@safetnsr/vet 1.3.0 → 1.4.0

package/dist/checks/permissions.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkPermissions(cwd: string): CheckResult;

package/dist/checks/permissions.js

@@ -0,0 +1,248 @@
+import { join, resolve, isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
+import { readFile, fileExists } from '../util.js';
+// ── Sensitive directories that trigger DANGER if MCP server writes there ──
+const SENSITIVE_DIRS = [
+    '~/.ssh',
+    '~/.aws',
+    '/etc',
+    '/var/www',
+];
+function expandHome(p) {
+    if (p.startsWith('~/'))
+        return join(homedir(), p.slice(2));
+    if (p === '~')
+        return homedir();
+    return p;
+}
+function isSensitiveDir(p) {
+    const expanded = expandHome(p);
+    return SENSITIVE_DIRS.some(d => {
+        const expandedSensitive = expandHome(d);
+        return expanded === expandedSensitive || expanded.startsWith(expandedSensitive + '/');
+    });
+}
+function isOutsideCwd(p, cwd) {
+    const expanded = expandHome(p);
+    const abs = isAbsolute(expanded) ? expanded : resolve(cwd, expanded);
+    const resolvedCwd = resolve(cwd);
+    return !abs.startsWith(resolvedCwd + '/') && abs !== resolvedCwd;
+}
+/** Score helper */
+function applyPenalty(score, severity) {
+    const penalties = { error: 30, warning: 15, info: 5 };
+    return Math.max(0, score - penalties[severity]);
+}
+// ── A. Scan .claude/settings.json ─────────────────────────────────────────
+function checkSettingsJson(cwd, issues) {
+    const settingsPath = join(cwd, '.claude', 'settings.json');
+    if (!fileExists(settingsPath))
+        return;
+    const raw = readFile(settingsPath);
+    if (!raw)
+        return;
+    let settings;
+    try {
+        settings = JSON.parse(raw);
+    }
+    catch {
+        issues.push({
+            severity: 'warning',
+            message: '.claude/settings.json is not valid JSON — cannot audit permissions',
+            file: '.claude/settings.json',
+            fixable: false,
+        });
+        return;
+    }
+    // allowedTools containing bare "Bash" or "Bash(*)"
+    const allowedTools = settings.allowedTools;
+    if (Array.isArray(allowedTools)) {
+        for (const tool of allowedTools) {
+            if (typeof tool === 'string') {
+                if (tool === 'Bash' || tool === 'Bash(*)') {
+                    issues.push({
+                        severity: 'error',
+                        message: `allowedTools contains "${tool}" without path restrictions — unrestricted shell access`,
+                        file: '.claude/settings.json',
+                        fixable: true,
+                        fixHint: `Replace "${tool}" with specific allowed commands, e.g. "Bash(npm run *)"`,
+                    });
+                }
+            }
+        }
+    }
+    // permissions.allow with wildcards
+    const permissions = settings.permissions;
+    if (permissions && Array.isArray(permissions.allow)) {
+        for (const rule of permissions.allow) {
+            if (typeof rule === 'string' && (rule === 'Bash(*)' || rule === '**' || rule.includes('**'))) {
+                issues.push({
+                    severity: 'error',
+                    message: `permissions.allow contains wildcard "${rule}" — grants broad access`,
+                    file: '.claude/settings.json',
+                    fixable: true,
+                    fixHint: 'Remove wildcard rules and enumerate specific allowed operations',
+                });
+            }
+        }
+    }
+    // defaultMode: "bypassPermissions"
+    if (settings.defaultMode === 'bypassPermissions') {
+        issues.push({
+            severity: 'error',
+            message: 'defaultMode is "bypassPermissions" — skips all permission checks',
+            file: '.claude/settings.json',
+            fixable: true,
+            fixHint: 'Remove defaultMode or set to "default"',
+        });
+    }
+    // No blockedTools or deny list
+    const hasBlockedTools = Array.isArray(settings.blockedTools) && settings.blockedTools.length > 0;
+    const hasDenyList = permissions && Array.isArray(permissions.deny) && permissions.deny.length > 0;
+    if (!hasBlockedTools && !hasDenyList) {
+        issues.push({
+            severity: 'warning',
+            message: 'No blockedTools or deny list defined — all unlisted tools remain available',
+            file: '.claude/settings.json',
+            fixable: true,
+            fixHint: 'Add blockedTools: ["Bash", "Write"] to restrict dangerous operations',
+        });
+    }
+    // ── B. MCP server configs ────────────────────────────────────────────────
+    checkMcpServers(cwd, settings, '.claude/settings.json', issues);
+}
+// ── B. MCP server analysis ─────────────────────────────────────────────────
+function checkMcpServers(cwd, settings, filePath, issues) {
+    const mcpServers = settings.mcpServers;
+    if (!mcpServers || typeof mcpServers !== 'object')
+        return;
+    for (const [serverName, serverConfig] of Object.entries(mcpServers)) {
+        if (typeof serverConfig !== 'object' || serverConfig === null)
+            continue;
+        const config = serverConfig;
