daemora 1.0.0-alpha.0

package/dist/safety/CommandGuard.d.ts

@@ -0,0 +1,32 @@
+/**
+ * CommandGuard — blocks shell commands that could exfiltrate secrets,
+ * escalate privilege, or read the agent's own config files.
+ *
+ * Called before any `execute_command` tool invocation. This is
+ * defence-in-depth; it sits BEFORE the actual spawn and AFTER the
+ * FilesystemGuard path check, and complements SecretScanner's
+ * post-hoc output redaction.
+ *
+ * Blocked categories (from JS parity):
+ *   1. Environment dumping   — `printenv`, `/proc/self/environ`, bare `env`.
+ *   2. `.env` file reads     — cat/less/head/tail/open/bat on `.env*`.
+ *   3. Env access via interpreters — node -e `process.env`, python -c `os.environ`, etc.
+ *   4. Credential exfiltration — curl/wget with `$API_KEY`, piping env to
+ *      external hosts, redirecting env dumps to files.
+ *   5. Sensitive file reads — vault files, tenant data, SSH private keys.
+ *   6. Daemora CLI privilege escalation — agent must never run its own CLI.
+ *   7. Agent config files   — `config/mcp.json`, `config/hooks.json` (often
+ *      hold provider tokens in plaintext).
+ */
+import { EventEmitter } from "node:events";
+export interface CommandCheck {
+    readonly allowed: boolean;
+    readonly reason?: string;
+    readonly category?: string;
+}
+export declare class CommandGuard extends EventEmitter {
+    /** Run a single command string through every rule. First match wins. */
+    check(cmd: string): CommandCheck;
+}
+export declare const commandGuard: CommandGuard;
+//# sourceMappingURL=CommandGuard.d.ts.map

package/dist/safety/CommandGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandGuard.d.ts","sourceRoot":"","sources":["../../src/safety/CommandGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAyI3C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,YAAa,SAAQ,YAAY;IAC5C,wEAAwE;IACxE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;CAWjC;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/dist/safety/CommandGuard.js

