kritya 0.8.2-beta

package/dist/trust/mcpTrust.js

@@ -0,0 +1,111 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { CONFIG_DIR } from "../config/config.js";
+import { hardenWindowsDir } from "../config/winAcl.js";
+/**
+ * Per-server MCP trust. Workspace trust (see trust.ts) gates whether a
+ * project's .mcp.json is read at all, but treats it as one blob alongside
+ * unrelated gated content (allow rules, hooks, .env) — approving it once
+ * approves every server the file names, including ones a later commit or PR
+ * branch adds. MCP servers are their own attack surface: each is arbitrary
+ * code (stdio) or a remote endpoint (HTTP) that runs with the user's
+ * credentials the moment it's loaded. So each server also gets its own
+ * first-use confirmation, fingerprinted on its declared (pre-expansion)
+ * config — never on expanded env/header values, which may hold live secrets
+ * — and recorded in a global manifest/allowlist (`mcp-trusted.json`), the
+ * same "approve once, matched by pattern thereafter" model already used for
+ * shell allow rules (see permissions/rules.ts). Once approved, the identical
+ * server (by fingerprint) is trusted in any workspace without asking again;
+ * if its command, args, cwd, url, tool filter, or env/header key names change,
+ * the fingerprint changes and it's treated as new. Approvals are not permanent:
+ * `/mcp trust` lists them and `/mcp trust revoke` withdraws them, so the store
+ * drains as well as fills.
+ */
+const MCP_TRUST_FILE = path.join(CONFIG_DIR, "mcp-trusted.json");
+/** Stable identity for a server's declared config — structural shape only, never secret values. */
+export function serverFingerprint(cfg) {
+    const shape = {
+        command: cfg.command,
+        args: cfg.args ?? [],
+        // Part of the identity, not a detail: cwd decides what a filesystem-style
+        // server can reach. Leaving it out would let a .mcp.json edit widen a
+        // server approved for ./docs to the whole disk without re-prompting.
+        cwd: cfg.cwd,
+        url: cfg.url,
+        envKeys: cfg.env ? Object.keys(cfg.env).sort() : [],
+        headerKeys: cfg.headers ? Object.keys(cfg.headers).sort() : [],
+        // Also scope-defining: an edit relaxing `allow` from ["search"] to ["*"]
+        // exposes tools the user never saw when they approved the server.
+        tools: cfg.tools ?? null,
+    };
+    return crypto.createHash("sha256").update(JSON.stringify(shape)).digest("hex");
+}
+function loadStore(storeFile) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(storeFile, "utf8"));
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+function saveStore(storeFile, entries) {
+    fs.mkdirSync(path.dirname(storeFile), { recursive: true, mode: 0o700 });
+    hardenWindowsDir(path.dirname(storeFile));
+    fs.writeFileSync(storeFile, JSON.stringify(entries, null, 2) + "\n", { mode: 0o600 });
+}
+export function isServerTrusted(fingerprint, storeFile = MCP_TRUST_FILE) {
+    return loadStore(storeFile).some((e) => e.fingerprint === fingerprint);
+}
+/** Record a server as trusted — the manifest/allowlist other workspaces reuse. */
+export function trustServer(name, fingerprint, storeFile = MCP_TRUST_FILE) {
+    const entries = loadStore(storeFile).filter((e) => e.fingerprint !== fingerprint);
+    entries.push({ name, fingerprint, trustedAt: new Date().toISOString() });
+    saveStore(storeFile, entries);
+}
+/** The full manifest, as shown by `/mcp trust`. */
+export function loadMcpAllowlist(storeFile = MCP_TRUST_FILE) {
+    return loadStore(storeFile);
+}
+/**
+ * Withdraw trust from every entry recorded under `name`. Returns the entries
+ * that were dropped, so the caller can report what it actually did.
+ *
+ * An allowlist that only grows is a ratchet: approvals accumulate for servers
+ * the user has long since stopped using, and because trust is matched by
+ * fingerprint across all workspaces, a stale entry silently approves the same
+ * server the next time any repo declares it. Revoking is the drain.
+ *
+ * Matched by name rather than fingerprint because that is what the user has:
+ * the same name can hold several entries if the config changed over time, and
+ * "stop trusting linear" plainly means all of them.
+ */
+export function revokeServer(name, storeFile = MCP_TRUST_FILE) {
+    const entries = loadStore(storeFile);
+    const removed = entries.filter((e) => e.name === name);
+    if (removed.length)
+        saveStore(storeFile, entries.filter((e) => e.name !== name));
+    return removed;
+}
+/** Withdraw trust from one exact config. Used when a server is removed outright. */
+export function revokeFingerprint(fingerprint, storeFile = MCP_TRUST_FILE) {
+    const entries = loadStore(storeFile);
+    const rest = entries.filter((e) => e.fingerprint !== fingerprint);
+    if (rest.length === entries.length)
+        return false;
+    saveStore(storeFile, rest);
+    return true;
+}
+/** Split a set of declared MCP servers into already-trusted vs needing first-use confirmation. */
+export function partitionByTrust(servers, storeFile = MCP_TRUST_FILE) {
+    const trusted = {};
+    const pending = {};
+    for (const [name, cfg] of Object.entries(servers)) {
+        if (isServerTrusted(serverFingerprint(cfg), storeFile))
+            trusted[name] = cfg;
+        else
+            pending[name] = cfg;
+    }
+    return { trusted, pending };
+}

package/dist/trust/trust.js

@@ -0,0 +1,231 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { CONFIG_DIR } from "../config/config.js";
+import { hardenWindowsDir } from "../config/winAcl.js";
+import { debugLog } from "../config/debug.js";
+/**
+ * Workspace trust. A workspace's `.kritya/settings.json` can define `allow`
+ * rules (auto-approve tool calls) and `hooks` (arbitrary shell commands run
+ * automatically around tool calls); it can also ship a `.env` file (env vars
+ * merged into the process, read by every shell command and MCP server),
+ * `.kritya/commands/*.md` (custom slash commands — attacker-authored prompts
+ * run with the user's standing permissions), `.mcp.json` (MCP servers —
+ * arbitrary processes launched, or remote endpoints contacted with the user's
+ * env-expanded credentials), `KRITYA.md` (project memory — read straight into
+ * the system prompt on every turn, so it's the highest-leverage prompt
+ * injection surface a cloned repo can ship), and `.kritya/skills/*.md`
+ * (skills — extra instructions the model can pull in mid-session, same risk
+ * as a custom command). All of these take effect the
+ * moment kritya launches in that directory, so a cloned repo could use any of
+ * them to silently grant itself broad permissions or run code. Before any of
+ * them takes effect, the workspace must be explicitly trusted.
+ *
+ * `deny` rules are excluded from this gate — they only remove permissions,
+ * never grant them — and always apply regardless of trust.
+ *
+ * Trust is hash-pinned: it's recorded against the exact gated content that
+ * was approved. If that content changes (e.g. a later `git pull` adds a hook
+ * or edits `.env`), the hash no longer matches and the workspace is treated
+ * as untrusted again.
+ */
+const TRUST_FILE = path.join(CONFIG_DIR, "trusted.json");
+function readSettingsGatedContent(workspace) {
+    const file = path.join(workspace, ".kritya", "settings.json");
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return {};
+    }
+    const allow = Array.isArray(parsed.allow)
+        ? parsed.allow.filter((r) => typeof r === "string")
+        : undefined;
+    const hooks = parsed.hooks && typeof parsed.hooks === "object" ? parsed.hooks : undefined;
+    return { allow, hooks };
+}
+function readEnvFile(workspace) {
+    try {
+        return fs.readFileSync(path.join(workspace, ".env"), "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+function readCommandFiles(workspace) {
+    const dir = path.join(workspace, ".kritya", "commands");
+    let files;
+    try {
+        files = fs
+            .readdirSync(dir)
+            .filter((f) => f.endsWith(".md"))
+            .sort();
+    }
+    catch {
+        return undefined;
+    }
+    if (!files.length)
+        return undefined;
+    const commands = {};
+    for (const f of files) {
+        try {
+            commands[f] = fs.readFileSync(path.join(dir, f), "utf8");
+        }
+        catch {
+            // Unreadable file — skip it rather than fail the whole hash.
+        }
+    }
+    return Object.keys(commands).length ? commands : undefined;
+}
+function readMcpFile(workspace) {
+    try {
+        return fs.readFileSync(path.join(workspace, ".mcp.json"), "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Raw content of KRITYA.md, if present. It's read straight into the system
+ * prompt and followed as an instruction (see src/agent/systemPrompt.ts), so
+ * it's gated on trust the same as an allow rule or a hook.
+ */
+function readMemoryFile(workspace) {
+    try {
+        return fs.readFileSync(path.join(workspace, "KRITYA.md"), "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Raw content of each .kritya/skills/<name>/SKILL.md file, keyed by the skill's
+ * directory name. A skill's full body is arbitrary instructions the model
+ * pulls in mid-session via load_skill (see src/tools/skills.ts) — same risk
+ * shape as a custom slash command.
+ */
+function readSkillFiles(workspace) {
+    const dir = path.join(workspace, ".kritya", "skills");
+    let entries;
+    try {
+        entries = fs
+            .readdirSync(dir, { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name)
+            .sort();
+    }
+    catch {
+        return undefined;
+    }
+    if (!entries.length)
+        return undefined;
+    const skills = {};
+    for (const name of entries) {
+        try {
+            skills[name] = fs.readFileSync(path.join(dir, name, "SKILL.md"), "utf8");
+        }
+        catch {
+            // No SKILL.md in this subdir, or unreadable — skip it rather than fail
+            // the whole hash.
