@wrongstack/core 0.285.0 → 0.287.0

package/dist/security/index.js

@@ -116,7 +116,12 @@ function hasCredentialAnchors(text) {
   text.includes("_TOKEN=") || // ACCESS_TOKEN=, AUTH_TOKEN=, ...
   text.includes("_SECRET=") || // API_SECRET=, CLIENT_SECRET=, ...
   text.includes("_PASSWORD=") || // DB_PASSWORD=, ROOT_PASSWORD=, ...
-  text.includes("mongodb://") || text.includes("mongodb+srv://") || text.includes("postgres://") || text.includes("postgresql://") || text.includes("mysql://") || text.includes("redis://");
+  text.includes("mongodb://") || text.includes("mongodb+srv://") || text.includes("postgres://") || text.includes("postgresql://") || text.includes("mysql://") || text.includes("redis://") || // JSON-style credential keys: tool outputs often serialise objects as
+  // raw JSON strings rather than parsed objects. The value may not start
+  // with a recognisable prefix (sk-, ghp_, etc.), so we anchor on common
+  // key names. The `"` prefix avoids matching prose that happens to mention
+  // these words — JSON serialisation always quotes string keys.
+  text.includes('"apiKey"') || text.includes('"api_key"') || text.includes('"token"') || text.includes('"secret"') || text.includes('"password"') || text.includes('"authorization"') || text.includes('"bearer"') || text.includes('"private_key"') || text.includes('"access_token"') || text.includes('"refresh_token"') || text.includes('"client_secret"');
 }
 var DefaultSecretScrubber = class {
   scrub(text) {
@@ -612,7 +617,7 @@ function walk(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key)/i;
+var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();
@@ -705,31 +710,40 @@ function unwrapDataKey(buf, keyFile) {
     });
   }
 }
-function checkKeyFilePermissions(keyFile) {
+function checkKeyFilePermissions(keyFile, opts) {
   if (process.platform === "win32") return;
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
   try {
     const stat2 = fs2.statSync(keyFile);
     const actualMode = stat2.mode & 511;
     if (actualMode !== KEY_FILE_MODE) {
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "vault.key_file_wrong_permissions",
-        message: `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Run: chmod ${KEY_FILE_MODE.toString(8)} ${keyFile}`,
-        keyFile,
-        expectedMode: KEY_FILE_MODE,
-        actualMode,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
+      warn(
+        `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Run: chmod ${KEY_FILE_MODE.toString(8)} ${keyFile}`
+      );
     }
   } catch {
   }
 }
 var DefaultSecretVault = class {
   keyFile;
+  logger;
   key;
   _keyVersion = 1;
   constructor(opts) {
     this.keyFile = opts.keyFile;
+    this.logger = opts.logger;
+  }
+  /**
+   * Emit a structured warning. Uses the configured Logger when available;
+   * falls back to console.warn(JSON) so warnings are never silently dropped
+   * during early boot.
+   */
+  logWarn(msg, ctx) {
+    if (this.logger) {
+      this.logger.warn(msg, ctx);
+    } else {
+      console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    }
   }
   /** Current key version. Starts at 1; incremented by rotateKey(). */
   get keyVersion() {
@@ -808,7 +822,7 @@ var DefaultSecretVault = class {
       newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
       fs2.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
     }
-    checkKeyFilePermissions(this.keyFile);
+    checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
     this.key = newKey;
     this._keyVersion = newVersion;
     return { oldVersion, newVersion };
@@ -827,7 +841,7 @@ var DefaultSecretVault = class {
       fs2.writeFileSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase), {
         mode: 384
       });
-      checkKeyFilePermissions(this.keyFile);
+      checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
     } catch {
     }
   }
@@ -839,13 +853,13 @@ var DefaultSecretVault = class {
         const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
         this.key = key2;
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         return this.key;
       }
       if (buf.length === KEY_BYTES) {
         this.key = buf;
         this._keyVersion = 1;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         this.migrateToWrappedIfPassphrase();
         return this.key;
       }
@@ -869,7 +883,7 @@ var DefaultSecretVault = class {
         }
         this.key = Buffer.from(key2);
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         this.migrateToWrappedIfPassphrase();
         return this.key;
       }
@@ -894,13 +908,13 @@ var DefaultSecretVault = class {
         const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
         this.key = winnerKey;
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         return this.key;
       }
       if (buf.length === KEY_BYTES) {
         this.key = buf;
         this._keyVersion = 1;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         return this.key;
       }
       if (buf.length === VERSIONED_KEY_FILE_SIZE) {
@@ -916,7 +930,7 @@ var DefaultSecretVault = class {
         const winnerKey = buf.subarray(KEY_FILE_MAGIC.length + 1);
         this.key = Buffer.from(winnerKey);
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         return this.key;
       }
       throw new ConfigError({
@@ -1207,6 +1221,173 @@ function getDangerousCapabilities(toolOrCaps) {