@@ -0,0 +1,157 @@
+/**
+ * CommandGuard — blocks shell commands that could exfiltrate secrets,
+ * escalate privilege, or read the agent's own config files.
+ *
+ * Called before any `execute_command` tool invocation. This is
+ * defence-in-depth; it sits BEFORE the actual spawn and AFTER the
+ * FilesystemGuard path check, and complements SecretScanner's
+ * post-hoc output redaction.
+ *
+ * Blocked categories (from JS parity):
+ *   1. Environment dumping   — `printenv`, `/proc/self/environ`, bare `env`.
+ *   2. `.env` file reads     — cat/less/head/tail/open/bat on `.env*`.
+ *   3. Env access via interpreters — node -e `process.env`, python -c `os.environ`, etc.
+ *   4. Credential exfiltration — curl/wget with `$API_KEY`, piping env to
+ *      external hosts, redirecting env dumps to files.
+ *   5. Sensitive file reads — vault files, tenant data, SSH private keys.
+ *   6. Daemora CLI privilege escalation — agent must never run its own CLI.
+ *   7. Agent config files   — `config/mcp.json`, `config/hooks.json` (often
+ *      hold provider tokens in plaintext).
+ */
+import { EventEmitter } from "node:events";
+import { createLogger } from "../util/logger.js";
+const log = createLogger("command-guard");
+const BLOCKED_COMMANDS = [
+    // 1. Environment dumping
+    { category: "env-dump", pattern: /\bprintenv\b/i, reason: "printenv dumps all environment variables and is blocked." },
+    { category: "env-dump", pattern: /\/proc\/self\/environ/, reason: "Reading /proc/self/environ is blocked." },
+    {
+        category: "env-dump",
+        pattern: /(?:^|[;&|`]\s*)env\s*(?:$|[|>&;`\n])/,
+        reason: "Bare 'env' command (dumps environment) is blocked.",
+    },
+    // 2. .env file access via shell
+    {
+        category: "dotenv",
+        pattern: /\b(?:cat|less|more|head|tail|bat|view|nano|vi|vim|emacs|open|code|subl)\b[^;|&\n]*\.env(?:\.[^\s;&|]*)?(?:\s|$)/i,
+        reason: "Reading .env files via shell is blocked.",
+    },
+    {
+        category: "dotenv",
+        pattern: /\b(?:cp|mv|rsync|scp|tar|zip|gzip)\b[^;|&\n]*\.env(?:\.[^\s;&|]*)?(?:\s|$)/i,
+        reason: "Copying / archiving .env files is blocked.",
+    },
+    // 3. Env access via interpreters
+    {
+        category: "interpreter-env",
+        pattern: /\bnode\b[^;|&\n]*(?:-e|--eval)\s+['"][^'"]*process\.env/i,
+        reason: "Accessing process.env via node -e is blocked.",
+    },
+    {
+        category: "interpreter-env",
+        pattern: /\bnode\b[^;|&\n]*(?:-e|--eval)\s+['"][^'"]*require\s*\(\s*['"]dotenv/i,
+        reason: "Loading .env via node -e + dotenv is blocked.",
+    },
+    {
+        category: "interpreter-env",
+        pattern: /\bpython[23]?\b[^;|&\n]*-c\s+['"][^'"]*(?:os\.environ|os\.getenv|dotenv)/i,
+        reason: "Accessing environment via python -c is blocked.",
+    },
+    {
+        category: "interpreter-env",
+        pattern: /\bruby\b[^;|&\n]*-e\s+['"][^'"]*ENV\[/i,
+        reason: "Accessing environment via ruby -e is blocked.",
+    },
+    // 4. Credential exfiltration
+    {
+        category: "exfil",
+        pattern: /\b(?:curl|wget)\b[^;|&\n]*\$(?:\{[A-Z_]+(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|SID|AUTH|PRIVATE)[^}]*\}|[A-Z_]+(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|SID|AUTH|PRIVATE)\b)/i,
+        reason: "Potential credential exfiltration: env var containing a secret inside curl/wget.",
+    },
+    {
+        category: "exfil",
+        pattern: /\b(?:curl|wget|nc|netcat|http|httpie)\b[^;|&\n]*\$\(\s*(?:printenv|env)\b/i,
+        reason: "Potential exfiltration: curl/wget combined with printenv/env.",
+    },
+    {
+        category: "exfil",
+        pattern: /\bprintenv\b[^;|&\n]*\|\s*(?:curl|wget|nc|netcat|tee|mail|sendmail)/i,
+        reason: "Piping env to an external destination is blocked.",
+    },
+    {
+        category: "exfil",
+        pattern: /\bprintenv\b[^;|&\n]*>/,
+        reason: "Redirecting env dump to a file is blocked.",
+    },
+    // 5. Sensitive file reads
+    {
+        category: "sensitive-read",
+        pattern: /\b(?:cat|less|more|head|tail)\b[^;|&\n]*(?:\.vault\.enc|\.vault\.salt|tenants\.json|\/data\/tenants\/)/i,
+        reason: "Reading vault / tenant data via shell is blocked.",
+    },
+    {
+        category: "sensitive-read",
+        pattern: /\b(?:cat|less|more|head|tail)\b[^;|&\n]*(?:id_rsa|id_ed25519|id_ecdsa|\.pem|\.key)\b/i,
+        reason: "Reading SSH / TLS private keys is blocked.",
+    },
+    // 6. Daemora CLI privilege escalation
+    {
+        category: "privesc",
+        pattern: /(?:^|[;&|`]\s*)(?:daemora|aegis)\b/,
+        reason: "Running daemora/aegis CLI from inside the agent is blocked (privilege escalation).",
+    },
+    {
+        category: "privesc",
+        pattern: /\bnpx\s+(?:daemora|aegis)\b/,
+        reason: "Running daemora/aegis via npx is blocked (privilege escalation).",
+    },
+    {
+        category: "privesc",
+        pattern: /\bnode\b[^;|&\n]*(?:cli\.js|bin\/daemora|bin\/aegis)\b/,
+        reason: "Running daemora/aegis CLI via node is blocked.",
+    },
+    {
+        category: "privesc",
+        pattern: /\bbash\b[^;|&\n]*-c\s+['"][^'"]*(?:daemora|aegis)\b/,
+        reason: "Running daemora/aegis via bash -c is blocked.",
+    },
+    // 7. Agent-owned config files
+    {
+        category: "config",
+        pattern: /\b(?:cat|less|more|head|tail|bat|jq|python|node)\b[^;|&\n]*config[\/\\]mcp\.json/i,
+        reason: "Reading config/mcp.json (MCP server credentials) is blocked.",
+    },
+    {
+        category: "config",
+        pattern: /\b(?:cat|less|more|head|tail|bat)\b[^;|&\n]*config[\/\\]hooks\.json/i,
+        reason: "Reading config/hooks.json is blocked.",
+    },
+    {
+        category: "config",
+        pattern: /config[\/\\]mcp\.json[^;|&\n]*(?:\||>)/,
+        reason: "Piping/redirecting config/mcp.json is blocked.",
+    },
+    // 8. Agent's own SQLite DB — user rule: "must not read its own DB"
+    {
+        category: "self-db",
+        pattern: /\bdaemora\.db(?:-(?:wal|shm))?\b/i,
+        reason: "Reading the Daemora SQLite database via shell is blocked.",
+    },
+];
+export class CommandGuard extends EventEmitter {
+    /** Run a single command string through every rule. First match wins. */
+    check(cmd) {
+        if (!cmd || typeof cmd !== "string")
+            return { allowed: true };
+        for (const rule of BLOCKED_COMMANDS) {
+            if (rule.pattern.test(cmd)) {
+                log.warn({ category: rule.category, cmd: cmd.slice(0, 160) }, "command blocked");
+                this.emit("blocked", { category: rule.category, reason: rule.reason, cmd: cmd.slice(0, 200) });
+                return { allowed: false, reason: rule.reason, category: rule.category };
+            }
+        }
+        return { allowed: true };
+    }
+}
+export const commandGuard = new CommandGuard();
+//# sourceMappingURL=CommandGuard.js.map

