@saulwade/swl-ses 2.6.0 → 2.8.0

package/scripts/lib/plan-lock.js

@@ -10,11 +10,9 @@
  * la ejecución. Cierra el hueco "el plan puede mutar tras aprobación" que
  * dejaba SDD en ~60%.
  *
- * Cláusula de gracia D-05 (compatibilidad legacy): un PLAN con
- * `estado: aprobado` en su frontmatter pero SIN `.lock` correspondiente
- * (los planes creados antes de la Fase 09) se considera `modo: "legacy"` y
- * se ejecuta con advertencia, sin bloqueo. Solo los planes firmados vía
- * `/swl:aprobar-plan` (post-Fase 09) exigen coincidencia de hash.
+ * Desde 3.0.0, un PLAN aprobado sin lock bloquea. Los planes pre-Fase 09 sólo
+ * pueden convertirse mediante `migrar-gates-legacy`, que deja un lock v2 ligado
+ * a una approval firmada y a un evento de integridad anclado.
  *
  * MODELO DE AMENAZA (gate G1): el lock detecta MUTACIÓN ACCIDENTAL o no
  * aprobada del PLAN tras su firma, y planes alterados por un agente que
@@ -52,6 +50,8 @@ try {
 }
 
 const LOCK_VERSION = 1;
+const LOCK_KEYS = ['archivo', 'firmadoEn', 'firmadoPor', 'sha256', 'version'];
+const MIGRATED_LOCK_KEYS = [...LOCK_KEYS, 'migration'];
 
 // Basename válido de un PLAN de fase: `PLAN.md` o `0N-PLAN.md`. Evita que
 // `firmarPlan` produzca locks de archivos arbitrarios (falsearía el audit
@@ -70,6 +70,14 @@ function sha256(data) {
   return crypto.createHash('sha256').update(data).digest('hex');
 }
 
+function tieneClavesExactas(value, expected) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  return actual.length === wanted.length
+    && actual.every((key, index) => key === wanted[index]);
+}
+
 /**
  * Extrae el campo `estado:` del frontmatter YAML del PLAN.
  * Reutiliza el patrón CRLF-safe de scripts/generar-skills-lock.js:46-55.
@@ -161,6 +169,12 @@ function firmarPlan(planPath, opciones = {}) {
     };
   }
   const buffer = fs.readFileSync(planPath);
+  if (leerEstado(buffer.toString('utf8')) !== 'aprobado') {
+    return {
+      ok: false,
+      motivo: 'el PLAN debe tener estado aprobado antes de firmarse',
+    };
+  }
   const hash = sha256(buffer);
 
   const lock = {
@@ -180,9 +194,11 @@ function firmarPlan(planPath, opciones = {}) {
  *
  * Modos de retorno:
  *   - `firmado`     : existe lock y el hash coincide  -> ok: true
- *   - `legacy`      : NO existe lock pero estado:aprobado (gracia D-05) -> ok: true
+ *   - `legacy-bloqueado`: NO existe lock pero estado:aprobado -> ok: false
+ *   - `migrado`     : existe lock v2 de migración y el hash coincide -> ok: true
  *   - `mutado`      : existe lock y el hash NO coincide -> ok: false
  *   - `lock-corrupto`: el lock existe pero no es JSON válido -> ok: false
+ *   - `estado-invalido`: existe lock pero el PLAN no está aprobado -> ok: false
  *   - `sin-firmar`  : NO existe lock y estado != aprobado -> ok: false
  *   - `sin-planning`: el PLAN no tiene `.planning` ancestro -> ok: false
  *   - `no-existe`   : el PLAN no existe en disco -> ok: false
@@ -204,15 +220,14 @@ function verificarPlan(planPath) {
   }
   const buffer = fs.readFileSync(planPath);
   const hashActual = sha256(buffer);
+  const estado = leerEstado(buffer.toString('utf8'));
 
   if (!fs.existsSync(lockPath)) {
-    // Cláusula de gracia D-05: plan aprobado antes de que existiera el lock.
-    const estado = leerEstado(buffer.toString('utf8'));
     if (estado === 'aprobado') {
       return {
-        ok: true,
-        modo: 'legacy',
-        motivo: 'plan aprobado pre-Fase09 (sin lock); ejecutar con advertencia',
+        ok: false,
+        modo: 'legacy-bloqueado',
+        motivo: 'plan aprobado sin lock; requiere migración legacy explícita',
         hashActual,
         lockPath,
       };
@@ -226,6 +241,16 @@ function verificarPlan(planPath) {
     };
   }
 
+  if (estado !== 'aprobado') {
+    return {
+      ok: false,
+      modo: 'estado-invalido',
+      motivo: `un lock no aprueba el PLAN (estado: ${estado || 'ausente'})`,
+      hashActual,
+      lockPath,
+    };
+  }
+
   let lock;
   try {
     lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
@@ -240,7 +265,11 @@ function verificarPlan(planPath) {
   }
 
   const hashEsperado = lock && typeof lock.sha256 === 'string' ? lock.sha256 : null;
-  if (!hashEsperado) {
+  const expectedKeys = lock && lock.version === 2 ? MIGRATED_LOCK_KEYS : LOCK_KEYS;
+  const baseValida = tieneClavesExactas(lock, expectedKeys) && [1, 2].includes(lock.version)
+    && lock.archivo === path.basename(planPath)
+    && typeof lock.firmadoEn === 'string' && typeof lock.firmadoPor === 'string';
+  if (!hashEsperado || !baseValida) {
     return {
       ok: false,
       modo: 'lock-corrupto',
@@ -250,8 +279,27 @@ function verificarPlan(planPath) {
     };
   }
 
+  if (lock.version === 2) {
+    const migration = lock.migration;
+    const migrationValida = migration && typeof migration === 'object'
+      && Object.keys(migration).sort().join(',') === [
+        'approvalDigest', 'contextDigest', 'cutoff', 'eventHeadHash',
+        'eventSequence', 'migrationId',
+      ].sort().join(',')
+      && typeof migration.migrationId === 'string'
+      && /^[a-f0-9]{64}$/u.test(migration.approvalDigest)
+      && /^[a-f0-9]{64}$/u.test(migration.contextDigest)
+      && /^[a-f0-9]{64}$/u.test(migration.eventHeadHash)
+      && Number.isInteger(migration.eventSequence) && migration.eventSequence > 0
+      && migration.cutoff === '2027-01-15T00:00:00.000Z';
+    if (!migrationValida) {
+      return { ok: false, modo: 'lock-corrupto', motivo: 'lock migrado inválido', hashActual, lockPath };
+    }
+  }
+
   if (hashEsperado === hashActual) {
-    return { ok: true, modo: 'firmado', hashEsperado, hashActual, lockPath };
+    const modo = lock.version === 2 ? 'migrado' : 'firmado';
+    return { ok: true, modo, hashEsperado, hashActual, lockPath };
   }
 
