@wrongstack/core 0.289.0 → 0.291.1

package/dist/security/index.js

@@ -264,7 +264,7 @@ async function renameWithRetry(from, to) {
       if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
         throw err;
       }
-      await new Promise((resolve) => setTimeout(resolve, delays[i]));
+      await new Promise((resolve2) => setTimeout(resolve2, delays[i]));
     }
   }
   throw lastErr;
@@ -428,7 +428,7 @@ function matchAny(patterns, input) {
 
 // src/utils/safe-json.ts
 function safeParse(input, maxBytes = 5e6) {
-  if (input.length > maxBytes) {
+  if (Buffer.byteLength(input, "utf8") > maxBytes) {
     return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
   }
   try {
@@ -1265,19 +1265,19 @@ var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function error(diagnostics, code, path3, message) {
-  diagnostics.push({ severity: "error", code, path: path3, message });
+function error(diagnostics, code, path4, message) {
+  diagnostics.push({ severity: "error", code, path: path4, message });
 }
-function validatePatterns(value, path3, diagnostics) {
+function validatePatterns(value, path4, diagnostics) {
   if (!Array.isArray(value)) {
-    error(diagnostics, "invalid_pattern_list", path3, "must be an array of strings");
+    error(diagnostics, "invalid_pattern_list", path4, "must be an array of strings");
     return void 0;
   }
   if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
     error(
       diagnostics,
       "too_many_patterns",
-      path3,
+      path4,
       `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
     );
     return void 0;
@@ -1285,7 +1285,7 @@ function validatePatterns(value, path3, diagnostics) {
   const patterns = [];
   const seen = /* @__PURE__ */ new Set();
   for (const [index, pattern] of value.entries()) {
-    const itemPath = `${path3}[${index}]`;
+    const itemPath = `${path4}[${index}]`;
     if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
       error(
         diagnostics,
@@ -1397,8 +1397,8 @@ var LruCache = class {
     this.capacity = capacity;
   }
   get(key) {
+    if (!this.store.has(key)) return void 0;
     const value = this.store.get(key);
-    if (value === void 0) return void 0;
     this.store.delete(key);
     this.store.set(key, value);
     return value;
@@ -1859,6 +1859,136 @@ var DefaultPermissionPolicy = class {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();
   }
+  /**
+   * Side-effect-free permission evaluation trace. Mirrors `evaluate()`
+   * step-by-step without prompting the user, writing to trust files, or
+   * mutating session state. Returns the full ordered trace and winner.
+   */
+  async explain(tool, input, ctx) {
+    if (!this.loaded) await this.reload();
+    const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+    const steps = [];
+    let winnerIndex = -1;
+    const add = (rule, matched, decision, source, detail) => {
+      steps.push({ rule, matched, decision, source, detail });
+    };
+    if (this.policyInvalid) {
+      add("policy invalid", true, "deny", "deny", "trust policy is invalid; all tools are denied");
+      winnerIndex = 0;
+      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "deny", source: "deny", reason: "trust policy is invalid" } };
+    }
+    add("policy valid", false, "auto", "default", "trust policy loaded successfully");
+    const namespaceEntry = this.findNamespaceEntry(tool.name);
+    const entry = this.policy[tool.name] ?? namespaceEntry;
+    const namespaceSource = namespaceEntry ? `wildcard entry matched (${Object.keys(this.policy).find((k) => k.includes("*") && matchGlob(k, tool.name))})` : "no namespace match";
+    const cacheKey = `${tool.name}::${subject ?? tool.name}`;
+    if (this.sessionDenied.has(cacheKey)) {
+      add("session soft deny", true, "deny", "deny", 'user pressed "no" earlier in this session \u2014 blocked until reload');
+      winnerIndex = steps.length - 1;
+      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "deny", source: "deny", reason: "session soft deny (user pressed no)" } };
+    }
+    add("session soft deny", false, "deny", "deny", "no session-level soft deny for this tool+subject");
+    if (this.sessionAllowed.has(cacheKey)) {
+      add("session soft allow", true, "auto", "trust", 'user pressed "yes" in current session \u2014 one-shot auto-approve (consumed)');
