javi-forge 1.34.0 → 1.35.0

package/assets/claude-hooks/javi-forge-skillguard-pre-tool-use.mjs

@@ -87,13 +87,31 @@ function policyPathKeys(input, options = {}) {
 	return real === lexical ? [lexical] : [lexical, real];
 }
 function isAbsolutePolicyPath(value) { return POSIX_ABSOLUTE.test(value) || WINDOWS_DRIVE.test(value) || WINDOWS_UNC.test(value) || /^\\(?:\\\?|\?\?|\\\.)\\/i.test(value); }
+// Home-relative credential files, matched as a path SUFFIX (never an expanded
+// literal home) so one rule holds for every user, container and HOME. Literals
+// stay lowercase because lexicalNormalize folds keys on darwin/win32.
+const SENSITIVE_PATH_SUFFIXES = Object.freeze(["/.aws/credentials", "/.kube/config", "/.config/gcloud/application_default_credentials.json", "/.docker/config.json", "/.config/gh/hosts.yml"]);
+// Absolute system secrets: the shadow suite holds every local account's password
+// hash, and passwd/vipw leave the "-" backup beside it holding the same secret.
+const SENSITIVE_ABSOLUTE_KEYS = Object.freeze(["/etc/shadow", "/etc/shadow-", "/etc/gshadow", "/etc/gshadow-"]);
+// /proc/<pid>/environ is the FULL environment - every secret - of ANY process the
+// agent can see, so it is a first-class exfiltration sink. The corpus idiom is
+// literal matching; this is the one place a wildcard is unavoidable because the
+// pid component is unbounded. Kept narrow (environ leaves only) and fail-closed:
+// it covers the self/thread-self aliases and the per-thread task/<tid> form.
+const PROC_ENVIRON_KEY = /^\/proc\/(?:\d+|self|thread-self)\/(?:task\/\d+\/)?environ$/;
+// Secret Service / GNOME keyring store: every file under it is credential
+// material, so the directory itself and its whole subtree are sensitive.
+const SENSITIVE_DIRECTORY_SUFFIXES = Object.freeze(["/.local/share/keyrings"]);
 export function isSensitivePolicyKey(key, platform = process.platform) {
 	const parts = key.split("/").filter(Boolean);
 	const basename = parts.at(-1) ?? "";
 	if (/^\.env(?:\..+)?$/i.test(basename) && !/^\.env\.(?:example|sample|template)$/i.test(basename)) return true;
 	if ([".npmrc", ".pypirc", ".netrc", ".git-credentials"].includes(basename.toLowerCase())) return true;
 	if (parts.some((part) => part === ".ssh" || part === ".gnupg")) return true;
-	if (key.endsWith("/.aws/credentials") || key.endsWith("/.kube/config") || key.endsWith("/.config/gcloud/application_default_credentials.json")) return true;
+	if (SENSITIVE_ABSOLUTE_KEYS.includes(key) || PROC_ENVIRON_KEY.test(key)) return true;
+	if (SENSITIVE_PATH_SUFFIXES.some((suffix) => key.endsWith(suffix))) return true;
+	if (SENSITIVE_DIRECTORY_SUFFIXES.some((directory) => key.endsWith(directory) || key.includes(`${directory}/`))) return true;
 	return platform === "win32" || platform === "darwin" ? basename.toLowerCase() === "serviceaccountkey.json" : basename === "serviceAccountKey.json";
 }
 function isManaged(key) {
@@ -284,7 +302,12 @@ function classifyLongOption(token, longOptions) {
 }
 const ASSIGNMENT_TOKEN = /^[A-Za-z_][A-Za-z0-9_]*=/;
 const SHORT_BUNDLE = /^-[^-]/;
-const CRITICAL_TARGET_CORPUS = Object.freeze(["/", "/*", "~", "$HOME", "${HOME}", ".", "..", PROJECT_ROOT]);
+// FHS roots whose wholesale destruction bricks the host. CRITICAL_TARGET gates
+// ONLY destructive writes (rm -rf, recursive/777 chmod) and never reads, and
+// membership is exact-token, so `rm -rf /var/tmp/scratch` stays allowed: only the
+// root token itself is protected, in the same bare / trailing / glob forms as "/".
+const CRITICAL_SYSTEM_ROOTS = ["/etc", "/usr", "/var", "/boot"];
+const CRITICAL_TARGET_CORPUS = Object.freeze(["/", "/*", "~", "$HOME", "${HOME}", ".", "..", PROJECT_ROOT, ...CRITICAL_SYSTEM_ROOTS.flatMap((root) => [root, `${root}/`, `${root}/*`])]);
 const isCriticalTarget = (token) => CRITICAL_TARGET_CORPUS.includes(token);
 const OCTAL_MODE_SHAPE = /^0?[0-7]{3,4}$/;
 const SYMBOLIC_MODE_SHAPE = /^[ugoa]*[+=-][rwxXstugo]+(?:,[ugoa]*[+=-][rwxXstugo]+)*$/;