   return {

package/scripts/lib/policy-broker.js

@@ -0,0 +1,338 @@
+'use strict';
+
+/** Autoriza efectos canónicos con default-deny dentro de una sola transacción. */
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { exactKeys, fail, freezeDeep, plainObject } = require('./policy-verifier-utils');
+const { canonicalizarIJson } = require('./signed-envelope');
+
+const APPROVAL_CAPABILITIES = new Set([
+  'delegate', 'filesystem.mutate', 'memory.write', 'network.access',
+  'shell.exec', 'skill.invoke',
+]);
+const EXPECTED_APPROVAL_ERRORS = new Set([
+  'APPROVAL_BINDING_INVALID', 'APPROVAL_EXPIRED', 'APPROVAL_INVALID',
+  'APPROVAL_TRUST_INVALID', 'PRINCIPAL_EXPIRED', 'PRINCIPAL_TRUST_INVALID',
+]);
+
+function sha256(value) {
+  return crypto.createHash('sha256').update(value).digest('hex');
+}
+
+function hitFault(point) {
+  if (process.env.SWL_SINGLE_USE_FAULT !== point) return;
+  if (process.env.NODE_ENV !== 'test' || process.env.SWL_INTEGRITY_TEST_MODE !== '1') {
+    fail('FAULT_CONFIG_INVALID', 'fault injection fuera del modo de pruebas');
+  }
+  fail('FAULT_INJECTED', `falla inyectada: ${point}`);
+}
+
+function safeOptions(options) {
+  if (options === undefined) return Object.freeze({ approval: null });
+  plainObject(options, 'POLICY_OPTIONS_INVALID', 'opciones de autorización');
+  exactKeys(options, ['approval'], 'POLICY_OPTIONS_INVALID', 'opciones de autorización');
+  return Object.freeze({ approval: options.approval });
+}
+
+function isInside(base, target, style) {
+  const module = style === 'win32' ? path.win32 : path.posix;
+  const relative = module.relative(base, target);
+  if (style === 'win32') {
+    const folded = relative.toLowerCase();
+    return folded === '' || (!folded.startsWith('..\\') && folded !== '..'
+      && !module.isAbsolute(relative));
+  }
+  return relative === '' || (!relative.startsWith('../') && relative !== '..');
+}
+
+function nativeStyle(workspaceRoot) {
+  return /^[A-Za-z]:\\/u.test(workspaceRoot) ? 'win32' : 'posix';
+}
+
+function assertSafeAncestors(workspaceRoot, target, style) {
+  const module = style === 'win32' ? path.win32 : path.posix;
+  const relative = module.relative(workspaceRoot, target);
+  let current = workspaceRoot;
+  for (const segment of relative.split(style === 'win32' ? '\\' : '/')) {
+    if (!segment) continue;
+    current = module.join(current, segment);
+    if (!fs.existsSync(current)) continue;
+    if (fs.lstatSync(current).isSymbolicLink()) {
+      fail('PATH_UNSAFE', 'ancestro simbólico o reparse no permitido');
+    }
+  }
+}
+
+function assertWorkspaceScope(operation, workspaceRoot) {
+  const style = nativeStyle(workspaceRoot);
+  if ((operation.effect.pathStyle && operation.effect.pathStyle !== style)
+      || !isInside(workspaceRoot, operation.cwd, style)) {
+    fail('PATH_OUTSIDE_WORKSPACE', 'cwd fuera del workspace');
+  }
+  assertSafeAncestors(workspaceRoot, operation.cwd, style);
+  if (operation.effect.kind !== 'filesystem') return;
+  if (!isInside(workspaceRoot, operation.effect.absolutePath, style)) {
+    fail('PATH_OUTSIDE_WORKSPACE', 'efecto fuera del workspace');
+  }
+  assertSafeAncestors(workspaceRoot, operation.effect.absolutePath, style);
+}
+
+function assertDirectProcess(effect) {
+  if (effect.kind !== 'process') return;
+  fail('SHELL_OPAQUE', 'process queda denegado hasta contar con adaptadores code-owned');
+}
+
+function policyMatchesContext(view, liveBundle) {
+  const context = view.context;
+  const globalDigest = sha256(canonicalizarIJson(liveBundle.globalPolicy));
+  return context.corpusDigest === liveBundle.corpusDigest
+    && context.policyVersion === liveBundle.policyVersion
+    && context.globalPolicyDigest === globalDigest
+    && view.bundle.corpusDigest === liveBundle.corpusDigest;
+}
+
+function assertCapability(view, liveBundle, operation) {
+  if (!view.context.allowedCapabilities.includes(operation.capability)) {
+    fail('CAPABILITY_DENIED', 'capability fuera de la intersección efectiva');
+  }
+  if (operation.effect.kind === 'skill'
+      && !view.context.allowedSkillNodeIds.includes(operation.effect.skillNodeId)) {
+    fail('SKILL_DENIED', 'skill fuera de la intersección efectiva');
+  }
+  if (operation.effect.kind !== 'delegation') return;
+  const capabilities = new Set(view.context.allowedCapabilities);
+  const target = liveBundle.policies.find(({ nodeId }) => (
+    nodeId === operation.effect.targetAgentNodeId
+  ));
+  if (!target || target.disposition !== 'allow'