+      winnerIndex = steps.length - 1;
+      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "trust", reason: "session one-shot allow (user pressed yes)" } };
+    }
+    add("session soft allow", false, "auto", "trust", "no session-level one-shot allow for this tool+subject");
+    if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
+      add("trust deny", true, "deny", "deny", `subject "${subject}" matched a deny pattern in trust file`);
+      winnerIndex = steps.length - 1;
+      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "deny", source: "deny", reason: "matched deny pattern" } };
+    }
+    add("trust deny", false, "deny", "deny", `no deny pattern matched (namespace: ${namespaceSource})`);
+    if (tool.permission === "deny") {
+      add("tool default deny", true, "deny", "default", `tool "${tool.name}" has permission: deny by default`);
+      winnerIndex = steps.length - 1;
+      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "deny", source: "default", reason: "tool default deny" } };
+    }
+    add("tool default deny", false, "deny", "default", `tool "${tool.name}" has permission: "${tool.permission}"`);
+    if (entry?.allow && subject && matchesTrust(entry.allow, subject)) {
+      add("trust allow", true, "auto", "trust", `subject "${subject}" matched an allow pattern in trust file`);
+      winnerIndex = steps.length - 1;
+      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "trust", reason: "matched allow pattern" } };
+    }
+    add("trust allow", false, "auto", "trust", `no allow pattern matched (namespace: ${namespaceSource})`);
+    if (entry?.auto) {
+      add("trust auto", true, "auto", "trust", `trust file has auto: true for "${tool.name}"`);
+      winnerIndex = steps.length - 1;
+      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "trust", reason: "trust auto" } };
+    }
+    add("trust auto", false, "auto", "trust", `no auto flag for "${tool.name}" in trust file`);
+    if (!this.yolo && this.isSensitiveReadCall(tool, input)) {
+      const hasDelegate2 = this.promptDelegate !== void 0;
+      add(
+        "sensitive read",
+        true,
+        hasDelegate2 ? "confirm" : "confirm",
+        "default",
+        hasDelegate2 ? "sensitive file read detected \u2014 would prompt user for approval" : "sensitive file read detected \u2014 returns confirm (no prompt delegate)"
+      );
+      winnerIndex = steps.length - 1;
+      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "confirm", source: "default", riskTier: "standard", reason: "sensitive file read needs explicit approval" } };
+    }
+    add("sensitive read", false, "confirm", "default", "not a sensitive read call (or YOLO bypasses this check)");
+    if (this.yolo) {
+      add("yolo", true, "auto", "yolo", "YOLO mode is active \u2014 auto-approving every non-denied call");
+      winnerIndex = steps.length - 1;
+      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "yolo" } };
+    }
+    add("yolo", false, "auto", "yolo", "YOLO mode is not active");
+    if (tool.name === "write" && subject) {
+      const hasRead = ctx.hasRead(subject);
+      add(
+        "write smart bypass",
+        hasRead,
+        "auto",
+        "context",
+        hasRead ? `file "${subject}" was already read in this session \u2014 auto-approving write` : `file "${subject}" was not read in this session \u2014 bypass does not apply`
+      );
+      if (hasRead) {
+        winnerIndex = steps.length - 1;
+        return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "context", reason: "file already read in this session" } };
+      }
+    } else {
+      add("write smart bypass", false, "auto", "context", 'tool is not "write" or has no subject \u2014 bypass does not apply');
+    }
+    const hasWriteCap = hasCapability(tool, ToolCapabilities.FS_WRITE);
+    const hasShellCap = hasCapability(tool, [
+      ToolCapabilities.SHELL_ARBITRARY,
+      ToolCapabilities.SHELL_RESTRICTED,
+      ToolCapabilities.SHELL_EXEC
+    ]);
+    const hasInstallCap = hasCapability(tool, ToolCapabilities.PACKAGE_INSTALL);
+    const hasConfigCap = hasCapability(tool, ToolCapabilities.CONFIG_MUTATE);
+    const hasSubagentCap = hasCapability(tool, ToolCapabilities.SUBAGENT_SPAWN);
+    const isMutating = tool.mutating || hasWriteCap || hasShellCap || hasInstallCap || hasConfigCap || hasSubagentCap;
+    if (tool.permission === "auto" && !isMutating) {
+      add("safe default auto", true, "auto", "default", `tool "${tool.name}" has auto permission and is not mutating \u2014 safe to auto-approve`);
+      winnerIndex = steps.length - 1;
+      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "default" } };
+    }
+    add(
+      "mutating default confirm",
+      true,
+      "confirm",
+      "default",
+      isMutating ? `tool "${tool.name}" is mutating (default auto not enough) \u2014 needs confirmation` : `tool "${tool.name}" has "${tool.permission}" permission \u2014 needs confirmation`
+    );
+    winnerIndex = steps.length - 1;
+    const hasDelegate = this.promptDelegate !== void 0;
+    return {
+      toolName: tool.name,
+      subject,
+      steps,
+      winnerIndex,
+      decision: {
+        permission: "confirm",
+        source: "default",
+        ...hasDelegate ? { reason: "would prompt user via delegate" } : {}
+      }
+    };
+  }
   findNamespaceEntry(toolName) {
     for (const { pattern, value } of this.wildcardEntries) {
       if (matchGlob(pattern, toolName)) return value;
@@ -1904,9 +2034,186 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   }
   allowOnce() {
   }
+  async explain(tool) {
+    const decision = await this.evaluate(tool);
+    return {
+      toolName: tool.name,
+      subject: null,
+      steps: [
+        {
+          rule: "subagent auto",
+          matched: decision.permission === "auto",
+          decision: decision.permission,
+          source: decision.source,
+          detail: decision.reason ?? `subagent policy: ${decision.permission}`
+        }
+      ],
+      winnerIndex: 0,
+      decision
+    };
+  }
   async reload() {
   }
 };
+
+// src/security/kanban-boundary.ts
+import { realpath } from "node:fs/promises";
+import * as path3 from "node:path";
+import {
+  evaluateKanbanBoundaryOpaque,
+  evaluateKanbanBoundaryPath,
+  readBoard,
+  resolveKanbanBoundaryLayers
+} from "@wrongstack/kanban";
+var PATH_KEYS = /* @__PURE__ */ new Set([
+  "path",
+  "paths",
+  "file",
+  "files",
+  "directory",
+  "dir",
+  "cwd",
+  "root",
+  "baseDir",
+  "out",
+  "outputPath",
+  "sourcePath",
+  "targetPath",
+  "destinationPath",
+  "fromPath",
+  "toPath",
+  "worktreePath"
+]);
+var TOOL_PATH_KEYS = {
+  // `target` is an identifier in tools such as plan/task/document, but a
+  // filesystem target in language_info. Keep ambiguous names tool-specific.
+  language_info: ["target"]
+};
+async function evaluateToolKanbanBoundary(tool, input, ctx) {
+  const identity = resolveKanbanIdentity(ctx);
+  if (!identity.boardId) return { decision: "allow" };
+  const board = await readBoard(identity.policyRoot ?? ctx.projectRoot, identity.boardId);
+  if (!board) return { decision: "allow" };
+  const task = identity.taskId ? board.tasks.find((candidate) => candidate.id === identity.taskId) : void 0;
+  const layers = resolveKanbanBoundaryLayers(board, task);
+  if (layers.length === 0) return { decision: "allow" };
+  const caps = tool.capabilities ?? [];
+  const access2 = caps.includes("fs.write") || caps.includes("fs.write.outside-project") ? "write" : caps.includes("fs.read") ? "read" : void 0;
+  const shellLike = caps.some((capability) => capability.startsWith("shell."));
+  const candidates = access2 ? await extractCandidatePaths(tool.name, input, ctx) : [];
+  let evaluation;
+  if (shellLike || access2 && candidates.length === 0) {
+    evaluation = evaluateKanbanBoundaryOpaque(layers, tool.name);
+  } else if (access2) {
+    const results = candidates.map(
+      (candidate) => evaluateKanbanBoundaryPath(layers, candidate, access2)
+    );
+    evaluation = results.find((result) => result.decision === "block") ?? results.find((result) => result.decision === "confirm") ?? { decision: "allow" };
+  } else {
+    evaluation = { decision: "allow" };
+  }
+  return {
+    ...evaluation,
+    boardId: board.id,
+    ...task ? { taskId: task.id } : {}
+  };
+}
+function resolveKanbanIdentity(ctx) {
+  const metaKanban = ctx.meta["kanban"];
+  const record = metaKanban && typeof metaKanban === "object" ? metaKanban : void 0;