package/assets/claude-hooks/manifest.json

@@ -1 +1 @@
-{"schemaVersion":1,"asset":{"name":"javi-forge-skillguard-pre-tool-use.mjs","version":1,"policyVersion":1,"sha256":"78be7e6613c012280b7ad17886462ba166b63ebd031e34565d757b3a0796d7cc","historical":[]},"settingsEntries":{"current":{"version":1,"canonicalSha256":"038c59a91bf8967f6908afed74c465f1e7030254e11e4f8738975d6d708424d4"},"historical":[]},"installerHelpers":{"windowsSecureObject":{"name":"javi-forge-windows-secure-object.ps1","sha256":"2289ef6ac6b039ec74dc3ea0894413e243ff9bea963f04008a356b3838f9b8dd"}}}
+{"schemaVersion":1,"asset":{"name":"javi-forge-skillguard-pre-tool-use.mjs","version":1,"policyVersion":1,"sha256":"5dc2a5c31131f4ac7d8657c78b950de52776aad6eaefe78ea0d764a9963c4425","historical":["78be7e6613c012280b7ad17886462ba166b63ebd031e34565d757b3a0796d7cc"]},"settingsEntries":{"current":{"version":1,"canonicalSha256":"038c59a91bf8967f6908afed74c465f1e7030254e11e4f8738975d6d708424d4"},"historical":[]},"installerHelpers":{"windowsSecureObject":{"name":"javi-forge-windows-secure-object.ps1","sha256":"2289ef6ac6b039ec74dc3ea0894413e243ff9bea963f04008a356b3838f9b8dd"}}}

package/dist/lib/__fixtures__/fake-secure-fs.d.ts

@@ -27,6 +27,11 @@ export interface FakeFaults {
     writeRefuse?: (name: string, callIndex: number) => boolean;
     /** Refuse renameInDir when the destination base name matches. */
     renameRefuse?: (to: string) => boolean;
+    /**
+     * Refuse applyExactMode for a target (chmod fault). Lets a test drive the
+     * rollback's prior-mode restore into failure without touching the bytes.
+     */
+    applyModeRefuse?: (target: string) => boolean;
     /**
      * Refuse proveManagedContainer for a path on its Nth call (a foreign
      * add/delete-child ACE on a managed container we own — the win32 CREATE_PARENT_DIR

package/dist/lib/__fixtures__/fake-secure-fs.js

@@ -152,6 +152,8 @@ export function makeFakeSecureFs() {
             return ok();
         },
         async applyExactMode(target, mode) {
+            if (fake.faults.applyModeRefuse?.(target))
+                return unsafe(`applyMode ${target}`);
             const file = files.get(target);
             if (!file)
                 return unsafe(`applyMode enoent ${target}`);

package/dist/lib/claude-hook-manager.js

@@ -191,10 +191,12 @@ function settingsSignals(value, classification, currentAssetSha) {
     };
 }
 const REMEDIATION = {
-    absent: "install the managed $ (Slice 3)",
-    "released-outdated": "upgrade the managed $ (Slice 3)",
-    "exact-legacy": "migrate the legacy $ (Slice 3)",
-    "edited-managed": "repair the managed $ with --force (Slice 3)",
+    // User-facing remediation: name the exact command to run, never an internal
+    // SDD slice number (which means nothing outside this repo's planning docs).
+    absent: "install the managed $ with: javi-forge hooks install claude",
+    "released-outdated": "upgrade the managed $ with: javi-forge hooks install claude",
+    "exact-legacy": "migrate the legacy $ with: javi-forge hooks install claude",
+    "edited-managed": "repair the managed $ with: javi-forge hooks repair claude --force",
     foreign: "manually review the $",
     symlink: "manually review the $",
     "non-regular": "manually review the $",

package/dist/lib/secure-fs-transaction.js

@@ -286,7 +286,16 @@ export async function runTransaction(input) {
                     errors.push(`STOP: cannot stage rollback for ${entry.path}`);
                     return;
                 }
-                await secureFs.applyExactMode(path.join(entry.dir.path, rName), entry.prior.mode);
+                // Prior-mode restore is BEST-EFFORT (JD-B-003): a chmod miss fails
+                // toward MORE restrictive perms (the 0600 staging mode), so it is not
+                // a security regression and must not halt the rollback — restoring the
+                // prior BYTES matters more than the prior mode. Record an
+                // INFORMATIONAL note (never `STOP:`, which signals a halted rollback)
+                // and continue to the rename.
+                const remoded = await secureFs.applyExactMode(path.join(entry.dir.path, rName), entry.prior.mode);
+                if (!remoded.ok) {
+                    errors.push(`note: restored ${entry.path}; prior-mode restore failed, verify permissions (${remoded.detail ?? remoded.refusal ?? "unknown"})`);
+                }
                 const restored = await secureFs.renameInDir(entry.dir, rName, base);
                 if (!restored.ok) {
                     errors.push(`STOP: cannot restore ${entry.path}; prior payload staged at ${path.join(entry.dir.path, rName)} for manual recovery`);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.34.0",
+	"version": "1.35.0",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {