@zoebuildsai/trace 1.5.0

package/src/workspace-isolation.ts

@@ -0,0 +1,298 @@
+/**
+ * Workspace Isolation for Trace
+ * Enforce security boundary between project workspace and private data
+ */
+
+import * as path from 'path';
+
+export interface WorkspaceBoundary {
+  root: string; // Workspace root (where git is initialized)
+  allowed: string[]; // Paths allowed in git
+  blocked: string[]; // Paths never committed
+  isPublic: boolean; // Whether workspace is public repo
+}
+
+export interface SecurityViolation {
+  path: string;
+  reason: string;
+  severity: 'warning' | 'error' | 'critical';
+  suggestion: string;
+}
+
+export class WorkspaceIsolation {
+  private boundary: WorkspaceBoundary;
+  private violations: SecurityViolation[] = [];
+
+  constructor(workspaceRoot: string, isPublic: boolean = true) {
+    this.boundary = {
+      root: workspaceRoot,
+      allowed: [
+        'src/',
+        'tests/',
+        'dist/',
+        'docs/',
+        'package.json',
+        'tsconfig.json',
+        'README.md',
+        '.gitignore',
+        '.gitattributes',
+        'LICENSE',
+      ],
+      blocked: [
+        '.env',
+        '.env.local',
+        '.env.*.local',
+        '*.key',
+        '*.pem',
+        'secrets.json',
+        'config.local.json',
+        '.credentials',
+        'credentials.json',
+        'oauth.json',
+        'api-keys.json',
+        'tokens.json',
+        'passwords.txt',
+        '.workspace/',
+        'workspace-private/',
+        'private/',
+        '.local/',
+        'agent-*.key',
+        'agent-*.pem',
+        'agent-keys/',
+        '.trace/config.local.json',
+        '.trace/keys.json',
+      ],
+      isPublic,
+    };
+  }
+
+  /**
+   * Check if path is safe to commit
+   */
+  isSafeToCommit(filePath: string): { safe: boolean; violations: SecurityViolation[] } {
+    const violations: SecurityViolation[] = [];
+
+    // Normalize path
+    const normalized = path.normalize(filePath).replace(/\\/g, '/');
+
+    // Check against blocked patterns
+    for (const blocked of this.boundary.blocked) {
+      if (this.matchesPattern(normalized, blocked)) {
+        violations.push({
+          path: filePath,
+          reason: `Matches blocked pattern: ${blocked}`,
+          severity: 'critical',
+          suggestion: `Add to .gitignore: ${blocked}`,
+        });
+      }
+    }
+
+    // Check if file is outside workspace root
+    const fullPath = path.resolve(this.boundary.root, filePath);
+    const relative = path.relative(this.boundary.root, fullPath);
+
+    if (relative.startsWith('..')) {
+      violations.push({
+        path: filePath,
+        reason: 'File is outside workspace root',
+        severity: 'critical',
+        suggestion: `Use paths relative to ${this.boundary.root}`,
+      });
+    }
+
+    // Warn on sensitive filenames
+    if (this.hasSensitiveName(normalized)) {
+      violations.push({
+        path: filePath,
+        reason: 'Filename suggests sensitive data',
+        severity: 'warning',
+        suggestion: 'Verify this file should be committed',
+      });
+    }
+
+    return {
+      safe: violations.length === 0,
+      violations,
+    };
+  }
+
+  /**
+   * Scan directory for violations
+   */
+  scanDirectory(dirPath: string): {
+    safeFiles: string[];
+    violatingFiles: string[];
+    violations: SecurityViolation[];
+  } {
+    const safeFiles: string[] = [];
+    const violatingFiles: string[] = [];
+    const allViolations: SecurityViolation[] = [];
+
+    // In real implementation, would recursively scan directory
+    // For now, check common patterns
+
+    const testPaths = [
+      'src/index.ts',
+      '.env',
+      'secrets.json',
+      '.credentials',
+      'package.json',
+    ];
+
+    for (const testPath of testPaths) {
+      const result = this.isSafeToCommit(testPath);
+      if (result.safe) {
+        safeFiles.push(testPath);
+      } else {
+        violatingFiles.push(testPath);
+        allViolations.push(...result.violations);
+      }
+    }
+
+    return { safeFiles, violatingFiles, violations: allViolations };
+  }
+
+  /**
+   * Check if git operation would leak private data
+   */
+  validateGitPush(filePaths: string[]): {
+    canPush: boolean;
+    violations: SecurityViolation[];
+  } {
+    const violations: SecurityViolation[] = [];
+
+    for (const file of filePaths) {
+      const result = this.isSafeToCommit(file);