package/dist/safety/CommandGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandGuard.js","sourceRoot":"","sources":["../../src/safety/CommandGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAQ1C,MAAM,gBAAgB,GAAyB;IAC7C,yBAAyB;IACzB,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,0DAA0D,EAAE;IACtH,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,wCAAwC,EAAE;IAC5G;QACE,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,sCAAsC;QAC/C,MAAM,EAAE,oDAAoD;KAC7D;IAED,gCAAgC;IAChC;QACE,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,kHAAkH;QAC3H,MAAM,EAAE,0CAA0C;KACnD;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,6EAA6E;QACtF,MAAM,EAAE,4CAA4C;KACrD;IAED,iCAAiC;IACjC;QACE,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,0DAA0D;QACnE,MAAM,EAAE,+CAA+C;KACxD;IACD;QACE,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,uEAAuE;QAChF,MAAM,EAAE,+CAA+C;KACxD;IACD;QACE,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,2EAA2E;QACpF,MAAM,EAAE,iDAAiD;KAC1D;IACD;QACE,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,wCAAwC;QACjD,MAAM,EAAE,+CAA+C;KACxD;IAED,6BAA6B;IAC7B;QACE,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,2KAA2K;QACpL,MAAM,EAAE,kFAAkF;KAC3F;IACD;QACE,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,4EAA4E;QACrF,MAAM,EAAE,+DAA+D;KACxE;IACD;QACE,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,sEAAsE;QAC/E,MAAM,EAAE,mDAAmD;KAC5D;IACD;QACE,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,wBAAwB;QACjC,MAAM,EAAE,4CAA4C;KACrD;IAED,0BAA0B;IAC1B;QACE,QAAQ,EAAE,gBAAgB;QAC1B,OAAO,EAAE,yGAAyG;QAClH,MAAM,EAAE,mDAAmD;KAC5D;IACD;QACE,QAAQ,EAAE,gBAAgB;QAC1B,OAAO,EAAE,uFAAuF;QAChG,MAAM,EAAE,4CAA4C;KACrD;IAED,sCAAsC;IACtC;QACE,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,oCAAoC;QAC7C,MAAM,EAAE,oFAAoF;KAC7F;IACD;QACE,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,6BAA6B;QACtC,MAAM,EAAE,kEAAkE;KAC3E;IACD;QACE,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,wDAAwD;QACjE,MAAM,EAAE,gDAAgD;KACzD;IACD;QACE,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,qDAAqD;QAC9D,MAAM,EAAE,+CAA+C;KACxD;IAED,8BAA8B;IAC9B;QACE,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,mFAAmF;QAC5F,MAAM,EAAE,8DAA8D;KACvE;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,sEAAsE;QAC/E,MAAM,EAAE,uCAAuC;KAChD;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,wCAAwC;QACjD,MAAM,EAAE,gDAAgD;KACzD;IAED,mEAAmE;IACnE;QACE,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,mCAAmC;QAC5C,MAAM,EAAE,2DAA2D;KACpE;CACF,CAAC;AAQF,MAAM,OAAO,YAAa,SAAQ,YAAY;IAC5C,wEAAwE;IACxE,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9D,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;gBACjF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC/F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC"}

