@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/skill-security-scan/scripts/lib.sh

@@ -0,0 +1,197 @@
+#!/usr/bin/env bash
+# Shared helpers for skill-security-scan check-*.sh scripts.
+#
+# Usage from caller:
+#   SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+#   . "$SCRIPT_DIR/lib.sh"
+
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Verdict aggregation
+#
+# `aggregate_verdict <severity1> [<severity2> ...]` echoes the max severity
+# across the inputs. Empty input → LOW-RISK.
+#
+# Order: HIGH-RISK > REVIEW > LOW-RISK. WARN is finding-level metadata only;
+# at script level it should be passed in as REVIEW (per plan Phase 3 WARN-tier
+# semantics).
+# ---------------------------------------------------------------------------
+aggregate_verdict() {
+  local v="LOW-RISK"
+  local s
+  for s in "$@"; do
+    case "$s" in
+      HIGH-RISK) echo "HIGH-RISK"; return 0 ;;
+      REVIEW)    v="REVIEW" ;;
+      LOW-RISK)  : ;;
+      *)         : ;;  # ignore unknown
+    esac
+  done
+  echo "$v"
+}
+
+# ---------------------------------------------------------------------------
+# Emit a category result as JSON. Invoked at end of every check-*.sh.
+#
+# Usage: emit_result <verdict> <category> <findings_json_array>
+#   - verdict: LOW-RISK | REVIEW | HIGH-RISK
+#   - category: code-execution | prompt-injection | supply-chain |
+#               filesystem-boundary | telemetry-surface
+#   - findings_json_array: a JSON array string (use build_findings to assemble)
+# ---------------------------------------------------------------------------
+#
+# ARGV CEILING (#6736). The findings array arrives here as a shell variable and is
+# fed to jq on STDIN, never as an `--argjson` argument. `--argjson f "$findings_json"`
+# makes the whole array ONE argv argument, and the kernel caps a SINGLE argv argument
+# at MAX_ARG_STRLEN = 131,072 B — verified by bisect on this host: 131,071 B passes,
+# 131,072 B fails E2BIG. This is NOT `getconf ARG_MAX` (2,097,152 B, the argv+envp
+# total); a payload at 6% of ARG_MAX still dies.
+#
+# This is the only genuinely UNBOUNDED site in the scanner. `apply_yaml_rules` caps
+# each snippet at 200 chars, but nothing caps the FINDING COUNT: one grep hit per
+# matching line, over a file of any length. At ~265 B/finding the ceiling lands at
+# ~490 findings — and this repo already carries a 220,523 B SKILL.md.
+#
+# The failure was SILENT, which is why it is worth a comment: run-scan.sh invokes each
+# category as `bash check-*.sh … || echo '{"…check-failed…"}'`, so an E2BIG here is
+# swallowed into a "category script error" placeholder and the scan reports a REVIEW
+# verdict with ZERO real findings instead of the hundreds it actually found.
+#
+# A pipe has no size limit and streams, so this needs no spool file and no cleanup
+# trap (unlike the --rawfile form used in run-scan.sh, which already owns a tmpdir).
+emit_result() {
+  local verdict="$1" category="$2" findings_json="$3"
+  printf '%s' "$findings_json" | jq -c \
+    --arg v "$verdict" \
+    --arg c "$category" \
+    '{verdict: $v, category: $c, findings: .}'
+}
+
+# ---------------------------------------------------------------------------
+# Build a findings JSON array from a series of finding lines on stdin.
+#
+# Stdin format (one finding per line, tab-separated):
+#   <rule_id>\t<severity>\t<line>\t<snippet>
+# Output: JSON array suitable for emit_result.
+# ---------------------------------------------------------------------------
+build_findings_array() {
+  jq -Rsn '
+    [inputs | split("\n") | .[] | select(length > 0) |
+      split("\t") |
+      {rule_id: .[0], severity: .[1], line: (.[2]|tonumber? // 0), snippet: .[3]}]
+  '
+}
+
+# ---------------------------------------------------------------------------
+# Apply a single YAML rule pack against input content.
+#
+# Args:
+#   $1 - path to YAML rule file
+#   $2 - path to input content file (NOT stdin; needs random access)
+#
+# Output (stdout): tab-separated finding lines: rule_id\tseverity\tline\tsnippet
+#
+# Rules are extracted by line: each rule starts with `  - id: <name>` and is
+# followed by `severity:` and `regex:` lines. We use a tiny awk parser rather
+# than yq to keep the toolchain dependency-free (plan TR1).