+        // Check server args for filesystem paths
+        const args = config.args;
+        const isFilesystemServer = (typeof config.command === 'string' && config.command.includes('filesystem')) ||
+            (Array.isArray(args) && args.some((a) => typeof a === 'string' && a.includes('filesystem')));
+        // Detect if server is read-only
+        const isReadOnly = Array.isArray(args) && args.some((a) => typeof a === 'string' && (a === '--read-only' || a === 'readonly' || a === '--readonly'));
+        // Collect root paths from args
+        const rootPaths = [];
+        if (Array.isArray(args)) {
+            for (const arg of args) {
+                if (typeof arg === 'string' && !arg.startsWith('-') && (arg.startsWith('/') || arg.startsWith('~/') || arg.startsWith('.'))) {
+                    rootPaths.push(arg);
+                }
+            }
+        }
+        // Also check explicit root config
+        if (typeof config.root === 'string') {
+            rootPaths.push(config.root);
+        }
+        if (Array.isArray(config.roots)) {
+            for (const r of config.roots) {
+                if (typeof r === 'string')
+                    rootPaths.push(r);
+            }
+        }
+        if (rootPaths.length === 0) {
+            // No path restrictions at all
+            issues.push({
+                severity: 'warning',
+                message: `MCP server "${serverName}" has no explicit path restrictions`,
+                file: filePath,
+                fixable: true,
+                fixHint: `Add root path restriction to "${serverName}" in mcpServers config`,
+            });
+            continue;
+        }
+        for (const rootPath of rootPaths) {
+            // Check sensitive directory access
+            if (isSensitiveDir(rootPath)) {
+                issues.push({
+                    severity: 'error',
+                    message: `MCP server "${serverName}" has access to sensitive directory: ${rootPath}`,
+                    file: filePath,
+                    fixable: true,
+                    fixHint: `Remove sensitive path "${rootPath}" from MCP server config`,
+                });
+                continue;
+            }
+            // Check if root is outside cwd and not read-only
+            if (isOutsideCwd(rootPath, cwd) && !isReadOnly) {
+                issues.push({
+                    severity: 'error',
+                    message: `MCP server "${serverName}" has write access outside project dir: ${rootPath}`,
+                    file: filePath,
+                    fixable: true,
+                    fixHint: `Restrict to project directory or add --read-only flag`,
+                });
+            }
+        }
+    }
+}
+// ── C. CLAUDE.md and AGENTS.md text heuristics ────────────────────────────
+const DANGEROUS_PHRASES = [
+    /full\s+access/i,
+    /unrestricted/i,
+    /\bsudo\b/i,
+    /skip\s+confirmation/i,
+    /no\s+restrictions/i,
+];
+function checkMarkdownFiles(cwd, issues) {
+    for (const filename of ['CLAUDE.md', 'AGENTS.md']) {
+        const filePath = join(cwd, filename);
+        if (!fileExists(filePath))
+            continue;
+        const content = readFile(filePath);
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        for (const pattern of DANGEROUS_PHRASES) {
+            for (let i = 0; i < lines.length; i++) {
+                if (pattern.test(lines[i])) {
+                    const matchText = lines[i].match(pattern)?.[0] ?? pattern.source;
+                    issues.push({
+                        severity: 'warning',
+                        message: `${filename} contains potentially dangerous instruction: "${matchText.trim()}"`,
+                        file: filename,
+                        line: i + 1,
+                        fixable: false,
+                        fixHint: `Review line ${i + 1} in ${filename} — ensure it doesn't grant unintended permissions`,
+                    });
+                    break; // one issue per pattern per file
+                }
+            }
+        }
+    }
+}
+// ── Main export ────────────────────────────────────────────────────────────
+export function checkPermissions(cwd) {
+    const issues = [];
+    checkSettingsJson(cwd, issues);
+    checkMarkdownFiles(cwd, issues);
+    // Score: start at 100, deduct per issue
+    let score = 100;
+    for (const issue of issues) {
+        score = applyPenalty(score, issue.severity);
+    }
+    const errorCount = issues.filter(i => i.severity === 'error').length;
+    const warnCount = issues.filter(i => i.severity === 'warning').length;
+    let summary;
+    if (issues.length === 0) {
+        summary = 'no dangerous permission grants detected';
+    }
+    else if (errorCount > 0) {
+        summary = `${errorCount} dangerous grant${errorCount !== 1 ? 's' : ''} detected — review before running agent`;
+    }
+    else {
+        summary = `${warnCount} permission warning${warnCount !== 1 ? 's' : ''} — tighten config before agent session`;
+    }
+    return {
+        name: 'permissions',
+        score,
+        maxScore: 100,
+        issues,
+        summary,
+    };
+}

