codiedev 0.10.0-beta.4 → 0.10.0-beta.6

package/dist/security.js

@@ -1,437 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SECURITY_RUNTIME_VERSION = void 0;
-exports.withEndpointIdentity = withEndpointIdentity;
-exports.evaluatePromptSecurity = evaluatePromptSecurity;
-exports.evaluateToolSecurity = evaluateToolSecurity;
-exports.securityInputHasSensitivePath = securityInputHasSensitivePath;
-exports.buildSecurityWorkflowEvent = buildSecurityWorkflowEvent;
-exports.buildSecurityPromptEvent = buildSecurityPromptEvent;
-exports.buildBlockedSecurityPromptEvent = buildBlockedSecurityPromptEvent;
-const crypto = __importStar(require("crypto"));
-// Advances only when endpoint enforcement behavior changes. This is
-// intentionally independent from the package version so security coverage can
-// remain current across unrelated CLI releases.
-exports.SECURITY_RUNTIME_VERSION = 1;
-function withEndpointIdentity(event, identity) {
-    return {
-        ...event,
-        ...(identity.endpointId ? { endpointId: identity.endpointId.slice(0, 240) } : {}),
-        ...(identity.endpointName ? { endpointName: identity.endpointName.slice(0, 240) } : {}),
-        ...(identity.cliVersion ? { cliVersion: identity.cliVersion.slice(0, 80) } : {}),
-        ...(typeof identity.securityRuntimeVersion === "number"
-            && Number.isInteger(identity.securityRuntimeVersion)
-            && identity.securityRuntimeVersion > 0
-            ? { securityRuntimeVersion: identity.securityRuntimeVersion }
-            : {}),
-        ...(typeof identity.securityPolicyVersion === "number"
-            && Number.isInteger(identity.securityPolicyVersion)
-            && identity.securityPolicyVersion > 0
-            ? { securityPolicyVersion: identity.securityPolicyVersion }
-            : {}),
-    };
-}
-function scopeMatches(value, candidate) {
-    const escaped = value.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-    try {
-        return new RegExp(`^${escaped}$`, "i").test(candidate);
-    }
-    catch {
-        return false;
-    }
-}
-function effectivePolicyAction(policy, category, fallback, source, input) {
-    if (!policy)
-        return fallback;
-    const toolName = input?.tool_name ?? input?.toolName ?? "";
-    const cwd = input?.cwd ?? "";
-    const excepted = policy.exceptions.some((exception) => {
-        if (exception.scope === "company" || exception.scope === "user")
-            return true;
-        if (exception.scope === "category")
-            return scopeMatches(exception.scopeValue, category);
-        if (exception.scope === "source")
-            return !!source && scopeMatches(exception.scopeValue, source);
-        if (exception.scope === "tool")
-            return !!toolName && scopeMatches(exception.scopeValue, toolName);
-        if (exception.scope === "repository")
-            return !!cwd && scopeMatches(exception.scopeValue, cwd);
-        return false;
-    });
-    if (excepted)
-        return "allow";
-    const configured = policy.rules[category] ?? fallback;
-    return policy.enforcementMode === "alert" && configured === "block" ? "alert" : configured;
-}
-function policyActionPrefix(action) {
-    if (action === "block")
-        return "Codie blocked";
-    if (action === "alert")
-        return "Codie detected";
-    return "Codie detected but allowed";
-}
-const SECRET_KEY = /(?:api[_-]?key|access[_-]?token|auth[_-]?token|password|passwd|secret|private[_-]?key|client[_-]?secret)/i;
-const SECRET_VALUE_PATTERNS = [
-    /\b(?:sk|rk|pk)-(?:live|test|proj)?[-_A-Za-z0-9]{16,}\b/g,
-    /\bgh[opusr]_[A-Za-z0-9]{20,}\b/g,
-    /\bAKIA[0-9A-Z]{16}\b/g,
-    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
-    /\bBearer\s+[A-Za-z0-9._~+\/-]{16,}=*\b/gi,
-];
-const SECRET_ASSIGNMENT = /\b([A-Z][A-Z0-9_]*(?:API_KEY|ACCESS_KEY|TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE_KEY|CLIENT_SECRET|DATABASE_URL))\s*[:=]\s*["']?([^\s"'`]{8,})/gi;
-const SENSITIVE_PATH = /(?:~\/\.ssh\/(?:id_[a-z0-9_-]+)|(?:^|\/)\.env(?:\.[a-z0-9_-]+)?|(?:^|\/)\.aws\/credentials|(?:^|\/)\.config\/gcloud\/application_default_credentials\.json)(?=$|[\/\s"'])/i;
