@pheem49/mint 1.4.2 → 1.5.1

package/src/System/safety_manager.js

@@ -0,0 +1,273 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { readConfig } = require('./config_manager');
+
+const TIERS = Object.freeze({
+    SAFE: 'safe',
+    APPROVAL: 'approval',
+    DANGEROUS: 'dangerous',
+    BLOCKED: 'blocked'
+});
+
+const BLOCKED_COMMAND_PATTERNS = [
+    { pattern: /\brm\s+(-[^\s]*r[^\s]*f|-rf|-fr)\b/, reason: 'recursive force delete' },
+    { pattern: /\bgit\s+reset\s+--hard\b/, reason: 'destructive git reset' },
+    { pattern: /\bgit\s+checkout\s+--\b/, reason: 'destructive git checkout path restore' },
+    { pattern: /\bgit\s+clean\b.*\s-[^\s]*f/, reason: 'destructive git clean' },
+    { pattern: /\bmkfs(?:\.\w+)?\b/, reason: 'filesystem formatting' },
+    { pattern: /\bdd\s+.*\bof=\/dev\//, reason: 'raw disk write' },
+    { pattern: />\s*\/dev\/(?:sd|nvme|hd|mapper)/, reason: 'write redirection to block device' },
+    { pattern: /\b(shutdown|reboot|poweroff|halt)\b/, reason: 'system power command' },
+    { pattern: /\bsudo\b/, reason: 'privilege escalation' },
+    { pattern: /\bchmod\s+-R\s+777\b/, reason: 'unsafe recursive permissions' },
+    { pattern: /\bchown\s+-R\b/, reason: 'unsafe recursive ownership change' },
+    { pattern: /\bcurl\b.*\|\s*(sh|bash|zsh)\b/, reason: 'remote script piping' },
+    { pattern: /\bwget\b.*\|\s*(sh|bash|zsh)\b/, reason: 'remote script piping' }
+];
+
+const DANGEROUS_ACTIONS = new Set([
+    'delete_file',
+    'system_automation'
+]);
+
+const SAFE_ACTIONS = new Set([
+    'open_url',
+    'search',
+    'open_app',
+    'open_file',
+    'open_folder',
+    'find_path',
+    'clipboard_write',
+    'learn_file',
+    'learn_folder',
+    'system_info',
+    'mcp_tool',
+    'mouse_move',
+    'mouse_click',
+    'type_text',
+    'key_tap',
+    'plugin',
+    'web_automation',
+    'create_folder'
+]);
+
+const DANGEROUS_SYSTEM_COMMANDS = new Set(['shutdown', 'restart', 'reboot', 'poweroff', 'sleep']);
+
+function normalizeCommand(command) {
+    return String(command || '').replace(/\s+/g, ' ').trim();
+}
+
+function expandHome(targetPath) {
+    const value = String(targetPath || '');
+    if (value === '~') return os.homedir();
+    if (value.startsWith('~/')) return path.join(os.homedir(), value.slice(2));
+    return value;
+}
+
+function normalizeRootList(paths) {
+    return (Array.isArray(paths) ? paths : [])
+        .filter(Boolean)
+        .map((entry) => path.resolve(expandHome(entry)));
+}
+
+function getPolicy(config = readConfig()) {
+    const enabled = config.safetyEnabled !== false;
+    const fallbackRead = [
+        os.homedir(),
+        process.cwd(),
+        path.join(os.homedir(), 'Desktop'),
+        path.join(os.homedir(), 'Documents'),
+        path.join(os.homedir(), 'Downloads'),
+        path.join(os.homedir(), 'Pictures'),
+        path.join(os.homedir(), 'Music'),
+        path.join(os.homedir(), 'Videos')
+    ];
+    const fallbackWrite = [
+        os.homedir(),
+        process.cwd(),
+        path.join(os.homedir(), 'Desktop'),
+        path.join(os.homedir(), 'Documents'),
+        path.join(os.homedir(), 'Downloads'),
+        path.join(os.homedir(), 'Pictures'),
+        path.join(os.homedir(), 'Music'),
+        path.join(os.homedir(), 'Videos')
+    ];
+
+    return {
+        enabled,
+        sandboxMode: ['off', 'prefer', 'enforce'].includes(config.sandboxMode) ? config.sandboxMode : 'prefer',
+        sandboxCommand: config.sandboxCommand || (process.platform === 'darwin' ? 'sandbox-exec' : process.platform === 'linux' ? 'bwrap' : ''),
+        allowedReadPaths: normalizeRootList(config.allowedReadPaths && config.allowedReadPaths.length ? config.allowedReadPaths : fallbackRead),
+        allowedWritePaths: normalizeRootList(config.allowedWritePaths && config.allowedWritePaths.length ? config.allowedWritePaths : fallbackWrite),