+      || operation.effect.capabilities.some((item) => !capabilities.has(item))) {
+    fail('DELEGATION_DENIED', 'delegación fuera de policy');
+  }
+}
+
+function mapPolicyError(error) {
+  const mappings = {
+    CAPABILITY_DENIED: 'CAPABILITY_DENIED',
+    CONTEXT_BINDING_INVALID: 'CONTEXT_MISMATCH',
+    CONTEXT_EXPIRED: 'CONTEXT_INVALID',
+    CONTEXT_INVALID: 'CONTEXT_INVALID',
+    DELEGATION_DENIED: 'DELEGATION_DENIED',
+    GATE_G1_EXPIRED: 'GATE_NOT_SATISFIED',
+    GATE_NOT_SATISFIED: 'GATE_NOT_SATISFIED',
+    GATE_PHASE_UNKNOWN: 'GATE_PHASE_UNKNOWN',
+    GATE_TASK_UNKNOWN: 'GATE_NOT_SATISFIED',
+    GATE_VERSION_MISMATCH: 'GATE_VERSION_MISMATCH',
+    PATH_OUTSIDE_WORKSPACE: 'PATH_OUTSIDE_WORKSPACE',
+    PATH_UNSAFE: 'PATH_UNSAFE',
+    PLAN_DRIFT: 'GATE_NOT_SATISFIED',
+    SHELL_OPAQUE: 'SHELL_OPAQUE',
+    SKILL_DENIED: 'SKILL_DENIED',
+  };
+  return mappings[error?.codigo] || null;
+}
+
+function baseDecision(authority, operation, context, reasonCode) {
+  return {
+    kind: 'policy-enforcement-decision', schemaVersion: '1.0.0',
+    outcome: 'deny', reasonCodes: [reasonCode],
+    operationDigest: operation?.operationDigest || null,
+    contextDigest: context?.contextDigest || null,
+    gateAuthorizationDigest: null, approvalDigest: null, grantDigest: null,
+    evidenceDigest: null, timestamp: authority.observedAt,
+    expiresAt: authority.observedAt,
+  };
+}
+
+function finalizeDecision(base) {
+  const digest = sha256(canonicalizarIJson(base));
+  return freezeDeep({ ...base, decisionId: `decision:${digest}`, decisionDigest: digest });
+}
+
+function approvalMatchesGate(components, approval, operation, gate) {
+  if (!components.grantIssuer.isVerifiedApproval(approval)) return false;
+  return approval.schemaVersion === '1.2.0'
+    && approval.phaseId === operation.phaseId
+    && approval.taskId === operation.taskId
+    && approval.planDigest === gate.planDigest
+    && approval.g1ApprovalDigest === gate.g1ApprovalDigest;
+}
+
+function createAllowedBase(authority, operation, view, gate, approval) {
+  const expiresAt = [
+    view.context.expiresAt, gate.g1ExpiresAt, approval?.expiresAt,
+  ].filter(Boolean).sort()[0];
+  const evidence = {
+    contextDigest: view.context.contextDigest,
+    gateAuthorizationDigest: gate.gateAuthorizationDigest,
+    operationDigest: operation.operationDigest,
+  };
+  return {
+    ...baseDecision(authority, operation, view.context, 'ALLOWED'),
+    outcome: 'allow',
+    reasonCodes: [approval ? 'APPROVAL_ACCEPTED' : 'ALLOWED'],
+    gateAuthorizationDigest: gate.gateAuthorizationDigest,
+    approvalDigest: approval?.approvalDigest || null,
+    evidenceDigest: sha256(canonicalizarIJson(evidence)), expiresAt,
+  };
+}
+
+function decisionEntry(state, decision, approvalClaim, grant) {
+  return {
+    expectedSequence: state.sequence, expectedHeadHash: state.headHash,
+    eventType: 'authorization.committed',
+    payload: {
+      schemaVersion: '2.0.0', approvalClaim,
+      decision: structuredClone(decision), grant: grant ? structuredClone(grant) : null,
+    },
+  };
+}
+
+function deniedEvaluation(authority, operation, context, reason) {
+  const decision = finalizeDecision(baseDecision(authority, operation, context, reason));
+  return { approvalClaim: null, decision, grant: null };
+}
+
+function evaluatePrerequisites(components, state, authority, operation, context) {
+  let view;
+  try {
+    view = components.contextReader.read(context, authority);
+    if (view.principal.operationDigest !== operation.operationDigest
+        || view.context.phaseId !== operation.phaseId) {
+      fail('CONTEXT_BINDING_INVALID', 'contexto ligado a otra operación o fase');
+    }
+    const liveBundle = components.compileBundle();
+    if (!policyMatchesContext(view, liveBundle)) fail('POLICY_DRIFT', 'policy cambió');
+    assertWorkspaceScope(operation, components.workspaceRoot);
+    assertDirectProcess(operation.effect);
+    const gate = components.gateReader.read(state, authority, operation);
+    assertCapability(view, liveBundle, operation);
+    return { gate, view };
+  } catch (error) {
+    const reason = error?.codigo === 'POLICY_DRIFT' ? 'POLICY_DRIFT' : mapPolicyError(error);
+    if (!reason) throw error;
+    return { denied: deniedEvaluation(
+      authority, operation, view?.context || null, reason
+    ) };
+  }
+}
+
+function issueGrant(components, state, authority, operation, view, approval) {
+  try {
+    return { issued: components.grantIssuer.issueApprovalGrant(state, authority, {
