@wrongstack/core 0.276.4 → 0.277.1

package/dist/security/index.js

@@ -1,7 +1,7 @@
 import { randomBytes, createCipheriv, createDecipheriv, scryptSync } from 'crypto';
 import * as fs2 from 'fs';
 import * as fs from 'fs/promises';
-import * as path3 from 'path';
+import * as path from 'path';
 
 // src/security/secret-scrubber.ts
 var PATTERNS = [
@@ -192,9 +192,9 @@ var DefaultSecretScrubber = class {
   }
 };
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path3.dirname(targetPath);
+  const dir = path.dirname(targetPath);
   await fs.mkdir(dir, { recursive: true });
-  const tmp = path3.join(dir, `.${path3.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tmp = path.join(dir, `.${path.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
       await fs.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
@@ -748,7 +748,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    fs2.mkdirSync(path.dirname(this.keyFile), { recursive: true });
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       fs2.writeFileSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase), { mode: 384 });
@@ -832,7 +832,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    fs2.mkdirSync(path.dirname(this.keyFile), { recursive: true });
     const key = randomBytes(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
@@ -931,7 +931,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fs.mkdir(path3.dirname(configPath), { recursive: true });
+  await fs.mkdir(path.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions(configPath);
 }
@@ -1101,6 +1101,8 @@ var ToolCapabilities = {
   SHELL_ARBITRARY: "shell.arbitrary",
   /** Can execute a restricted set of commands (the `exec` tool). */
   SHELL_RESTRICTED: "shell.restricted",
+  /** Can run a restricted project formatter/linter-style command. */
+  SHELL_EXEC: "shell.exec",
   /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
   FS_READ: "fs.read",
   /** Can write / modify / delete files inside the project. */
@@ -1109,6 +1111,20 @@ var ToolCapabilities = {
   FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
   /** Can perform outbound network requests. */
   NET_OUTBOUND: "net.outbound",
+  /** Can mutate in-memory session todos only. */
+  SESSION_TODO: "session.todo",
+  /** Can mutate in-memory session mode only. */
+  SESSION_MODE: "session.mode",
+  /** Can inspect registered tool metadata. */
+  TOOL_META: "tool.meta",
+  /** Can invoke arbitrary registered tools through a meta-tool. */
+  TOOL_MUTATE_ANY: "tool.mutate.any",
+  /** Can read persistent memory. */
+  MEMORY_READ: "memory.read",
+  /** Can write persistent memory. */
+  MEMORY_WRITE: "memory.write",
+  /** Can delete persistent memory. */
+  MEMORY_DELETE: "memory.delete",
   /** Proxies tools from external MCP servers (unknown capability). */
   MCP_PROXY: "mcp.proxy",
   /** Can spawn or manage subagents / multi-agent tasks. */
@@ -1127,8 +1143,12 @@ var ToolCapabilities = {
 var DANGEROUS_FOR_SUBAGENTS = [
   ToolCapabilities.SHELL_ARBITRARY,
   ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
   ToolCapabilities.FS_WRITE,
   ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.TOOL_MUTATE_ANY,
+  ToolCapabilities.MEMORY_WRITE,
+  ToolCapabilities.MEMORY_DELETE,
   ToolCapabilities.MCP_PROXY,
   ToolCapabilities.SUBAGENT_SPAWN,
   ToolCapabilities.CONFIG_MUTATE,
@@ -1138,8 +1158,12 @@ var DANGEROUS_FOR_SUBAGENTS = [
   ToolCapabilities.FS_READ,
   ToolCapabilities.FS_WRITE,
   ToolCapabilities.NET_OUTBOUND,
+  ToolCapabilities.SESSION_TODO,
+  ToolCapabilities.TOOL_META,
+  ToolCapabilities.MEMORY_READ,
   ToolCapabilities.SHELL_ARBITRARY,
   ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
   ToolCapabilities.PACKAGE_INSTALL
 ];
 function hasDangerousCapabilityForSubagents(toolOrCaps) {
@@ -1198,19 +1222,51 @@ var LruCache = class {
     return this.store.size;
   }
 };
-var DESTRUCTIVE_BASH_PATTERNS = [
-  /\bgit\s+(?:clean\s+-[^\s]*[xdf]|reset\s+--hard)\b/i,
-  /\b(?:drop|truncate)\s+(?:table|database|schema)\b/i,
-  /\bdelete\s+from\b/i,
-  /\b(?:mkfs|format|diskpart|shutdown|reboot)\b/i,
-  /\bchmod\s+-R\s+777\b/i,
-  /\bchown\s+-R\b/i,
-  /\b(?:curl|wget)\b.*\|\s*(?:sh|bash|zsh|pwsh|powershell)\b/i,
-  /\b(?:powershell|pwsh)\b.*(?:-encodedcommand|-enc)\b/i,
-  /:\(\)\s*\{\s*:\|:&\s*}\s*;/
+var CATASTROPHIC_PATTERNS = [
+  /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
+  // make a filesystem — wipes a partition
+  /\bformat\s+[A-Za-z]:/i,
+  // format C: — wipes a Windows volume
+  /\bdiskpart\b/i,
+  // Windows partition editor
+  /\bdd\b[^|]*\bof=(?:\/dev\/|\\\\[.?]\\)/i,
+  // dd writing straight to a raw device
+  />\s*\/dev\/(?:sd|hd|nvme|disk|mapper|vd)/i,
