farming-code 2.2.6

package/SECURITY.md

@@ -0,0 +1,29 @@
+# Security Policy
+
+> Chinese version: [SECURITY.zh_cn.md](./SECURITY.zh_cn.md)
+
+Farming controls real terminals and AI coding-agent processes on the target machine. Treat every deployment as access to that machine.
+
+## Supported Versions
+
+The active development branch and the latest published release receive security fixes.
+
+## Deployment Guidance
+
+- Run Farming on trusted development machines and trusted networks.
+- Do not expose Farming directly to the public internet without an additional security layer such as VPN, SSH tunnel, HTTPS reverse proxy, or network ACLs.
+- Keep token authentication enabled outside trusted local development.
+- Use `FARMING_DISABLE_AUTH=1` only for local development on a trusted machine.
+- Install and configure Codex / Claude Code permissions according to their own security model; Farming hosts their CLI sessions but does not replace their permission system.
+- Do not commit real tokens, private `.env` files, internal hosts, personal machine paths, or private screenshots.
+
+## Reporting A Vulnerability
+
+Please report security issues privately to the maintainers instead of opening a public issue with exploit details.
+
+Maintainers:
+
+- [zhuwenzhuang](https://github.com/zhuwenzhuang)
+- [l4wei](https://github.com/l4wei)
+
+When reporting, include the affected version or commit, deployment mode, reproduction steps, and the expected impact.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,106 @@
+# Third Party Notices
+
+Farming is licensed under the MIT License. This file summarizes third-party
+software and external tools that Farming bundles, depends on, or interoperates
+with.
+
+## Bundled Production Dependencies
+
+Farming's app bundle installs the production dependency tree pinned by
+`package.json` and `package-lock.json`. Package-level license files are
+preserved in bundled `node_modules` when bundled dependencies are enabled.
+
+## Direct Runtime Dependencies
+
+| Package | Version | License | Purpose |
+| --- | --- | --- | --- |
+| `@agentclientprotocol/sdk` | 1.2.1 | Apache-2.0 | ACP JSON-RPC client and protocol types |
+| `@agentclientprotocol/codex-acp` | 1.1.2 | Apache-2.0 | Codex ACP adapter |
+| `@agentclientprotocol/claude-agent-acp` | 0.58.1 | Apache-2.0 | Claude Code ACP adapter |
+| `@xterm/addon-clipboard` | 0.2.0 | MIT | Browser terminal clipboard integration |
+| `@xterm/addon-fit` | 0.11.0 | MIT | Browser terminal sizing |
+| `@xterm/addon-search` | 0.16.0 | MIT | Browser terminal search |
+| `@xterm/addon-serialize` | 0.14.0 | MIT | Terminal screen serialization |
+| `@xterm/addon-webgl` | 0.19.0 | MIT | CRT terminal GPU renderer |
+| `@xterm/headless` | 6.0.0 | MIT | Backend terminal screen state |
+| `@xterm/xterm` | 6.0.0 | MIT | Browser terminal renderer |
+| `ansi-to-html` | 0.7.2 | MIT | ANSI text rendering support |
+| `chokidar` | 5.0.0 | MIT | Filesystem watching |
+| `diff` | 9.0.0 | BSD-3-Clause | Character-level diff ranges for code review |
+| `express` | 4.22.1 | MIT | HTTP API server |
+| `ghostty-web` | 0.4.0 | MIT | Optional/debug terminal renderer assets |
+| `highlight.js` | 11.11.1 | BSD-3-Clause | Syntax highlighting |
+| `katex` | 0.17.0 | MIT | Mathematical notation rendering |
+| `material-icon-theme` | 5.36.1 | MIT | File and folder icons |
+| `mermaid` | 11.16.0 | MIT | Diagram rendering |
+| `monaco-editor` | 0.55.1 | MIT | Lightweight code editor |
+| `node-pty` | 1.2.0-beta.12 | MIT | Native pseudo-terminal integration |
+| `qrcode-generator` | 2.0.4 | MIT | Browser share QR generation |
+| `react` | 19.2.4 | MIT | Frontend UI framework |
+| `react-arborist` | 3.10.5 | MIT | Tree view UI |
+| `react-dom` | 19.2.4 | MIT | React DOM renderer |
+| `react-markdown` | 10.1.0 | MIT | Markdown rendering |
+| `rehype-highlight` | 7.0.2 | MIT | Markdown syntax-highlighting integration |
+| `rehype-katex` | 7.0.1 | MIT | Markdown math rendering integration |
+| `remark-gfm` | 4.0.1 | MIT | GitHub Flavored Markdown support |
+| `remark-math` | 6.0.0 | MIT | Markdown math syntax support |
+| `ripgrep` | 0.3.1 | MIT | Node wrapper for file search support |
+| `ws` | 8.21.0 | MIT | WebSocket server/client support |
+| `yaml` | 2.9.0 | ISC | YAML parsing |
+
+## Vendored Assets
+
+Farming vendors `ghostty-web` distribution files under
+`frontend/vendor/ghostty-web` for the optional Ghostty debug renderer. The
+source package is `ghostty-web` 0.4.0, licensed under MIT. Its license is kept
+beside the vendored files at `frontend/vendor/ghostty-web/LICENSE`.