   );
 }
 
+// src/security/permission-policy-schema.ts
+var TRUST_POLICY_SCHEMA_VERSION = 1;
+var TRUST_POLICY_LIMITS = Object.freeze({
+  maxTools: 1e3,
+  maxPatternsPerRule: 1e3,
+  maxToolNameChars: 256,
+  maxPatternChars: 4096
+});
+var TRUST_POLICY_JSON_SCHEMA = Object.freeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "https://wrongstack.dev/schemas/trust-policy-v1.json",
+  title: "WrongStack Trust Policy",
+  type: "object",
+  maxProperties: TRUST_POLICY_LIMITS.maxTools,
+  propertyNames: {
+    minLength: 1,
+    maxLength: TRUST_POLICY_LIMITS.maxToolNameChars,
+    not: { enum: ["__proto__", "prototype", "constructor"] }
+  },
+  additionalProperties: {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      allow: {
+        type: "array",
+        maxItems: TRUST_POLICY_LIMITS.maxPatternsPerRule,
+        items: { type: "string", minLength: 1, maxLength: TRUST_POLICY_LIMITS.maxPatternChars }
+      },
+      deny: {
+        type: "array",
+        maxItems: TRUST_POLICY_LIMITS.maxPatternsPerRule,
+        items: { type: "string", minLength: 1, maxLength: TRUST_POLICY_LIMITS.maxPatternChars }
+      },
+      auto: { type: "boolean" },
+      trustWorkdir: { type: "boolean" },
+      denyPrivate: { type: "boolean" }
+    }
+  }
+});
+var RULE_FIELDS = /* @__PURE__ */ new Set(["allow", "deny", "auto", "trustWorkdir", "denyPrivate"]);
+var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function error(diagnostics, code, path3, message) {
+  diagnostics.push({ severity: "error", code, path: path3, message });
+}
+function validatePatterns(value, path3, diagnostics) {
+  if (!Array.isArray(value)) {
+    error(diagnostics, "invalid_pattern_list", path3, "must be an array of strings");
+    return void 0;
+  }
+  if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
+    error(
+      diagnostics,
+      "too_many_patterns",
+      path3,
+      `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
+    );
+    return void 0;
+  }
+  const patterns = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, pattern] of value.entries()) {
+    const itemPath = `${path3}[${index}]`;
+    if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
+      error(
+        diagnostics,
+        "invalid_pattern",
+        itemPath,
+        `must be a non-empty string up to ${TRUST_POLICY_LIMITS.maxPatternChars} characters`
+      );
+      continue;
+    }
+    if (seen.has(pattern)) {
+      diagnostics.push({
+        severity: "warning",
+        code: "duplicate_pattern",
+        path: itemPath,
+        message: "duplicates an earlier pattern and was normalized away"
+      });
+      continue;
+    }
+    seen.add(pattern);
+    patterns.push(pattern);
+  }
+  return patterns;
+}
+function validateTrustPolicy(value) {
+  const diagnostics = [];
+  if (!isRecord(value)) {
+    return {
+      ok: false,
+      diagnostics: [
+        {
+          severity: "error",
+          code: "invalid_root",
+          path: "$",
+          message: "trust policy must be an object"
+        }
+      ]
+    };
+  }
+  const entries = Object.entries(value);
+  if (entries.length > TRUST_POLICY_LIMITS.maxTools) {
+    error(
+      diagnostics,
+      "too_many_tools",
+      "$",
+      `must contain at most ${TRUST_POLICY_LIMITS.maxTools} tool rules`
+    );
+  }
+  const policy = {};
+  for (const [toolName, rawRule] of entries.slice(0, TRUST_POLICY_LIMITS.maxTools)) {
+    const toolPath = `$[${JSON.stringify(toolName)}]`;
+    if (toolName.length === 0 || toolName.length > TRUST_POLICY_LIMITS.maxToolNameChars) {
+      error(
+        diagnostics,
+        "invalid_tool_name",
+        toolPath,
+        `tool name must be 1-${TRUST_POLICY_LIMITS.maxToolNameChars} characters`
+      );
+      continue;
+    }
+    if (UNSAFE_PROPERTY_NAMES.has(toolName)) {
+      error(
+        diagnostics,
+        "unsafe_tool_name",
+        toolPath,
+        "reserved object property names are not valid tool rules"
+      );
+      continue;
+    }
+    if (!isRecord(rawRule)) {
+      error(diagnostics, "invalid_rule", toolPath, "tool rule must be an object");
+      continue;
+    }
+    for (const field of Object.keys(rawRule)) {
+      if (!RULE_FIELDS.has(field)) {
+        error(
+          diagnostics,
+          "unknown_field",
+          `${toolPath}.${field}`,
+          `unknown policy field "${field}"`
+        );
+      }
+    }
+    const rule = {};
+    for (const field of ["allow", "deny"]) {
+      if (rawRule[field] === void 0) continue;
+      const patterns = validatePatterns(rawRule[field], `${toolPath}.${field}`, diagnostics);
+      if (patterns) rule[field] = patterns;
+    }
+    for (const field of ["auto", "trustWorkdir", "denyPrivate"]) {
+      const setting = rawRule[field];
+      if (setting === void 0) continue;
+      if (typeof setting !== "boolean") {
+        error(diagnostics, "invalid_boolean", `${toolPath}.${field}`, "must be a boolean");
+      } else {
+        rule[field] = setting;
+      }
+    }
+    policy[toolName] = rule;
+  }
+  return diagnostics.some((diagnostic) => diagnostic.severity === "error") ? { ok: false, diagnostics } : { ok: true, policy, diagnostics };
+}
+
 // src/utils/lru-cache.ts
 var LruCache = class {
   store = /* @__PURE__ */ new Map();
@@ -1375,6 +1556,8 @@ var DefaultPermissionPolicy = class {
    * the LRU evicts the least-recently-used entries first.
