codiedev 0.9.35 → 0.9.37

package/dist/securityPolicy.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trustedPolicyKeysFromEnvironment = trustedPolicyKeysFromEnvironment;
+exports.verifyEndpointSecurityPolicySignature = verifyEndpointSecurityPolicySignature;
+exports.readEndpointSecurityPolicy = readEndpointSecurityPolicy;
+exports.inspectEndpointSecurityPolicy = inspectEndpointSecurityPolicy;
+exports.writeEndpointSecurityPolicy = writeEndpointSecurityPolicy;
+exports.syncEndpointSecurityPolicy = syncEndpointSecurityPolicy;
+const fs = __importStar(require("fs"));
+const crypto = __importStar(require("crypto"));
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const path = __importStar(require("path"));
+const configDir_1 = require("./configDir");
+const POLICY_FILE = "security-policy.json";
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, child]) => `${JSON.stringify(key)}:${stableJson(child)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+function trustedPolicyKeysFromEnvironment(env = process.env) {
+    const raw = env.CODIEDEV_SECURITY_POLICY_PUBLIC_KEYS;
+    if (!raw)
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        return Object.fromEntries(Object.entries(parsed)
+            .filter((entry) => typeof entry[1] === "string"));
+    }
+    catch {
+        return {};
+    }
+}
+function verifyEndpointSecurityPolicySignature(policy, trustedKeys = trustedPolicyKeysFromEnvironment()) {
+    const configuredKeys = Object.keys(trustedKeys);
+    if (configuredKeys.length === 0) {
+        return { ok: true, trusted: false, detail: "no endpoint policy public keys are pinned" };
+    }
+    const envelope = policy.signature;
+    if (!envelope || envelope.algorithm !== "Ed25519") {
+        return { ok: false, trusted: false, detail: "policy signature is missing" };
+    }
+    const publicKey = trustedKeys[envelope.keyId];
+    if (!publicKey)
+        return { ok: false, trusted: false, detail: `policy signing key ${envelope.keyId} is not trusted` };
+    const unsigned = { ...policy };
+    delete unsigned.signature;
+    try {
+        const ok = crypto.verify(null, Buffer.from(`${envelope.signedAt}.${stableJson(unsigned)}`), crypto.createPublicKey(publicKey), Buffer.from(envelope.value, "base64"));
+        return ok
+            ? { ok: true, trusted: true, detail: `verified with ${envelope.keyId}` }
+            : { ok: false, trusted: false, detail: "policy signature does not match its content" };
+    }
+    catch (error) {
+        return { ok: false, trusted: false, detail: `policy signature could not be verified: ${error.message}` };
+    }
+}
+function readEndpointSecurityPolicy(stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment()) {
+    const inspection = inspectEndpointSecurityPolicy(stateDir, trustedKeys);
+    return inspection.verification.ok ? inspection.policy : undefined;
+}
+function inspectEndpointSecurityPolicy(stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment()) {
+    const target = path.join(stateDir, POLICY_FILE);
+    if (!fs.existsSync(target)) {
+        return { exists: false, verification: { ok: true, trusted: false, detail: "no cached endpoint policy" } };
+    }
+    try {
+        const value = JSON.parse(fs.readFileSync(target, "utf8"));
+        if (value?.schemaVersion !== 1 || !["alert", "block"].includes(value.enforcementMode)) {
+            return { exists: true, verification: { ok: false, trusted: false, detail: "cached endpoint policy has an invalid schema" } };
+        }
+        const policy = value;
+        return { exists: true, policy, verification: verifyEndpointSecurityPolicySignature(policy, trustedKeys) };
+    }
+    catch (error) {
+        return { exists: true, verification: { ok: false, trusted: false, detail: `cached endpoint policy could not be read: ${error.message}` } };
+    }
+}
+function writeEndpointSecurityPolicy(policy, stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment()) {
+    const verification = verifyEndpointSecurityPolicySignature(policy, trustedKeys);
+    if (!verification.ok)
+        throw new Error(`Refusing untrusted endpoint policy: ${verification.detail}`);
+    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    const target = path.join(stateDir, POLICY_FILE);
+    const temporary = `${target}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(policy, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(temporary, 0o600);
+    fs.renameSync(temporary, target);
+}
+async function syncEndpointSecurityPolicy(config, source, timeoutMs = 3_000) {
+    const url = new URL("/api/cli/securityPolicy", config.backendUrl);
+    if (source)
+        url.searchParams.set("source", source);
+    const transport = url.protocol === "https:" ? https : http;
+    const policy = await new Promise((resolve, reject) => {
+        const request = transport.request(url, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${config.token}`, Accept: "application/json" },
+        }, (response) => {
+            let raw = "";
+            response.setEncoding("utf8");
+            response.on("data", (chunk) => { raw += chunk; });
+            response.on("end", () => {
+                if ((response.statusCode ?? 500) >= 300)
+                    return reject(new Error(`policy_http_${response.statusCode}`));
+                try {
+                    resolve(JSON.parse(raw));
+                }
+                catch {
+                    reject(new Error("invalid policy response"));
+                }
+            });
+        });
+        request.setTimeout(timeoutMs, () => request.destroy(new Error(`policy sync timeout after ${timeoutMs}ms`)));
+        request.on("error", reject);
+        request.end();
+    });
+    writeEndpointSecurityPolicy(policy);
+    return policy;
+}

package/dist/securitySession.d.ts

@@ -0,0 +1,6 @@
+interface SessionSignal {
+    sensitiveReadAt?: number;
+}
+export declare function readSessionSecuritySignal(sessionId: string | undefined, stateDir?: string, now?: number): SessionSignal | undefined;
+export declare function recordSensitiveReadSignal(sessionId: string | undefined, stateDir?: string, now?: number): void;
+export {};

package/dist/securitySession.js

@@ -0,0 +1,72 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSessionSecuritySignal = readSessionSecuritySignal;
+exports.recordSensitiveReadSignal = recordSensitiveReadSignal;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const configDir_1 = require("./configDir");
+const SIGNAL_FILE = "security-session-signals.json";
+const MAX_AGE_MS = 2 * 60 * 60 * 1_000;
+function readSignals(stateDir, now) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(stateDir, SIGNAL_FILE), "utf8"));
+        if (parsed.schemaVersion !== 1 || !parsed.sessions || typeof parsed.sessions !== "object")
+            throw new Error("invalid signals");
+        parsed.sessions = Object.fromEntries(Object.entries(parsed.sessions)
+            .filter(([, signal]) => signal.sensitiveReadAt && now - signal.sensitiveReadAt <= MAX_AGE_MS)
+            .slice(-250));
+        return parsed;
+    }
+    catch {
+        return { schemaVersion: 1, sessions: {} };
+    }
+}
+function readSessionSecuritySignal(sessionId, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now()) {
+    if (!sessionId)
+        return undefined;
+    return readSignals(stateDir, now).sessions[sessionId];
+}
+function recordSensitiveReadSignal(sessionId, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now()) {
+    if (!sessionId)
+        return;
+    const signals = readSignals(stateDir, now);
+    signals.sessions[sessionId] = { sensitiveReadAt: now };
+    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    const target = path.join(stateDir, SIGNAL_FILE);
+    const temporary = `${target}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(signals)}\n`, { mode: 0o600 });
+    fs.renameSync(temporary, target);
+}

package/dist/utils.js

@@ -1054,6 +1054,11 @@ function installOpenCodeCapturePlugin() {
     const start = resolveHookInvocation("session-start-opencode");
     const capture = resolveHookInvocation("capture-opencode");
     const finish = resolveHookInvocation("capture-opencode-final");
+    const backup = resolveHookInvocation("backup");
+    const prompt = resolveHookInvocation("discover-codie");
+    const securityPre = resolveHookInvocation("security-pre-codie");
+    const securityPost = resolveHookInvocation("security-post-codie");
+    const securityFailure = resolveHookInvocation("security-failure-codie");
     const source = `// Managed by codiedev connect. Safe to remove and reinstall.\n` +
         `import { spawn, spawnSync } from "node:child_process";\n` +
         `import { mkdir, writeFile } from "node:fs/promises";\n` +
@@ -1062,6 +1067,11 @@ function installOpenCodeCapturePlugin() {
         `const START = ${JSON.stringify(start)};\n` +
         `const CAPTURE = ${JSON.stringify(capture)};\n` +
         `const FINISH = ${JSON.stringify(finish)};\n` +
+        `const BACKUP = ${JSON.stringify(backup)};\n` +
+        `const PROMPT = ${JSON.stringify(prompt)};\n` +
+        `const SECURITY_PRE = ${JSON.stringify(securityPre)};\n` +
+        `const SECURITY_POST = ${JSON.stringify(securityPost)};\n` +
+        `const SECURITY_FAILURE = ${JSON.stringify(securityFailure)};\n` +
         `const fingerprints = new Map();\n\n` +
         `const transcriptPaths = new Map();\n\n` +
         `function sessionId(event) {\n` +
@@ -1077,6 +1087,18 @@ function installOpenCodeCapturePlugin() {
         `function dispatchSync(invocation, payload) {\n` +
         `  try { spawnSync(invocation.command, invocation.args, { input: JSON.stringify(payload), stdio: ["pipe", "ignore", "ignore"], timeout: 1500 }); } catch {}\n` +
         `}\n\n` +
+        `function enforceSync(invocation, payload) {\n` +
+        `  const result = spawnSync(invocation.command, invocation.args, { input: JSON.stringify(payload), encoding: "utf8", stdio: ["pipe", "pipe", "ignore"], timeout: 1500 });\n` +
+        `  if (result.error) return;\n` +
+        `  try {\n` +
+        `    const decision = JSON.parse(result.stdout || "{}");\n` +
+        `    const denied = decision?.decision === "block" || decision?.hookSpecificOutput?.permissionDecision === "deny";\n` +
+        `    if (denied) throw new Error(decision?.reason || decision?.hookSpecificOutput?.permissionDecisionReason || "Codie security policy blocked this action");\n` +
+        `  } catch (error) {\n` +
+        `    if (error instanceof SyntaxError) return;\n` +
+        `    throw error;\n` +
+        `  }\n` +
+        `}\n\n` +
         `export const CodiedevCapture = async ({ client, directory, worktree }) => {\n` +
         `  const finalizeAll = () => {\n` +
         `    for (const [id, transcriptPath] of transcriptPaths) {\n` +
@@ -1086,6 +1108,21 @@ function installOpenCodeCapturePlugin() {
         `  };\n` +
         `  process.once("exit", finalizeAll);\n` +
         `  return ({\n` +
+        `  "chat.message": async (input, output) => {\n` +
+        `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
+        `    const cwd = worktree || directory || process.cwd();\n` +
+        `    const prompt = Array.isArray(output?.parts) ? output.parts.filter((part) => part?.type === "text").map((part) => part.text || "").join("\\n") : "";\n` +
+        `    enforceSync(PROMPT, { sessionId: id, cwd, prompt });\n` +
+        `  },\n` +
+        `  "tool.execute.before": async (input, output) => {\n` +
+        `    const cwd = worktree || directory || process.cwd();\n` +
+        `    enforceSync(SECURITY_PRE, { sessionId: input?.sessionID ?? input?.sessionId ?? "unknown", cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: output?.args ?? output });\n` +
+        `  },\n` +
+        `  "tool.execute.after": async (input, output) => {\n` +
+        `    const cwd = worktree || directory || process.cwd();\n` +
+        `    const payload = { sessionId: input?.sessionID ?? input?.sessionId ?? "unknown", cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: input?.args, toolResponse: output };\n` +
+        `    dispatch(output?.error ? SECURITY_FAILURE : SECURITY_POST, payload);\n` +
+        `  },\n` +
         `  event: async ({ event }) => {\n` +
         `    const id = sessionId(event);\n` +
         `    if (!id) return;\n` +
@@ -1117,6 +1154,7 @@ function installOpenCodeCapturePlugin() {
         `      await writeFile(transcriptPath, JSON.stringify(list), { mode: 0o600 });\n` +
         `      transcriptPaths.set(id, transcriptPath);\n` +
         `      dispatch(CAPTURE, { session_id: id, transcript_path: transcriptPath, cwd, workspace_roots: [cwd] });\n` +
+        `      dispatch(BACKUP, { session_id: id, cwd, workspace_roots: [cwd] });\n` +
         `    } catch {}\n` +
         `  },\n` +
         `  });\n` +
@@ -1196,6 +1234,11 @@ function installHook() {
     const hooks = settings.hooks;
     // SessionEnd → capture (upload the finished session for the team library).
     upsertCodiedevHook(hooks, "SessionEnd", "capture");
+    // Tool boundaries → ADR shadow detection. PreToolUse is the eventual
+    // enforcement point; alert mode always returns allow.
+    upsertCodiedevHook(hooks, "PreToolUse", "security-pre");
+    upsertCodiedevHook(hooks, "PostToolUse", "security-post");
+    upsertCodiedevHook(hooks, "PostToolUseFailure", "security-failure");
     // UserPromptSubmit → discover (surface a matching team skill for the task).
     upsertCodiedevHook(hooks, "UserPromptSubmit", "discover");
     // Stop → backup (auto-back-up changed artifact files to your private library).
@@ -1305,6 +1348,9 @@ function ensureAllCodiedevHooksInstalled() {
         const hooks = (settings.hooks ?? {});
         const wanted = [
             ["SessionEnd", "capture"],
+            ["PreToolUse", "security-pre"],
+            ["PostToolUse", "security-post"],
+            ["PostToolUseFailure", "security-failure"],
             ["UserPromptSubmit", "discover"],
             ["Stop", "backup"],
             ["StopFailure", "limit", "rate_limit"],
@@ -1767,9 +1813,8 @@ function installCodexHook() {
         hooksFile.hooks = {};
     }
     const hooks = hooksFile.hooks;
-    if (!hooks.Stop) {
+    if (!hooks.Stop)
         hooks.Stop = [];
-    }
     const existing = hooks.Stop;
     const filtered = existing.filter((hook) => {
         const inner = hook.hooks;
@@ -1797,6 +1842,15 @@ function installCodexHook() {
         ],
     });
     hooks.Stop = filtered;
+    // Codex uses the same Claude-style matcher-group shape. Keep these as
+    // separate entries because Codex hook coverage is still evolving and a
+    // malformed/unavailable post hook must not interfere with PreToolUse.
+    upsertCodiedevHook(hooks, "PreToolUse", "security-pre-codex");
+    upsertCodiedevHook(hooks, "PostToolUse", "security-post-codex");
+    upsertCodiedevHook(hooks, "PostToolUseFailure", "security-failure-codex");
+    // Prompt guard + skill discovery. The guard runs locally before any prompt
+    // content can reach either the model or Codiedev's discovery endpoint.
+    upsertCodiedevHook(hooks, "UserPromptSubmit", "discover-codex");
     if (!fs.existsSync(CODEX_DIR)) {
         fs.mkdirSync(CODEX_DIR, { recursive: true });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.35",
+  "version": "0.9.37",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",
@@ -12,6 +12,7 @@
     "dev": "tsc --watch",
     "prepublishOnly": "tsc",
     "test": "vitest run",
+    "test:security-pilot": "vitest run src/__tests__/security.test.ts src/__tests__/securityInstall.test.ts src/__tests__/securityPilot.test.ts src/__tests__/codieSecurityAdapterWiring.test.ts && tsc && node dist/cli.js security pilot --json",
     "test:watch": "vitest"
   },
   "files": [
@@ -35,12 +36,18 @@
     "session-capture"
   ],
   "homepage": "https://codiedev.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Signal-and-Code/codiedev.git",
+    "directory": "packages/codiedev-cli"
+  },
   "license": "MIT",
   "engines": {
     "node": ">=18"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "devDependencies": {
     "@types/node": "^20.0.0",