+  // redirect into a raw block device
+  /:\(\)\s*\{\s*:\|:&\s*\}\s*;/
+  // classic fork bomb
 ];
-var PROJECT_ESCAPE_PATTERN = /(?:^|[\s"'])\.\.(?:[\\/]|$)/;
-var ABSOLUTE_PATH_PATTERN = /(?:^|[\s"'])(?:~[\\/]|\/[A-Za-z0-9_.-]|[A-Za-z]:[\\/])/;
+var CATASTROPHIC_POSIX_ROOTS = /* @__PURE__ */ new Set([
+  "/etc",
+  "/usr",
+  "/bin",
+  "/sbin",
+  "/lib",
+  "/lib64",
+  "/var",
+  "/boot",
+  "/dev",
+  "/sys",
+  "/proc",
+  "/opt",
+  "/root",
+  "/home",
+  "/srv",
+  "/run",
+  "/system",
+  "/library",
+  "/applications",
+  "/users"
+]);
+var CATASTROPHIC_WIN_SUBDIRS = /* @__PURE__ */ new Set([
+  "windows",
+  "system32",
+  "winnt",
+  "program files",
+  "program files (x86)",
+  "programdata",
+  "users"
+]);
 var SHELL_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", "|", ";", ">", ">>", "<", "2>", "2>>"]);
 function getInputString(input, key) {
   if (!input || typeof input !== "object") return void 0;
@@ -1220,27 +1276,28 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path3.resolve(projectRoot, rawPath);
-  const relative2 = path3.relative(projectRoot, resolved);
-  return !!relative2 && !relative2.startsWith("..") && !path3.isAbsolute(relative2);
+  const resolved = path.resolve(projectRoot, rawPath);
+  const relative2 = path.relative(projectRoot, resolved);
+  return !!relative2 && !relative2.startsWith("..") && !path.isAbsolute(relative2);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
 }
-function pathTokenIsOutsideProject(token, projectRoot) {
-  if (!token || SHELL_OPERATORS.has(token) || token.startsWith("-")) return false;
-  if (token === "/" || token === "~" || token === "." || token === "..") return token !== ".";
-  if (token.includes("*")) return true;
-  if (token.startsWith("..") || token.includes("../") || token.includes("..\\")) return true;
-  if (path3.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
+function isCatastrophicDeleteTarget(rawTarget) {
+  const t = rawTarget.replace(/^['"]|['"]$/g, "").trim();
+  if (!t) return false;
+  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*") return true;
+  const s = t.replace(/[\\/]\*+$/, "").replace(/[\\/]+$/, "");
+  if (s === "") return true;
+  if (s === "~" || /^\$HOME$/i.test(s) || /^%USERPROFILE%$/i.test(s)) return true;
+  if (/^[A-Za-z]:$/.test(s)) return true;
+  const norm = s.toLowerCase().replace(/\\/g, "/");
+  if (CATASTROPHIC_POSIX_ROOTS.has(norm)) return true;
+  const win = norm.match(/^[a-z]:\/([^/]+)$/);
+  if (win?.[1] && CATASTROPHIC_WIN_SUBDIRS.has(win[1])) return true;
   return false;
 }
-function hasDangerousDeleteTarget(tokens, start, projectRoot) {
-  const targets = tokens.slice(start).filter((token) => !token.startsWith("-") && !SHELL_OPERATORS.has(token));
-  if (targets.length === 0) return true;
-  return targets.some((target) => pathTokenIsOutsideProject(target, projectRoot));
-}
-function hasDestructiveDelete(command, projectRoot) {
+function hasCatastrophicDelete(command) {
   const tokens = tokenizeShell(command);
   for (let i = 0; i < tokens.length; i++) {
     const token = tokens[i]?.toLowerCase();
@@ -1248,35 +1305,43 @@ function hasDestructiveDelete(command, projectRoot) {
     if (token === "rm") {
       const args = tokens.slice(i + 1);
       const recursiveOrForce = args.some(
-        (arg) => /^-[^-]*[rf]/i.test(arg) || arg === "--recursive" || arg === "--force"
+        (arg) => /^-[^-]*[rf]/i.test(arg) || arg === "--recursive" || arg === "--force" || arg === "--no-preserve-root"
       );
-      if (recursiveOrForce && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+      if (!recursiveOrForce) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+      if (targets.length === 0) return true;
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
+    }
+    if (token === "remove-item" || token === "ri") {
+      const args = tokens.slice(i + 1);
+      const recursive = args.some((arg) => {
+        const a = arg.toLowerCase();
+        return a === "-recurse" || a === "-force";
+      });
+      if (!recursive) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
     if (token === "rmdir" || token === "rd") {
       const args = tokens.slice(i + 1);
       const recursive = args.some((arg) => arg.toLowerCase() === "/s");
-      if (recursive && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+      if (!recursive) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
     if (token === "del" || token === "erase") {
-      if (hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
-    }
-    if (token === "remove-item") {
-      const args = tokens.slice(i + 1).map((arg) => arg.toLowerCase());
-      const recursiveOrForce = args.includes("-recurse") || args.includes("-force");
-      if (recursiveOrForce && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+      const args = tokens.slice(i + 1);
+      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
   }
   return false;
 }
-function isClearlyDestructiveBashCommand(command, projectRoot) {
+function isClearlyDestructiveBashCommand(command, _projectRoot) {
   const trimmed = command.trim();
   if (!trimmed) return false;
-  if (hasDestructiveDelete(trimmed, projectRoot)) return true;
-  if (DESTRUCTIVE_BASH_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
-  if (/\bcd\s+(?:\.\.|~|\/|[A-Za-z]:[\\/])/i.test(trimmed)) return true;
-  if (PROJECT_ESCAPE_PATTERN.test(trimmed)) return true;
-  const absolute = trimmed.match(ABSOLUTE_PATH_PATTERN)?.[0]?.trim().replace(/^['"]|['"]$/g, "");
-  if (absolute && !pathLooksInsideProject(absolute, projectRoot)) return true;
+  if (hasCatastrophicDelete(trimmed)) return true;
+  if (CATASTROPHIC_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
   return false;
 }
 
@@ -1284,6 +1349,15 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
+function shellCommandLineFromInput(input) {
+  const command = getInputString(input, "command") ?? getInputString(input, "cmd") ?? getInputString(input, "script");
+  if (!command) return void 0;
+  if (!input || typeof input !== "object") return command;
+  const args = input["args"];
+  if (!Array.isArray(args) || args.length === 0) return command;
+  const renderedArgs = args.filter((arg) => typeof arg === "string").map((arg) => /\s/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg);
+  return [command, ...renderedArgs].join(" ");
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -1301,9 +1375,10 @@ var DefaultPermissionPolicy = class {
    */
   sessionDenied = /* @__PURE__ */ new Map();
   /**
-   * Session-scoped "soft trust" map. When the user presses 'a' (allow once),
-   * the tool+pattern is added here. If the LLM retries in the same session,
-   * we return auto directly without asking again.
+   * Session-scoped one-shot "soft trust" map. When the user presses 'y', the
+   * tool+pattern is added here so the immediate confirm re-run can proceed.
+   * The entry is consumed on first use; future calls must ask again unless the
+   * user chose persistent trust.
    *
    * Cleared on reload().
    */
@@ -1342,7 +1417,7 @@ var DefaultPermissionPolicy = class {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
     this.yoloDestructive = opts.yoloDestructive ?? opts.forceAllYolo ?? false;
-    this.confirmDestructive = opts.confirmDestructive ?? false;
+    this.confirmDestructive = true;
     this.promptDelegate = opts.promptDelegate;
   }
   /**
@@ -1373,9 +1448,9 @@ var DefaultPermissionPolicy = class {
     return this.yoloDestructive;
   }
   /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
-  setConfirmDestructive(enabled) {
-    if (this.confirmDestructive !== enabled) this._evalCache.clear();
-    this.confirmDestructive = enabled;
+  setConfirmDestructive(_enabled) {
+    if (!this.confirmDestructive) this._evalCache.clear();
+    this.confirmDestructive = true;
   }
   /** Check whether destructive confirmation gate is active. */
   getConfirmDestructive() {
@@ -1414,12 +1489,12 @@ var DefaultPermissionPolicy = class {
       return decision;
     }
     if (this.sessionAllowed.has(cacheKey)) {
+      this.sessionAllowed.delete(cacheKey);
       const decision = {
         permission: "auto",
         source: "trust",
-        reason: "session soft allow (user pressed yes)"
+        reason: "session one-shot allow (user pressed yes)"
       };
-      this._evalCache.set(cacheKey, decision);
       return decision;
     }
     if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
@@ -1432,6 +1507,29 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(cacheKey, decision);
       return decision;
     }
+    if (this.yolo) {
+      const destructive = this.isDestructiveYoloCall(tool, input, ctx);
+      if (destructive) {
+        if (this.promptDelegate) {
+          const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
+          if (decision === "deny") {
+            await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
+            return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
+          }
+          return {
+            permission: decision === "yes" || decision === "always" ? "auto" : "deny",
+            source: "user",
+            reason: "destructive yolo approved for this call"
+          };
+        }
+        return {
+          permission: "confirm",
+          source: "yolo_destructive",
+          riskTier: "destructive",
+          reason: "destructive tool needs explicit approval in YOLO mode"