+      approval, principal: view.principal, operation,
+    }) };
+  } catch (error) {
+    if (error?.codigo !== 'APPROVAL_ALREADY_USED'
+        && !EXPECTED_APPROVAL_ERRORS.has(error?.codigo)) throw error;
+    const reason = error.codigo === 'APPROVAL_ALREADY_USED'
+      ? 'APPROVAL_USED' : 'APPROVAL_INVALID';
+    return { denied: deniedEvaluation(authority, operation, view.context, reason) };
+  }
+}
+
+function issueDirectGrant(components, state, authority, operation, prerequisites) {
+  const expiresAt = [
+    prerequisites.view.context.expiresAt, prerequisites.gate.g1ExpiresAt,
+  ].sort()[0];
+  return components.grantIssuer.issuePolicyGrant(state, authority, {
+    expiresAt, gate: prerequisites.gate,
+    principal: prerequisites.view.principal, operation,
+  });
+}
+
+function evaluateApproval(components, state, authority, operation, approval, prerequisites) {
+  const { gate, view } = prerequisites;
+  if (APPROVAL_CAPABILITIES.has(operation.capability) && !approval) {
+    const base = baseDecision(authority, operation, view.context, 'APPROVAL_REQUIRED');
+    return { decision: finalizeDecision({
+      ...base, outcome: 'require_approval',
+      gateAuthorizationDigest: gate.gateAuthorizationDigest,
+    }), grant: null, approvalClaim: null };
+  }
+  if (approval && !approvalMatchesGate(components, approval, operation, gate)) {
+    return deniedEvaluation(authority, operation, view.context, 'APPROVAL_STALE');
+  }
+  const result = approval
+    ? issueGrant(components, state, authority, operation, view, approval)
+    : { issued: { approvalClaim: null, grant: issueDirectGrant(
+      components, state, authority, operation, prerequisites
+    ) } };
+  if (result.denied) return result.denied;
+  const { issued } = result;
+  hitFault('after-approval-claim-before-decision');
+  const allowed = createAllowedBase(authority, operation, view, gate, approval);
+  const grantDigest = issued.grant.grantDigest;
+  const decision = finalizeDecision({ ...allowed, grantDigest });
+  hitFault('after-decision-before-grant');
+  return {
+    decision,
+    grant: issued.grant,
+    approvalClaim: issued.approvalClaim,
+  };
+}
+
+function evaluateLocked(components, state, authority, operation, context, approval) {
+  if (!components.isVerifiedOperation(operation)) {
+    return deniedEvaluation(authority, null, null, 'OPERATION_INVALID');
+  }
+  if (operation.schemaVersion !== '1.1.0') {
+    return deniedEvaluation(authority, operation, null, 'OPERATION_SCOPE_UNVERIFIABLE');
+  }
+  const prerequisites = evaluatePrerequisites(
+    components, state, authority, operation, context
+  );
+  if (prerequisites.denied) return prerequisites.denied;
+  return evaluateApproval(
+    components, state, authority, operation, approval, prerequisites
+  );
+}
+
+function createReceipt(decision, grant, appendReceipt, decisions) {
+  const receipt = freezeDeep({
+    ...structuredClone(decision), authorizationGrant: grant,
+    sequence: appendReceipt.sequence, headHash: appendReceipt.headHash,
+  });
+  decisions.add(receipt);
+  return receipt;
+}
+
+function authorize(components, decisions, operation, context, options) {
+  const { approval } = safeOptions(options);
+  let evaluated;
+  let appendReceipt;
+  try {
+    appendReceipt = components.writer.transact((state, authority) => {
+      evaluated = evaluateLocked(
+        components, state, authority, operation, context, approval
+      );
+      return decisionEntry(
+        state, evaluated.decision, evaluated.approvalClaim, evaluated.grant
+      );
+    });
+  } catch (cause) {
+    const error = new Error('autorización no pudo persistirse de forma atómica', { cause });
+    error.codigo = 'POLICY_AUTHORIZATION_FAILED';
+    throw error;
+  }
+  return createReceipt(evaluated.decision, evaluated.grant, appendReceipt, decisions);
+}
+
+function createPolicyBroker(components) {
+  plainObject(components, 'POLICY_BROKER_INVALID', 'componentes del broker');
+  exactKeys(components, [
+    'compileBundle', 'contextReader', 'gateReader', 'grantIssuer',
+    'isVerifiedOperation', 'workspaceRoot', 'writer',
+  ], 'POLICY_BROKER_INVALID', 'componentes del broker');
+  const decisions = new WeakSet();
+  return Object.freeze({
+    authorize: (operation, context, options) => (
+      authorize(components, decisions, operation, context, options)
+    ),
+    isPolicyDecision: (value) => decisions.has(value),
+  });
+}
+
+module.exports = { createPolicyBroker };