+# ---------------------------------------------------------------------------
+apply_yaml_rules() {
+  local yaml_file="$1"
+  local content_file="$2"
+
+  awk '
+    /^[[:space:]]*-[[:space:]]*id:/ {
+      gsub(/^[[:space:]]*-[[:space:]]*id:[[:space:]]*/, "")
+      gsub(/[[:space:]]*$/, "")
+      id = $0
+      next
+    }
+    /^[[:space:]]+severity:/ {
+      gsub(/^[[:space:]]+severity:[[:space:]]*/, "")
+      gsub(/[[:space:]]*$/, "")
+      sev = $0
+      next
+    }
+    /^[[:space:]]+regex:/ {
+      # Strip "    regex: " prefix; strip surrounding single quotes if present.
+      sub(/^[[:space:]]+regex:[[:space:]]*/, "")
+      sub(/^['"'"']/, "")
+      sub(/['"'"']$/, "")
+      print id "\t" sev "\t" $0
+    }
+  ' "$yaml_file" | while IFS=$'\t' read -r rule_id severity regex; do
+    # Skip rule emission if any field is empty (defensive).
+    [ -z "$rule_id" ] && continue
+    [ -z "$severity" ] && continue
+    [ -z "$regex" ] && continue
+    # grep -nE: match line numbers + extended regex. Suppress errors (some
+    # patterns may not match anywhere). cap match snippet to 200 chars.
+    grep -nE -- "$regex" "$content_file" 2>/dev/null | while IFS=':' read -r line rest; do
+      snippet="${rest:0:200}"
+      # Replace tabs in snippet with spaces so output stays tab-delimited.
+      snippet="${snippet//$'\t'/ }"
+      printf '%s\t%s\t%s\t%s\n' "$rule_id" "$severity" "$line" "$snippet"
+    done
+  done
+}
+
+# ---------------------------------------------------------------------------
+# Read stdin into a temporary file. Echoes the path on stdout.
+# Caller is responsible for cleanup via trap.
+# ---------------------------------------------------------------------------
+stdin_to_tempfile() {
+  local tmp
+  # lint-trap-ownership: ok — sourced library; caller owns cleanup by contract
+  # (every check-*.sh caller registers `trap 'rm -f "$tmp"…' EXIT`), and an
+  # EXIT trap here would fire before the caller reads the file (#10017 census).
+  tmp="$(mktemp -t skill-scan-XXXXXX)"
+  cat > "$tmp"
+  echo "$tmp"
+}
+
+# ---------------------------------------------------------------------------
+# Compute aggregated severity from tab-separated finding lines on stdin.
+# Echoes a single LOW-RISK | REVIEW | HIGH-RISK to stdout.
+# ---------------------------------------------------------------------------
+findings_to_verdict() {
+  awk -F'\t' '
+    { sev[$2]++ }
+    END {
+      if (sev["HIGH-RISK"] > 0) print "HIGH-RISK"
+      else if (sev["REVIEW"] > 0) print "REVIEW"
+      else print "LOW-RISK"
+    }
+  '
+}
+
+# ---------------------------------------------------------------------------
+# yaml_list <file> <key> — emit the contents of a top-level YAML list section.
+#
+# Recognizes block-style lists only:
+#
+#   <key>:
+#     - <value1>
+#     - <value2>
+#
+# Section terminates at the next top-level key (line beginning with [a-zA-Z_]).
+# Inline `# comment` suffixes are stripped. Surrounding single/double quotes
+# stripped. Lines whose value resolves to empty after stripping are skipped.
+#
+# Does NOT mutate $0 (avoids the pattern-3 reset bug where gsub-mutated
+# values match subsequent predicates).
