causly-server 0.0.0-stage → 1.5.1

package/tools/security.js

@@ -0,0 +1,488 @@
+// Security subsystem: secret redaction, permission levels, and command
+// risk classification. Single source of truth so every tool call, log
+// line, and approval check uses the same rules.
+
+// ---------------- Secret redaction ----------------
+
+// Key names (case-insensitive substring match) whose values must never
+// appear in logs, error messages, or tool responses.
+const SECRET_KEY_PATTERNS = [
+  "token",
+  "password",
+  "passwd",
+  "api_key",
+  "apikey",
+  "secret",
+  "authorization",
+  "access_token",
+  "refresh_token",
+  "db_pass",
+  "credential",
+  "private_key",
+  "client_secret",
+  "auth_token",
+];
+
+const REDACTED = "[REDACTED]";
+
+function isSecretKey(key) {
+  const lower = key.toLowerCase();
+  return SECRET_KEY_PATTERNS.some((pattern) => lower.includes(pattern));
+}
+
+/**
+ * Recursively walk an object/array and replace the value of any key that
+ * looks like a secret with "[REDACTED]". Never mutates the input — returns
+ * a deep copy. Safe against circular references (bails out to "[Circular]").
+ */
+export function redactSecrets(value, seen = new WeakSet()) {
+  if (value === null || value === undefined) return value;
+
+  if (Array.isArray(value)) {
+    if (seen.has(value)) return "[Circular]";
+    seen.add(value);
+    return value.map((item) => redactSecrets(item, seen));
+  }
+
+  if (typeof value === "object") {
+    if (seen.has(value)) return "[Circular]";
+    seen.add(value);
+    const out = {};
+    for (const [key, val] of Object.entries(value)) {
+      out[key] = isSecretKey(key) ? REDACTED : redactSecrets(val, seen);
+    }
+    return out;
+  }
+
+  return value;
+}
+
+/**
+ * Redact secret-looking substrings out of a plain string (e.g. an error
+ * message that happens to include "token=abc123..."). Best-effort — key/
+ * value pairs like `token=xxx`, `token: xxx`, `"token":"xxx"` are caught;
+ * this is not a substitute for redactSecrets() on structured data.
+ */
+export function redactSecretsInString(str) {
+  if (typeof str !== "string") return str;
+  const pattern = new RegExp(
+    `\\b(${SECRET_KEY_PATTERNS.join("|")})\\b(\\s*[:=]\\s*)("[^"]*"|'[^']*'|\\S+)`,
+    "gi"
+  );
+  return str.replace(pattern, (_match, key, sep) => `${key}${sep}${REDACTED}`);
+}
+
+// ---------------- Permission levels ----------------
+
+// READ        — safe, read-only, no side effects
+// LOW         — normal dev actions, low blast radius, easily reversible
+// MEDIUM      — modifies project/repo state, reversible with effort
+// HIGH        — production-impacting or hard to reverse (pushes, deploys,
+//               merges, arbitrary shell/SQL execution)
+// DESTRUCTIVE — deletion / irreversible
+//
+// Approval policy: READ and LOW run automatically. MEDIUM runs
+// automatically too in this single-user trusted-local-machine mode, but
+// is classified so that policy can be tightened later without touching
+// every tool. HIGH and DESTRUCTIVE always require the caller to pass
+// `confirm: true` — this is the approval gate.
+export const PERMISSION_LEVELS = {
+  // Files
+  read_file: "READ",
+  read_multiple_files: "READ",
+  create_file: "MEDIUM",
+  write_file: "MEDIUM",
+  edit_file: "MEDIUM",
+  delete_file: "DESTRUCTIVE",
+  move_file: "MEDIUM",
+  copy_file: "LOW",
+  get_file_info: "READ",
+
+  // Directory
+  list_directory: "READ",
+  directory_tree: "READ",
+  create_directory: "LOW",
+  delete_directory: "DESTRUCTIVE",
+  search_files: "READ",
+
+  // Git
+  git_init: "LOW",
+  git_status: "READ",
+  git_add: "LOW",
+  git_commit: "MEDIUM",
+  git_push: "MEDIUM",
+  git_pull: "MEDIUM",
+  git_log: "READ",
+  git_diff: "READ",
+  git_branch: "READ",
+  git_create_branch: "LOW",
+  git_checkout: "MEDIUM",
+  git_merge: "MEDIUM",
+  git_reset: "HIGH",
+  git_stash: "LOW",
+  git_show: "READ",
+  git_remote: "MEDIUM",
+  git_tag: "LOW",
+  git_changed_files: "READ",
+  git_diff_stat: "READ",
+  git_check_clean: "READ",
+
+  // Command
+  run_command: "HIGH",
+
+  // GitHub
+  github_get_authenticated_user: "READ",
+  github_create_repo: "MEDIUM",
+  github_delete_repo: "DESTRUCTIVE",
+  github_list_repos: "READ",
+  github_create_issue: "LOW",
+  github_list_issues: "READ",
+  github_create_pull_request: "MEDIUM",
+  github_list_pull_requests: "READ",
+  github_add_comment: "LOW",
+  github_get_repo: "READ",
+  github_get_issue: "READ",
+  github_update_issue: "MEDIUM",
+  github_get_pull_request: "READ",
+  github_update_pull_request: "MEDIUM",
+  github_merge_pull_request: "HIGH",
+  github_get_pull_request_files: "READ",
+  github_get_pull_request_diff: "READ",
+  github_get_pull_request_comments: "READ",
+  github_get_pull_request_reviews: "READ",
+  github_get_branch: "READ",
+  github_list_branches: "READ",
+  github_list_workflows: "READ",
+  github_list_workflow_runs: "READ",
+  github_get_workflow_run: "READ",
+  github_get_workflow_run_jobs: "READ",
+  github_get_job_logs: "READ",
+  github_rerun_workflow: "MEDIUM",
+
+  // Vercel
+  vercel_get_authenticated_user: "READ",
+  vercel_list_projects: "READ",
+  vercel_get_project: "READ",
+  vercel_list_deployments: "READ",
+  vercel_get_deployment: "READ",
+  vercel_create_deployment: "HIGH",
+  vercel_delete_project: "DESTRUCTIVE",
+  vercel_get_deployment_logs: "READ",
+  vercel_get_deployment_events: "READ",
+  vercel_cancel_deployment: "MEDIUM",
+  http_check: "READ",
+
+  // Project intelligence
+  project_detect: "READ",
+  project_info: "READ",
+  project_health: "READ",
+  run_tests: "LOW",
+  run_lint: "LOW",
+  run_typecheck: "LOW",
+  run_build: "LOW",
+
+  // Workflows
+  ship_change: "HIGH",
+  fix_ci: "READ",
+  verify_ci_fix: "HIGH",
+  deploy_project: "HIGH",
+
+  // Slack
+  slack_get_user: "READ",
+  slack_list_channels: "READ",
+  slack_get_channel: "READ",
+  slack_read_messages: "READ",
+  slack_search_messages: "READ",
+  slack_send_message: "HIGH",
+  slack_reply_thread: "HIGH",
+  slack_create_channel: "HIGH",
+
+  // Gmail
+  gmail_get_profile: "READ",
+  gmail_search: "READ",
+  gmail_list_messages: "READ",
+  gmail_get_message: "READ",
+  gmail_get_thread: "READ",
+  gmail_send: "HIGH",
+  gmail_reply: "HIGH",
+  gmail_forward: "HIGH",
+
+  // Supabase
+  supabase_list_organizations: "READ",
+  supabase_list_projects: "READ",
+  supabase_get_project: "READ",
+  supabase_create_project: "MEDIUM",
+  supabase_delete_project: "DESTRUCTIVE",
+  supabase_run_sql: "HIGH",
+
+  // Database
+  postgres_query: "HIGH",
+  postgres_list_tables: "READ",
+  postgres_describe_table: "READ",
+  postgres_test_connection: "READ",
+  mysql_query: "HIGH",
+  mysql_list_tables: "READ",
+  mysql_describe_table: "READ",
+  mysql_test_connection: "READ",
+
+  // Secrets
+  secrets_set: "HIGH",
+  secrets_get: "MEDIUM",
+  secrets_list: "READ",
+  secrets_delete: "DESTRUCTIVE",
+  secrets_rotate_key: "HIGH",
+  secrets_generate_key: "LOW",
+
+  // Sentry
+  sentry_list_projects: "READ",
+  sentry_list_issues: "READ",
+  sentry_search_issues: "READ",
+  sentry_get_issue: "READ",
+  sentry_get_project_stats: "READ",
+  sentry_resolve_issue: "HIGH",
+  sentry_ignore_issue: "HIGH",
+  sentry_add_comment: "HIGH",
+
+  // Notion
+  notion_search: "READ",
+  notion_get_page: "READ",
+  notion_get_database: "READ",
+  notion_query_database: "READ",
+  notion_get_block_children: "READ",
+  notion_get_comments: "READ",
+  notion_list_users: "READ",
+  notion_get_user: "READ",
+  notion_create_page: "HIGH",
+  notion_update_page: "HIGH",
+  notion_create_database: "HIGH",
+  notion_append_block_children: "HIGH",
+  notion_update_block: "HIGH",
+  notion_add_comment: "HIGH",
+  notion_delete_block: "HIGH",
+
+  // Terraform
+  terraform_init: "LOW",
+  terraform_validate: "READ",
+  terraform_fmt: "MEDIUM",
+  terraform_plan: "LOW",
+  terraform_apply: "HIGH",
+  terraform_destroy: "DESTRUCTIVE",
+  terraform_show: "READ",
+  terraform_output: "READ",
+  terraform_workspace: "HIGH",
+  terraform_state_list: "READ",
+  terraform_state_show: "READ",
+  terraform_state_pull: "READ",
+  terraform_state_mv: "HIGH",
+  terraform_state_rm: "HIGH",
+  terraform_import: "HIGH",
+  terraform_taint: "HIGH",
+  terraform_untaint: "MEDIUM",
+  terraform_graph: "READ",
+  terraform_providers: "READ",
+  terraform_plan_comment: "MEDIUM",
+
+  // Docker
+  docker_version: "READ",
+  docker_ps: "READ",
+  docker_images: "READ",
+  docker_logs: "READ",
+  docker_inspect: "READ",
+  docker_stats: "READ",
+  docker_start: "LOW",
+  docker_pull: "MEDIUM",
+  docker_build: "HIGH",
+  docker_run: "HIGH",
+  docker_stop: "HIGH",
+  docker_restart: "HIGH",
+  docker_exec: "HIGH",
+  docker_push: "HIGH",
+  docker_compose_up: "HIGH",
+  docker_compose_down: "HIGH",
+  docker_remove: "DESTRUCTIVE",
+  docker_remove_image: "DESTRUCTIVE",
+
+  // Toolset management
+  search_tools: "READ",
+  load_toolset: "LOW",
+  use_tool: "READ", // only forwards; the called tool applies its own risk level and approvals
+
+  // Reminders
+  reminder_create: "LOW",
+  reminder_list: "READ",
+  reminder_update: "LOW",
+
+  // Research
+  web_search: "READ",
+  web_fetch: "MEDIUM",
+
+  // Leads
+  lead_hn_hiring: "READ",
+  lead_remote_jobs: "READ",
+  lead_company_contacts: "MEDIUM",
+
+  // SEO and content
+  seo_keyword_ideas: "READ",
+  seo_page_audit: "MEDIUM",
+  seo_content_check: "READ",
+  seo_search_console: "READ",
+
+  // Pipeline
+  pipeline_add_lead: "LOW",
+  pipeline_list: "READ",
+  pipeline_get: "READ",
+  pipeline_update: "LOW",
+  pipeline_log_activity: "LOW",
+  pipeline_add_contact: "LOW",
+  pipeline_report: "READ",
+  pipeline_export: "MEDIUM",
+  pipeline_delete_deal: "DESTRUCTIVE",
+
+  // Google Calendar (inviting guests is gated separately inside the tools)
+  calendar_list_calendars: "READ",
+  calendar_list_events: "READ",
+  calendar_get_event: "READ",
+  calendar_free_busy: "READ",
+  calendar_find_slots: "READ",
+  calendar_create_event: "MEDIUM",
+  calendar_update_event: "MEDIUM",
+  calendar_delete_event: "DESTRUCTIVE",
+
+  // Meeting notes (transcribing uploads audio to Groq, so it needs confirm)
+  meeting_transcribe: "HIGH",
+  meeting_save: "MEDIUM",
+  meeting_list: "READ",
+  meeting_get: "READ",
+  meeting_search: "READ",
+  meeting_actions: "READ",
+  meeting_complete_action: "LOW",
+  meeting_prep: "READ",
+  meeting_delete: "DESTRUCTIVE",
+
+  // Telegram (notify only reaches the owner's own chat)
+  telegram_get_me: "READ",
+  telegram_get_updates: "READ",
+  telegram_get_chat: "READ",
+  telegram_notify: "LOW",
+  telegram_send_message: "HIGH",
+
+  // Linear
+  linear_get_viewer: "READ",
+  linear_list_teams: "READ",
+  linear_list_issues: "READ",
+  linear_get_issue: "READ",
+  linear_create_issue: "MEDIUM",
+  linear_update_issue: "MEDIUM",
+  linear_add_comment: "MEDIUM",
+
+  // Stripe (live keys are refused unless STRIPE_ALLOW_LIVE=true; anything that emails or moves money is HIGH)
+  stripe_get_account: "READ",
+  stripe_list_customers: "READ",
+  stripe_create_customer: "MEDIUM",
+  stripe_list_invoices: "READ",
+  stripe_create_invoice: "MEDIUM",
+  stripe_send_invoice: "HIGH",
+  stripe_create_payment_link: "HIGH",
+  stripe_list_payments: "READ",
+  stripe_refund: "HIGH",
+
+  // Discord
+  discord_get_me: "READ",
+  discord_list_guilds: "READ",
+  discord_list_channels: "READ",
+  discord_read_messages: "READ",
+  discord_send_message: "HIGH",
+};
+
+const APPROVAL_REQUIRED_LEVELS = new Set(["HIGH", "DESTRUCTIVE"]);
+
+/**
+ * Checks whether a tool call is allowed to proceed. HIGH and DESTRUCTIVE
+ * tools require the caller to explicitly pass `confirm: true` in their
+ * input — this is the approval gate for this single-user trusted-machine
+ * server (no separate human-approval UI exists at the MCP layer, so the
+ * explicit flag stands in for it: the AI must consciously decide to
+ * proceed, typically after confirming with the person).
+ *
+ * Returns { allowed, level, reason }. Never throws.
+ */
+export function checkApproval(toolName, input) {
+  const level = PERMISSION_LEVELS[toolName] || "MEDIUM";
+  if (!APPROVAL_REQUIRED_LEVELS.has(level)) {
+    return { allowed: true, level };
+  }
+  if (input && input.confirm === true) {
+    return { allowed: true, level };
+  }
+  return {
+    allowed: false,
+    level,
+    reason: `'${toolName}' is a ${level}-risk action and requires explicit confirmation. Re-call with confirm: true to proceed.`,
+  };
+}
+
+// ---------------- Command risk classification ----------------
+
+// Beyond the hard BLOCKED_PATTERNS in commandOps.js (which stop a call
+// outright), this gives a *graded* risk read on a command string so it can
+// be surfaced in logs/results for auditability — per the roadmap's own
+// warning: "Do not rely only on regex-based destructive command blocking."
+const RISKY_COMMAND_SIGNALS = [
+  { pattern: /\b(rm|del|erase)\b/i, reason: "deletes files" },
+  { pattern: /\bdrop\s+(table|database|schema)\b/i, reason: "drops a database object" },
+  { pattern: /\btruncate\s+table\b/i, reason: "truncates a table" },
+  { pattern: /\bgit\s+push\s+.*--force/i, reason: "force-pushes (can overwrite remote history)" },
+  { pattern: /\bgit\s+reset\s+--hard/i, reason: "hard-resets (can discard uncommitted work)" },
+  { pattern: /\bcurl\b.*\|\s*(bash|sh|powershell)/i, reason: "pipes a remote script directly into a shell" },
+  { pattern: /\biwr\b.*\|\s*iex\b/i, reason: "downloads and executes a remote script (PowerShell)" },
+  { pattern: /\bchmod\s+-R\s+777\b/i, reason: "recursively opens permissions" },
+  { pattern: /\bsudo\b|\brunas\b/i, reason: "elevates privileges" },
+  { pattern: />\s*\/dev\/(sd|nvme|hd)/i, reason: "writes directly to a disk device" },
+  { pattern: /\bnpm\s+publish\b/i, reason: "publishes a package publicly" },
+  { pattern: /\bgh\s+repo\s+delete\b/i, reason: "deletes a GitHub repository" },
+];
+
+/**
+ * Returns a risk read on a shell command string: { risk: "LOW"|"ELEVATED",
+ * signals: [reasons] }. Purely informational (does not block) — the hard
+ * BLOCKED_PATTERNS check in commandOps.js still runs separately and does
+ * block outright. This exists so risky-but-legitimate commands (force
+ * push, drop table, etc.) are visible in the audit log even when allowed.
+ */
+export function classifyCommandRisk(command) {
+  const signals = RISKY_COMMAND_SIGNALS.filter((s) => s.pattern.test(command)).map((s) => s.reason);
+  return { risk: signals.length ? "ELEVATED" : "LOW", signals };
+}
+
+// ---------------- Path security ----------------
+
+// System-critical directories that must never be targeted by delete/write
+// operations, even on a trusted single-user machine — a wrong path here
+// is the difference between "oops, undo" and "reinstall Windows". Matched
+// case-insensitively against the resolved absolute path prefix.
+const DENIED_PATH_PREFIXES = [
+  "C:\\Windows",
+  "C:\\Program Files",
+  "C:\\Program Files (x86)",
+  "C:\\ProgramData",
+  "C:\\Users\\Default",
+  "C:\\Users\\Public",
+  "C:\\System Volume Information",
+  "C:\\Recovery",
+  "C:\\Boot",
+];
+
+/**
+ * Checks whether a path falls inside a denied system directory. Compares
+ * the normalized, lowercased path against known-dangerous prefixes.
+ * Returns { denied, reason }.
+ */
+export function isPathDenied(targetPath) {
+  if (!targetPath || typeof targetPath !== "string") return { denied: false };
+  const normalized = targetPath.replace(/\//g, "\\").toLowerCase();
+  const hit = DENIED_PATH_PREFIXES.find((prefix) => normalized.startsWith(prefix.toLowerCase()));
+  if (hit) {
+    return { denied: true, reason: `'${targetPath}' is inside a protected system directory (${hit}) and cannot be modified through this tool.` };
+  }
+  return { denied: false };
+}

package/tools/sentryOps.js

@@ -0,0 +1,130 @@
+const SENTRY_HOSTS = ["https://sentry.io/api/0", "https://de.sentry.io/api/0"];
+
+function getToken() {
+  const token = process.env.SENTRY_AUTH_TOKEN;
+  if (!token) {
+    throw new Error(
+      "SENTRY_AUTH_TOKEN not set. Create one at https://sentry.io/settings/account/api/auth-tokens/ and add it to your .env file: SENTRY_AUTH_TOKEN=..."
+    );
+  }
+  return token;
+}
+
+async function sentryFetchOnHost(host, path, { method = "GET", body } = {}) {
+  const token = getToken();
+  const res = await fetch(`${host}${path}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  const data = text ? JSON.parse(text) : {};
+  return { ok: res.ok, status: res.status, data };
+}
+
+/**
+ * Some Sentry endpoints (notably bare /issues/{id}/ lookups) only resolve on
+ * the organization's actual data-residency host (e.g. de.sentry.io for EU
+ * orgs), even though org/project-scoped endpoints work fine on sentry.io.
+ * We try the default host first, and on a 404 transparently retry on the
+ * other known region host before giving up.
+ */
+async function sentryFetch(path, opts = {}) {
+  let last;
+  for (const host of SENTRY_HOSTS) {
+    const result = await sentryFetchOnHost(host, path, opts);
+    if (result.ok) return result.data;
+    last = result;
+    if (result.status !== 404) break;
+  }
+  throw new Error(`Sentry API error (${path}): ${last.data.detail || last.status}`);
+}
+
+function simplifyIssue(i) {
+  return {
+    id: i.id,
+    shortId: i.shortId,
+    title: i.title,
+    culprit: i.culprit,
+    level: i.level,
+    status: i.status,
+    count: i.count,
+    userCount: i.userCount,
+    firstSeen: i.firstSeen,
+    lastSeen: i.lastSeen,
+    permalink: i.permalink,
+  };
+}
+
+/** List projects in the organization. */
+export async function sentryListProjects({ org_slug }) {
+  const data = await sentryFetch(`/organizations/${org_slug}/projects/`);
+  return {
+    projects: data.map((p) => ({ id: p.id, slug: p.slug, name: p.name, platform: p.platform })),
+  };
+}
+
+/** List recent issues (errors) for a project. */
+export async function sentryListIssues({ org_slug, project_slug, query, limit = 25 }) {
+  const params = new URLSearchParams({ limit: String(limit) });
+  if (query) params.set("query", query);
+  const data = await sentryFetch(`/projects/${org_slug}/${project_slug}/issues/?${params}`);
+  return { issues: data.map(simplifyIssue) };
+}
+
+/** Search issues with a Sentry query string (e.g. "is:unresolved level:error"). */
+export async function sentrySearchIssues({ org_slug, project_slug, query, limit = 25 }) {
+  return sentryListIssues({ org_slug, project_slug, query, limit });
+}
+
+/** Get a single issue's full detail (stack trace context, occurrence counts). */
+export async function sentryGetIssue({ issue_id }) {
+  const data = await sentryFetch(`/issues/${issue_id}/`);
+  return {
+    ...simplifyIssue(data),
+    metadata: data.metadata,
+    type: data.type,
+    platform: data.platform,
+  };
+}
+
+/** Mark an issue as resolved. HIGH risk — requires confirm: true. */
+export async function sentryResolveIssue({ issue_id, confirm }) {
+  const data = await sentryFetch(`/issues/${issue_id}/`, {
+    method: "PUT",
+    body: { status: "resolved" },
+  });
+  return { id: data.id, status: data.status };
+}
+
+/** Mute/ignore an issue so it stops notifying. HIGH risk — requires confirm: true. */
+export async function sentryIgnoreIssue({ issue_id, confirm }) {
+  const data = await sentryFetch(`/issues/${issue_id}/`, {
+    method: "PUT",
+    body: { status: "ignored" },
+  });
+  return { id: data.id, status: data.status };
+}
+
+/** Get error-count stats/trends for a project over a time period. */
+export async function sentryGetProjectStats({ org_slug, project_slug, stat = "received", period = "24h" }) {
+  const params = new URLSearchParams({ stat, resolution: "1h" });
+  const data = await sentryFetch(`/projects/${org_slug}/${project_slug}/stats/?${params}`);
+  return {
+    period,
+    stat,
+    points: data.map(([timestamp, value]) => ({ timestamp, value })),
+  };
+}
+
+/** Add a comment/note to an issue. HIGH risk — requires confirm: true. */
+export async function sentryAddComment({ issue_id, text, confirm }) {
+  const data = await sentryFetch(`/issues/${issue_id}/comments/`, {
+    method: "POST",
+    body: { text },
+  });
+  return { id: data.id, posted: true };
+}