
+            matchedText: normalized,
+        };
+    }
+    if (parsed.command === "sudo" ||
+        (parsed.command === "su" && parsed.args[0] === "root") ||
+        ["passwd", "visudo", "setcap"].includes(parsed.command) ||
+        (parsed.command === "chmod" && parsed.args.some((arg) => arg.includes("+s"))) ||
+        (parsed.command === "chown" && parsed.args.some((arg) => arg.startsWith("root")))) {
+        return {
+            category: "privilege-escalation",
+            rule: parsed.command,
+            reason: "Privilege escalation and account mutation commands are not allowed",
+            matchedText: normalized,
+        };
+    }
+    if ((parsed.command === "kill" &&
+        (parsed.args.includes("-9") || parsed.args.includes("-KILL")) &&
+        parsed.args.includes("1")) ||
+        ["killall", "pkill"].includes(parsed.command) ||
+        (parsed.command === "history" && hasAnyArg(parsed.args, ["-c", "--clear"])) ||
+        (parsed.command === "unset" && parsed.args.includes("HISTFILE")) ||
+        normalized.includes("export HISTSIZE=0")) {
+        return {
+            category: "process-manipulation",
+            rule: parsed.command,
+            reason: "Process-kill or history tampering commands are not allowed",
+            matchedText: normalized,
+        };
+    }
+    if ((parsed.command === "curl" && parsed.args.includes("--upload-file")) ||
+        (parsed.command === "wget" && parsed.args.includes("--post-file")) ||
+        (parsed.command === "nc" && parsed.args.some((arg) => /^-[^-]*l/.test(arg) || arg === "--listen")) ||
+        (parsed.command === "socat" && /\bexec\b/i.test(argsText)) ||
+        normalized.includes("/dev/tcp/") ||
+        (normalized.includes("mkfifo") && normalized.includes(" nc")) ||
+        (parsed.command === "bash" && parsed.args.includes("-i") && /[>&]/.test(argsText))) {
+        return {
+            category: "network-abuse",
+            rule: parsed.command,
+            reason: "Network exfiltration or listener setup commands are not allowed",
+            matchedText: normalized,
+        };
+    }
+    if (parsed.command === "nsenter" ||
+        (parsed.command === "docker" &&
+            ((parsed.args[0] === "run" && parsed.args.includes("--privileged")) ||
+                (parsed.args[0] === "exec" && parsed.args.includes("--privileged")) ||
+                (parsed.args[0] === "run" && parsed.args.some((arg) => arg.includes("/:")))))) {
+        return {
+            category: "container-escape",
+            rule: parsed.command,
+            reason: "Container escape and privileged container commands are not allowed",
+            matchedText: normalized,
+        };
+    }
+    if (config.blockObfuscation) {
+        if (/\bbase64\b.*(?:-d|--decode).*?\|\s*(bash|sh|exec|eval)\b/i.test(normalized) ||
+            /\beval\s+\$\(/i.test(normalized) ||
+            ((parsed.command === "python" || parsed.command === "python3") &&
+                parsed.args.includes("-c") &&
+                /(os\.system|subprocess|exec\(|eval\()/i.test(argsText)) ||
+            (parsed.command === "perl" && parsed.args.includes("-e") && /\b(system|exec)\b/.test(argsText)) ||
+            (parsed.command === "ruby" && parsed.args.includes("-e") && /\b(system|exec)\b/.test(argsText)) ||
+            (parsed.command === "node" && parsed.args.includes("-e") && /\b(child_process|exec|spawn)\b/.test(argsText)) ||
+            /\\x[0-9a-f]{2}/i.test(normalized) ||
+            /\$'/.test(normalized)) {
+            return {
+                category: "obfuscation",
+                rule: parsed.command,
+                reason: "Obfuscated command execution is not allowed",
+                matchedText: normalized,
+            };
+        }
+    }
+    for (const pattern of config.additionalDenyPatterns) {
+        try {
+            const regex = new RegExp(pattern, "i");
+            if (regex.test(normalized)) {
+                return {
+                    category: "configured-command-deny",
+                    rule: pattern,
+                    reason: "Command matched a configured deny pattern",
+                    matchedText: normalized,
+                };
+            }
+        }
+        catch {
+            // Ignore invalid user patterns.
+        }
+    }
+    return null;
+}
+export function guardCommand(command, config) {
+    if (!config.enabled) {
+        return { allowed: true };
+    }
+    const atoms = splitCommandChain(command);
+    const normalizedWhole = stripNullAndNormalize(command);
+    for (const allowPattern of config.allowPatterns) {
+        if (normalizedWhole.includes(allowPattern)) {
+            return { allowed: true };
+        }
+    }
+    if (config.blockObfuscation &&
+        (/\bbase64\b.*(?:-d|--decode).*?\|\s*(bash|sh|exec|eval)\b/i.test(normalizedWhole) ||
+            /\beval\s+\$\(/i.test(normalizedWhole) ||
+            /\\x[0-9a-f]{2}/i.test(normalizedWhole) ||
+            /\$'/.test(normalizedWhole))) {
+        return {
+            allowed: false,
+            category: "obfuscation",
+            rule: "obfuscation-whole-command",
+            reason: "Obfuscated command execution is not allowed",
+            matchedText: normalizedWhole,
+        };
+    }
+    for (const atom of atoms) {
+        const parsed = parseCommand(atom);
+        if (!parsed) {
+            continue;
+        }
+        const match = matchRule(parsed, config);
+        if (match) {
+            return {
+                allowed: false,
+                category: match.category,
+                rule: match.rule,
+                reason: match.reason,
+                matchedText: match.matchedText,
+            };
+        }
+    }
+    return { allowed: true };
+}
+export const internalCommandGuard = {
+    parseShellWords,
+    parseCommand,
+    splitCommandChain,
+};