+
+If vendored assets are updated, keep this notice in sync with the package name,
+version, and license.
+
+The CRT skin bundles one font file under `frontend/skins/crt/fonts/`:
+
+| Font | License | Purpose |
+| --- | --- | --- |
+
+The corresponding license texts are stored beside the font files.
+
+## Bundled Data
+
+Farming includes a generated Chinese poetic token word list at
+`backend/data/chinese-poetic-words.json`. It is derived from the
+`chinese-poetry/chinese-poetry` dataset, licensed under MIT:
+https://github.com/chinese-poetry/chinese-poetry.
+
+The generated file stores the source commit and selected corpus directories.
+The original corpus is not bundled in the runtime package.
+
+## Development And Build Dependencies
+
+Farming also uses development-time tools such as TypeScript, Vite, ESLint,
+Playwright, Puppeteer, esbuild, and package builders. These tools are not part
+of the app runtime dependency set unless a release artifact explicitly embeds
+their code.
+
+## External Interoperability
+
+Farming can launch or observe coding-agent CLIs installed by the user, including
+OpenCode and the terminal forms of OpenAI Codex CLI and Anthropic Claude Code.
+The optional structured ACP runtime includes the pinned Codex and Claude ACP
+adapter dependency trees, including the provider SDK/runtime packages required
+by those adapters. Those packages remain separate projects governed by their
+own terms and licenses; package-level license files remain in `node_modules`.
+
+Farming is not affiliated with, sponsored by, or endorsed by OpenAI, Anthropic,
+Microsoft, or the maintainers of the third-party projects listed above.
+
+## Design References
+
+Farming's interface is influenced by modern coding workbenches and agent tools,
+including Codex, Visual Studio Code, and browser IDEs. This notice covers
+software and assets used by Farming; design inspiration alone does not imply
+that those projects are bundled with Farming.
+
+The CRT skin also studies the visual behavior of cool-retro-term. Farming's
+browser shaders are an independent implementation and do not copy or bundle
+cool-retro-term source code.

