aiblueprint-cli 1.4.46 → 1.4.48

package/claude-code-config/scripts/command-validator/src/lib/security-rules.ts

@@ -1,174 +0,0 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
-import type { SecurityRules } from "./types";
-
-export const SECURITY_RULES: SecurityRules = {
-	CRITICAL_COMMANDS: [
-		"del",
-		"format",
-		"mkfs",
-		"shred",
-		"dd",
-		"fdisk",
-		"parted",
-		"gparted",
-		"cfdisk",
-	],
-
-	PRIVILEGE_COMMANDS: [
-		"sudo",
-		"su",
-		"passwd",
-		"chpasswd",
-		"usermod",
-		"chmod",
-		"chown",
-		"chgrp",
-		"setuid",
-		"setgid",
-	],
-
-	NETWORK_COMMANDS: [
-		"nc",
-		"netcat",
-		"nmap",
-		"telnet",
-		"ssh-keygen",
-		"iptables",
-		"ufw",
-		"firewall-cmd",
-		"ipfw",
-	],
-
-	SYSTEM_COMMANDS: [
-		"systemctl",
-		"service",
-		"kill",
-		"killall",
-		"pkill",
-		"mount",
-		"umount",
-		"swapon",
-		"swapoff",
-	],
-
-	DANGEROUS_PATTERNS: [
-		/rm\s+.*-rf\s*\/\s*$/i,
-		/rm\s+.*-rf\s*\/etc/i,
-		/rm\s+.*-rf\s*\/usr/i,
-		/rm\s+.*-rf\s*\/bin/i,
-		/rm\s+.*-rf\s*\/sys/i,
-		/rm\s+.*-rf\s*\/proc/i,
-		/rm\s+.*-rf\s*\/boot/i,
-		/rm\s+.*-rf\s*\/home\/[^/]*\s*$/i,
-		/rm\s+.*-rf\s*\.\.+\//i,
-		/rm\s+.*-rf\s*\*.*\*/i,
-		/rm\s+.*-rf\s*\$\w+/i,
-		/>\s*\/dev\/(sda|hda|nvme)/i,
-		/dd\s+.*of=\/dev\//i,
-		/shred\s+.*\/dev\//i,
-		/mkfs\.\w+\s+\/dev\//i,
-		/:\(\)\{\s*:\|:&\s*\};:/,
-		/while\s+true\s*;\s*do.*done/i,
-		/for\s*\(\(\s*;\s*;\s*\)\)/i,
-		/\|\s*(sh|bash|zsh|fish)$/i,
-		/(wget|curl)\s+.*\|\s*(sh|bash)/i,
-		/(wget|curl)\s+.*-O-.*\|\s*(sh|bash)/i,
-		/`.*rm.*`/i,
-		/\$\(.*rm.*\)/i,
-		/`.*dd.*`/i,
-		/\$\(.*dd.*\)/i,
-		/cat\s+\/etc\/(passwd|shadow|sudoers)/i,
-		/>\s*\/etc\/(passwd|shadow|sudoers)/i,
-		/echo\s+.*>>\s*\/etc\/(passwd|shadow|sudoers)/i,
-		/\|\s*nc\s+\S+\s+\d+/i,
-		/curl\s+.*-d.*\$\(/i,
-		/wget\s+.*--post-data.*\$\(/i,
-		/>\s*\/var\/log\//i,
-		/rm\s+\/var\/log\//i,
-		/echo\s+.*>\s*~?\/?\.bash_history/i,
-		/nc\s+.*-l.*-e/i,
-		/nc\s+.*-e.*-l/i,
-		/ncat\s+.*--exec/i,
-		/ssh-keygen.*authorized_keys/i,
-		/(wget|curl).*\.(sh|py|pl|exe|bin).*\|\s*(sh|bash|python)/i,
-		/(xmrig|ccminer|cgminer|bfgminer)/i,
-		/cat\s+\/dev\/(mem|kmem)/i,
-		/echo\s+.*>\s*\/dev\/(mem|kmem)/i,
-		/(insmod|rmmod|modprobe)\s+/i,
-		/crontab\s+-e/i,
-		/echo\s+.*>>\s*\/var\/spool\/cron/i,
-		/env\s*\|\s*grep.*PASSWORD/i,
-		/printenv.*PASSWORD/i,
-		/docker\s+(rm|rmi|kill|stop)\s+.*\$\(/i,
-		/docker\s+system\s+prune.*-a/i,
-		/docker\s+container\s+prune.*-f/i,
-		/docker\s+volume\s+rm.*\$\(/i,
-		/docker\s+network\s+rm.*\$\(/i,
-		/prisma\s+(migrate\s+reset|db\s+push\s+--force-reset)/i,
-	],
-
-	PROTECTED_PATHS: [
-		"/etc/",
-		"/usr/",
-		"/sbin/",
-		"/boot/",
-		"/sys/",
-		"/proc/",
-		"/dev/",
-		"/root/",
-	],
-
-	SAFE_EXECUTABLE_PATHS: [
-		"/Applications/",
-		"/usr/local/bin/",
-		"/usr/bin/",
-		"/bin/",
-		"/opt/",
-	],
-
-	SAFE_RM_PATHS: [
-		join(homedir(), "Developer/"),
-		"/tmp/",
-		"/var/tmp/",
-		`${process.cwd()}/`,
-	],
-};
-
-export const SAFE_COMMANDS = [
-	"ls",
-	"dir",
-	"pwd",
-	"whoami",
-	"date",
-	"echo",
-	"cat",
-	"head",
-	"tail",
-	"grep",
-	"find",
-	"wc",
-	"sort",
-	"uniq",
-	"cut",
-	"awk",
-	"sed",
-	"git",
-	"npm",
-	"pnpm",
-	"node",
-	"bun",
-	"python",
-	"pip",
-	"source",
-	"cd",
-	"cp",
-	"mv",
-	"mkdir",
-	"touch",
-	"ln",
-	"psql",
-	"mysql",
-	"sqlite3",
-	"mongo",
-];