+# ---------------------------------------------------------------------------
+yaml_list() {
+  local file="$1" key="$2"
+  awk -v key="$key" '
+    $0 ~ "^"key":[[:space:]]*$" { in_sec = 1; next }
+    /^[a-zA-Z_]/ { in_sec = 0 }
+    in_sec && /^[[:space:]]*-[[:space:]]/ {
+      val = $0
+      sub(/^[[:space:]]*-[[:space:]]*/, "", val)
+      sub(/[[:space:]]*#.*$/, "", val)
+      sub(/^["'"'"']/, "", val); sub(/["'"'"']$/, "", val)
+      if (val != "") print val
+    }
+  ' "$file"
+}

package/skills/skill-security-scan/scripts/parse-override.sh

@@ -0,0 +1,231 @@
+#!/usr/bin/env bash
+# parse-override.sh — detect and validate skill-security override artifacts.
+#
+# Scans `git diff <base>...<head> --diff-filter=A` for newly-added files
+# matching `^knowledge-base/engineering/security/skill-overrides/\d{4}-\d{2}-\d{2}-.+\.md$`,
+# validates each artifact's frontmatter against override-artifact-schema.json,
+# checks rule_pack_sha256 freshness against current manifest, validates the
+# slug regex.
+#
+# Stdout: JSON {matched, invalid_schema, stale_findings}.
+# Exit 0 if all matched artifacts validate; exit 1 otherwise.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+MANIFEST="$SKILL_DIR/references/rules/manifest.yaml"
+SCHEMA="$SKILL_DIR/references/override-artifact-schema.json"
+
+BASE="main"
+HEAD="HEAD"
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --base) BASE="$2"; shift 2 ;;
+    --head) HEAD="$2"; shift 2 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+# Path regex: YYYY-MM-DD-<slug>.md under the override directory.
+path_re='^knowledge-base/engineering/security/skill-overrides/[0-9]{4}-[0-9]{2}-[0-9]{2}-[a-z][a-z0-9-]*\.md$'
+slug_re='^[a-z][a-z0-9-]*$'
+
+# Compute current manifest SHA for freshness check.
+current_manifest_sha="$(sha256sum "$MANIFEST" 2>/dev/null | cut -d' ' -f1 || echo "")"
+
+matched='[]'
+invalid='[]'
+stale='[]'
+
+# Enumerate added files in the diff.
+if ! mapfile -t added < <(git diff "$BASE...$HEAD" --name-only --diff-filter=A 2>/dev/null); then
+  added=()
+fi
+
+for path in "${added[@]}"; do
+  [ -z "$path" ] && continue
+  if ! [[ "$path" =~ $path_re ]]; then
+    continue
+  fi
+  # Extract slug from filename (date-prefix stripped).
+  base="$(basename "$path" .md)"
+  slug="${base#????-??-??-}"
+  if ! [[ "$slug" =~ $slug_re ]]; then
+    invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "slug regex violation" '. + [{path: $p, reason: $r}]')"
+    continue
+  fi
+
+  # Read frontmatter (between leading --- and second ---).
+  if [ ! -f "$path" ]; then
+    invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "file not found in working tree" '. + [{path: $p, reason: $r}]')"
+    continue
+  fi
+  fm="$(awk '
+    BEGIN { phase = "pre" }
+    phase == "pre" && /^---[[:space:]]*$/ { phase = "fm"; next }
+    phase == "fm"  && /^---[[:space:]]*$/ { phase = "done"; exit }
+    phase == "fm"  { print }
+  ' "$path")"
+
+  required_fields=(skill source findings_json justification approver scanner_version rule_pack_sha256 verdict timestamp)
+  # Presence is TWO-ARMED (#10167, decision-challenges.md `#10167` ruling row,
+  # CTO): a `^f:` top-level key counts present iff (a) non-whitespace, non-null
+  # content follows the colon on the same line — `f: v`, `f: {}`, `f: |` — OR
+  # (b) a following INDENTED (whitespace-led) line carries content before the
+  # block ends — the block-mapping spelling the schema's `oneOf string|object`
+  # admits for findings_json. Rejects: `f:` bare, `f:   ` (whitespace-only —
+  # the CTO dissent; the pre-#10167 grep accepted it), `f: null`/`f: ~`
+  # (a YAML null is not present for a required field), and `f:value` — with
+  # no separation space YAML reads the whole line as a plain SCALAR, not a
+  # mapping entry, so the key arm requires `:` followed by whitespace or EOL.
+  # The block ends at the next recognized key line OR any other column-0
+  # content line (`other :`, `"q":`, `9x:`, `- item`, `...`) — an indented
+  # stray under a construct this gate does not parse cannot back-fill the
+  # pending key. `^`-anchored matching keeps a nested same-named key from
+  # false-presenting; comment and blank lines are neutral — they neither
+  # satisfy presence nor close the block. A repeated key RECOMPUTES rather
+  # than latching (YAML last-wins): `f: v` then `f:` reports missing. Scope:
+  # presence, not type — `f: []`/`f: 5` count present and remain the schema
+  # validator's problem — this gate checks presence only; value type is
+  # unenforced for the three fields with no downstream check (findings_json,
+  # source, justification). Quoted keys (`'f':`), `f : v`, and tab-separated
+  # `f:\tv` are spellings this gate does not recognize — they report missing
+  # (deny-direction by design); the key arm's ` ` (not [[:space:]]) and the
+  # block arm's leading-space requirement deny tab indentation, which YAML
+  # forbids (CRLF is normalized first — `\r` is stripped before matching, so a
+  # CRLF-authored block map still reads as a key + indented block). Duplicate
+  # keys resolve last-wins here AND in the value extractors below — presence
+  # and extraction must read the same occurrence, or the gate and the artifact
+  # disagree about which value was validated (ship advisor finding).
+  missing="$(printf '%s\n' "$fm" | awk -v fields="${required_fields[*]}" '
+    BEGIN { n = split(fields, req, " ") }
+    { sub(/\r$/, "") }
+    /^[A-Za-z_][A-Za-z0-9_-]*:( |$)/ {
+      key = $0; sub(/:.*/, "", key)
+      cur = key; seen[key] = 1
+      content[key] = 0
+      rest = $0; sub(/^[^:]*:[[:space:]]*/, "", rest)
+      if (rest !~ /^[[:space:]]*$/ && rest !~ /^[[:space:]]*#/ &&
+          rest !~ /^(null|Null|NULL|~)([[:space:]]|$)/) content[key] = 1
+      next
+    }
+    /^ +[^[:space:]#]/ {
+      if (cur != "") content[cur] = 1
+      next
+    }
+    /^[^[:space:]#]/ { cur = "" }
+    END {
+      out = ""
+      for (i = 1; i <= n; i++) {
+        f = req[i]
+        if (!(f in seen) || !content[f]) out = out f " "
+      }
+      printf "%s", out
+    }
+  ')"
+  if [ -n "$missing" ]; then
+    invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "missing fields: ${missing}" '. + [{path: $p, reason: $r}]')"
+    continue
+  fi
+
+  # Verdict must be HIGH-RISK or REVIEW.
+  # Last-wins, whole-rest-of-line: a `-F:` field read truncates `verdict:
+  # HIGH-RISK:junk` at the embedded colon and validates the prefix, and a
+  # first-match read diverges from presence's last-wins — both fail open.
+  verdict="$(echo "$fm" | awk '/^verdict:/ { v = $0 } END { sub(/^verdict:[[:space:]]*/, "", v); gsub(/"|'"'"'/, "", v); gsub(/^[[:space:]]+|[[:space:]]+$/, "", v); print v }')"
+  case "$verdict" in
+    HIGH-RISK|REVIEW) ;;
+    *)
+      invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "verdict must be HIGH-RISK or REVIEW (got: $verdict)" '. + [{path: $p, reason: $r}]')"
+      continue
+      ;;
+  esac
+
+  # Schema enforcement: approver must be email-shaped, scanner_version semver,
+  # timestamp ISO-8601 (data-integrity review F1). The JSON schema declares
+  # these `format:` constraints but no validator ran — enforce them here.
+  field_value() {
+    echo "$fm" | awk -v fld="$1" '
+      $0 ~ "^"fld":" { v = $0 }
+      END {
+        # Capture everything after the first colon (preserve embedded :),
+        # last occurrence wins — presence resolved last-wins.