package/backend/acp/client-services.js

@@ -0,0 +1,312 @@
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+const nodePty = require('../packaged-node-pty');
+
+const fsp = fs.promises;
+const DEFAULT_MAX_FILE_BYTES = 8 * 1024 * 1024;
+const DEFAULT_TERMINAL_OUTPUT_BYTES = 1024 * 1024;
+const MAX_TERMINAL_OUTPUT_BYTES = 16 * 1024 * 1024;
+const MAX_ACTIVE_TERMINALS_PER_AGENT = 32;
+
+function isInside(root, target) {
+  const relative = path.relative(root, target);
+  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+
+function requireMatchingSession(binding, params) {
+  if (!binding?.sessionId || String(params?.sessionId || '') !== binding.sessionId) {
+    throw new Error('ACP client request does not match the active session');
+  }
+}
+
+async function resolveWorkspacePath(binding, requestedPath, options = {}) {
+  const value = String(requestedPath || '');
+  if (!path.isAbsolute(value)) throw new Error('ACP file and terminal paths must be absolute');
+  const logicalRoot = path.resolve(binding.cwd);
+  const root = await fsp.realpath(binding.cwd);
+  const logicalTarget = path.resolve(value);
+  const target = isInside(logicalRoot, logicalTarget)
+    ? path.resolve(root, path.relative(logicalRoot, logicalTarget))
+    : isInside(root, logicalTarget)
+      ? logicalTarget
+      : null;
+  if (!target) throw new Error('ACP path is outside the Agent workspace');
+
+  if (options.allowMissing === true) {
+    const parent = await fsp.realpath(path.dirname(target));
+    if (!isInside(root, parent)) throw new Error('ACP path resolves outside the Agent workspace');
+    return target;
+  }
+
+  const realTarget = await fsp.realpath(target);
+  if (!isInside(root, realTarget)) throw new Error('ACP path resolves outside the Agent workspace');
+  return realTarget;
+}
+
+class AcpClientFileSystem {
+  constructor(options = {}) {
+    this.maxFileBytes = options.maxFileBytes || DEFAULT_MAX_FILE_BYTES;
+  }
+
+  async readTextFile(binding, params) {
+    requireMatchingSession(binding, params);
+    const target = await resolveWorkspacePath(binding, params.path);
+    const stat = await fsp.stat(target);
+    if (!stat.isFile()) throw new Error('ACP read path must be a file');
+    if (stat.size > this.maxFileBytes) throw new Error('ACP text file is too large to read');
+    const content = await fsp.readFile(target, 'utf8');
+    const requestedLine = params.line == null ? 1 : Number(params.line);
+    const requestedLimit = params.limit == null ? null : Number(params.limit);
+    if (!Number.isInteger(requestedLine) || requestedLine < 1) throw new Error('ACP read line must be a positive integer');
+    if (requestedLimit !== null && (!Number.isInteger(requestedLimit) || requestedLimit < 0)) {
+      throw new Error('ACP read limit must be a non-negative integer');
+    }
+    if (requestedLine === 1 && requestedLimit === null) return { content };
+    const lines = content.split('\n');
+    const start = requestedLine - 1;
+    const end = requestedLimit === null ? lines.length : start + requestedLimit;
+    return { content: lines.slice(start, end).join('\n') };
+  }
+
+  async writeTextFile(binding, params) {
+    requireMatchingSession(binding, params);
+    const content = String(params.content ?? '');
+    if (Buffer.byteLength(content, 'utf8') > this.maxFileBytes) {
+      throw new Error('ACP text file is too large to write');
+    }
+    const target = await resolveWorkspacePath(binding, params.path, { allowMissing: true });
+    let mode = 0o666;
+    try {
+      const existing = await fsp.realpath(target);
+      const root = await fsp.realpath(binding.cwd);
+      if (!isInside(root, existing)) throw new Error('ACP path resolves outside the Agent workspace');
+      const stat = await fsp.stat(existing);
+      if (!stat.isFile()) throw new Error('ACP write path must be a file');
+      mode = stat.mode;
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+    const temporary = path.join(path.dirname(target), `.${path.basename(target)}.farming-acp-${process.pid}-${Date.now()}.tmp`);
+    try {
+      await fsp.writeFile(temporary, content, { mode });
+      await fsp.rename(temporary, target);
+    } catch (error) {
+      await fsp.rm(temporary, { force: true }).catch(() => {});
+      throw error;
+    }
+    return {};
+  }
+}
+
+function boundedOutputLimit(value) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_TERMINAL_OUTPUT_BYTES;