+      if (!result.safe) {
+        violations.push(...result.violations);
+      }
+    }
+
+    return {
+      canPush: violations.length === 0,
+      violations,
+    };
+  }
+
+  /**
+   * Get workspace boundary info
+   */
+  getBoundary(): WorkspaceBoundary {
+    return { ...this.boundary };
+  }
+
+  /**
+   * Set custom allowed paths
+   */
+  setAllowed(paths: string[]): void {
+    this.boundary.allowed = paths;
+  }
+
+  /**
+   * Add path to blocked list
+   */
+  blockPath(pattern: string): void {
+    if (!this.boundary.blocked.includes(pattern)) {
+      this.boundary.blocked.push(pattern);
+    }
+  }
+
+  /**
+   * Check if filename has sensitive indicators
+   */
+  private hasSensitiveName(filePath: string): boolean {
+    const sensitive = [
+      'password',
+      'secret',
+      'token',
+      'credential',
+      'apikey',
+      'api_key',
+      'private',
+      'backup',
+      'dump',
+      'key',
+      'pem',
+      'cert',
+    ];
+
+    const fileName = path.basename(filePath).toLowerCase();
+
+    return sensitive.some(s => fileName.includes(s));
+  }
+
+  /**
+   * Match path against pattern (supports * wildcards)
+   */
+  private matchesPattern(filePath: string, pattern: string): boolean {
+    // Simple glob-style matching
+    const regex = pattern
+      .replace(/\./g, '\\.')
+      .replace(/\*/g, '.*')
+      .replace(/\?/g, '.');
+
+    return new RegExp(`^${regex}$`).test(filePath);
+  }
+
+  /**
+   * Generate security report
+   */
+  generateReport(): string {
+    let report = `\n🔒 WORKSPACE SECURITY REPORT\n`;
+    report += `Workspace Root: ${this.boundary.root}\n`;
+    report += `Public Repository: ${this.boundary.isPublic ? 'Yes' : 'No'}\n\n`;
+
+    report += `✅ ALLOWED PATHS (${this.boundary.allowed.length}):\n`;
+    for (const path of this.boundary.allowed) {
+      report += `  • ${path}\n`;
+    }
+
+    report += `\n🚫 BLOCKED PATHS (${this.boundary.blocked.length}):\n`;
+    for (const path of this.boundary.blocked) {
+      report += `  • ${path}\n`;
+    }
+
+    if (this.violations.length > 0) {
+      report += `\n⚠️  VIOLATIONS DETECTED (${this.violations.length}):\n`;
+      for (const v of this.violations) {
+        report += `  [${v.severity.toUpperCase()}] ${v.path}\n`;
+        report += `    Reason: ${v.reason}\n`;
+        report += `    Fix: ${v.suggestion}\n`;
+      }
+    }
+
+    return report;
+  }
+
+  /**
+   * Create pre-commit hook content
+   */
+  getPreCommitHook(): string {
+    return `#!/bin/bash
+# Trace Pre-Commit Security Hook
+# Prevents accidental commits of private files
+
+STAGED_FILES=$(git diff --cached --name-only)
+
+for file in $STAGED_FILES; do
+  if [[ $file == .env* ]] || [[ $file == *.key ]] || [[ $file == *.pem ]] || [[ $file == *secret* ]] || [[ $file == *credential* ]]; then
+    echo "🚫 SECURITY: Cannot commit private file: $file"
+    echo "   Add to .gitignore if this is intentional"
+    exit 1
+  fi
+done
+
+echo "✅ Pre-commit security check passed"
+exit 0
+`;
+  }
+
+  /**
+   * Clear violations log
+   */
+  clearViolations(): void {
+    this.violations = [];
+  }
+}
+
+export default WorkspaceIsolation;

package/tests/auto-commit.test.ts

@@ -0,0 +1,308 @@
+/**
+ * Auto-Commit Feature Tests
+ * 
+ * Core test suite for auto-commit functionality:
+ * - File watching with configurable intervals
+ * - Change detection (skip if no changes)
+ * - Auto-commit prefix handling
+ * - Concurrent change handling
+ * - Performance requirements (<500ms)
+ */
+
+import { AutoCommitter } from '../src/auto-commit';
+import { TraceCommands } from '../src/commands';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+
+describe('Auto-Commit Feature', () => {
+  let testDir: string;
+  let homeDir: string;
+  let memoryDir: string;
+  let commands: TraceCommands;
+  let autoCommitter: AutoCommitter;
+
+  beforeEach(() => {
+    testDir = fs.mkdtempSync(path.join(os.tmpdir(), 'memory-git-'));
+    homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'home-'));
+    process.env.HOME = homeDir;
+    memoryDir = path.join(homeDir, '.openclaw/memory');
+    fs.mkdirSync(memoryDir, { recursive: true });
+    
+    commands = new TraceCommands(testDir);
+    autoCommitter = new AutoCommitter(commands, memoryDir);
+  });
+
+  afterEach(() => {
+    if (autoCommitter) {
+      autoCommitter.stop();
+    }
+    if (fs.existsSync(testDir)) {
