infraweaver 0.1.0

package/src/agents/nativeFsDenies.ts

@@ -0,0 +1,164 @@
+// Canonical native-FS-tool deny set shared by the OpenCode and Claude harnesses.
+//
+// The agent's NATIVE FS tools (Read/Write/Edit/Glob/Grep) run in the agent
+// process OUTSIDE the bash mount-namespace sandbox (FS_MOUNTS in
+// action/mcp/shell.ts), so they need an independent deny — without it a
+// prompt-injected agent could plant a git filter or hook via the native edit
+// tool, bypassing the shell sandbox entirely. See wiki/security.md "Native
+// Tool Filesystem Sandbox".
+//
+// WRITES are denied across ALL of .git, READS only on .git/config:
+//   - nothing legitimately WRITES under .git via native tools — real commits
+//     go through the MCP git tools, which run in the action process OUTSIDE
+//     this permission gate. so a blanket write-deny is free, and it robustly
+//     covers every code-exec surface an enumerated list would miss:
+//     .git/config, .git/config.worktree, .git/modules/*/config (all carry the
+//     same core.hooksPath / clean+smudge filter / alias / credential.helper
+//     exec vectors) plus .git/hooks/* and .git/info/attributes. the deny also
+//     covers the `.git` gitfile itself and nested `*/.git` gitfiles (worktree /
+//     submodule layouts), whose `gitdir:` pointer is the same exec surface.
+//   - READS stay narrow (.git/config only) because over-blocking .git reads
+//     would break legit native orientation reads (.git/HEAD, refs), and the
+//     read threat is low — ASKPASS keeps live tokens out of .git/config.
+//
+// The two agents express denies differently, so the surfaces are encoded once
+// here and formatted per-agent:
+//   - OpenCode: worktree-relative patterns under the per-tool `read`/`edit`
+//     permission keys (Wildcard dialect: `*` is regex `.*`, matching `/`
+//     recursively). The `external_directory` gate can't restrict within-project
+//     paths (it short-circuits inside the repo root via Instance.containsPath),
+//     and the `grep`/`glob` permissions match the search pattern rather than a
+//     filepath — so only `read` and `edit` can path-deny within the project.
+//   - Claude: gitignore-style globs (`**` = recursive) per (tool, path) in
+//     managed-settings `permissions.deny`.
+
+/** worktree-relative blanket WRITE deny for the entire `.git` tree, in
+ * OpenCode Wildcard dialect (`*` compiles to regex `.*`, matching `/`
+ * recursively — see packages/core/src/util/wildcard.ts). spread into the
+ * `edit` ruleset after a `"*": "allow"` baseline — `evaluate` is
+ * last-match-wins by key order, so the deny keys must follow the wildcard
+ * allow.
+ *
+ * four patterns, because the root-anchored descendants glob only matches
+ * paths under a root `.git` *directory* — it misses `.git` when it's a gitfile
+ * (worktree / submodule layouts: a regular file whose `gitdir:` line redirects
+ * git metadata) and misses nested gitfiles (a `.git` inside a subdirectory).
+ * rewriting either pointer is the same code-exec surface (`core.hooksPath`,
+ * clean/smudge filters, credential.helper) the blanket deny exists to seal, so
+ * we cover the gitfile itself and any nested `.git` too. */
+export const GIT_NATIVE_WRITE_DENY_OPENCODE: Record<string, "deny"> = {
+  ".git": "deny",
+  ".git/*": "deny",
+  "*/.git": "deny",
+  "*/.git/*": "deny",
+};
+
+/** worktree-relative narrow READ deny (`.git/config` only), in OpenCode
+ * Wildcard dialect. spread into the `read` ruleset after the `"*": "allow"`
+ * baseline. */
+export const GIT_NATIVE_READ_DENY_OPENCODE: Record<string, "deny"> = {
+  ".git/config": "deny",
+};
+
+/** native FS tools Claude exposes that can read or enumerate files. */
+const CLAUDE_READ_TOOLS = ["Read", "Grep", "Glob"] as const;
+
+/** native FS tools Claude exposes that can create or modify a file (Edit
+ * modifies an existing file; Write creates/overwrites one). */
+const CLAUDE_WRITE_TOOLS = ["Edit", "Write"] as const;
+
+/** worktree-relative patterns for the blanket `.git` write deny. `**` is
+ * recursive. the exact `.git` entry plus the recursive-prefix gitfile entry
+ * cover the gitfile pointer (root + nested) that the root-anchored descendants
+ * glob alone misses; the recursive-prefix descendants entry covers nested
+ * gitdirs. */
+const GIT_WRITE_DENY_PATTERNS = [
+  ".git",
+  ".git/**",
+  "**/.git",
+  "**/.git/**",
+] as const;
+
+/** Claude `permissions.deny` entries for the blanket `.git` WRITE deny across
+ * BOTH write-capable native tools — mirrors {@link GIT_NATIVE_WRITE_DENY_OPENCODE}.