+  return Math.min(MAX_TERMINAL_OUTPUT_BYTES, Math.max(1, Math.floor(parsed)));
+}
+
+function trimUtf8Start(buffer, limit) {
+  if (buffer.length <= limit) return { buffer, truncated: false };
+  let start = buffer.length - limit;
+  while (start < buffer.length && (buffer[start] & 0xc0) === 0x80) start += 1;
+  return { buffer: buffer.subarray(start), truncated: true };
+}
+
+class AcpClientTerminalManager {
+  constructor(options = {}) {
+    this.spawn = options.spawn || spawn;
+    this.ptySpawn = typeof options.ptySpawn === 'function'
+      ? options.ptySpawn
+      : typeof options.spawn === 'function'
+        ? null
+        : nodePty.spawn;
+    this.sequence = 0;
+    this.terminals = new Map();
+  }
+
+  activeCount(agentId) {
+    let count = 0;
+    for (const record of this.terminals.values()) {
+      if (record.agentId === agentId && !record.released && !record.exitStatus) count += 1;
+    }
+    return count;
+  }
+
+  async create(binding, params) {
+    requireMatchingSession(binding, params);
+    if (this.activeCount(binding.agentId) >= MAX_ACTIVE_TERMINALS_PER_AGENT) {
+      throw new Error('ACP terminal limit reached for this Agent');
+    }
+    const command = String(params.command || '').trim();
+    if (!command) throw new Error('ACP terminal command is required');
+    const cwd = params.cwd
+      ? await resolveWorkspacePath(binding, params.cwd)
+      : await fsp.realpath(binding.cwd);
+    const env = { ...binding.env };
+    for (const item of Array.isArray(params.env) ? params.env : []) {
+      const name = String(item?.name || '');
+      if (!name || name.includes('=') || name.includes('\0')) throw new Error('Invalid ACP terminal environment variable');
+      env[name] = String(item?.value ?? '');
+    }
+    const terminalId = `acp-terminal-${++this.sequence}`;
+    const args = Array.isArray(params.args) ? params.args.map(String) : [];
+    const child = this.ptySpawn
+      ? this.ptySpawn(command, args, {
+          cwd,
+          env,
+          name: 'xterm-256color',
+          cols: 80,
+          rows: 24,
+        })
+      : this.spawn(command, args, {
+          cwd,
+          env,
+          stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    const record = {
+      terminalId,
+      agentId: binding.agentId,
+      sessionId: binding.sessionId,
+      command,
+      args,
+      cwd,
+      startedAt: Date.now(),
+      endedAt: null,
+      child,
+      output: Buffer.alloc(0),
+      outputLimit: boundedOutputLimit(params.outputByteLimit),
+      truncated: false,
+      exitStatus: null,
+      released: false,
+      waiters: [],
+      interactive: Boolean(this.ptySpawn),
+    };
+    this.terminals.set(terminalId, record);
+    const append = chunk => {
+      const next = Buffer.concat([record.output, Buffer.from(chunk)]);
+      const bounded = trimUtf8Start(next, record.outputLimit);
+      record.output = bounded.buffer;
+      record.truncated = record.truncated || bounded.truncated;
+    };
+    if (record.interactive) {
+      child.onData(append);
+      child.onExit(event => this.finish(record, {
+        exitCode: Number.isInteger(event?.exitCode) ? event.exitCode : null,
+        signal: Number.isInteger(event?.signal) && event.signal > 0 ? String(event.signal) : null,
+      }));
+    } else {
+      child.stdout?.on('data', append);
+      child.stderr?.on('data', append);
+      child.on('error', error => {
+        append(`${error.message || error}\n`);
+        this.finish(record, { exitCode: null, signal: 'spawn-error' });
+      });
+      child.on('close', (code, signal) => this.finish(record, {
+        exitCode: Number.isInteger(code) ? code : null,
+        signal: signal ? String(signal) : null,
+      }));
+    }
+    return { terminalId };
+  }
+
+  require(binding, params, options = {}) {
+    requireMatchingSession(binding, params);
+    const record = this.terminals.get(String(params.terminalId || ''));
+    if (!record || record.agentId !== binding.agentId || record.sessionId !== binding.sessionId) {
+      throw new Error('Unknown ACP terminal');
+    }
+    if (record.released && options.allowReleased !== true) throw new Error('ACP terminal has been released');
+    return record;
+  }
+
+  finish(record, exitStatus) {
+    if (record.exitStatus) return;
+    record.exitStatus = exitStatus;
+    record.endedAt = Date.now();
+    const waiters = record.waiters.splice(0);
