calllint 0.9.0 → 0.9.2

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import { execFileSync } from "node:child_process";
 
 // src/args.ts
@@ -4472,6 +4472,592 @@ function receiptCommand(args, deps) {
   return { stdout, exitCode: EXIT.OK };
 }
 
+// src/commands/action.ts
+import { readFileSync as readFileSync9 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
+
+// ../../packages/action-analyzer/src/types.ts
+var KIND_RISK_PROFILES = {
+  "email.reply": ["ACTION", "SECRETS", "PROMPT"],
+  "email.forward": ["ACTION", "SECRETS", "FILES", "PROMPT"],
+  "message.post": ["ACTION", "SECRETS"],
+  "a2a.delegate": ["ACTION", "NETWORK", "PROMPT"],
+  "payment.authorize": ["MONEY", "SECRETS"],
+  "account.register": ["ACTION", "SECRETS", "SUPPLY"],
+  "github.write": ["ACTION", "SUPPLY"],
+  "npm.publish": ["ACTION", "SUPPLY", "MONEY"],
+  "cloud.modify": ["ACTION", "EXEC", "MONEY"]
+};
+
+// ../../packages/action-analyzer/src/analyzeAction.ts
+function analyzeAction(descriptor) {
+  const findings = [];
+  if (descriptor.schema_version !== "calllint.action.v0") {
+    findings.push({
+      id: "action.unknown-schema-version",
+      title: "Unknown action schema version",
+      severity: "medium",
+      blocker: false,
+      symbol: "ACTION",
+      riskClass: "S3",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "schema_version",
+        value: descriptor.schema_version
+      }],
+      impact: `Unknown action schema version: ${descriptor.schema_version}`,
+      fix: "Use calllint.action.v0 schema version"
+    });
+    return findings;
+  }
+  const riskProfile = KIND_RISK_PROFILES[descriptor.kind];
+  if (!riskProfile) {
+    findings.push({
+      id: "action.unknown-kind",
+      title: "Unknown action kind",
+      severity: "medium",
+      blocker: false,
+      symbol: "ACTION",
+      riskClass: "S3",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "kind",
+        value: descriptor.kind
+      }],
+      impact: `Unknown action kind: ${descriptor.kind}`,
+      fix: "Use one of the 9 defined action kinds (email.reply, email.forward, message.post, a2a.delegate, payment.authorize, account.register, github.write, npm.publish, cloud.modify)"
+    });
+    return findings;
+  }
+  switch (descriptor.kind) {
+    case "email.reply":
+    case "email.forward":
+      findings.push(...analyzeEmail(descriptor));
+      break;
+    case "message.post":
+      findings.push(...analyzeMessaging(descriptor));
+      break;
+    case "a2a.delegate":
+      findings.push(...analyzeDelegate(descriptor));
+      break;
+    case "payment.authorize":
+      findings.push(...analyzePayment(descriptor));
+      break;
+    case "account.register":
+      findings.push(...analyzeRegistration(descriptor));
+      break;
+    case "github.write":
+      findings.push(...analyzeGitHub(descriptor));
+      break;
+    case "npm.publish":
+      findings.push(...analyzeNpmPublish(descriptor));
+      break;
+    case "cloud.modify":
+      findings.push(...analyzeCloud(descriptor));
+      break;
+  }
+  findings.push(...analyzeSecretShapedHeaders(descriptor));
+  return findings;
+}
+function analyzeEmail(descriptor) {
+  const findings = [];
+  const metadata = descriptor.metadata || {};
+  const hasAttachments = descriptor.parameters.has_attachments;
+  const attachmentHashes = metadata.attachment_hashes || [];
+  if (hasAttachments && attachmentHashes.length === 0) {
+    findings.push({
+      id: "action.unverified-attachment",
+      title: "Unverified email attachments",
+      severity: "high",
+      blocker: false,
+      symbol: "FILES",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "parameters.has_attachments",
+        value: String(hasAttachments)
+      }],
+      impact: "Email action has attachments but no attachment_hashes provided",
+      fix: "Provide SHA-256 hashes for all attachments in metadata.attachment_hashes"
+    });
+  }
+  return findings;
+}
+function analyzeMessaging(descriptor) {
+  const findings = [];
+  return findings;
+}
+function analyzeDelegate(descriptor) {
+  const findings = [];
+  const metadata = descriptor.metadata || {};
+  const delegateTarget = metadata.delegate_target;
+  if (!delegateTarget) {
+    findings.push({
+      id: "action.missing-delegate-target",
+      title: "Missing delegate target",
+      severity: "high",
+      blocker: false,
+      symbol: "NETWORK",
+      riskClass: "S3",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.delegate_target",
+        value: "null"
+      }],
+      impact: "Agent delegation missing delegate_target in metadata",