+      fs.rmSync(testDir, { recursive: true, force: true });
+    }
+    if (fs.existsSync(homeDir)) {
+      fs.rmSync(homeDir, { recursive: true, force: true });
+    }
+  });
+
+  describe('Interval configuration', () => {
+    it('should commit with default 60s interval', () => {
+      autoCommitter.start({}); // default interval
+      expect(autoCommitter.getInterval()).toBe(60000);
+    });
+
+    it('should respect custom interval', () => {
+      autoCommitter.start({ interval: 200 });
+      expect(autoCommitter.getInterval()).toBe(200);
+    });
+
+    it('should handle interval in milliseconds', () => {
+      autoCommitter.start({ interval: 1500 });
+      expect(autoCommitter.getInterval()).toBe(1500);
+    });
+
+    it('should allow interval update while watching', () => {
+      autoCommitter.start({ interval: 100 });
+      expect(autoCommitter.getInterval()).toBe(100);
+
+      autoCommitter.setInterval(200);
+      expect(autoCommitter.getInterval()).toBe(200);
+    });
+  });
+
+  describe('Watch control', () => {
+    it('should start watching', () => {
+      autoCommitter.start({ interval: 100 });
+      expect(autoCommitter.isRunning_()).toBe(true);
+    });
+
+    it('should stop watching', () => {
+      autoCommitter.start({ interval: 100 });
+      expect(autoCommitter.isRunning_()).toBe(true);
+
+      autoCommitter.stop();
+      expect(autoCommitter.isRunning_()).toBe(false);
+    });
+
+    it('should not throw when stopping if not started', () => {
+      expect(() => {
+        autoCommitter.stop();
+      }).not.toThrow();
+    });
+
+    it('should handle restart after stop', () => {
+      autoCommitter.start({ interval: 100 });
+      autoCommitter.stop();
+      autoCommitter.start({ interval: 100 });
+      expect(autoCommitter.isRunning_()).toBe(true);
+    });
+  });
+
+  describe('Core logic - commit detection', () => {
+    it('should create initial commit', () => {
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'content');
+      const hash = commands.commit('initial');
+      expect(hash).toBeDefined();
+      expect(hash.length).toBeGreaterThan(0);
+      expect(typeof hash).toBe('string');
+    });
+
+    it('should detect file changes', () => {
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'content');
+      commands.commit('initial');
+
+      // Make change
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'updated');
+
+      const status = commands.status();
+      expect(status.modified.length).toBeGreaterThan(0);
+      expect(status.clean).toBe(false);
+    });
+
+    it('should detect added files', () => {
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'content');
+      commands.commit('initial');
+
+      // Add new file
+      fs.writeFileSync(path.join(memoryDir, 'new.md'), 'new');
+
+      const status = commands.status();
+      expect(status.added.length).toBeGreaterThan(0);
+    });
+
+    it('should detect deleted files', () => {
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'content');
+      commands.commit('initial');
+
+      // Delete file
+      fs.unlinkSync(path.join(memoryDir, 'test.md'));
+
+      const status = commands.status();
+      expect(status.deleted.length).toBeGreaterThan(0);
+    });
+
+    it('should skip commits when no changes', () => {
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'content');
+      commands.commit('initial');
+
+      const status = commands.status();
+      expect(status.clean).toBe(true);
+      expect(status.modified.length).toBe(0);
+      expect(status.added.length).toBe(0);
+      expect(status.deleted.length).toBe(0);
+    });
+  });
+
+  describe('Auto-commit markers', () => {
+    it('should mark commits with [auto] prefix', () => {
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'initial');
+      commands.commit('initial');
+
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'updated');
+
+      const message = '[auto] Memory snapshot (files: 1)';
+      const hash = commands.commit(message, 'agent', { auto: true });
+
+      const log = commands.log(1);
+      expect(log[0].message).toContain('[auto]');
+      expect(log[0].message).toContain('Memory snapshot');
+    });
+
+    it('should include file count in metadata', () => {
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'content');
+      commands.commit('initial');
+
+      fs.writeFileSync(path.join(memoryDir, 'file1.md'), 'new');