+    waiters.forEach(resolve => resolve({ ...exitStatus }));
+  }
+
+  output(binding, params) {
+    const record = this.require(binding, params);
+    return {
+      output: record.output.toString('utf8'),
+      truncated: record.truncated,
+      ...(record.exitStatus ? { exitStatus: { ...record.exitStatus } } : {}),
+    };
+  }
+
+  waitForExit(binding, params) {
+    const record = this.require(binding, params);
+    if (record.exitStatus) return { ...record.exitStatus };
+    return new Promise(resolve => record.waiters.push(resolve));
+  }
+
+  input(binding, params) {
+    const record = this.require(binding, params);
+    if (!record.interactive) throw new Error('ACP terminal does not accept interactive input');
+    if (record.exitStatus) throw new Error('ACP terminal has already exited');
+    const input = String(params.input ?? '');
+    if (Buffer.byteLength(input, 'utf8') > 64 * 1024) throw new Error('ACP terminal input is too large');
+    record.child.write(input);
+    return {};
+  }
+
+  resize(binding, params) {
+    const record = this.require(binding, params);
+    if (!record.interactive) return {};
+    const cols = Number(params.cols);
+    const rows = Number(params.rows);
+    if (!Number.isInteger(cols) || cols < 2 || cols > 1000 || !Number.isInteger(rows) || rows < 1 || rows > 1000) {
+      throw new Error('ACP terminal size is invalid');
+    }
+    if (!record.exitStatus) record.child.resize(cols, rows);
+    return {};
+  }
+
+  kill(binding, params) {
+    const record = this.require(binding, params);
+    if (!record.exitStatus && !record.child.killed) record.child.kill('SIGTERM');
+    return {};
+  }
+
+  release(binding, params) {
+    const record = this.require(binding, params);
+    if (!record.exitStatus && !record.child.killed) record.child.kill('SIGTERM');
+    record.released = true;
+    return {};
+  }
+
+  display(terminalId) {
+    const record = this.terminals.get(String(terminalId || ''));
+    if (!record) return null;
+    return {
+      command: record.command,
+      args: [...record.args],
+      cwd: record.cwd,
+      output: record.output.toString('utf8'),
+      truncated: record.truncated,
+      exitStatus: record.exitStatus ? { ...record.exitStatus } : null,
+      released: record.released,
+      startedAt: record.startedAt,
+      endedAt: record.endedAt,
+      durationMs: Math.max(0, (record.endedAt || Date.now()) - record.startedAt),
+      interactive: record.interactive,
+    };
+  }
+
+  cleanupAgent(agentId) {
+    for (const [terminalId, record] of this.terminals) {
+      if (record.agentId !== agentId) continue;
+      if (!record.exitStatus && !record.child.killed) record.child.kill('SIGTERM');
+      this.terminals.delete(terminalId);
+      this.finish(record, { exitCode: null, signal: 'SIGTERM' });
+    }
+  }
+}
+
+module.exports = {
+  AcpClientFileSystem,
+  AcpClientTerminalManager,
+  resolveWorkspacePath,
+};

package/backend/acp/patch-decisions.js

@@ -0,0 +1,137 @@
+const fs = require('fs');
+const path = require('path');
+const { resolveWorkspacePath } = require('./client-services');
+
+const fsp = fs.promises;
+
+class AcpPatchDecisionError extends Error {
+  constructor(message, statusCode = 409) {
+    super(message);
+    this.name = 'AcpPatchDecisionError';
+    this.statusCode = statusCode;
+  }
+}
+
+function inside(root, target) {
+  const relative = path.relative(root, target);
+  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+
+function logicalPatchPath(root, requestedPath) {
+  const workspace = path.resolve(root);
+  let realWorkspace = workspace;
+  try {
+    realWorkspace = fs.realpathSync.native(workspace);
+  } catch {
+    // The caller will report the missing workspace through the normal file operation.
+  }
+  const value = String(requestedPath || '').trim();
+  if (!value || value.includes('\0')) throw new AcpPatchDecisionError('ACP patch path is invalid', 400);
+  const target = path.resolve(path.isAbsolute(value) ? value : path.join(workspace, value));
+  if (!inside(workspace, target) && !inside(realWorkspace, target)) {
+    throw new AcpPatchDecisionError('ACP patch is outside the Agent workspace', 403);
+  }
+  return target;
+}
+
+function relativeWorkspacePath(root, target) {
+  const workspace = path.resolve(root);
+  let realWorkspace = workspace;
+  try {
+    realWorkspace = fs.realpathSync.native(workspace);
+  } catch {
+    // Fall through to the logical root.