+  const boardId = ctx.currentKanbanBoardId ?? (typeof record?.["boardId"] === "string" ? record["boardId"] : void 0);
+  const taskId = ctx.currentKanbanTaskId ?? (typeof record?.["taskId"] === "string" ? record["taskId"] : void 0);
+  const policyRoot = typeof record?.["projectRoot"] === "string" ? record["projectRoot"] : void 0;
+  return {
+    ...boardId ? { boardId } : {},
+    ...taskId ? { taskId } : {},
+    ...policyRoot ? { policyRoot } : {}
+  };
+}
+async function extractCandidatePaths(toolName, input, ctx) {
+  if (toolName === "patch" && typeof input["patch"] === "string") {
+    const directoryInput = stringValue(input["directory"]) ?? ctx.workingDir;
+    const directory = path3.isAbsolute(directoryInput) ? directoryInput : path3.resolve(ctx.workingDir, directoryInput);
+    const strip = Math.max(1, numericValue(input["strip"]) ?? 1);
+    const targets = extractPatchTargets(input["patch"], strip).map(
+      (target) => relativeToProject(path3.resolve(directory, target), ctx.projectRoot)
+    );
+    return Promise.all(targets.map((target) => canonicalizeCandidatePath(target, ctx)));
+  }
+  const values = [];
+  const pathKeys = new Set(PATH_KEYS);
+  for (const key of TOOL_PATH_KEYS[toolName] ?? []) pathKeys.add(key);
+  collectPathValues(input, values, pathKeys);
+  if (toolName === "scaffold" && typeof input["name"] === "string") {
+    const cwd = stringValue(input["cwd"]) ?? ctx.workingDir;
+    values.push(path3.join(cwd, input["name"]));
+  }
+  const candidates = [
+    ...new Set(values.flatMap(splitPathList).map((value) => resolveInputPath(value, ctx)))
+  ];
+  return Promise.all(candidates.map((candidate) => canonicalizeCandidatePath(candidate, ctx)));
+}
+async function canonicalizeCandidatePath(candidate, ctx) {
+  if (path3.isAbsolute(candidate)) return candidate;
+  const absolute = path3.resolve(ctx.projectRoot, candidate);
+  const canonicalRoot = await realpath(ctx.projectRoot).catch(() => ctx.projectRoot);
+  let probe = absolute;
+  const missingSegments = [];
+  while (true) {
+    try {
+      const canonical = path3.join(await realpath(probe), ...missingSegments);
+      return relativeToProject(canonical, canonicalRoot);
+    } catch (cause) {
+      const code = cause.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return absolute;
+      const parent = path3.dirname(probe);
+      if (parent === probe) return absolute;
+      missingSegments.unshift(path3.basename(probe));
+      probe = parent;
+    }
+  }
+}
+function collectPathValues(value, output, pathKeys, key) {
+  if (typeof value === "string") {
+    if (key && pathKeys.has(key)) output.push(value);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectPathValues(item, output, pathKeys, key);
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [childKey, child] of Object.entries(value)) {
+    collectPathValues(child, output, pathKeys, childKey);
+  }
+}
+function splitPathList(value) {
+  return value.split(",").map((item) => item.trim()).filter(Boolean);
+}
+function resolveInputPath(value, ctx) {
+  const absolute = path3.isAbsolute(value) ? value : path3.resolve(ctx.workingDir, value);
+  return relativeToProject(absolute, ctx.projectRoot);
+}
+function relativeToProject(absolute, projectRoot) {
+  const relative2 = path3.relative(projectRoot, absolute).replace(/\\/g, "/");
+  return relative2.startsWith("../") || path3.isAbsolute(relative2) ? absolute : relative2 || ".";
+}
+function extractPatchTargets(patchText, strip) {
+  const targets = [];
+  for (const match of patchText.matchAll(/^\+\+\+\s+([^\t\r\n]+)/gm)) {
+    const raw = match[1]?.trim();
+    if (!raw || raw === "/dev/null") continue;
+    const parts = raw.replace(/\\/g, "/").split("/").filter((part) => part && part !== ".");
+    if (parts.length > strip) targets.push(parts.slice(strip).join("/"));
+  }
+  return targets;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function numericValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
 export {
   AutoApprovePermissionPolicy,
   DANGEROUS_FOR_SUBAGENTS,
@@ -1919,6 +2226,7 @@ export {
   ToolCapabilities,
   decryptConfigSecrets,
   encryptConfigSecrets,
+  evaluateToolKanbanBoundary,
   getDangerousCapabilities,
   hasCapability,
   hasDangerousCapabilityForSubagents,