+        };
+      }
+    }
     if (entry?.allow && subject && matchesTrust(entry.allow, subject)) {
       const decision = { permission: "auto", source: "trust", reason: "matched allow pattern" };
       this._evalCache.set(cacheKey, decision);
@@ -1443,29 +1541,6 @@ var DefaultPermissionPolicy = class {
       return decision;
     }
     if (this.yolo) {
-      if (this.confirmDestructive) {
-        const destructive = this.isDestructiveYoloCall(tool, input, ctx);
-        if (destructive) {
-          if (this.promptDelegate) {
-            const decision2 = await this.promptDelegate(tool, input, subject ?? tool.name);
-            if (decision2 === "always") {
-              await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
-              return { permission: "auto", source: "user", reason: "destructive yolo always-allowed" };
-            }
-            if (decision2 === "deny") {
-              await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
-              return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
-            }
-            return { permission: decision2 === "yes" ? "auto" : "deny", source: "user" };
-          }
-          return {
-            permission: "confirm",
-            source: "yolo_destructive",
-            riskTier: "destructive",
-            reason: "destructive tool needs explicit approval (confirmDestructive is on)"
-          };
-        }
-      }
       const decision = { permission: "auto", source: "yolo" };
       this._evalCache.set(cacheKey, decision);
       return decision;
@@ -1482,7 +1557,8 @@ var DefaultPermissionPolicy = class {
     const hasWriteCap = hasCapability(tool, ToolCapabilities.FS_WRITE);
     const hasShellCap = hasCapability(tool, [
       ToolCapabilities.SHELL_ARBITRARY,
-      ToolCapabilities.SHELL_RESTRICTED
+      ToolCapabilities.SHELL_RESTRICTED,
+      ToolCapabilities.SHELL_EXEC
     ]);
     const hasInstallCap = hasCapability(tool, ToolCapabilities.PACKAGE_INSTALL);
     const hasConfigCap = hasCapability(tool, ToolCapabilities.CONFIG_MUTATE);
@@ -1510,27 +1586,30 @@ var DefaultPermissionPolicy = class {
   // Capability-based destructive check (preferred over name-based)
   isDestructiveByCapability(tool) {
     const caps = tool.capabilities ?? [];
-    if (caps.includes("shell.arbitrary")) return true;
-    if (caps.includes("fs.write")) return true;
-    if (caps.includes("fs.write.outside-project")) return true;
+    if (caps.includes(ToolCapabilities.SHELL_ARBITRARY)) return true;
+    if (caps.includes(ToolCapabilities.SHELL_RESTRICTED)) return true;
+    if (caps.includes(ToolCapabilities.SHELL_EXEC)) return true;
+    if (caps.includes(ToolCapabilities.FS_WRITE)) return true;
+    if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
     return false;
   }
   isDestructiveYoloCall(tool, input, ctx) {
     if (this.isDestructiveByCapability(tool)) {
-      if (tool.name === "bash") {
-        const command = getInputString(input, "command");
-        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+      const caps = tool.capabilities ?? [];
+      if (caps.includes(ToolCapabilities.SHELL_ARBITRARY) || caps.includes(ToolCapabilities.SHELL_RESTRICTED) || caps.includes(ToolCapabilities.SHELL_EXEC)) {
+        const command = shellCommandLineFromInput(input);
+        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
       }
-      if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
+      if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
+      if (caps.includes(ToolCapabilities.FS_WRITE)) {
         const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
         if (!targetPath || !ctx.projectRoot) return false;
         return !pathLooksInsideProject(targetPath, ctx.projectRoot);
       }
-      return true;
     }
-    if (tool.name === "bash") {
-      const command = getInputString(input, "command");
-      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+    if (tool.name === "bash" || tool.name === "shell" || tool.name === "exec") {
+      const command = shellCommandLineFromInput(input);
+      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
     }
     if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
       const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
@@ -1579,7 +1658,7 @@ var DefaultPermissionPolicy = class {
     this.sessionDenied.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();
   }
-  /** Auto-approve this tool+pattern for the rest of this session (no trust file). */
+  /** Auto-approve this tool+pattern once (no trust file). */
   allowOnce(rule) {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();