package/dist/safety/DockerSandbox.d.ts

@@ -0,0 +1,72 @@
+/**
+ * DockerSandbox — kernel-level isolation for `execute_command`.
+ *
+ * When `SANDBOX_MODE=docker`, every shell invocation goes through
+ * `exec(scopeId, command)` here instead of running on the host.
+ * Each scope (usually a session id) gets its own long-lived container
+ * with:
+ *
+ *   • `--network none`        — no outbound
+ *   • `--read-only`           — host fs is mounted ro
+ *   • `--cap-drop ALL`        — drop all Linux capabilities
+ *   • `--memory`, `--cpus`    — bounded
+ *   • `/tmp` + `/workspace`   — tmpfs writable overlays
+ *
+ * Containers are reused across calls for the same scope (so the agent
+ * keeps its working tree) and auto-cleaned after `CLEANUP_AFTER_MS` of
+ * inactivity.
+ */
+import { EventEmitter } from "node:events";
+export interface DockerSandboxOpts {
+    readonly image?: string;
+    readonly memory?: string;
+    readonly cpus?: string;
+    readonly network?: "none" | "bridge" | "host";
+    readonly tmpWorkspaceMb?: number;
+    readonly execTimeoutMs?: number;
+}
+export interface DockerExecResult {
+    readonly ok: boolean;
+    readonly stdout: string;
+    readonly stderr?: string;
+    readonly exitCode?: number;
+    readonly message: string;
+}
+export declare class DockerSandbox extends EventEmitter {
+    private readonly image;
+    private readonly memory;
+    private readonly cpus;
+    private readonly network;
+    private readonly tmpWorkspaceMb;
+    private readonly execTimeoutMs;
+    private available;
+    private readonly containers;
+    constructor(opts?: DockerSandboxOpts);
+    /** Is docker actually usable on this host? Cached after first call. */
+    isAvailable(): boolean;
+    /** Ensure a container for this scope exists and is running. */
+    ensureContainer(scopeId?: string): string;
+    /** Run a shell command inside the scope's container. */
+    exec(scopeId: string, command: string, opts?: {
+        timeoutMs?: number;
+        cwd?: string;
+    }): DockerExecResult;
+    /** Copy host files into the container (e.g. user workspace). */
+    copyToContainer(scopeId: string, hostPath: string, containerPath?: string): boolean;
+    /** Remove a scope's container (force). */
+    removeContainer(scopeId: string): void;
+    /** Drop containers that have been idle past CLEANUP_AFTER_MS. */
+    cleanup(): number;
+    /** Remove every sandbox container — process shutdown. */
+    removeAll(): void;
+    list(): readonly {
+        scopeId: string;
+        containerId: string;
+        containerName: string;
+        createdAt: string;
+        lastUsedAt: string;
+        idleMs: number;
+    }[];
+}
+export declare const dockerSandbox: DockerSandbox;
+//# sourceMappingURL=DockerSandbox.d.ts.map

package/dist/safety/DockerSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DockerSandbox.d.ts","sourceRoot":"","sources":["../../src/safety/DockerSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AASD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,aAAc,SAAQ,YAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqC;gBAEpD,IAAI,GAAE,iBAAsB;IAUxC,uEAAuE;IACvE,WAAW,IAAI,OAAO;IAWtB,+DAA+D;IAC/D,eAAe,CAAC,OAAO,SAAW,GAAG,MAAM;IAiD3C,wDAAwD;IACxD,IAAI,CACF,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9C,gBAAgB;IA4CnB,gEAAgE;IAChE,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,SAAe,GAAG,OAAO;IAezF,0CAA0C;IAC1C,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAWtC,iEAAiE;IACjE,OAAO,IAAI,MAAM;IAYjB,yDAAyD;IACzD,SAAS,IAAI,IAAI;IAIjB,IAAI,IAAI,SAAS;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,EAAE;CAWJ;AAED,eAAO,MAAM,aAAa,eAAsB,CAAC"}

package/dist/safety/DockerSandbox.js

@@ -0,0 +1,188 @@
+/**
+ * DockerSandbox — kernel-level isolation for `execute_command`.
+ *
+ * When `SANDBOX_MODE=docker`, every shell invocation goes through
+ * `exec(scopeId, command)` here instead of running on the host.
+ * Each scope (usually a session id) gets its own long-lived container
+ * with:
+ *
+ *   • `--network none`        — no outbound
+ *   • `--read-only`           — host fs is mounted ro
+ *   • `--cap-drop ALL`        — drop all Linux capabilities
+ *   • `--memory`, `--cpus`    — bounded
+ *   • `/tmp` + `/workspace`   — tmpfs writable overlays
+ *
+ * Containers are reused across calls for the same scope (so the agent
+ * keeps its working tree) and auto-cleaned after `CLEANUP_AFTER_MS` of
+ * inactivity.
+ */
+import { EventEmitter } from "node:events";
+import { execFileSync } from "node:child_process";
+import { createLogger } from "../util/logger.js";
+const log = createLogger("docker-sandbox");
+const CLEANUP_AFTER_MS = 10 * 60_000;
+export class DockerSandbox extends EventEmitter {
+    image;
+    memory;
+    cpus;
+    network;
+    tmpWorkspaceMb;
+    execTimeoutMs;
+    available = null;
+    containers = new Map();
+    constructor(opts = {}) {
+        super();
+        this.image = opts.image ?? process.env["DOCKER_IMAGE"] ?? "node:22-slim";
+        this.memory = opts.memory ?? process.env["DOCKER_MEMORY"] ?? "512m";
+        this.cpus = opts.cpus ?? process.env["DOCKER_CPUS"] ?? "0.5";
+        this.network = opts.network ?? process.env["DOCKER_NETWORK"] ?? "none";
+        this.tmpWorkspaceMb = opts.tmpWorkspaceMb ?? 500;
+        this.execTimeoutMs = opts.execTimeoutMs ?? 120_000;
+    }
+    /** Is docker actually usable on this host? Cached after first call. */
+    isAvailable() {
+        if (this.available !== null)
+            return this.available;
+        try {
+            execFileSync("docker", ["info"], { stdio: "pipe", timeout: 5000 });
+            this.available = true;
+        }
+        catch {
+            this.available = false;
+        }
+        return this.available;
+    }
+    /** Ensure a container for this scope exists and is running. */
+    ensureContainer(scopeId = "shared") {
+        const existing = this.containers.get(scopeId);
+        if (existing) {
+            try {
+                const out = execFileSync("docker", ["inspect", "-f", "{{.State.Running}}", existing.containerId], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
+                if (out === "true") {
+                    existing.lastUsedAt = Date.now();
+                    return existing.containerId;
+                }
+            }
+            catch {
+                this.containers.delete(scopeId);
+            }
+        }
+        const containerName = `daemora-sandbox-${scopeId.replace(/[^a-zA-Z0-9_-]/g, "-").slice(0, 30)}-${Date.now()}`;
+        const args = [
+            "run", "-d",
+            "--name", containerName,
+            "--memory", this.memory,
+            "--cpus", this.cpus,
+            "--network", this.network,
+            "--read-only",
+            "--cap-drop", "ALL",
+            "--tmpfs", "/tmp:rw,noexec,nosuid,size=100m",
+            "--tmpfs", `/workspace:rw,size=${this.tmpWorkspaceMb}m`,
+            "-w", "/workspace",
+            this.image,
+            "tail", "-f", "/dev/null",
+        ];
+        const containerId = execFileSync("docker", args, {
+            encoding: "utf-8",
+            timeout: 30_000,
+        }).trim();
+        this.containers.set(scopeId, {
+            containerId,
+            containerName,
+            createdAt: Date.now(),
+            lastUsedAt: Date.now(),
+        });
+        log.info({ scopeId, containerName, short: containerId.slice(0, 12) }, "container created");
+        this.emit("container:created", { scopeId, containerId, containerName });
+        return containerId;
+    }
+    /** Run a shell command inside the scope's container. */
+    exec(scopeId, command, opts = {}) {
+        const containerId = this.ensureContainer(scopeId);
+        const timeoutMs = opts.timeoutMs ?? this.execTimeoutMs;
+        const cwd = opts.cwd ?? "/workspace";
+        try {
+            const stdout = execFileSync("docker", ["exec", "-w", cwd, containerId, "sh", "-c", command], {
+                encoding: "utf-8",
+                timeout: timeoutMs,
+                maxBuffer: 10 * 1024 * 1024,
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+            const entry = this.containers.get(scopeId);
+            if (entry)
+                entry.lastUsedAt = Date.now();
+            return { ok: true, stdout: stdout || "", message: stdout ? "ok" : "(command completed with no output)" };
+        }
+        catch (e) {
+            const err = e;
+            if (err.killed) {
+                return { ok: false, stdout: "", message: `Command timed out after ${Math.round(timeoutMs / 1000)}s in Docker sandbox.` };
+            }
+            const stdout = typeof err.stdout === "string" ? err.stdout : err.stdout?.toString() ?? "";
+            const stderr = typeof err.stderr === "string" ? err.stderr : err.stderr?.toString() ?? "";
+            const msg = `Docker exec failed${err.status != null ? ` (exit ${err.status})` : ""}: ${err.message}`;
+            return {
+                ok: false,
+                stdout: stdout.slice(0, 4000),
+                stderr: stderr.slice(0, 4000),
+                ...(err.status != null ? { exitCode: err.status } : {}),
+                message: msg,
+            };
+        }
+    }
+    /** Copy host files into the container (e.g. user workspace). */
+    copyToContainer(scopeId, hostPath, containerPath = "/workspace") {
+        const containerId = this.ensureContainer(scopeId);
+        try {
+            execFileSync("docker", ["cp", `${hostPath}/.`, `${containerId}:${containerPath}`], { stdio: "pipe", timeout: 30_000 });
+            return true;
+        }
+        catch (e) {
+            log.warn({ err: e.message }, "docker cp failed");
+            return false;
+        }
+    }
+    /** Remove a scope's container (force). */
+    removeContainer(scopeId) {
+        const entry = this.containers.get(scopeId);
+        if (!entry)
+            return;
+        try {
+            execFileSync("docker", ["rm", "-f", entry.containerId], { stdio: "pipe", timeout: 10_000 });
+            log.info({ scopeId }, "container removed");
+        }
+        catch { /* non-fatal */ }
+        this.containers.delete(scopeId);
+        this.emit("container:removed", { scopeId });
+    }
+    /** Drop containers that have been idle past CLEANUP_AFTER_MS. */
+    cleanup() {
+        const now = Date.now();
+        let removed = 0;
+        for (const [scopeId, entry] of this.containers.entries()) {
+            if (now - entry.lastUsedAt > CLEANUP_AFTER_MS) {
+                this.removeContainer(scopeId);
+                removed++;
+            }
+        }
+        return removed;
+    }
+    /** Remove every sandbox container — process shutdown. */
+    removeAll() {
+        for (const scope of [...this.containers.keys()])
+            this.removeContainer(scope);
+    }
+    list() {
+        const now = Date.now();
+        return [...this.containers.entries()].map(([scopeId, entry]) => ({
+            scopeId,
+            containerId: entry.containerId.slice(0, 12),
+            containerName: entry.containerName,
+            createdAt: new Date(entry.createdAt).toISOString(),
+            lastUsedAt: new Date(entry.lastUsedAt).toISOString(),
+            idleMs: now - entry.lastUsedAt,
+        }));
+    }
+}
+export const dockerSandbox = new DockerSandbox();
+//# sourceMappingURL=DockerSandbox.js.map