+      fix: "Specify the delegate target (agent ID, API endpoint, or service name)"
+    });
+  } else if (typeof delegateTarget === "string" && delegateTarget.startsWith("http://")) {
+    findings.push({
+      id: "action.insecure-delegate-target",
+      title: "Insecure delegate target",
+      severity: "medium",
+      blocker: false,
+      symbol: "NETWORK",
+      riskClass: "S3",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.delegate_target",
+        value: delegateTarget
+      }],
+      impact: "Delegate target uses insecure HTTP",
+      fix: "Use HTTPS for delegate targets"
+    });
+  }
+  return findings;
+}
+function analyzePayment(descriptor) {
+  const findings = [];
+  const metadata = descriptor.metadata || {};
+  const amount = metadata.amount;
+  if (typeof amount === "number" && amount > 0) {
+    findings.push({
+      id: "action.financial-observed",
+      title: "Financial transaction observed",
+      severity: "high",
+      blocker: false,
+      symbol: "MONEY",
+      riskClass: "S5",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.amount",
+        value: String(amount)
+      }],
+      impact: `Payment authorization for ${metadata.currency || "unknown currency"} ${amount}`,
+      fix: "Verify payment amount and recipient before authorizing"
+    });
+  }
+  return findings;
+}
+function analyzeRegistration(descriptor) {
+  const findings = [];
+  const metadata = descriptor.metadata || {};
+  const serviceVerified = metadata.service_verified;
+  if (serviceVerified === false) {
+    findings.push({
+      id: "action.unverified-service",
+      title: "Unverified service registration",
+      severity: "high",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S3",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.service_verified",
+        value: "false"
+      }],
+      impact: "Account registration on unverified service",
+      fix: "Verify the service domain and reputation before registering"
+    });
+  }
+  const scopes = metadata.oauth_scopes || [];
+  const dangerousScopes = ["admin", "delete_account", "financial_data", "admin:org"];
+  const foundDangerous = scopes.filter(
+    (s) => dangerousScopes.some((d) => s.toLowerCase().includes(d.toLowerCase()))
+  );
+  if (foundDangerous.length > 0) {
+    findings.push({
+      id: "action.excessive-oauth-scopes",
+      title: "Excessive OAuth scopes requested",
+      severity: "medium",
+      blocker: false,
+      symbol: "SECRETS",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.oauth_scopes",
+        value: foundDangerous.join(", ")
+      }],
+      impact: `Registration requests sensitive scopes: ${foundDangerous.join(", ")}`,
+      fix: "Request only the minimum necessary OAuth scopes"
+    });
+  }
+  return findings;
+}
+function analyzeGitHub(descriptor) {
+  const findings = [];
+  const metadata = descriptor.metadata || {};
+  const repoVerified = metadata.repository_verified;
+  if (repoVerified === false) {
+    findings.push({
+      id: "action.unverified-repository",
+      title: "Unverified repository target",
+      severity: "medium",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S3",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.repository_verified",
+        value: "false"
+      }],
+      impact: "GitHub write operation to unverified repository",
+      fix: "Verify repository ownership before writing"
+    });
+  }
+  const scopes = metadata.oauth_scopes || [];
+  const dangerousScopes = ["delete_repo", "admin:org", "admin:repo_hook"];
+  const foundDangerous = scopes.filter(
+    (s) => dangerousScopes.some((d) => s.toLowerCase().includes(d.toLowerCase()))
+  );
+  if (foundDangerous.length > 0) {
+    findings.push({
+      id: "action.excessive-github-scopes",
+      title: "Excessive GitHub OAuth scopes",
+      severity: "medium",
+      blocker: false,
+      symbol: "SECRETS",
+      riskClass: "S3",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.oauth_scopes",
+        value: foundDangerous.join(", ")
+      }],
+      impact: `GitHub operation requests dangerous scopes: ${foundDangerous.join(", ")}`,
+      fix: "Request only necessary OAuth scopes for the operation"
+    });
+  }
+  const externalLinks = metadata.external_links || [];
+  if (externalLinks.length > 0) {
+    findings.push({
+      id: "action.external-links",
+      title: "External links in GitHub content",
+      severity: "low",
+      blocker: false,
+      symbol: "NETWORK",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "medium",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.external_links",
+        value: externalLinks.join(", ")
+      }],
+      impact: `Issue/PR contains external links: ${externalLinks.length} found`,
+      fix: "Review external links for safety"
+    });
+  }
+  return findings;
+}
+function analyzeNpmPublish(descriptor) {
+  const findings = [];
+  const metadata = descriptor.metadata || {};
+  const params = descriptor.parameters || {};
+  const similarTo = metadata.similar_to_popular || [];
+  if (similarTo.length > 0) {
+    findings.push({
+      id: "supply.name-squatting",
+      title: "Potential name squatting",
+      severity: "high",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S3",
+      mode: "INFERRED",
+      confidence: "medium",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.similar_to_popular",
+        value: similarTo.join(", ")
+      }],
+      impact: `Package name similar to popular packages: ${similarTo.join(", ")}`,
+      fix: "Verify this is not a typosquatting attempt"
+    });
+  }
+  const versionPinned = metadata.version_pinned;
+  const versionRange = metadata.version_range;
+  if (versionPinned === false || versionRange === true) {
+    findings.push({
+      id: "supply.version-float",
+      title: "Version not pinned",
+      severity: "medium",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "parameters.version",
+        value: String(params.version || "unknown")
+      }],
+      impact: "Publishing with floating version range instead of pinned version",
+      fix: 'Use pinned version (e.g., "1.2.3" not "^1.2.3")'
+    });
+  }
+  return findings;
+}
+function analyzeCloud(descriptor) {
+  const findings = [];
+  const metadata = descriptor.metadata || {};
+  const monthlyCost = metadata.estimated_monthly_cost;
+  if (typeof monthlyCost === "number" && monthlyCost > 1e3) {
+    findings.push({
+      id: "action.expensive-cloud-resource",
+      title: "Expensive cloud resource",
+      severity: "high",
+      blocker: false,
+      symbol: "MONEY",
+      riskClass: "S5",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.estimated_monthly_cost",
+        value: String(monthlyCost)
+      }],
+      impact: `Cloud resource estimated at $${monthlyCost}/month`,
+      fix: "Verify cost estimate and budget before creating"
+    });
+  }
+  const opensAllPorts = metadata.opens_all_ports;
+  if (opensAllPorts === true) {
+    findings.push({
+      id: "action.insecure-security-group",
+      title: "Insecure security group configuration",
+      severity: "high",
+      blocker: false,
+      symbol: "NETWORK",
+      riskClass: "S4",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.opens_all_ports",
+        value: "true"
+      }],
+      impact: "Security group opens all ports to the internet (0.0.0.0/0)",
+      fix: "Restrict ports and source IPs to minimum necessary"
+    });
+  }
+  return findings;
+}
+function analyzeSecretShapedHeaders(descriptor) {
+  const findings = [];
+  const metadata = descriptor.metadata || {};
+  const headerKeys = metadata.header_keys || [];
+  const secretPatterns = ["authorization", "api-key", "api_key", "token", "secret", "password", "bearer"];
+  for (const key of headerKeys) {
+    const lowerKey = key.toLowerCase();
+    if (secretPatterns.some((pattern) => lowerKey.includes(pattern))) {
+      findings.push({
+        id: "secrets.env-key",
+        title: "Secret-shaped header key",
+        severity: "medium",
+        blocker: false,
+        symbol: "SECRETS",
+        riskClass: "S2",
+        mode: "OBSERVED",
+        confidence: "medium",
+        detectionMethod: "config-analysis",
+        evidence: [{
+          type: "config",
+          path: "metadata.header_keys",
+          value: key
+        }],
+        impact: `Header key resembles a secret: ${key}`,
+        fix: "Verify that secret headers are properly secured and not logged"
+      });
+      break;
+    }
+  }
+  return findings;
+}
+
+// src/commands/action.ts
+function actionCommand(args, deps) {
+  const subcommand = args.positionals[0];
+  if (!subcommand || subcommand === "help") {
+    return {
+      stdout: actionHelp(),
+      stderr: "",
+      exitCode: 0
+    };
+  }
+  if (subcommand === "inspect") {
+    return actionInspect(args, deps);
+  }
+  return {
+    stdout: "",
+    stderr: `Unknown action subcommand: ${subcommand}
+Run \`calllint action help\`.`,
+    exitCode: 2
+  };
+}
+function actionInspect(args, deps) {
+  const actionFile = args.positionals[1];
+  if (!actionFile) {
+    return {
+      stdout: "",
+      stderr: "Error: Missing action file\nUsage: calllint action inspect <file.json>",
+      exitCode: 2
+    };
+  }
+  try {
+    const absolutePath = resolve5(deps.cwd, actionFile);
+    const content = readFileSync9(absolutePath, "utf-8");
+    const descriptor = JSON.parse(content);
+    if (descriptor.schema_version !== "calllint.action.v0") {
+      return {
+        stdout: "",
+        stderr: `Error: Unsupported schema version: ${descriptor.schema_version}
+Expected: calllint.action.v0`,
+        exitCode: 2
+      };
+    }
+    const policyPath = args.flags["policy"];
+    const policy = loadPolicyOrDefault(policyPath ? resolve5(deps.cwd, policyPath) : void 0);
+    const findings = analyzeAction(descriptor);
+    const verdict = computeActionVerdict(findings, policy);
+    let stdout = "";
+    if (args.flags["json"]) {
+      const report = {
+        schema_version: "calllint.action-report.v0",
+        verdict,
+        findings,
+        target: {
+          type: "action",
+          kind: descriptor.kind,
+          schema_version: descriptor.schema_version
+        },
+        policy_applied: "default",
+        scan_timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      stdout = JSON.stringify(report, null, 2);
+    } else {
+      const header = `
+\u{1F50D} Action: ${descriptor.kind}
+`;
+      const verdictEmoji = verdict === "SAFE" ? "\u2705" : verdict === "BLOCK" ? "\u26D4" : verdict === "REVIEW" ? "\u26A0\uFE0F" : "\u25C7";
+      const verdictLine = `Verdict: ${verdictEmoji} ${verdict}
+`;
+      const findingsLine = `Findings: ${findings.length}
+`;
+      let body = verdictLine + findingsLine;
+      if (findings.length > 0) {
+        body += "\n";
+        for (const f of findings) {
+          body += `  \u2022 ${f.id}: ${f.impact}
+`;
+        }
+      }
+      stdout = header + body;
+    }
+    return {
+      stdout,
+      stderr: "",
+      exitCode: verdict === "SAFE" ? 0 : 1
+    };
+  } catch (error) {
+    const err = error;
+    let stderr = "";
+    if (err.code === "ENOENT") {
+      stderr = `Error: File not found: ${actionFile}`;
+    } else if (error instanceof SyntaxError) {
+      stderr = `Error: Invalid JSON in ${actionFile}
+${error.message}`;
+    } else {
+      stderr = `Error: ${err.message}`;
+    }
+    return {
+      stdout: "",
+      stderr,
+      exitCode: 2
+    };
+  }
+}
+function actionHelp() {
+  return `calllint action \u2014 Inspect planned external actions
+
+USAGE
+  calllint action inspect <file.json>
+  calllint action help
+
+COMMANDS
+  inspect <file>    Analyze a calllint.action.v0 descriptor
+  help              Show this help
+
+OPTIONS
+  --json            Output JSON report
+  --policy <file>   Use custom policy file
+  --no-emoji        Disable emoji in output
+
+EXAMPLE
+  calllint action inspect payment.json
+  calllint action inspect email-reply.json --json
+
+See: https://calllint.com/docs/action-inspect (ADR 0029)
+`;
+}
+function computeActionVerdict(findings, policy) {
+  if (findings.length === 0) {
+    return "SAFE";
+  }
+  const hasBlocker = findings.some((f) => f.blocker || f.severity === "critical");
+  if (hasBlocker) {
+    return "BLOCK";
+  }
+  const hasHigh = findings.some((f) => f.severity === "high");
+  if (hasHigh) {
+    return "REVIEW";
+  }
+  return "REVIEW";
+}
+
 // src/run.ts
 function run(argv, deps) {
   const args = parseArgs(argv);
@@ -4540,6 +5126,8 @@ function run(argv, deps) {
       return explainCommand(args, { cwd: deps.cwd });
     case "receipt":
       return receiptCommand(args, { cwd: deps.cwd });
+    case "action":
+      return actionCommand(args, { cwd: deps.cwd });
     case "gen-rule":
       return genRuleCommand(args, { cwd: deps.cwd });
     case "policy":
@@ -4813,13 +5401,13 @@ async function breathe(argv, deps = {}) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname as dirname4, join as join11 } from "node:path";
 function resolveToolVersion() {
   try {
     const pkgPath = join11(dirname4(fileURLToPath(import.meta.url)), "..", "package.json");
-    const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : "unknown";
   } catch {
     return "unknown";
@@ -4829,7 +5417,7 @@ function resolveToolVersion() {
 // src/index.ts
 function readStdin() {
   try {
-    return readFileSync10(0, "utf8");
+    return readFileSync11(0, "utf8");
   } catch {
     return "";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",
@@ -49,6 +49,7 @@
   },
   "dependencies": {},
   "devDependencies": {
+    "@calllint/action-analyzer": "workspace:*",
     "@calllint/core": "workspace:*",
     "@calllint/fixtures": "workspace:*",
     "@calllint/online": "workspace:*",