package/claude-code-config/scripts/command-validator/src/lib/types.ts

@@ -1,34 +0,0 @@
-export interface HookInput {
-	tool_name: string;
-	tool_input: {
-		command?: string;
-	};
-	session_id?: string;
-}
-
-export interface ValidationResult {
-	isValid: boolean;
-	severity: "LOW" | "MEDIUM" | "HIGH" | "CRITICAL";
-	violations: string[];
-	sanitizedCommand: string;
-	action: "allow" | "deny" | "ask";
-}
-
-export interface SecurityRules {
-	CRITICAL_COMMANDS: string[];
-	PRIVILEGE_COMMANDS: string[];
-	NETWORK_COMMANDS: string[];
-	SYSTEM_COMMANDS: string[];
-	DANGEROUS_PATTERNS: RegExp[];
-	PROTECTED_PATHS: string[];
-	SAFE_EXECUTABLE_PATHS: string[];
-	SAFE_RM_PATHS: string[];
-}
-
-export interface HookOutput {
-	hookSpecificOutput: {
-		hookEventName: string;
-		permissionDecision: "allow" | "block" | "ask";
-		permissionDecisionReason: string;
-	};
-}

package/claude-code-config/scripts/command-validator/src/lib/validator.ts

@@ -1,90 +0,0 @@
-import type { ValidationResult } from "./types";
-
-const DANGEROUS_COMMANDS = [
-	"sudo",
-	"su",
-	"chmod",
-	"chown",
-	"dd",
-	"mkfs",
-	"fdisk",
-	"kill",
-	"killall",
-];
-
-export class CommandValidator {
-	validate(command: string, _toolName = "Unknown"): ValidationResult {
-		const result: ValidationResult = {
-			isValid: true,
-			severity: "LOW",
-			violations: [],
-			sanitizedCommand: command,
-			action: "allow",
-		};
-
-		if (!command || typeof command !== "string") {
-			result.isValid = false;
-			result.violations.push("Invalid command format");
-			result.action = "deny";
-			return result;
-		}
-
-		// rm -rf → DENY (blocked completely)
-		if (this.containsRmRf(command)) {
-			result.isValid = false;
-			result.severity = "CRITICAL";
-			result.violations.push("rm -rf is forbidden - use trash instead");
-			result.action = "deny";
-			return result;
-		}
-
-		// Other dangerous commands → ASK (ask for permission)
-		const dangerousCmd = this.containsDangerousCommand(command);
-		if (dangerousCmd) {
-			result.isValid = false;
-			result.severity = "HIGH";
-			result.violations.push(`Potentially dangerous command: ${dangerousCmd}`);
-			result.action = "ask";
-			return result;
-		}
-
-		return result;
-	}
-
-	containsRmRf(command: string): boolean {
-		// Check for rm -rf in any form (rm -rf, rm -fr, rm -r -f, etc.)
-		const rmRfPatterns = [
-			/\brm\s+(-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*r[a-zA-Z]*)\s/i,
-			/\brm\s+-r\s+-f\s/i,
-			/\brm\s+-f\s+-r\s/i,
-		];
-
-		for (const pattern of rmRfPatterns) {
-			if (pattern.test(command)) {
-				return true;
-			}
-		}
-
-		return false;
-	}
-
-	containsDangerousCommand(command: string): string | null {
-		const normalizedCmd = command.trim().toLowerCase();
-		const parts = normalizedCmd.split(/\s+/);
-		const mainCommand = parts[0].split("/").pop() || "";
-
-		if (DANGEROUS_COMMANDS.includes(mainCommand)) {
-			return mainCommand;
-		}
-
-		// Check in chained commands
-		for (const dangerous of DANGEROUS_COMMANDS) {
-			const pattern = new RegExp(`\\b${dangerous}\\b`, "i");
-			if (pattern.test(command)) {
-				return dangerous;
-			}
-		}
-
-		return null;
-	}
-}