+ * Write is included so the agent can't PLANT a new hook/config file (e.g.
+ * `.git/hooks/pre-push`) that an Edit-only deny would miss. */
+export const GIT_NATIVE_WRITE_DENY_CLAUDE: string[] =
+  CLAUDE_WRITE_TOOLS.flatMap((tool) =>
+    GIT_WRITE_DENY_PATTERNS.map((pattern) => `${tool}(${pattern})`),
+  );
+
+/** Claude `permissions.deny` entries for the narrow `.git/config` READ deny,
+ * one per read/enumerate tool — mirrors {@link GIT_NATIVE_READ_DENY_OPENCODE}. */
+export const GIT_NATIVE_READ_DENY_CLAUDE: string[] = CLAUDE_READ_TOOLS.map(
+  (tool) => `${tool}(.git/config)`,
+);
+
+/** Native write-capable tool names as they appear in permission rules —
+ * includes the MultiEdit/NotebookEdit variants the PreToolUse gate also
+ * intercepts, so a harness-file deny can't be dodged via an alternate tool. */
+const CLAUDE_ALL_WRITE_TOOLS = [
+  "Edit",
+  "Write",
+  "MultiEdit",
+  "NotebookEdit",
+] as const;
+
+/** Claude `permissions.deny` entries protecting the harness-owned files in the
+ * per-run tmpdir (`infraweaver-*`: the PreToolUse gate script, the Stop hook
+ * script, the write-policy JSON, the flag settings). The tmpdir doubles as the
+ * agent's $HOME, so these paths are discoverable; the hook scripts are
+ * re-executed by claude-code with the full process env, which makes
+ * overwriting one arbitrary command execution outside every other deny. Both
+ * single- and double-slash forms are emitted, mirroring the secretDenyPaths
+ * pattern in buildManagedSettings. */
+export function harnessTmpdirWriteDenyClaude(
+  tmpdir: string | undefined,
+): string[] {
+  if (!tmpdir) return [];
+  const dir = tmpdir.replace(/\\/g, "/").replace(/\/+$/, "");
+  return CLAUDE_ALL_WRITE_TOOLS.flatMap((tool) => [
+    `${tool}(${dir}/infraweaver-*)`,
+    `${tool}(/${dir}/infraweaver-*)`,
+  ]);
+}
+
+/** Out-of-workspace files/dirs (relative to the runner's real $HOME) whose
+ * contents a LATER workflow step trusts: shell init, plus VCS / cloud / container
+ * / package-manager / Terraform credentials and exec hooks. */
+const RUNNER_HOME_WRITE_TARGETS = [
+  ".bashrc",
+  ".bash_profile",
+  ".bash_env",
+  ".profile",
+  ".zshrc",
+  ".gitconfig",
+  ".config/git/**",
+  ".ssh/**",
+  ".aws/**",
+  ".config/gcloud/**",
+  ".azure/**",
+  ".docker/**",
+  ".npmrc",
+  ".terraformrc",
+  ".terraform.d/**",
+] as const;
+
+/** Claude `permissions.deny` (Edit+Write) keeping native file writes out of the
+ * out-of-workspace persistence/credential targets above. The agent runs with
+ * HOME pointed at a throwaway tmpdir, so the only way a poisoned native write
+ * reaches a file a later step trusts is an absolute path under the real runner
+ * $HOME — which these enumerate. Enumerated rather than deny-all on purpose:
+ * Claude's permission model has no allow carve-out under a broad deny (a
+ * `Edit(/**)` deny would also block the in-repo fix), and `sandbox.filesystem`
+ * governs only Bash — so "deny everything outside the repo" is not expressible
+ * for native tools. Returns [] when the runner $HOME is unknown. */
+export function runnerHomeWriteDenyClaude(
+  runnerHome: string | undefined,
+): string[] {
+  if (!runnerHome) return [];
+  const home = runnerHome.replace(/[/\\]+$/, "");
+  return RUNNER_HOME_WRITE_TARGETS.flatMap((target) =>
+    CLAUDE_WRITE_TOOLS.map((tool) => `${tool}(${home}/${target})`),
+  );
+}