+  }
+  const base = inside(workspace, target) ? workspace : realWorkspace;
+  return path.relative(base, target);
+}
+
+function matchingDiffBlocks(entry, root, requestedPath) {
+  const requested = logicalPatchPath(root, requestedPath);
+  return (Array.isArray(entry?.content) ? entry.content : []).filter(block => {
+    if (block?.type !== 'diff' || typeof block.path !== 'string') return false;
+    try {
+      return logicalPatchPath(root, block.path) === requested;
+    } catch {
+      return false;
+    }
+  });
+}
+
+function patchBlock(entry, root, requestedPath) {
+  const matches = matchingDiffBlocks(entry, root, requestedPath);
+  if (matches.length === 0) throw new AcpPatchDecisionError('ACP patch file was not found', 404);
+  if (matches.length > 1) throw new AcpPatchDecisionError('ACP patch file has multiple changes; open Review to resolve them', 409);
+  return matches[0];
+}
+
+function patchKind(block) {
+  return String(block?._meta?.kind || '').trim().toLowerCase();
+}
+
+async function existingTarget(root, requestedPath) {
+  const logical = logicalPatchPath(root, requestedPath);
+  let stat;
+  try {
+    stat = await fsp.lstat(logical);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { exists: false, logical, target: null, stat: null };
+    throw error;
+  }
+  if (stat.isSymbolicLink()) throw new AcpPatchDecisionError('ACP patch decision will not modify a symbolic link', 409);
+  if (!stat.isFile()) throw new AcpPatchDecisionError('ACP patch target is not a regular file', 409);
+  const target = await resolveWorkspacePath({ cwd: root }, logical);
+  return { exists: true, logical, target, stat };
+}
+
+async function missingTarget(root, requestedPath) {
+  const logical = logicalPatchPath(root, requestedPath);
+  const target = await resolveWorkspacePath({ cwd: root }, logical, { allowMissing: true });
+  return { logical, target };
+}
+
+async function atomicWrite(target, content, mode = 0o666) {
+  const temporary = path.join(path.dirname(target), `.${path.basename(target)}.farming-acp-revert-${process.pid}-${Date.now()}.tmp`);
+  try {
+    await fsp.writeFile(temporary, content, { mode });
+    await fsp.rename(temporary, target);
+  } catch (error) {
+    await fsp.rm(temporary, { force: true }).catch(() => {});
+    throw error;
+  }
+}
+
+async function rejectPatch({ entry, root, requestedPath }) {
+  const block = patchBlock(entry, root, requestedPath);
+  const oldText = block.oldText == null ? '' : String(block.oldText);
+  const newText = block.newText == null ? '' : String(block.newText);
+  const kind = patchKind(block);
+  const added = block.oldText == null || ['add', 'added', 'create', 'created'].includes(kind);
+  const deleted = ['delete', 'deleted', 'remove', 'removed'].includes(kind);
+  const current = await existingTarget(root, requestedPath);
+
+  if (deleted) {
+    if (current.exists) throw new AcpPatchDecisionError('File changed after this ACP patch; it was not reverted', 409);
+    const target = await missingTarget(root, requestedPath);
+    await atomicWrite(target.target, oldText);
+    return { action: 'reverted', path: relativeWorkspacePath(root, target.logical) };
+  }
+
+  if (!current.exists) throw new AcpPatchDecisionError('File changed after this ACP patch; it was not reverted', 409);
+  const currentText = await fsp.readFile(current.target, 'utf8');
+  if (currentText !== newText) throw new AcpPatchDecisionError('File changed after this ACP patch; it was not reverted', 409);
+
+  if (added) {
+    await fsp.rm(current.target);
+  } else {
+    await atomicWrite(current.target, oldText, current.stat.mode);
+  }
+  return { action: 'reverted', path: relativeWorkspacePath(root, current.logical) };
+}
+