+        blockedPaths: normalizeRootList(config.blockedPaths || []),
+        blockedFileNames: new Set(Array.isArray(config.blockedFileNames) ? config.blockedFileNames : ['.env', 'id_rsa', 'id_ed25519'])
+    };
+}
+
+function isPathWithin(root, targetPath) {
+    const relative = path.relative(root, targetPath);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+function resolveCapabilityPath(targetPath, options = {}) {
+    if (!targetPath) throw new Error('Target path is required.');
+
+    const expanded = expandHome(targetPath);
+    if (path.isAbsolute(expanded)) return path.resolve(expanded);
+
+    const firstPart = String(expanded).split(/[/\\]/)[0];
+    const commonHomeFolders = new Set(['Desktop', 'Documents', 'Downloads', 'Pictures', 'Music', 'Videos']);
+    if (commonHomeFolders.has(firstPart)) {
+        return path.resolve(os.homedir(), expanded);
+    }
+
+    const base = options.defaultBase || process.cwd();
+    return path.resolve(base, expanded);
+}
+
+function assertPathCapability(targetPath, capability = 'read', options = {}) {
+    const policy = getPolicy(options.config);
+    const resolved = resolveCapabilityPath(targetPath, options);
+
+    if (!policy.enabled) return resolved;
+
+    if (policy.blockedFileNames.has(path.basename(resolved))) {
+        throw new Error(`Blocked ${capability} access to sensitive file name: ${path.basename(resolved)}`);
+    }
+
+    const blockedRoot = policy.blockedPaths.find((root) => isPathWithin(root, resolved));
+    if (blockedRoot) {
+        throw new Error(`Blocked ${capability} access to protected path: ${resolved}`);
+    }
+
+    const allowedRoots = capability === 'write' ? policy.allowedWritePaths : policy.allowedReadPaths;
+    const allowed = allowedRoots.some((root) => isPathWithin(root, resolved));
+    if (!allowed) {
+        throw new Error(`Path ${capability} denied by capability policy: ${resolved}`);
+    }
+
+    return resolved;
+}
+
+function getAllowedRoots(capability = 'read', options = {}) {
+    const policy = getPolicy(options.config);
+    return capability === 'write' ? policy.allowedWritePaths : policy.allowedReadPaths;
+}
+
+function classifyShellCommand(command) {
+    const normalized = normalizeCommand(command);
+    if (!normalized) {
+        return { tier: TIERS.BLOCKED, reason: 'empty shell command' };
+    }
+
+    for (const rule of BLOCKED_COMMAND_PATTERNS) {
+        if (rule.pattern.test(normalized)) {
+            return { tier: TIERS.BLOCKED, reason: rule.reason };
+        }
+    }
+
+    return { tier: TIERS.APPROVAL, reason: 'shell command requires approval' };
+}
+
+function assertShellCommandAllowed(command) {
+    const result = classifyShellCommand(command);
+    if (result.tier === TIERS.BLOCKED) {
+        throw new Error(`Blocked unsafe command (${result.reason}): ${command}`);
+    }
+    return result;
+}
+
+function classifyAction(action = {}) {
+    const type = action.type || 'none';
+    if (type === 'none') return { tier: TIERS.SAFE, reason: 'no-op action' };
+
+    if (type === 'system_automation') {
+        const command = String(action.target || '').split(':')[0];
+        if (DANGEROUS_SYSTEM_COMMANDS.has(command)) {
+            return { tier: TIERS.DANGEROUS, reason: `system automation command '${command}'` };
+        }
+        return { tier: TIERS.APPROVAL, reason: 'system automation requires approval' };
+    }
+
+    if (DANGEROUS_ACTIONS.has(type)) {
+        return { tier: TIERS.DANGEROUS, reason: `${type} can affect user data or system state` };
+    }
+
+    if (SAFE_ACTIONS.has(type)) {
+        return { tier: TIERS.SAFE, reason: 'allowed action' };
+    }
+
+    return { tier: TIERS.APPROVAL, reason: 'unknown action requires approval' };
+}
+
+function assertActionAllowed(action, options = {}) {