package/dist/cli.js

@@ -18,6 +18,7 @@ import { checkMemory } from './checks/memory.js';
 import { checkVerify } from './checks/verify.js';
 import { checkTests } from './checks/tests.js';
 import { checkMap, renderMapReport } from './checks/map.js';
+import { checkPermissions } from './checks/permissions.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON, reportBadge } from './reporter.js';
 const args = process.argv.slice(2);
@@ -49,6 +50,7 @@ if (flags.has('--help') || flags.has('-h')) {
     npx @safetnsr/vet init               generate configs + hooks
     npx @safetnsr/vet receipt            show last agent session receipt
     npx @safetnsr/vet map [dir]          show agent visibility map
+    npx @safetnsr/vet permissions [dir]  audit Claude Code config for dangerous grants
 
   ${c.dim}categories:${c.reset}
     security   (30%)  scan, secrets, config, model usage
@@ -83,7 +85,7 @@ if (flags.has('--version') || flags.has('-v')) {
     }
     process.exit(0);
 }
-const COMMANDS = ['init', 'receipt', 'map'];
+const COMMANDS = ['init', 'receipt', 'map', 'permissions'];
 const command = COMMANDS.includes(positional[0]) ? positional[0] : undefined;
 const cwd = resolve(positional.find(p => !COMMANDS.includes(p)) || '.');
 const isCI = flags.has('--ci');
@@ -123,6 +125,30 @@ if (command === 'map') {
     }
     process.exit(0);
 }
+if (command === 'permissions') {
+    const result = checkPermissions(cwd);
+    if (isJSON) {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        console.log(`\n  ${c.bold}vet permissions${c.reset} — ${result.summary}\n`);
+        console.log(`  score: ${result.score}/100\n`);
+        if (result.issues.length === 0) {
+            console.log(`  ${c.green}no issues found${c.reset}\n`);
+        }
+        else {
+            for (const issue of result.issues) {
+                const icon = issue.severity === 'error' ? c.red + '✗' : issue.severity === 'warning' ? c.yellow + '⚠' : c.dim + 'i';
+                const loc = issue.file ? ` ${c.dim}(${issue.file}${issue.line ? `:${issue.line}` : ''})${c.reset}` : '';
+                console.log(`  ${icon}${c.reset} ${issue.message}${loc}`);
+                if (issue.fixHint)
+                    console.log(`    ${c.dim}→ ${issue.fixHint}${c.reset}`);
+            }
+            console.log('');
+        }
+    }
+    process.exit(result.score < 60 ? 1 : 0);
+}
 if (!isGitRepo(cwd)) {
     console.error(`${c.red}not a git repository${c.reset}. vet operates on git repos.`);
     process.exit(1);
@@ -145,7 +171,7 @@ if (isFix) {
 }
 async function runChecks() {
     // Run all checks, grouped into categories
-    // Security: scan, secrets, config, models, owasp
+    // Security: scan, secrets, config, models, owasp, permissions
     const [scanResult, secretsResult, configResult, modelsResult, owaspResult] = await Promise.all([
         Promise.resolve(checkScan(cwd)),
         checkSecrets(cwd),
@@ -153,6 +179,7 @@ async function runChecks() {
         checkModels(cwd, ignore),
         Promise.resolve(checkOwasp(cwd)),
     ]);
+    const permissionsResult = checkPermissions(cwd);
     // Integrity: diff, integrity checks
     const diffResult = checkDiff(cwd, { since });
     const integrityResult = await checkIntegrity(cwd, ignore);
@@ -173,7 +200,7 @@ async function runChecks() {
     // Tests: test theater detection
     const testsResult = checkTests(cwd, ignore);
     return score(cwd, {
-        security: [scanResult, secretsResult, configResult, modelsResult, owaspResult],
+        security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult],
         integrity: [diffResult, integrityResult, receiptResult, memoryResult, verifyResult, testsResult],
         debt: [readyResult, historyResult, debtResult],
         deps: [depsResult],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {