@tonyclaw/agent-inspector 4.0.1 → 4.0.3

package/src/proxy/privateDataPath.ts

@@ -1,419 +0,0 @@
-import { spawnSync } from "node:child_process";
-import {
-  closeSync,
-  constants,
-  fchmodSync,
-  fstatSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readdirSync,
-  realpathSync,
-} from "node:fs";
-import { join, parse, resolve, sep } from "node:path";
-
-export const PRIVATE_DIRECTORY_MODE = 0o700;
-export const PRIVATE_FILE_MODE = 0o600;
-
-export type PrivateDataPathKind = "directory" | "file";
-
-type WindowsCommandResult = {
-  status: number | null;
-  stdout: string;
-};
-
-export type WindowsCommandRunner = (
-  executable: string,
-  args: readonly string[],
-) => WindowsCommandResult;
-
-type PathEntry = {
-  path: string;
-  kind: PrivateDataPathKind;
-  identity: string;
-  mode: number;
-};
-
-type PathChainSnapshot = {
-  absolutePath: string;
-  complete: boolean;
-  entries: readonly PathEntry[];
-  missingParts: readonly string[];
-};
-
-type TreeEntry = {
-  path: string;
-  kind: PrivateDataPathKind;
-  fingerprint: string;
-};
-
-type PathEntryRead =
-  | { status: "ok"; entry: PathEntry }
-  | { status: "missing" }
-  | { status: "unsafe" };
-
-const securedPathFingerprints = new Map<string, string>();
-let cachedWindowsSid: string | null = null;
-
-// Always invoke the system copies of Windows security utilities regardless of PATH ordering.
-function windowsSystemPath(executable: string): string {
-  const systemRoot = process.env["SystemRoot"] ?? "C:\\Windows";
-  return `${systemRoot}\\System32\\${executable}`;
-}
-
-function runWindowsCommand(executable: string, args: readonly string[]): WindowsCommandResult {
-  const resolved =
-    process.platform === "win32" && /^(whoami|icacls)\.exe$/iu.test(executable)
-      ? windowsSystemPath(executable)
-      : executable;
-  const result = spawnSync(resolved, [...args], {
-    encoding: "utf8",
-    shell: false,
-    windowsHide: true,
-  });
-  return { status: result.status, stdout: result.stdout };
-}
-
-function windowsUserSid(output: string): string | null {
-  const match = /S-\d+(?:-\d+)+/.exec(output);
-  return match?.[0] ?? null;
-}
-
-function resolveWindowsUserSid(run: WindowsCommandRunner): string | null {
-  if (run === runWindowsCommand && cachedWindowsSid !== null) return cachedWindowsSid;
-  const identity = run("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
-  if (identity.status !== 0) return null;
-  const sid = windowsUserSid(identity.stdout);
-  if (run === runWindowsCommand) cachedWindowsSid = sid;
-  return sid;
-}
-
-function windowsBroadGroupRemovalArgs(): readonly string[] {
-  return ["/remove:g", "*S-1-1-0", "*S-1-5-11", "*S-1-5-32-545", "CodexSandboxUsers"];
-}
-
-function applyWindowsAclWithSid(
-  path: string,
-  kind: PrivateDataPathKind,
-  sid: string,
-  run: WindowsCommandRunner,
-): boolean {
-  const access = kind === "directory" ? `(OI)(CI)F` : "F";
-  const result = run("icacls.exe", [
-    path,
-    "/inheritance:r",
-    "/grant:r",
-    `*${sid}:${access}`,
-    ...windowsBroadGroupRemovalArgs(),
-    "/q",
-  ]);
-  return result.status === 0;
-}
-
-/** Remove inherited Windows permissions and grant access only to the current process user. */
-export function applyWindowsUserOnlyAcl(
-  path: string,
-  kind: PrivateDataPathKind,
-  run: WindowsCommandRunner = runWindowsCommand,
-): boolean {
-  const sid = resolveWindowsUserSid(run);
-  return sid !== null && applyWindowsAclWithSid(path, kind, sid, run);
-}
-
-function comparablePath(path: string): string {
-  let normalized = path;
-  if (process.platform === "win32") {
-    if (normalized.startsWith("\\\\?\\UNC\\")) {
-      normalized = `\\\\${normalized.slice(8)}`;
-    } else if (normalized.startsWith("\\\\?\\")) {
-      normalized = normalized.slice(4);
-    }
-  }
-  const absolute = resolve(normalized);
-  return process.platform === "win32" ? absolute.toLowerCase() : absolute;
-}
-
-type PathStats = NonNullable<ReturnType<typeof lstatSync>>;
-
-function pathIdentity(stats: PathStats): string {
-  return `${String(stats.dev)}:${String(stats.ino)}:${String(stats.birthtimeMs)}`;
-}
-
-function readPathEntry(path: string): PathEntryRead {
-  let stats: PathStats;
-  try {
-    const observed = lstatSync(path);
-    if (observed === undefined) return { status: "missing" };
-    stats = observed;
-  } catch {
-    return { status: "missing" };
-  }
-
-  // On Windows, junctions and the supported reparse indirections are surfaced as symbolic links.