+    const classification = classifyAction(action);
+    const allowDangerous = options.allowDangerous === true;
+    const allowApproval = options.allowApproval === true;
+
+    if (classification.tier === TIERS.BLOCKED) {
+        throw new Error(`Blocked action (${classification.reason}): ${action.type}`);
+    }
+
+    if (classification.tier === TIERS.DANGEROUS && !allowDangerous) {
+        throw new Error(`Dangerous action requires explicit permission (${classification.reason}): ${action.type}`);
+    }
+
+    if (classification.tier === TIERS.APPROVAL && !allowApproval) {
+        throw new Error(`Action requires approval (${classification.reason}): ${action.type}`);
+    }
+
+    return classification;
+}
+
+function resolveWithinRoot(root, targetPath) {
+    if (!root) throw new Error('Root path is required.');
+    if (!targetPath) throw new Error('Target path is required.');
+
+    const resolvedRoot = path.resolve(root);
+    const expandedTarget = String(targetPath).startsWith('~/')
+        ? path.join(os.homedir(), String(targetPath).slice(2))
+        : targetPath;
+    const resolvedTarget = path.resolve(resolvedRoot, expandedTarget);
+    const relative = path.relative(resolvedRoot, resolvedTarget);
+
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Path is outside allowed root: ${targetPath}`);
+    }
+
+    return resolvedTarget;
+}
+
+function appendActionLog(entry, options = {}) {
+    const logPath = options.logPath || path.join(os.homedir(), '.config', 'mint', 'action-log.jsonl');
+    const payload = {
+        time: new Date().toISOString(),
+        ...entry
+    };
+
+    try {
+        fs.mkdirSync(path.dirname(logPath), { recursive: true });
+        fs.appendFileSync(logPath, `${JSON.stringify(payload)}\n`, 'utf8');
+    } catch (error) {
+        if (process.env.MINT_DEBUG === '1') {
+            console.error('[Safety] Failed to append action log:', error.message);
+        }
+    }
+
+    return payload;
+}
+
+module.exports = {
+    TIERS,
+    getPolicy,
+    getAllowedRoots,
+    classifyShellCommand,
+    assertShellCommandAllowed,
+    classifyAction,
+    assertActionAllowed,
+    assertPathCapability,
+    resolveCapabilityPath,
+    resolveWithinRoot,
+    appendActionLog
+};

package/src/System/sandbox_runner.js

@@ -0,0 +1,182 @@
+const { execFile, spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const safetyManager = require('./safety_manager');
+
+function commandExists(command) {
+    const lookup = process.platform === 'win32' ? 'where' : 'which';
+    const result = spawnSync(lookup, [command], { encoding: 'utf8', shell: false });
+    return result.status === 0;
+}
+
+function uniqueExistingRoots(roots) {
+    return Array.from(new Set((roots || [])
+        .filter(Boolean)
+        .map((root) => path.resolve(root))
+        .filter((root) => fs.existsSync(root))));
+}
+
+function buildBubblewrapArgs(command, options = {}) {
+    const cwd = path.resolve(options.cwd || process.cwd());
+    const readRoots = uniqueExistingRoots(safetyManager.getAllowedRoots('read'));
+    const writeRoots = uniqueExistingRoots(safetyManager.getAllowedRoots('write'));
+    const writableSet = new Set(writeRoots);
+    const bindRoots = uniqueExistingRoots([cwd, ...readRoots, ...writeRoots]);
+
+    const args = [
+        '--die-with-parent',
+        '--proc', '/proc',
+        '--dev', '/dev',
+        '--tmpfs', '/tmp',
+        '--ro-bind', '/usr', '/usr',
+        '--ro-bind', '/bin', '/bin',
+        '--ro-bind', '/etc', '/etc'
+    ];
+
+    for (const libPath of ['/lib', '/lib64']) {
+        if (fs.existsSync(libPath)) args.push('--ro-bind', libPath, libPath);
+    }
+
+    const parentDirs = new Set();
+    for (const root of bindRoots) {
+        let current = path.dirname(root);