-const PROTECTED_AGENT_CONFIG = /(?:^|[\/\s"'])\.(?:claude\/(?:settings(?:\.local)?\.json|hooks)|codex\/(?:config\.toml|hooks\.json)|cursor\/(?:mcp\.json|rules)|config\/opencode\/(?:opencode\.json|plugins))(?=$|[\s"'\/])/i;
-function looksLikePlaceholder(value) {
-    return (/^\$\{?[A-Z][A-Z0-9_]*\}?$/.test(value) ||
-        /^(?:your|example|sample|dummy|fake|replace|redacted|changeme)[-_\[]/i.test(value) ||
-        /^\[(?:redacted|secret|value)\]$/i.test(value) ||
-        /^<[^>]+>$/.test(value));
-}
-function containsSecretValue(text) {
-    for (const pattern of SECRET_VALUE_PATTERNS) {
-        pattern.lastIndex = 0;
-        if (pattern.test(text)) {
-            pattern.lastIndex = 0;
-            return true;
-        }
-        pattern.lastIndex = 0;
-    }
-    SECRET_ASSIGNMENT.lastIndex = 0;
-    let match;
-    while ((match = SECRET_ASSIGNMENT.exec(text)) !== null) {
-        if (!looksLikePlaceholder(match[2])) {
-            SECRET_ASSIGNMENT.lastIndex = 0;
-            return true;
-        }
-    }
-    SECRET_ASSIGNMENT.lastIndex = 0;
-    return false;
-}
-/**
- * Runs before a user prompt reaches the model. This is intentionally narrow:
- * block credential material, but allow safe references such as
- * `$OPENAI_API_KEY` so developers can ask agents to use environment variables
- * without pasting their values.
- */
-function evaluatePromptSecurity(prompt, policy, source) {
-    if (!prompt || !containsSecretValue(prompt))
-        return { action: "allow" };
-    const action = effectivePolicyAction(policy, "secret_in_prompt", "block", source);
-    return {
-        action,
-        category: "secret_in_prompt",
-        reason: policyActionPrefix(action) + " this prompt because it appears to contain an API key, password, or credential. Remove the secret value and reference the environment variable by name instead (for example, $OPENAI_API_KEY).",
-    };
-}
-function serializedToolInput(input) {
-    const value = input.tool_input ?? input.toolInput;
-    if (typeof value === "string")
-        return value;
-    try {
-        return JSON.stringify(value ?? "");
-    }
-    catch {
-        return "";
-    }
-}
-function toolCommand(input) {
-    const value = input.tool_input ?? input.toolInput;
-    if (value && typeof value === "object" && typeof value.command === "string") {
-        return value.command;
-    }
-    return typeof value === "string" ? value : "";
-}
-function isWriteOperation(input, serialized) {
-    const tool = String(input.tool_name ?? input.toolName ?? "").toLowerCase();
-    return /(?:^|[_-])(?:write|edit|patch|move|rename)(?:$|[_-])/.test(tool) ||
-        (/\b(?:tee|cp|mv|install)\b|(?:^|[^>])>{1,2}(?:[^>]|$)/.test(serialized) && /(?:bash|shell|terminal|exec)/.test(tool));
-}
-function networkHosts(text) {
-    const hosts = [];
-    for (const match of text.matchAll(/https?:\/\/([^\s/"'`]+)/gi))
-        hosts.push(match[1].replace(/:\d+$/, "").toLowerCase());
-    return [...new Set(hosts)];
-}
-function allowedByPatterns(candidate, patterns) {
-    return Boolean(patterns?.some((pattern) => scopeMatches(pattern, candidate)));
-}
-function mcpServerName(input) {
-    const tool = String(input.tool_name ?? input.toolName ?? "");
-    return tool.match(/^mcp__(.+?)__/)?.[1] ?? tool.match(/^mcp[.:/]([^.:/]+)/i)?.[1] ?? null;
-}
-function rootCommand(command) {
-    const cleaned = command.trim().replace(/^(?:sudo\s+|env\s+(?:[A-Za-z_][A-Za-z0-9_]*=[^\s]+\s+)*)/, "");
-    return cleaned.match(/^([A-Za-z0-9_./+-]+)/)?.[1]?.split("/").pop() ?? null;
-}
-function destructiveTargetOutsideWorkspace(command, cwd) {
-    const match = command.match(/\brm\s+(?:-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*r[a-zA-Z]*)\s+(?:--\s+)?([^\s;&|]+)/);
-    if (!match)
-        return false;
-    const target = match[1].replace(/^['"]|['"]$/g, "");
-    if (["/", "~", "$HOME", "${HOME}", "..", "../"].includes(target))
-        return true;
-    if (target.startsWith("~/") || target.startsWith("../"))
-        return true;
-    if (!target.startsWith("/") || !cwd)
-        return false;
-    const normalizedCwd = cwd.replace(/\/+$/, "");
-    return target !== normalizedCwd && !target.startsWith(`${normalizedCwd}/`);
-}
-/** Runs synchronously before a tool executes. No network or model is involved. */
-function evaluateToolSecurity(input, phase, policy, source, sessionContext) {
-    if (phase !== "pre")
-        return { action: "allow" };
-    const serialized = serializedToolInput(input);
-    if (!serialized)
-        return { action: "allow" };
-    if (destructiveTargetOutsideWorkspace(serialized, input.cwd)) {
-        const action = effectivePolicyAction(policy, "destructive_outside_workspace", "block", source, input);
-        return {
-            action,
-            category: "destructive_outside_workspace",
-            reason: policyActionPrefix(action) + " a destructive command targeting files outside the approved workspace.",
-        };
-    }
-    const hasNetworkEgress = /\b(?:curl|wget)\b|https?:\/\//i.test(serialized);
-    if (hasNetworkEgress && containsSecretValue(serialized)) {
-        const action = effectivePolicyAction(policy, "secret_exfiltration", "block", source, input);
-        return {
-            action,
-            category: "secret_exfiltration",
-            reason: policyActionPrefix(action) + " a command that would send credential material to an external destination.",
-        };
-    }
-    if (hasNetworkEgress &&
-        sessionContext?.sensitiveReadAt &&
-        (sessionContext.now ?? Date.now()) - sessionContext.sensitiveReadAt <= 5 * 60_000) {
-        return {
-            action: effectivePolicyAction(policy, "sensitive_read_then_egress", "alert", source, input),
-            category: "sensitive_read_then_egress",
-            reason: "Codie observed network egress shortly after this session read a credential-bearing file.",
-        };
-    }
-    const writeOperation = isWriteOperation(input, serialized);
-    if (writeOperation && SENSITIVE_PATH.test(serialized)) {
-        const action = effectivePolicyAction(policy, "sensitive_file_write", "block", source, input);
-        return {
-            action,
-            category: "sensitive_file_write",
-            reason: policyActionPrefix(action) + " a write to a credential-bearing file.",
-        };
-    }
-    if (writeOperation && PROTECTED_AGENT_CONFIG.test(serialized)) {
-        const action = effectivePolicyAction(policy, "protected_agent_config_write", "block", source, input);
-        return {
-            action,
-            category: "protected_agent_config_write",
-            reason: policyActionPrefix(action) + " an agent modifying its own hooks, policy, MCP, or instruction configuration.",
-        };
-    }
-    const server = mcpServerName(input);
-    if (server && policy?.constraints?.allowedMcpServers?.length && !allowedByPatterns(server, policy.constraints.allowedMcpServers)) {
-        return {
-            action: effectivePolicyAction(policy, "untrusted_mcp_tool", "alert", source, input),
-            category: "untrusted_mcp_tool",
-            reason: `Codie observed a tool call from MCP server “${server}”, which is not in the approved component list.`,
-        };
-    }
-    const hosts = networkHosts(serialized);
-    const unapprovedHost = hosts.find((host) => policy?.constraints?.allowedHosts?.length && !allowedByPatterns(host, policy.constraints.allowedHosts));
-    if (unapprovedHost) {
-        return {
-            action: effectivePolicyAction(policy, "unapproved_network_egress", "alert", source, input),
-            category: "unapproved_network_egress",
-            reason: `Codie observed network egress to unapproved host “${unapprovedHost}”.`,
-        };
-    }
-    const command = toolCommand(input);
-    if (/\b(?:base64\s+(?:-[a-z]*d|--decode)|openssl\s+enc\s+-d)[^|;&]*(?:\||&&)\s*(?:sh|bash|zsh)\b|\beval\s+["']?\$\(/i.test(command)) {
-        return {
-            action: effectivePolicyAction(policy, "obfuscated_shell_command", "alert", source, input),
-            category: "obfuscated_shell_command",
-            reason: "Codie observed an encoded or dynamically evaluated shell payload.",
-        };
-    }
-    if (/\b(?:npm|pnpm|yarn|pipx?|uv|gem|cargo)\s+(?:add|install|i)\b/i.test(command)) {
-        return {
-            action: effectivePolicyAction(policy, "package_install", "alert", source, input),
-            category: "package_install",
-            reason: "Codie observed a package installation. Verify the package source and pinned version.",
-        };
-    }
-    const commandName = rootCommand(command);
-    if (commandName && policy?.constraints?.allowedCommands?.length && !allowedByPatterns(commandName, policy.constraints.allowedCommands)) {
-        return {
-            action: effectivePolicyAction(policy, "unapproved_command", "alert", source, input),
-            category: "unapproved_command",
-            reason: `Codie observed command “${commandName}”, which is not in the approved command list.`,
-        };
-    }
-    if (SENSITIVE_PATH.test(serialized)) {
-        return {
-            action: effectivePolicyAction(policy, "sensitive_file_read", "alert", source, input),
-            category: "sensitive_file_read",
-            reason: "Codie observed access to a sensitive credential file. This policy is alert-only.",
-        };
-    }
-    return { action: "allow" };
-}
-function securityInputHasSensitivePath(input) {
-    return SENSITIVE_PATH.test(serializedToolInput(input));
-}
-function fingerprint(value) {
-    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 12);
-}
-function redactString(value) {
-    let count = 0;
-    let redacted = value;
-    for (const pattern of SECRET_VALUE_PATTERNS) {
-        redacted = redacted.replace(pattern, (match) => {
-            count += 1;
-            return `[REDACTED_SECRET:${fingerprint(match)}]`;
-        });
-    }
-    // Keep hook payloads bounded. Full transcripts already use Codie's existing
-    // capture path; the detector only needs immediate causal context here.
-    if (redacted.length > 16_384)
-        redacted = `${redacted.slice(0, 16_384)}[TRUNCATED]`;
-    return { value: redacted, count };
-}
-function redact(value, key = "", depth = 0) {
-    if (depth > 8)
-        return { value: "[TRUNCATED_DEPTH]", count: 0 };
-    if (SECRET_KEY.test(key) && value !== null && value !== undefined) {
-        const text = typeof value === "string" ? value : JSON.stringify(value);
-        return { value: `[REDACTED_SECRET:${fingerprint(text)}]`, count: 1 };
-    }
-    if (typeof value === "string")
-        return redactString(value);
-    if (Array.isArray(value)) {
-        let count = 0;
-        const next = value.slice(0, 200).map((item) => {
-            const result = redact(item, key, depth + 1);
-            count += result.count;
-            return result.value;
-        });
-        return { value: next, count };
-    }
-    if (value && typeof value === "object") {
-        let count = 0;
-        const next = {};
-        for (const [childKey, childValue] of Object.entries(value).slice(0, 200)) {
-            const result = redact(childValue, childKey, depth + 1);
-            count += result.count;
-            next[childKey] = result.value;
-        }
-        return { value: next, count };
-    }
-    return { value, count: 0 };
-}
-function buildSecurityWorkflowEvent(input, phase, source, now = Date.now) {
-    const sessionId = input.session_id ?? input.sessionId ?? "";
-    const toolName = input.tool_name ?? input.toolName ?? "";
-    if (!sessionId || !toolName)
-        return null;
-    const rawPayload = {
-        input: input.tool_input ?? input.toolInput,
-        ...(phase === "post" ? { response: input.tool_response ?? input.toolResponse } : {}),
-        ...(phase === "failure" ? { error: input.error ?? input.tool_response ?? input.toolResponse } : {}),
-    };
-    const sanitized = redact(rawPayload);
-    const duration = input.duration_ms ?? input.durationMs;
-    return {
-        schemaVersion: 1,
-        source,
-        phase,
-        sessionId,
-        toolName,
-        toolUseId: input.tool_use_id ?? input.toolUseId,
-        cwd: input.cwd,
-        observedAt: now(),
-        toolDurationMs: typeof duration === "number" && Number.isFinite(duration) ? duration : undefined,
-        payload: sanitized.value,
-        redactionCount: sanitized.count,
-    };
-}
-/**
- * Captures the intent side of the causal chain without weakening the local
- * privacy boundary. A prompt that the deterministic policy blocks never
- * becomes an uploadable event; allowed prompts are redacted and bounded using
- * the same sanitizer as tool payloads.
- */
-function buildSecurityPromptEvent(input, source, now = Date.now, policy) {
-    const sessionId = input.session_id ?? input.sessionId ?? "";
-    if (!sessionId || !input.prompt) {
-        return null;
-    }
-    const decision = evaluatePromptSecurity(input.prompt, policy, source);
-    if (decision.action === "block")
-        return null;
-    const sanitized = redact({ prompt: input.prompt });
-    return {
-        schemaVersion: 1,
-        source,
-        phase: "pre",
-        sessionId,
-        toolName: "UserPrompt",
-        cwd: input.cwd,
-        observedAt: now(),
-        payload: sanitized.value,
-        redactionCount: sanitized.count,
-        localDecision: decision.action === "alert" ? "alert" : undefined,
-        localCategory: decision.action === "alert" ? decision.category : undefined,
-    };
-}
-/** Audit-safe evidence for a blocked prompt. The secret-bearing prompt is
- * intentionally omitted; administrators still see that prevention occurred. */
-function buildBlockedSecurityPromptEvent(input, source, category, now = Date.now) {
-    const sessionId = input.session_id ?? input.sessionId ?? "";
-    if (!sessionId)
-        return null;
-    return {
-        schemaVersion: 1,
-        source,
-        phase: "pre",
-        sessionId,
-        toolName: "UserPrompt",
-        cwd: input.cwd,
-        observedAt: now(),
-        payload: { blocked: true, content: "[REDACTED_BLOCKED_PROMPT]" },
-        redactionCount: 1,
-        localDecision: "block",
-        localCategory: category,
-    };
-}

package/dist/securityDeepScan.d.ts

@@ -1,41 +0,0 @@
-import { type SpawnSyncReturns } from "child_process";
-import type { SecurityFindingSeverity, SecurityInventoryReport } from "./securityInventory";
-export interface ExternalSecurityFinding {
-    scanner: string;
-    componentKey?: string;
-    severity: SecurityFindingSeverity;
-    ruleId?: string;
-    title: string;
-}
-export interface ExternalScannerRun {
-    scanner: string;
-    status: "passed" | "findings" | "unavailable" | "error" | "skipped";
-    detail: string;
-    findings: ExternalSecurityFinding[];
-}
-export interface DeepSecurityScanReport {
-    schemaVersion: 1;
-    generatedAt: string;
-    runs: ExternalScannerRun[];
-    findings: ExternalSecurityFinding[];
-}
-/** Adds component-addressable OSS scanner findings to the uploadable inventory.
- * Workspace-level findings (for example OSV dependency results) stay in the
- * deep-scan report because they do not identify one agent component. */
-export declare function mergeDeepScanFindings(report: SecurityInventoryReport, deep: DeepSecurityScanReport): SecurityInventoryReport;
-type Runner = (command: string, args: string[], timeoutMs: number) => SpawnSyncReturns<string>;
-/**
- * Runs optional open-source scanners. No scanner is downloaded implicitly.
- * MCP server connection is a separate opt-in because scanning a live stdio
- * server starts third-party code; the normal deep scan remains static.
- */
-export declare function runDeepSecurityScan(report: SecurityInventoryReport, options?: {
-    homeDir?: string;
-    workspace?: string;
-    connectMcp?: boolean;
-    supplyChain?: boolean;
-    timeoutMs?: number;
-    runner?: Runner;
-    now?: () => number;
-}): DeepSecurityScanReport;
-export {};