package/dist/safety/DockerSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DockerSandbox.js","sourceRoot":"","sources":["../../src/safety/DockerSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE3C,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AA0BrC,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC5B,KAAK,CAAS;IACd,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAA6B;IACpC,cAAc,CAAS;IACvB,aAAa,CAAS;IAE/B,SAAS,GAAmB,IAAI,CAAC;IACxB,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEhE,YAAY,OAA0B,EAAE;QACtC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC;QACpE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAK,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAA4C,IAAI,MAAM,CAAC;QACnH,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC;QACjD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC;IACrD,CAAC;IAED,uEAAuE;IACvE,WAAW;QACT,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QACnD,IAAI,CAAC;YACH,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,+DAA+D;IAC/D,eAAe,CAAC,OAAO,GAAG,QAAQ;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CACtB,QAAQ,EACR,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAAC,EAC7D,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CACtE,CAAC,IAAI,EAAE,CAAC;gBACT,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;oBACnB,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBACjC,OAAO,QAAQ,CAAC,WAAW,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,mBAAmB,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9G,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,WAAW,EAAE,IAAI,CAAC,OAAO;YACzB,aAAa;YACb,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,iCAAiC;YAC5C,SAAS,EAAE,sBAAsB,IAAI,CAAC,cAAc,GAAG;YACvD,IAAI,EAAE,YAAY;YAClB,IAAI,CAAC,KAAK;YACV,MAAM,EAAE,IAAI,EAAE,WAAW;SAC1B,CAAC;QACF,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE;YAC/C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC,IAAI,EAAE,CAAC;QAEV,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE;YAC3B,WAAW;YACX,aAAa;YACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACxE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,wDAAwD;IACxD,IAAI,CACF,OAAe,EACf,OAAe,EACf,OAA6C,EAAE;QAE/C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CACzB,QAAQ,EACR,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EACrD;gBACE,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;gBAC3B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,KAAK;gBAAE,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oCAAoC,EAAE,CAAC;QAC3G,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAMX,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,2BAA2B,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC3H,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC1F,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC1F,MAAM,GAAG,GACP,qBAAqB,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;YAC3F,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;gBAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;gBAC7B,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,GAAG;aACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,eAAe,CAAC,OAAe,EAAE,QAAgB,EAAE,aAAa,GAAG,YAAY;QAC7E,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,YAAY,CACV,QAAQ,EACR,CAAC,IAAI,EAAE,GAAG,QAAQ,IAAI,EAAE,GAAG,WAAW,IAAI,aAAa,EAAE,CAAC,EAC1D,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CACnC,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,eAAe,CAAC,OAAe;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC;YACH,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,iEAAiE;IACjE,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;gBAC9C,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,yDAAyD;IACzD,SAAS;QACP,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI;QAQF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO;YACP,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAClD,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YACpD,MAAM,EAAE,GAAG,GAAG,KAAK,CAAC,UAAU;SAC/B,CAAC,CAAC,CAAC;IACN,CAAC;CACF;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC"}