+        while (current && current !== path.dirname(current)) {
+            parentDirs.add(current);
+            current = path.dirname(current);
+        }
+    }
+    for (const dir of Array.from(parentDirs).sort((a, b) => a.length - b.length)) {
+        if (!['/usr', '/bin', '/etc', '/lib', '/lib64'].includes(dir)) {
+            args.push('--dir', dir);
+        }
+    }
+
+    for (const root of bindRoots) {
+        const flag = writableSet.has(root) || root === cwd ? '--bind' : '--ro-bind';
+        args.push(flag, root, root);
+    }
+
+    args.push('--chdir', cwd, 'bash', '-lc', command);
+    return args;
+}
+
+function escapeSandboxProfileString(value) {
+    return String(value || '').replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
+function buildMacSandboxProfile(options = {}) {
+    const cwd = path.resolve(options.cwd || process.cwd());
+    const readRoots = uniqueExistingRoots(safetyManager.getAllowedRoots('read'));
+    const writeRoots = uniqueExistingRoots(safetyManager.getAllowedRoots('write'));
+    const allowedRead = uniqueExistingRoots([
+        cwd,
+        '/bin',
+        '/sbin',
+        '/usr',
+        '/System',
+        '/Library',
+        ...readRoots,
+        ...writeRoots
+    ]);
+    const allowedWrite = uniqueExistingRoots([cwd, ...writeRoots]);
+
+    const readRules = allowedRead.map((root) => `  (subpath "${escapeSandboxProfileString(root)}")`).join('\n');
+    const writeRules = allowedWrite.map((root) => `  (subpath "${escapeSandboxProfileString(root)}")`).join('\n');
+
+    return [
+        '(version 1)',
+        '(deny default)',
+        '(allow process*)',
+        '(allow sysctl-read)',
+        '(allow signal (target self))',
+        '(allow file-read-metadata)',
+        '(allow file-read*',
+        readRules,
+        ')',
+        '(allow file-write*',
+        writeRules,
+        `  (subpath "${escapeSandboxProfileString(os.tmpdir())}")`,
+        ')'
+    ].join('\n');
+}
+
+function getShellInvocation(command) {
+    if (process.platform === 'win32') {
+        return {
+            command: 'powershell.exe',
+            args: ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', command]
+        };
+    }
+    return {
+        command: 'bash',
+        args: ['-lc', command]
+    };
+}
+
+function execFilePromise(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+        execFile(command, args, options, (error, stdout, stderr) => {
+            if (error) {
+                error.stdout = stdout;
+                error.stderr = stderr;
+                reject(error);
+                return;
+            }
+            resolve({ stdout, stderr });
+        });
+    });
+}
+
+async function runShell(command, options = {}) {
+    const policy = safetyManager.getPolicy();
+    safetyManager.assertShellCommandAllowed(command);
+
+    const cwd = path.resolve(options.cwd || process.cwd());
+    const execOptions = {
+        cwd,
+        maxBuffer: options.maxBuffer || 1024 * 1024 * 4,
+        env: options.env || process.env
+    };
+
+    if (!policy.enabled || policy.sandboxMode === 'off') {
+        const shell = getShellInvocation(command);
+        return execFilePromise(shell.command, shell.args, execOptions);
+    }
+
+    const sandboxCommand = policy.sandboxCommand || 'bwrap';
+    if (process.platform === 'linux' && commandExists(sandboxCommand)) {
+        return execFilePromise(sandboxCommand, buildBubblewrapArgs(command, { cwd }), execOptions);
+    }
+
+    if (process.platform === 'darwin' && commandExists('sandbox-exec')) {
+        return execFilePromise('sandbox-exec', ['-p', buildMacSandboxProfile({ cwd }), 'bash', '-lc', command], execOptions);
+    }
+
+    if (policy.sandboxMode === 'enforce') {
+        const hint = process.platform === 'darwin'
+            ? "macOS sandbox-exec is not available."