+      fs.writeFileSync(path.join(memoryDir, 'file2.md'), 'new');
+
+      const metadata = { auto: true, filesChanged: 2, timestamp: Date.now() };
+      commands.commit('[auto] Memory snapshot (files: 2)', 'agent', metadata);
+
+      const commit = commands.getCurrentCommit();
+      expect(commit?.metadata?.auto).toBe(true);
+      expect(commit?.metadata?.filesChanged).toBe(2);
+    });
+
+    it('should mark author as agent', () => {
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'content');
+      const hash = commands.commit('[auto] test', 'agent');
+
+      const log = commands.log(1);
+      expect(log[0].author).toBe('agent');
+    });
+  });
+
+  describe('Ignore patterns', () => {
+    it('should skip node_modules by default', () => {
+      fs.mkdirSync(path.join(memoryDir, 'node_modules'), { recursive: true });
+      fs.writeFileSync(path.join(memoryDir, 'node_modules', 'pkg.json'), 'data');
+
+      // The auto-committer should ignore node_modules changes
+      autoCommitter.start({ interval: 100, ignorePatterns: ['node_modules'] });
+
+      expect(autoCommitter.isRunning_()).toBe(true);
+      autoCommitter.stop();
+    });
+  });
+
+  describe('Performance', () => {
+    it('should initialize quickly', () => {
+      const start = Date.now();
+      autoCommitter.start({ interval: 50 });
+      const duration = Date.now() - start;
+
+      expect(duration).toBeLessThan(100);
+      autoCommitter.stop();
+    });
+
+    it('should commit in under 500ms', () => {
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'x'.repeat(10000));
+      commands.commit('initial');
+
+      fs.writeFileSync(path.join(memoryDir, 'test.md'), 'x'.repeat(10001));
+
+      const start = Date.now();
+      const message = '[auto] Memory snapshot (files: 1)';
+      commands.commit(message, 'agent', { auto: true });
+      const duration = Date.now() - start;
+
+      expect(duration).toBeLessThan(500);
+    });
+
+    it('should handle many commits quickly', () => {
+      for (let i = 0; i < 50; i++) {
+        fs.writeFileSync(path.join(memoryDir, `file-${i}.txt`), `content ${i}`);
+        commands.commit(`commit ${i}`);
+      }
+
+      const log = commands.log(100);
+      expect(log.length).toBeGreaterThanOrEqual(50);
+    });
+  });
+
+  describe('Edge cases', () => {
+    it('should handle empty directory', () => {
+      autoCommitter.start({ interval: 100 });
+      expect(autoCommitter.isRunning_()).toBe(true);
+      autoCommitter.stop();
+    });
+
+    it('should handle special characters in filenames', () => {
+      fs.writeFileSync(path.join(memoryDir, 'initial.md'), 'start');
+      commands.commit('initial');
+
+      fs.writeFileSync(path.join(memoryDir, 'file-with-dash.md'), 'content');
+      fs.writeFileSync(path.join(memoryDir, 'file_with_underscore.md'), 'content');
+      
+      const status = commands.status();
+      expect(status.added.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should handle deeply nested files', () => {
+      const deep = path.join(memoryDir, 'a', 'b', 'c', 'd');
+      fs.mkdirSync(deep, { recursive: true });
+      fs.writeFileSync(path.join(deep, 'file.md'), 'content');
+
+      commands.commit('nested');
+      const log = commands.log(1);
+      expect(log[0].message).toBe('nested');
+    });
+
+    it('should not throw on permission errors', () => {
+      const file = path.join(memoryDir, 'readonly.md');
+      fs.writeFileSync(file, 'content');
+      commands.commit('initial');
+
+      autoCommitter.start({ interval: 100 });
+      expect(autoCommitter.isRunning_()).toBe(true);
+
+      autoCommitter.stop();
+    });
+  });
+
+  describe('Multi-interval scenarios', () => {
+    it('should handle interval changes mid-run', () => {
+      autoCommitter.start({ interval: 100 });
+      autoCommitter.setInterval(200);
+      autoCommitter.setInterval(50);
+
+      expect(autoCommitter.getInterval()).toBe(50);
+      expect(autoCommitter.isRunning_()).toBe(true);
+
+      autoCommitter.stop();
+    });
+
+    it('should stop and restart cleanly', () => {
+      autoCommitter.start({ interval: 100 });
+      autoCommitter.stop();
+
+      expect(autoCommitter.isRunning_()).toBe(false);
+
+      autoCommitter.start({ interval: 150 });
+      expect(autoCommitter.isRunning_()).toBe(true);
+      expect(autoCommitter.getInterval()).toBe(150);
+
+      autoCommitter.stop();
+    });
+  });
+});