@vibecodetown/mcp-server 1.3.1

package/build/mcp/security/path-policy.js

@@ -0,0 +1,289 @@
+// adapters/mcp-ts/src/security/path-policy.ts
+// Path validation and do_not_touch policy enforcement
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+import { minimatch } from "minimatch";
+// ============================================================
+// Vibe-SDS Path Zones (Standard Directory Structure)
+// ============================================================
+/**
+ * Path zones for AI workspace control
+ * - BLACK: System only - AI cannot read or write
+ * - RED: Protected - AI cannot modify (auto do_not_touch)
+ * - YELLOW: Caution - AI can modify with warnings
+ * - GREEN: Free zone - AI workspace
+ */
+export const PATH_ZONES = {
+    /** System state - AI cannot access */
+    BLACK: [".vibe", ".vibe/**"],
+    /** Protected config - auto do_not_touch */
+    RED: ["config/**", ".env", ".env.*", "*.pem", "*.key", "credentials.*"],
+    /** Documentation - AI can modify with caution */
+    YELLOW: ["docs/**", "README.md", "*.md"],
+    /** AI workspace - free to modify */
+    GREEN: ["src/**", "tests/**", "lib/**", "scripts/**"],
+};
+const CONTROL_PLANE_BLACKLIST = [
+    "vibecoding_helper/**",
+    "adapters/**",
+    "engines/**",
+    "schemas/**",
+    "fixtures/**",
+    "policy/**",
+    "runs/**",
+    "config/semgrep/**",
+    "config/gitleaks/**",
+    "docs/ssot/**",
+    "docs/DEV_SPEC/implemented/**",
+    "scripts/generate-contracts.sh",
+    "scripts/generate-contract-lock.py",
+    "schemas/contracts.version.json",
+    "schemas/contracts.lock.json",
+];
+let cachedControlPlaneRepo = null;
+function isControlPlaneRepo() {
+    if (cachedControlPlaneRepo !== null)
+        return cachedControlPlaneRepo;
+    const cwd = process.cwd();
+    const hasSpec = fs.existsSync(path.join(cwd, "vibecoding_helper.spec"));
+    const hasLayout = fs.existsSync(path.join(cwd, "vibecoding_helper")) && fs.existsSync(path.join(cwd, "adapters", "mcp-ts"));
+    cachedControlPlaneRepo = hasSpec || hasLayout;
+    return cachedControlPlaneRepo;
+}
+/**
+ * Get the zone for a given path
+ */
+export function getPathZone(relativePath) {
+    const normalized = relativePath.replace(/\\/g, "/");
+    if (isControlPlaneRepo()) {
+        for (const pattern of CONTROL_PLANE_BLACKLIST) {
+            if (minimatch(normalized, pattern, { dot: true })) {
+                return "BLACK";
+            }
+        }
+    }
+    // Check zones in priority order: BLACK > RED > YELLOW > GREEN
+    for (const [zone, patterns] of Object.entries(PATH_ZONES)) {
+        for (const pattern of patterns) {
+            if (minimatch(normalized, pattern, { dot: true })) {
+                return zone;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Check if a path is in a forbidden zone (BLACK or RED)
+ */
+export function isPathForbidden(relativePath) {
+    const zone = getPathZone(relativePath);
+    if (zone === "BLACK") {
+        return {
+            forbidden: true,
+            zone,
+            reason: "이 경로는 시스템 전용 영역입니다. AI가 접근할 수 없습니다.",
+        };
+    }
+    if (zone === "RED") {
+        return {
+            forbidden: true,
+            zone,
+            reason: "이 경로는 보호된 설정 파일입니다. 수정할 수 없습니다.",
+        };
+    }
+    return { forbidden: false, zone: zone ?? undefined };
+}
+export function validateWorkOrderPaths(relativePaths) {
+    const allowed = [];
+    const forbidden = [];
+    for (const p of relativePaths) {
+        const check = isPathForbidden(p);
+        if (check.forbidden && check.zone && check.reason) {
+            forbidden.push({ path: p, zone: check.zone, reason: check.reason });
+        }
+        else {
+            allowed.push(p);
+        }
+    }
+    return {
+        valid: forbidden.length === 0,
+        allowed,
+        forbidden,
+    };
+}
+// ============================================================
+// Dangerous Patterns (system-level protection)
+// ============================================================
+/**
+ * Dangerous path patterns that should always be blocked
+ */
+const DANGEROUS_PATTERNS = [
+    /\.\./, // Path traversal
+    /^\/etc\//, // System config
+    /^\/usr\//, // System binaries
+    /^\/bin\//, // Binaries
+    /^\/sbin\//, // System binaries
+    /^\/var\/log\//, // System logs
+    /^\/root\//, // Root home
+    /^\/home\/[^/]+\/\./, // Hidden files in home
+    /^C:\\Windows/i, // Windows system
+    /^C:\\Program Files/i, // Windows programs
+    /\.env$/i, // Environment files
+    /credentials\.json$/i, // Credential files
+    /\.pem$/i, // Private keys
+    /\.key$/i, // Key files
+    /id_rsa/i, // SSH keys
+];
+/**
+ * Normalize a path relative to a base path
+ *
+ * - Resolves relative paths
+ * - Prevents path traversal attacks
+ * - Returns normalized absolute path
+ *
+ * @throws McpError if path traversal is detected
+ */
+export function normalizePath(inputPath, basePath) {
+    const pathApi = getPathApi(basePath);
+    // Reject obvious path traversal
+    if (inputPath.includes("..")) {
+        throw pathTraversalError(inputPath);
+    }
+    // Resolve the path
+    const resolved = pathApi.isAbsolute(inputPath)
+        ? inputPath
+        : pathApi.resolve(basePath, inputPath);
+    // Normalize to remove any . or redundant separators
+    const normalized = pathApi.normalize(resolved);
+    // Verify the resolved path is within basePath
+    const normalizedBase = pathApi.resolve(basePath);
+    const relative = pathApi.relative(normalizedBase, normalized);
+    if (relative.startsWith("..") || pathApi.isAbsolute(relative)) {
+        throw pathTraversalError(inputPath);
+    }
+    // Check against dangerous patterns
+    for (const pattern of DANGEROUS_PATTERNS) {
+        if (pattern.test(normalized) || pattern.test(inputPath)) {
+            throw pathTraversalError(inputPath);
+        }
+    }
+    return normalized;
+}
+function getPathApi(basePath) {
+    // When tests pass POSIX-style base paths on Windows, path.resolve/relative will
+    // introduce drive letters (e.g., F:\home\...) and break determinism.
+    // Choose the path implementation based on the basePath style.
+    if (/^[A-Za-z]:[\\/]/.test(basePath) || basePath.includes("\\")) {
+        return path.win32;
+    }
+    if (basePath.startsWith("/")) {
+        return path.posix;
+    }
+    return path;
+}
+/**
+ * Check if a path matches any do_not_touch patterns
+ */
+export function matchesDoNotTouch(targetPath, patterns) {
+    for (const pattern of patterns) {
+        // Try minimatch glob matching
+        if (minimatch(targetPath, pattern, { dot: true, matchBase: true })) {
+            return pattern;
+        }
+        // Also check if pattern is a prefix (directory match)
+        const normalizedTarget = targetPath.replace(/\\/g, "/");
+        const normalizedPattern = pattern.replace(/\\/g, "/");
+        if (normalizedTarget.startsWith(normalizedPattern + "/") ||
+            normalizedTarget === normalizedPattern) {
+            return pattern;
+        }
+    }
+    return null;
+}
+/**
+ * Check multiple paths against do_not_touch patterns
+ *
+ * @returns Object with allowed paths and any violations
+ */
+export function checkDoNotTouch(targetPaths, doNotTouchPatterns, basePath) {
+    const allowed = [];
+    const violations = [];
+    const pathApi = getPathApi(basePath);
+    for (const targetPath of targetPaths) {
+        try {
+            const normalized = normalizePath(targetPath, basePath);
+            const relativePath = pathApi.relative(basePath, normalized);
+            const matchedPattern = matchesDoNotTouch(relativePath, doNotTouchPatterns);
+            if (matchedPattern) {
+                violations.push({
+                    path: targetPath,
+                    pattern: matchedPattern,
+                    normalizedPath: normalized,
+                });
+            }
+            else {
+                allowed.push(normalized);