package/dist/safety/EgressGuard.d.ts

@@ -0,0 +1,35 @@
+/**
+ * EgressGuard — scans outbound HTTP (URL, headers, body) for leaked
+ * secrets before the request actually fires.
+ *
+ * Complements SecretScanner (which redacts inbound tool output). Here
+ * we fail-closed: if a request body contains a tracked secret value,
+ * the caller sees `{ safe: false, leakedFromEnv }` and can abort the
+ * request rather than ship credentials to some third-party URL the
+ * agent was told to call.
+ *
+ * Secrets are tracked by value (8+ chars) so we don't false-positive
+ * on tiny strings like `NODE_ENV=dev`.
+ */
+export interface EgressCheck {
+    readonly safe: boolean;
+    /** Env-var name (or "TRACKED") the leaked value came from — for logs. */
+    readonly leakedFromEnv?: string;
+}
+export declare class EgressGuard {
+    private readonly secrets;
+    private enabled;
+    constructor();
+    /** Re-snapshot sensitive env-var values. Call after vault unlock / reload. */
+    refreshFromEnv(): number;
+    /** Add known secret values — e.g. vault keys after unlock. */
+    addSecrets(values: readonly string[], sourceLabel?: string): void;
+    enable(): void;
+    disable(): void;
+    /** Does `data` contain any tracked secret value? */
+    check(data: string | undefined | null): EgressCheck;
+    /** Convenience: check URL + body together in one call. */
+    checkRequest(url: string, body?: unknown, headers?: Record<string, string>): EgressCheck;
+}
+export declare const egressGuard: EgressGuard;
+//# sourceMappingURL=EgressGuard.d.ts.map

package/dist/safety/EgressGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EgressGuard.d.ts","sourceRoot":"","sources":["../../src/safety/EgressGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,OAAO,CAAQ;;IAMvB,8EAA8E;IAC9E,cAAc,IAAI,MAAM;IAcxB,8DAA8D;IAC9D,UAAU,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,SAAY,GAAG,IAAI;IAQpE,MAAM,IAAI,IAAI;IACd,OAAO,IAAI,IAAI;IAEf,oDAAoD;IACpD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW;IAWnD,0DAA0D;IAC1D,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW;CAgBzF;AAMD,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/safety/EgressGuard.js