-  // The realpath equality check also rejects path aliases whose target differs from the lexical path.
-  if (stats.isSymbolicLink()) return { status: "unsafe" };
-  const kind: PrivateDataPathKind | null = stats.isDirectory()
-    ? "directory"
-    : stats.isFile()
-      ? "file"
-      : null;
-  if (kind === null) return { status: "unsafe" };
-
-  let canonical: string;
-  try {
-    canonical = realpathSync.native(path);
-  } catch {
-    return { status: "unsafe" };
-  }
-  if (comparablePath(canonical) !== comparablePath(path)) return { status: "unsafe" };
-
-  return {
-    status: "ok",
-    entry: {
-      path,
-      kind,
-      identity: pathIdentity(stats),
-      mode: stats.mode & 0o777,
-    },
-  };
-}
-
-function snapshotPathChain(path: string): PathChainSnapshot | null {
-  const absolutePath = resolve(path);
-  const root = parse(absolutePath).root;
-  const suffix = absolutePath.slice(root.length);
-  const parts = suffix === "" ? [] : suffix.split(sep).filter((part) => part !== "");
-  const entries: PathEntry[] = [];
-  let current = root;
-
-  const rootRead = readPathEntry(root);
-  if (rootRead.status !== "ok" || rootRead.entry.kind !== "directory") return null;
-  entries.push(rootRead.entry);
-
-  for (let index = 0; index < parts.length; index += 1) {
-    const part = parts[index];
-    if (part === undefined) return null;
-    current = join(current, part);
-    const read = readPathEntry(current);
-    if (read.status === "unsafe") return null;
-    if (read.status === "missing") {
-      return {
-        absolutePath,
-        complete: false,
-        entries,
-        missingParts: parts.slice(index),
-      };
-    }
-    if (index < parts.length - 1 && read.entry.kind !== "directory") return null;
-    entries.push(read.entry);
-  }
-
-  return { absolutePath, complete: true, entries, missingParts: [] };
-}
-
-function chainFingerprint(snapshot: PathChainSnapshot): string {
-  return snapshot.entries.map((entry) => `${entry.path}:${entry.identity}`).join("|");
-}
-
-function snapshotsRetainPrefix(before: PathChainSnapshot, after: PathChainSnapshot): boolean {
-  if (after.entries.length < before.entries.length) return false;
-  return before.entries.every((entry, index) => {
-    const next = after.entries[index];
-    return next !== undefined && next.path === entry.path && next.identity === entry.identity;
-  });
-}
-
-function completeSnapshotForKind(
-  path: string,
-  kind: PrivateDataPathKind,
-): PathChainSnapshot | null {
-  const snapshot = snapshotPathChain(path);
-  if (snapshot === null || !snapshot.complete) return null;
-  const leaf = snapshot.entries.at(-1);
-  return leaf !== undefined && leaf.kind === kind ? snapshot : null;
-}
-
-function applyPosixPermissions(
-  path: string,
-  kind: PrivateDataPathKind,
-  expectedIdentity: string,
-): boolean {
-  let descriptor: number | null = null;
-  try {
-    const directoryFlag = kind === "directory" ? constants.O_DIRECTORY : 0;
-    descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | directoryFlag);
-    const before = fstatSync(descriptor);
-    if (pathIdentity(before) !== expectedIdentity) return false;
-    fchmodSync(descriptor, kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
-    const after = fstatSync(descriptor);
-    return (
-      pathIdentity(after) === expectedIdentity &&
-      (after.mode & 0o777) === (kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE)
-    );
-  } catch {
-    return false;
-  } finally {
-    if (descriptor !== null) {
-      try {
-        closeSync(descriptor);
-      } catch {
-        // The permission result already fails closed; descriptor cleanup is best effort here.