package/dist/security/config.d.ts

@@ -0,0 +1,4 @@
+import type { SecurityConfig } from "./types.js";
+export declare const DEFAULT_SECURITY_CONFIG: SecurityConfig;
+export declare function getSecurityConfigPath(appHomeDir?: string): string;
+export declare function loadSecurityConfig(appHomeDir?: string): SecurityConfig;

package/dist/security/config.js

@@ -0,0 +1,82 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { APP_HOME_DIR } from "../paths.js";
+import { isRecord } from "../shared/type-guards.js";
+export const DEFAULT_SECURITY_CONFIG = {
+    enabled: true,
+    commandGuard: {
+        enabled: true,
+        additionalDenyPatterns: [],
+        allowPatterns: [],
+        blockObfuscation: true,
+    },
+    pathGuard: {
+        enabled: true,
+        readAllow: [],
+        readDeny: [],
+        writeAllow: [],
+        writeDeny: [],
+        resolveSymlinks: true,
+    },
+    audit: {
+        logBlocked: true,
+    },
+};
+function asStringArray(value) {
+    return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function asOptionalString(value) {
+    return typeof value === "string" && value.trim() ? value : undefined;
+}
+function mergeSecurityConfig(source) {
+    if (!isRecord(source)) {
+        return DEFAULT_SECURITY_CONFIG;
+    }
+    const commandGuard = isRecord(source.commandGuard) ? source.commandGuard : {};
+    const pathGuard = isRecord(source.pathGuard) ? source.pathGuard : {};
+    const audit = isRecord(source.audit) ? source.audit : {};
+    return {
+        enabled: typeof source.enabled === "boolean" ? source.enabled : DEFAULT_SECURITY_CONFIG.enabled,
+        commandGuard: {
+            enabled: typeof commandGuard.enabled === "boolean"
+                ? commandGuard.enabled
+                : DEFAULT_SECURITY_CONFIG.commandGuard.enabled,
+            additionalDenyPatterns: asStringArray(commandGuard.additionalDenyPatterns),
+            allowPatterns: asStringArray(commandGuard.allowPatterns),
+            blockObfuscation: typeof commandGuard.blockObfuscation === "boolean"
+                ? commandGuard.blockObfuscation
+                : DEFAULT_SECURITY_CONFIG.commandGuard.blockObfuscation,
+        },
+        pathGuard: {
+            enabled: typeof pathGuard.enabled === "boolean" ? pathGuard.enabled : DEFAULT_SECURITY_CONFIG.pathGuard.enabled,
+            readAllow: asStringArray(pathGuard.readAllow),
+            readDeny: asStringArray(pathGuard.readDeny),
+            writeAllow: asStringArray(pathGuard.writeAllow),
+            writeDeny: asStringArray(pathGuard.writeDeny),
+            resolveSymlinks: typeof pathGuard.resolveSymlinks === "boolean"
+                ? pathGuard.resolveSymlinks
+                : DEFAULT_SECURITY_CONFIG.pathGuard.resolveSymlinks,
+        },
+        audit: {
+            logBlocked: typeof audit.logBlocked === "boolean" ? audit.logBlocked : DEFAULT_SECURITY_CONFIG.audit.logBlocked,
+            logFile: asOptionalString(audit.logFile),
+        },
+    };
+}
+export function getSecurityConfigPath(appHomeDir = APP_HOME_DIR) {
+    return join(appHomeDir, "security.json");
+}
+export function loadSecurityConfig(appHomeDir = APP_HOME_DIR) {
+    const configPath = getSecurityConfigPath(appHomeDir);
+    if (!existsSync(configPath)) {
+        return DEFAULT_SECURITY_CONFIG;
+    }
+    try {
+        const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+        return mergeSecurityConfig(raw);
+    }
+    catch (error) {
+        console.warn(`Failed to load security config from ${configPath}: ${error}`);
+        return DEFAULT_SECURITY_CONFIG;
+    }
+}

package/dist/security/logger.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityConfig, SecurityLogEvent } from "./types.js";
+export declare function logSecurityEvent(workspaceDir: string, config: SecurityConfig, event: SecurityLogEvent): void;

package/dist/security/logger.js

@@ -0,0 +1,18 @@
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+function getLogPath(workspaceDir, config) {
+    return config.audit.logFile?.trim() ? config.audit.logFile : join(workspaceDir, ".pipiclaw", "security.log");
+}
+export function logSecurityEvent(workspaceDir, config, event) {
+    if (!config.audit.logBlocked) {
+        return;
+    }
+    const logPath = getLogPath(workspaceDir, config);
+    try {
+        mkdirSync(dirname(logPath), { recursive: true });
+        appendFileSync(logPath, `${JSON.stringify({ date: new Date().toISOString(), ...event })}\n`, "utf-8");
+    }
+    catch {
+        // Audit logging must never break the tool path.
+    }
+}

package/dist/security/path-guard.d.ts

@@ -0,0 +1,2 @@
+import type { PathGuardContext, PathGuardResult } from "./types.js";
+export declare function guardPath(rawPath: string, operation: "read" | "write", ctx: PathGuardContext): PathGuardResult;