+module.exports = {
+  AcpPatchDecisionError,
+  logicalPatchPath,
+  patchBlock,
+  rejectPatch,
+};

package/backend/acp/permission-security.js

@@ -0,0 +1,108 @@
+const { domainToUnicode } = require('url');
+
+const BIDI_NAMES = new Map([
+  [0x061c, 'arabic letter mark'],
+  [0x200e, 'left-to-right mark'],
+  [0x200f, 'right-to-left mark'],
+  [0x202a, 'left-to-right embedding'],
+  [0x202b, 'right-to-left embedding'],
+  [0x202c, 'pop directional formatting'],
+  [0x202d, 'left-to-right override'],
+  [0x202e, 'right-to-left override'],
+  [0x2066, 'left-to-right isolate'],
+  [0x2067, 'right-to-left isolate'],
+  [0x2068, 'first strong isolate'],
+  [0x2069, 'pop directional isolate'],
+]);
+
+const INVISIBLE_NAMES = new Map([
+  [0x00a0, 'no-break space'],
+  [0x00ad, 'soft hyphen'],
+  [0x180e, 'mongolian vowel separator'],
+  [0x200b, 'zero-width space'],
+  [0x200c, 'zero-width non-joiner'],
+  [0x200d, 'zero-width joiner'],
+  [0x2060, 'word joiner'],
+  [0x3000, 'ideographic space'],
+  [0xfeff, 'zero-width no-break space'],
+]);
+
+function codePointLabel(character) {
+  return `U+${character.codePointAt(0).toString(16).toUpperCase().padStart(4, '0')}`;
+}
+
+function scriptName(character) {
+  const scripts = [
+    ['Cyrillic', /\p{Script=Cyrillic}/u],
+    ['Greek', /\p{Script=Greek}/u],
+    ['Arabic', /\p{Script=Arabic}/u],
+    ['Hebrew', /\p{Script=Hebrew}/u],
+    ['Han', /\p{Script=Han}/u],
+    ['Hiragana', /\p{Script=Hiragana}/u],
+    ['Katakana', /\p{Script=Katakana}/u],
+    ['Latin', /\p{Script=Latin}/u],
+  ];
+  return scripts.find(([, matcher]) => matcher.test(character))?.[0] || 'Unicode';
+}
+
+function classifyCharacter(character) {
+  const point = character.codePointAt(0);
+  if (BIDI_NAMES.has(point)) {
+    return { character: '', codePoint: codePointLabel(character), kind: 'bidi-control', description: BIDI_NAMES.get(point) };
+  }
+  if (
+    INVISIBLE_NAMES.has(point)
+    || (point >= 0x2061 && point <= 0x2064)
+    || (point >= 0x2000 && point <= 0x200a)
+    || [0x1680, 0x202f, 0x205f].includes(point)
+    || /\p{Control}|\p{Format}/u.test(character)
+  ) {
+    return {
+      character: '',
+      codePoint: codePointLabel(character),
+      kind: 'invisible',
+      description: INVISIBLE_NAMES.get(point) || 'invisible or formatting character',
+    };
+  }
+  return {
+    character,
+    codePoint: codePointLabel(character),
+    kind: 'confusable',
+    description: `${scriptName(character)} character`,
+  };
+}
+
+function scanUnicode(value) {
+  const seen = new Set();
+  const findings = [];
+  for (const character of String(value || '')) {
+    if (character.codePointAt(0) <= 0x7f || seen.has(character)) continue;
+    seen.add(character);
+    findings.push(classifyCharacter(character));
+  }
+  return findings;
+}
+
+function permissionSecurityWarnings(request) {
+  const meta = { ...(request?._meta || {}), ...(request?.toolCall?._meta || {}) };
+  const sandbox = meta.sandbox_authorization;
+  if (!sandbox || typeof sandbox !== 'object' || Array.isArray(sandbox)) return [];
+  const warnings = [];
+  const add = (targetType, value, displayValue = value) => {
+    const characters = scanUnicode(displayValue);
+    if (characters.length > 0) warnings.push({ targetType, value, displayValue, characters });
+  };
+  for (const host of Array.isArray(sandbox.network_hosts) ? sandbox.network_hosts : []) {
+    const value = String(host || '');
+    add('host', value, domainToUnicode(value) || value);
+  }
+  for (const targetPath of Array.isArray(sandbox.write_paths) ? sandbox.write_paths : []) {
+    add('path', String(targetPath || ''));
+  }
+  return warnings;
+}
+
+module.exports = {
+  permissionSecurityWarnings,
+  scanUnicode,
+};