+            : process.platform === 'win32'
+                ? 'Windows sandbox provider is not configured. Use WSL/containers or set sandboxMode to prefer.'
+                : `Sandbox command '${sandboxCommand}' is not available.`;
+        throw new Error(`Sandbox is enforced but no sandbox provider could run. ${hint}`);
+    }
+
+    safetyManager.appendActionLog({
+        source: options.source || 'sandbox_runner',
+        action: 'sandbox_fallback',
+        sandboxCommand,
+        platform: process.platform,
+        cwd
+    });
+    const shell = getShellInvocation(command);
+    return execFilePromise(shell.command, shell.args, execOptions);
+}
+
+module.exports = {
+    runShell,
+    buildBubblewrapArgs,
+    buildMacSandboxProfile,
+    getShellInvocation,
+    commandExists
+};

package/src/System/screen_capture.js

@@ -0,0 +1,175 @@
+const { BrowserWindow, desktopCapturer, screen } = require('electron');
+const path = require('path');
+
+const TRANSLATE_REFRESH_MS = 3000;
+const TRANSLATE_FAILURE_COOLDOWN_MS = 15000;
+
+function createScreenCaptureController({ projectRoot, translateImageContent, getMainWindow }) {
+    let screenPickerWindow = null;
+    let translateIntervalHandle = null;
+    let isTranslateRequestInFlight = false;
+    let translateCooldownUntil = 0;
+
+    async function startScreenCapture() {
+        if (screenPickerWindow) return;
+
+        try {
+            const primaryDisplay = screen.getPrimaryDisplay();
+            const { width, height } = primaryDisplay.size;
+            const sources = await desktopCapturer.getSources({
+                types: ['screen'],
+                thumbnailSize: { width, height }
+            });
+            const primarySource = sources[0];
+
+            screenPickerWindow = new BrowserWindow({
+                width,
+                height,
+                x: primaryDisplay.bounds.x,
+                y: primaryDisplay.bounds.y,
+                fullscreen: true,
+                transparent: true,
+                frame: false,
+                alwaysOnTop: true,
+                skipTaskbar: true,
+                webPreferences: {
+                    preload: path.join(projectRoot, 'preload-picker.js'),
+                    nodeIntegration: false,
+                    contextIsolation: true
+                }
+            });
+
+            await screenPickerWindow.loadFile(path.join(projectRoot, 'src/UI/screenPicker.html'));
+
+            if (primarySource && primarySource.thumbnail) {
+                screenPickerWindow.webContents.send('screenshot-data', primarySource.thumbnail.toDataURL());
+            }
+
+            screenPickerWindow.on('closed', () => { screenPickerWindow = null; });
+        } catch (err) {
+            console.error("Error starting screen capture:", err);
+        }
+    }
+
+    function handleSelection(base64Image) {
+        if (screenPickerWindow) screenPickerWindow.close();
+
+        const mainWindow = getMainWindow();
+        if (mainWindow) {
+            mainWindow.webContents.send('vision-ready', base64Image);
+            mainWindow.show();
+        }
+    }
+
+    function startLiveTranslate(rect) {
+        if (!screenPickerWindow) return;
+
+        screenPickerWindow.setIgnoreMouseEvents(true, { forward: true });
+        isTranslateRequestInFlight = false;
+        translateCooldownUntil = 0;
+
+        stopLiveTranslate(false);
+        captureAndTranslate(rect);
+        translateIntervalHandle = setInterval(() => {
+            captureAndTranslate(rect);
+        }, TRANSLATE_REFRESH_MS);
+    }
+
+    function stopLiveTranslate(resetMouseEvents = true) {
+        if (translateIntervalHandle) {