@@ -0,0 +1,95 @@
+/**
+ * EgressGuard — scans outbound HTTP (URL, headers, body) for leaked
+ * secrets before the request actually fires.
+ *
+ * Complements SecretScanner (which redacts inbound tool output). Here
+ * we fail-closed: if a request body contains a tracked secret value,
+ * the caller sees `{ safe: false, leakedFromEnv }` and can abort the
+ * request rather than ship credentials to some third-party URL the
+ * agent was told to call.
+ *
+ * Secrets are tracked by value (8+ chars) so we don't false-positive
+ * on tiny strings like `NODE_ENV=dev`.
+ */
+import { createLogger } from "../util/logger.js";
+const log = createLogger("egress-guard");
+const SENSITIVE_NAME_PATTERN = /(_KEY|_TOKEN|_SECRET|_PASSWORD|_CREDENTIAL|_AUTH|_SID|_PRIVATE|_PASSPHRASE)$/i;
+const MIN_SECRET_LEN = 8;
+export class EgressGuard {
+    secrets = new Map(); // value → source-name
+    enabled = true;
+    constructor() {
+        this.refreshFromEnv();
+    }
+    /** Re-snapshot sensitive env-var values. Call after vault unlock / reload. */
+    refreshFromEnv() {
+        let added = 0;
+        for (const [k, v] of Object.entries(process.env)) {
+            if (!v)
+                continue;
+            if (v.length < MIN_SECRET_LEN)
+                continue;
+            if (!SENSITIVE_NAME_PATTERN.test(k))
+                continue;
+            if (this.secrets.has(v))
+                continue;
+            this.secrets.set(v, k);
+            added++;
+        }
+        if (added > 0)
+            log.info({ added, total: this.secrets.size }, "egress guard refreshed from env");
+        return added;
+    }
+    /** Add known secret values — e.g. vault keys after unlock. */
+    addSecrets(values, sourceLabel = "TRACKED") {
+        for (const v of values) {
+            if (v && v.length >= MIN_SECRET_LEN && !this.secrets.has(v)) {
+                this.secrets.set(v, sourceLabel);
+            }
+        }
+    }
+    enable() { this.enabled = true; }
+    disable() { this.enabled = false; }
+    /** Does `data` contain any tracked secret value? */
+    check(data) {
+        if (!this.enabled || !data || typeof data !== "string")
+            return { safe: true };
+        for (const [value, source] of this.secrets.entries()) {
+            if (data.includes(value)) {
+                log.warn({ source }, "egress guard caught a tracked secret in outbound data");
+                return { safe: false, leakedFromEnv: source };
+            }
+        }
+        return { safe: true };
+    }
+    /** Convenience: check URL + body together in one call. */
+    checkRequest(url, body, headers) {
+        const urlResult = this.check(url);
+        if (!urlResult.safe)
+            return urlResult;
+        if (body !== undefined && body !== null) {
+            const bodyStr = typeof body === "string" ? body : safeStringify(body);
+            const bodyResult = this.check(bodyStr);
+            if (!bodyResult.safe)
+                return bodyResult;
+        }
+        if (headers) {
+            for (const val of Object.values(headers)) {
+                const headerResult = this.check(val);
+                if (!headerResult.safe)
+                    return headerResult;
+            }
+        }
+        return { safe: true };
+    }
+}
+function safeStringify(v) {
+    try {
+        return JSON.stringify(v);
+    }
+    catch {
+        return String(v);
+    }
+}
+export const egressGuard = new EgressGuard();
+//# sourceMappingURL=EgressGuard.js.map

package/dist/safety/EgressGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EgressGuard.js","sourceRoot":"","sources":["../../src/safety/EgressGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAEzC,MAAM,sBAAsB,GAC1B,+EAA+E,CAAC;AAElF,MAAM,cAAc,GAAG,CAAC,CAAC;AAQzB,MAAM,OAAO,WAAW;IACL,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,sBAAsB;IACpE,OAAO,GAAG,IAAI,CAAC;IAEvB;QACE,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,cAAc;QACZ,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc;gBAAE,SAAS;YACxC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,KAAK,EAAE,CAAC;QACV,CAAC;QACD,IAAI,KAAK,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAChG,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8DAA8D;IAC9D,UAAU,CAAC,MAAyB,EAAE,WAAW,GAAG,SAAS;QAC3D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAW,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;IACvC,OAAO,KAAW,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC;IAEzC,oDAAoD;IACpD,KAAK,CAAC,IAA+B;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC9E,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,uDAAuD,CAAC,CAAC;gBAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,0DAA0D;IAC1D,YAAY,CAAC,GAAW,EAAE,IAAc,EAAE,OAAgC;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI;gBAAE,OAAO,UAAU,CAAC;QAC1C,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,YAAY,CAAC,IAAI;oBAAE,OAAO,YAAY,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}