+            }
+        }
+        catch (e) {
+            // Path normalization failed (traversal attack)
+            violations.push({
+                path: targetPath,
+                pattern: "PATH_TRAVERSAL",
+                normalizedPath: targetPath,
+            });
+        }
+    }
+    return { allowed, violations };
+}
+/**
+ * Pre-execution check that throws if any violations are found
+ *
+ * @throws McpError if any path violates do_not_touch or is a traversal attempt
+ */
+export function preExecutionCheck(targetPaths, doNotTouchPatterns, basePath) {
+    const { allowed, violations } = checkDoNotTouch(targetPaths, doNotTouchPatterns, basePath);
+    if (violations.length > 0) {
+        const firstViolation = violations[0];
+        if (firstViolation.pattern === "PATH_TRAVERSAL") {
+            throw pathTraversalError(firstViolation.path);
+        }
+        throw doNotTouchError(firstViolation.path, firstViolation.pattern);
+    }
+    return allowed;
+}
+/**
+ * Validate a single path without do_not_touch check (just traversal protection)
+ */
+export function validatePath(inputPath, basePath) {
+    return normalizePath(inputPath, basePath);
+}
+/**
+ * Validate multiple paths and return normalized versions
+ */
+export function validatePaths(inputPaths, basePath) {
+    return inputPaths.map((p) => normalizePath(p, basePath));
+}
+/**
+ * Create path traversal error
+ */
+export function pathTraversalError(inputPath) {
+    return new McpError(ErrorCode.InvalidParams, `[SECURITY] Path traversal detected: "${inputPath}"`, {
+        vibeCode: -32_061,
+        category: "SECURITY",
+        context: { path: inputPath },
+        recovery: "Use paths relative to the project directory without '..' sequences",
+    });
+}
+/**
+ * Create do_not_touch violation error
+ */
+export function doNotTouchError(inputPath, pattern) {
+    return new McpError(ErrorCode.InvalidParams, `[SECURITY] Path "${inputPath}" matches do_not_touch pattern "${pattern}"`, {
+        vibeCode: -32_063,
+        category: "SECURITY",
+        context: { path: inputPath, pattern },
+        recovery: "This path is protected and cannot be modified. Choose a different target.",
+    });
+}

package/build/mcp/security/sandbox.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Sandbox configuration
+ */
+export interface SandboxConfig {
+    /** Sandbox mode: none (default), podman (recommended), docker (deprecated), or firejail */
+    mode: "none" | "podman" | "docker" | "firejail";
+    /** Paths to mount read-only in sandbox */
+    allowedPaths: string[];
+    /** Whether to allow network access */
+    networkAccess: boolean;
+    /** Memory limit in MB */
+    memoryLimitMb: number;
+    /** CPU limit (number of cores) */
+    cpuLimit: number;
+    /** Timeout in milliseconds */
+    timeoutMs: number;
+}
+/**
+ * Execution result from sandbox
+ */
+export interface SandboxResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+/**
+ * Default sandbox configuration (no sandboxing)
+ */
+export declare const DEFAULT_SANDBOX_CONFIG: SandboxConfig;
+/**
+ * Check if Podman is available on the system (recommended)
+ */
+export declare function isPodmanAvailable(): Promise<boolean>;
+/**
+ * Check if Docker is available on the system
+ * @deprecated Use isPodmanAvailable instead - Docker has container kill bugs
+ */
+export declare function isDockerAvailable(): Promise<boolean>;
+/**
+ * Check if firejail is available on the system
+ */
+export declare function isFirejailAvailable(): Promise<boolean>;
+/**
+ * Run command in sandbox environment
+ *
+ * @param cmd - Command to execute
+ * @param args - Command arguments
+ * @param config - Sandbox configuration
+ * @returns Execution result
+ */
+export declare function runInSandbox(cmd: string, args: string[], config?: SandboxConfig): Promise<SandboxResult>;
+/**
+ * Create sandbox configuration from environment
+ */
+export declare function getSandboxConfigFromEnv(): SandboxConfig;