+            clearInterval(translateIntervalHandle);
+            translateIntervalHandle = null;
+        }
+        if (resetMouseEvents && screenPickerWindow && !screenPickerWindow.isDestroyed()) {
+            screenPickerWindow.setIgnoreMouseEvents(false);
+        }
+        isTranslateRequestInFlight = false;
+        translateCooldownUntil = 0;
+    }
+
+    function setOverlayInteractable(isInteractable) {
+        if (!screenPickerWindow || screenPickerWindow.isDestroyed()) return;
+        screenPickerWindow.setIgnoreMouseEvents(!isInteractable, { forward: true });
+    }
+
+    async function captureAndTranslate(rect) {
+        if (!screenPickerWindow || screenPickerWindow.isDestroyed()) return;
+        if (isTranslateRequestInFlight) return;
+        if (Date.now() < translateCooldownUntil) return;
+
+        try {
+            isTranslateRequestInFlight = true;
+            const primaryDisplay = screen.getPrimaryDisplay();
+            const sources = await desktopCapturer.getSources({
+                types: ['screen'],
+                thumbnailSize: {
+                    width: primaryDisplay.size.width,
+                    height: primaryDisplay.size.height
+                }
+            });
+
+            if (sources.length > 0) {
+                const croppedImage = sources[0].thumbnail.crop({
+                    x: Math.round(rect.x),
+                    y: Math.round(rect.y),
+                    width: Math.round(rect.width),
+                    height: Math.round(rect.height)
+                });
+
+                const base64Crop = croppedImage.toJPEG(70).toString('base64');
+                const translationResult = await translateImageContent(`data:image/jpeg;base64,${base64Crop}`);
+                if (translationResult.retryableFailure) {
+                    translateCooldownUntil = Date.now() + TRANSLATE_FAILURE_COOLDOWN_MS;
+                    console.warn(`Live translation cooldown active for ${TRANSLATE_FAILURE_COOLDOWN_MS / 1000}s after retryable API failure.`);
+                } else {
+                    translateCooldownUntil = 0;
+                }
+
+                if (screenPickerWindow && !screenPickerWindow.isDestroyed()) {
+                    screenPickerWindow.webContents.send('vision-translate-result', translationResult.text);
+                }
+            }
+        } catch (err) {
+            console.error("Continuous translation loop failed:", err);
+        } finally {
+            isTranslateRequestInFlight = false;
+        }
+    }
+
+    function cancel() {
+        stopLiveTranslate(false);
+        if (screenPickerWindow) screenPickerWindow.close();
+
+        const mainWindow = getMainWindow();
+        if (mainWindow) mainWindow.show();
+    }
+
+    async function captureSilentScreen() {
+        try {
+            const primaryDisplay = screen.getPrimaryDisplay();
+            const { width, height } = primaryDisplay.size;
+            const sources = await desktopCapturer.getSources({
+                types: ['screen'],
+                thumbnailSize: { width, height }
+            });
+
+            const primarySource = sources[0];
+            return primarySource && primarySource.thumbnail ? primarySource.thumbnail.toDataURL() : null;
+        } catch (err) {
+            console.error("Error silently capturing screen:", err);
+            return null;
+        }
+    }
+
+    return {
+        startScreenCapture,
+        handleSelection,
+        startLiveTranslate,
+        stopLiveTranslate,
+        setOverlayInteractable,
+        cancel,
+        captureSilentScreen
+    };
+}
+
+module.exports = { createScreenCaptureController };