-      }
-    }
-  }
-}
-
-function permissionsArePrivate(entry: PathEntry): boolean {
-  if (process.platform === "win32") return true;
-  return entry.mode === (entry.kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
-}
-
-function secureExistingPath(
-  path: string,
-  kind: PrivateDataPathKind,
-  forcePermissions = false,
-): boolean {
-  const before = completeSnapshotForKind(path, kind);
-  if (before === null) return false;
-  const leaf = before.entries.at(-1);
-  if (leaf === undefined) return false;
-  const cacheKey = `${kind}:${before.absolutePath}`;
-  const beforeFingerprint = chainFingerprint(before);
-  if (
-    !forcePermissions &&
-    securedPathFingerprints.get(cacheKey) === beforeFingerprint &&
-    permissionsArePrivate(leaf)
-  ) {
-    const cachedCheck = completeSnapshotForKind(path, kind);
-    return cachedCheck !== null && chainFingerprint(cachedCheck) === beforeFingerprint;
-  }
-
-  const applied =
-    process.platform === "win32"
-      ? applyWindowsUserOnlyAcl(path, kind)
-      : applyPosixPermissions(path, kind, leaf.identity);
-  if (!applied) return false;
-
-  const after = completeSnapshotForKind(path, kind);
-  if (after === null || !snapshotsRetainPrefix(before, after)) return false;
-  const afterLeaf = after.entries.at(-1);
-  if (afterLeaf === undefined || afterLeaf.identity !== leaf.identity) return false;
-  if (!permissionsArePrivate(afterLeaf)) return false;
-  securedPathFingerprints.set(cacheKey, chainFingerprint(after));
-  return true;
-}
-
-export function ensurePrivateDirectorySync(path: string): boolean {
-  const before = snapshotPathChain(path);
-  if (before === null) return false;
-
-  let current = before.entries.at(-1)?.path;
-  if (current === undefined) return false;
-  for (const part of before.missingParts) {
-    const next = join(current, part);
-    try {
-      mkdirSync(next, { mode: PRIVATE_DIRECTORY_MODE });
-    } catch {
-      const raced = readPathEntry(next);
-      if (raced.status !== "ok" || raced.entry.kind !== "directory") return false;
-    }
-    if (!secureExistingPath(next, "directory", true)) return false;
-    current = next;
-  }
-
-  const complete = completeSnapshotForKind(path, "directory");
-  if (complete === null || !snapshotsRetainPrefix(before, complete)) return false;
-  return secureExistingPath(path, "directory");
-}
-
-export function securePrivateFileSync(path: string, forceAcl = false): boolean {
-  return secureExistingPath(path, "file", forceAcl);
-}
-
-function collectSafeTree(root: string): TreeEntry[] | null {
-  const collected: TreeEntry[] = [];
-
-  const visit = (path: string): boolean => {
-    const snapshot = snapshotPathChain(path);
-    if (snapshot === null || !snapshot.complete) return false;
-    const leaf = snapshot.entries.at(-1);
-    if (leaf === undefined) return false;
-    const fingerprint = chainFingerprint(snapshot);
-    collected.push({ path: snapshot.absolutePath, kind: leaf.kind, fingerprint });
-    if (leaf.kind === "file") return true;
-
-    let entries: string[];
-    try {
-      entries = readdirSync(path);
-    } catch {
-      return false;
-    }
-    const afterRead = completeSnapshotForKind(path, "directory");
-    if (afterRead === null || chainFingerprint(afterRead) !== fingerprint) return false;
-    for (const entry of entries) {
-      if (!visit(join(path, entry))) return false;
-    }
-    return true;
-  };
-
-  return visit(root) ? collected : null;
-}
-
-function treeFingerprintsMatch(
-  expected: readonly TreeEntry[],
-  observed: readonly TreeEntry[] | null,
-): boolean {
-  if (observed === null || observed.length !== expected.length) return false;
-  return expected.every((entry, index) => {
-    const next = observed[index];
-    return (
-      next !== undefined &&
-      next.path === entry.path &&
-      next.kind === entry.kind &&
-      next.fingerprint === entry.fingerprint
-    );
-  });
-}
-
-/** Read-only preflight used before copy/import operations that must not follow indirection. */
-export function isPathTreeFreeOfIndirectionSync(root: string): boolean {
-  return collectSafeTree(root) !== null;
-}
-
-/** Apply ACLs item by item after a no-follow scan; never use icacls /T across a reparse point. */
-export function applyWindowsUserOnlyTreeAcl(
-  root: string,
-  run: WindowsCommandRunner = runWindowsCommand,
-): boolean {
-  const entries = collectSafeTree(root);
-  if (entries === null) return false;
-  const sid = resolveWindowsUserSid(run);
-  if (sid === null) return false;
-
-  for (const entry of entries) {
-    const before = completeSnapshotForKind(entry.path, entry.kind);
-    if (before === null || chainFingerprint(before) !== entry.fingerprint) return false;
-    if (!applyWindowsAclWithSid(entry.path, entry.kind, sid, run)) return false;
-    const after = completeSnapshotForKind(entry.path, entry.kind);
-    if (after === null || chainFingerprint(after) !== entry.fingerprint) return false;
-    securedPathFingerprints.set(`${entry.kind}:${entry.path}`, entry.fingerprint);
-  }
-  return treeFingerprintsMatch(entries, collectSafeTree(root));
-}
-
-/** Secure an existing tree while refusing every symlink, junction, or reparse indirection. */
-export function securePrivateTreeSync(root: string): boolean {
-  const entries = collectSafeTree(root);
-  if (entries === null) return false;
-  if (process.platform === "win32") return applyWindowsUserOnlyTreeAcl(root);
-
-  for (const entry of entries) {
-    if (!secureExistingPath(entry.path, entry.kind, true)) return false;
-  }
-  return treeFingerprintsMatch(entries, collectSafeTree(root));
-}
-
-export function _resetPrivateDataPathCacheForTests(): void {
-  securedPathFingerprints.clear();
-  cachedWindowsSid = null;
-}