    */
   _evalCache = new LruCache(500);
+  policyDiagnostics = [];
+  policyInvalid = false;
   constructor(opts) {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
@@ -1418,13 +1601,50 @@ var DefaultPermissionPolicy = class {
   getConfirmDestructive() {
     return this.confirmDestructive;
   }
+  /** Read-only diagnostics for policy inspector/editor surfaces. */
+  getPolicyDiagnostics() {
+    return this.policyDiagnostics.map((diagnostic) => ({ ...diagnostic }));
+  }
   async reload() {
+    this.policyDiagnostics = [];
+    this.policyInvalid = false;
     try {
       const raw = await fs3.readFile(this.trustFile, "utf8");
       const parsed = safeParse(raw);
-      if (parsed.ok && parsed.value) this.policy = parsed.value;
-    } catch {
+      if (!parsed.ok) {
+        this.policy = {};
+        this.policyInvalid = true;
+        this.policyDiagnostics = [
+          {
+            severity: "error",
+            code: "invalid_json",
+            path: "$",
+            message: parsed.error ?? "trust policy is not valid JSON"
+          }
+        ];
+      } else {
+        const validation = validateTrustPolicy(parsed.value);
+        this.policyDiagnostics = validation.diagnostics;
+        if (validation.ok) {
+          this.policy = validation.policy;
+        } else {
+          this.policy = {};
+          this.policyInvalid = true;
+        }
+      }
+    } catch (err) {
       this.policy = {};
+      if (err.code !== "ENOENT") {
+        this.policyInvalid = true;
+        this.policyDiagnostics = [
+          {
+            severity: "error",
+            code: "read_error",
+            path: "$",
+            message: err instanceof Error ? err.message : String(err)
+          }
+        ];
+      }
     }
     this.wildcardEntries = [];
     for (const [key, val] of Object.entries(this.policy)) {
@@ -1437,6 +1657,13 @@ var DefaultPermissionPolicy = class {
   }
   async evaluate(tool, input, ctx) {
     if (!this.loaded) await this.reload();
+    if (this.policyInvalid) {
+      return {
+        permission: "deny",
+        source: "deny",
+        reason: "trust policy is invalid; refusing tool execution until it is repaired"
+      };
+    }
     const namespaceEntry = this.findNamespaceEntry(tool.name);
     const entry = this.policy[tool.name] ?? namespaceEntry;
     const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
@@ -1566,6 +1793,9 @@ var DefaultPermissionPolicy = class {
   }
   async trust(rule) {
     if (!this.loaded) await this.reload();
+    if (this.policyInvalid) {
+      throw new Error("Cannot update trust rules while trust.json is invalid; repair it first.");
+    }
     const entry = this.policy[rule.tool] ?? {};
     entry.allow = Array.from(/* @__PURE__ */ new Set([...entry.allow ?? [], rule.pattern]));
     this.policy[rule.tool] = entry;
@@ -1584,6 +1814,9 @@ var DefaultPermissionPolicy = class {
   /** Persist a deny rule — this tool+pattern pair is permanently blocked. */
   async deny(rule) {
     if (!this.loaded) await this.reload();
+    if (this.policyInvalid) {
+      throw new Error("Cannot update deny rules while trust.json is invalid; repair it first.");
+    }
     const entry = this.policy[rule.tool] ?? {};
     entry.deny = Array.from(/* @__PURE__ */ new Set([...entry.deny ?? [], rule.pattern]));
     this.policy[rule.tool] = entry;
@@ -1663,6 +1896,9 @@ export {
   DefaultPermissionPolicy,
   DefaultSecretScrubber,
   DefaultSecretVault,
+  TRUST_POLICY_JSON_SCHEMA,
+  TRUST_POLICY_LIMITS,
+  TRUST_POLICY_SCHEMA_VERSION,
   ToolCapabilities,
   decryptConfigSecrets,
   encryptConfigSecrets,
@@ -1672,6 +1908,7 @@ export {
   isSecretField,
   migratePlaintextSecrets,
   rewriteConfigEncrypted,
-  rotateConfigKeys
+  rotateConfigKeys,
+  validateTrustPolicy
 };
 //# sourceMappingURL=index.js.map