+        sub("^"fld":[[:space:]]*", "", v)
+        gsub(/^["'"'"']|["'"'"']$/, "", v)
+        gsub(/^[[:space:]]+|[[:space:]]+$/, "", v)
+        print v
+      }'
+  }
+  approver="$(field_value approver)"
+  scanner_version="$(field_value scanner_version)"
+  timestamp="$(field_value timestamp)"
+  if ! [[ "$approver" =~ ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ ]]; then
+    invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "approver must be email-shaped (got: $approver)" '. + [{path: $p, reason: $r}]')"
+    continue
+  fi
+  if ! [[ "$scanner_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "scanner_version must be semver (got: $scanner_version)" '. + [{path: $p, reason: $r}]')"
+    continue
+  fi
+  if ! [[ "$timestamp" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(Z|[+-][0-9]{2}:?[0-9]{2})$ ]]; then
+    invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "timestamp must be ISO-8601 (got: $timestamp)" '. + [{path: $p, reason: $r}]')"
+    continue
+  fi
+
+  # PII guard (data-integrity F3): reject artifacts whose frontmatter or body
+  # contain a raw email pattern OUTSIDE the approver field (PR author
+  # copy-pasted from unredacted stdout instead of using the path-form).
+  # Filter the approver line at any line position; only THAT field is
+  # allowed to contain a literal email.
+  artifact_text="$(awk -v approver_line="approver:" '
+    index($0, approver_line) == 1 { next }
+    /^[[:space:]]*approver:/      { next }
+    { print }
+  ' "$path")"
+  if grep -qE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' <<<"$artifact_text"; then
+    invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "artifact contains raw email pattern outside approver field — use path-form findings_json (point to redacted .scan-meta.json) instead of inline" '. + [{path: $p, reason: $r}]')"
+    continue
+  fi
+
+  # Freshness: rule_pack_sha256 prefix must match current manifest sha (≥8 chars).
+  artifact_sha="$(echo "$fm" | awk '/^rule_pack_sha256:/ { v = $0 } END { sub(/^rule_pack_sha256:[[:space:]]*/, "", v); gsub(/"|'"'"'/, "", v); gsub(/^[[:space:]]+|[[:space:]]+$/, "", v); print v }')"
+  prefix_len="${#artifact_sha}"
+  if [ "$prefix_len" -lt 8 ]; then
+    invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "rule_pack_sha256 prefix too short (need >=8 chars)" '. + [{path: $p, reason: $r}]')"
+    continue
+  fi
+  if [ "${current_manifest_sha:0:$prefix_len}" != "$artifact_sha" ]; then
+    stale="$(echo "$stale" | jq --arg p "$path" --arg art "$artifact_sha" --arg cur "${current_manifest_sha:0:$prefix_len}" \
+      '. + [{path: $p, artifact_sha: $art, current_sha: $cur}]')"
+    continue
+  fi
+
+  # Extract the `skill:` frontmatter field — this is the slug the artifact CLAIMS
+  # to authorize. Per-skill binding requires that the file-name slug AND the
+  # frontmatter slug match each other (defense-in-depth against template-copy
+  # mistakes), AND that consumers (CI gate, PreToolUse hook) verify the slug
+  # binds to the specific HIGH-RISK skill being installed.
+  artifact_skill="$(echo "$fm" | awk '/^skill:/ { v = $0 } END { sub(/^skill:[[:space:]]*/, "", v); gsub(/"|'"'"'/, "", v); gsub(/^[[:space:]]+|[[:space:]]+$/, "", v); print v }')"
+  if [ -z "$artifact_skill" ] || ! [[ "$artifact_skill" =~ $slug_re ]]; then
+    invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "skill: field invalid (got: $artifact_skill)" '. + [{path: $p, reason: $r}]')"
+    continue
+  fi
+  if [ "$artifact_skill" != "$slug" ]; then
+    invalid="$(echo "$invalid" | jq --arg p "$path" --arg r "skill: field ($artifact_skill) does not match filename slug ($slug)" '. + [{path: $p, reason: $r}]')"
+    continue
+  fi
+
+  matched="$(echo "$matched" | jq --arg p "$path" --arg s "$slug" --arg sk "$artifact_skill" --arg v "$verdict" '. + [{path: $p, slug: $s, skill: $sk, verdict: $v}]')"
+done
+
+result="$(jq -n --argjson m "$matched" --argjson i "$invalid" --argjson s "$stale" \
+  '{matched: $m, invalid_schema: $i, stale_findings: $s}')"
+echo "$result"
+
+n_invalid="$(echo "$result" | jq '.invalid_schema | length')"
+n_stale="$(echo "$result" | jq '.stale_findings | length')"
+if [ "$n_invalid" -gt 0 ] || [ "$n_stale" -gt 0 ]; then
+  exit 1
+fi
+exit 0