+        }
+    }
+    return Object.keys(skills).length ? skills : undefined;
+}
+function readGatedContent(workspace) {
+    const { allow, hooks } = readSettingsGatedContent(workspace);
+    const env = readEnvFile(workspace);
+    const commands = readCommandFiles(workspace);
+    const mcp = readMcpFile(workspace);
+    const memory = readMemoryFile(workspace);
+    const skills = readSkillFiles(workspace);
+    if ((!allow || allow.length === 0) &&
+        !hooks &&
+        env === undefined &&
+        !commands &&
+        mcp === undefined &&
+        memory === undefined &&
+        !skills)
+        return null;
+    return { allow, hooks, env, commands, mcp, memory, skills };
+}
+/**
+ * A human-readable rendering of ALL the gated content, for the trust prompt.
+ * The user must be able to see everything they're approving — not just
+ * settings.json but the .env contents and each custom command file.
+ */
+export function describeGatedContent(workspace) {
+    const { allow, hooks } = readSettingsGatedContent(workspace);
+    const env = readEnvFile(workspace);
+    const commands = readCommandFiles(workspace);
+    const sections = [];
+    if ((allow && allow.length > 0) || hooks) {
+        sections.push(`.kritya/settings.json (allow rules / hooks):\n${JSON.stringify({ allow, hooks }, null, 2)}`);
+    }
+    if (env !== undefined) {
+        sections.push(`.env (loaded into the environment of every command):\n${env.trimEnd()}`);
+    }
+    if (commands) {
+        const list = Object.entries(commands)
+            .map(([file, body]) => {
+            const first = body.split("\n")[0]?.trim().slice(0, 80) ?? "";
+            return `  /${file.replace(/\.md$/, "")} — ${first || "(empty)"}`;
+        })
+            .join("\n");
+        sections.push(`.kritya/commands/ (custom slash commands — prompts run as you):\n${list}`);
+    }
+    const mcp = readMcpFile(workspace);
+    if (mcp !== undefined) {
+        sections.push(`.mcp.json (MCP servers — processes launched / endpoints contacted as you):\n${mcp.trimEnd()}`);
+    }
+    const memory = readMemoryFile(workspace);
+    if (memory !== undefined) {
+        sections.push(`KRITYA.md (project memory — read into the system prompt and followed as an instruction):\n${memory.trimEnd()}`);
+    }
+    const skills = readSkillFiles(workspace);
+    if (skills) {
+        const list = Object.entries(skills)
+            .map(([name, body]) => {
+            const first = body.split("\n")[0]?.trim().slice(0, 80) ?? "";
+            return `  ${name} — ${first || "(empty)"}`;
+        })
+            .join("\n");
+        sections.push(`.kritya/skills/ (custom skills — instructions the model can load mid-session):\n${list}`);
+    }
+    return sections.join("\n\n") || "(no gated content)";
+}
+/**
+ * A stable hash of the workspace's gated content (allow rules, hooks, .env,
+ * and custom command files), or null if there's nothing to gate. A null
+ * result means trust never needs to be asked.
+ */
+export function gatedContentHash(workspace) {
+    const content = readGatedContent(workspace);
+    if (!content)
+        return null;
+    return crypto.createHash("sha256").update(JSON.stringify(content)).digest("hex");
+}
+function loadTrustStore(storeFile) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(storeFile, "utf8"));
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch (err) {
+        // A missing file means "nothing trusted yet" (normal); a malformed one
+        // means every workspace re-prompts for trust, worth being able to see.
+        debugLog(`loadTrustStore(${storeFile})`, err);
+        return {};
+    }
+}
+/** Whether `hash` (from {@link gatedContentHash}) matches the last-trusted hash for this workspace. */
+export function isTrusted(workspace, hash, storeFile = TRUST_FILE) {
+    return loadTrustStore(storeFile)[path.resolve(workspace)] === hash;
+}
+/** Record that the workspace's current gated content is trusted. */
+export function saveTrust(workspace, hash, storeFile = TRUST_FILE) {
+    const store = loadTrustStore(storeFile);
+    store[path.resolve(workspace)] = hash;
+    fs.mkdirSync(path.dirname(storeFile), { recursive: true, mode: 0o700 });
+    hardenWindowsDir(path.dirname(storeFile));
+    fs.writeFileSync(storeFile, JSON.stringify(store, null, 2) + "\n", { mode: 0o600 });
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/dist/ui/AiDisclosurePrompt.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from "react";
+import { Box, Text, useInput } from "ink";
+const BLINK_INTERVAL_MS = 500;
+/**
+ * One-time, first-run notice: kritya is an AI agent that reads/writes files
+ * and runs shell commands via a model you configure. Shown once per machine
+ * (see aiDisclosureAcknowledged in config.ts) and only on the interactive
+ * path — headless/CI runs skip it, since --trust already signals deliberate,
+ * informed use there.
+ */
+export function AiDisclosurePrompt({ onDismiss }) {
+    useInput((_input, key) => {
+        if (key.return)
+            onDismiss();
+    });
+    const [blinkOn, setBlinkOn] = useState(true);
+    useEffect(() => {
+        const id = setInterval(() => setBlinkOn((v) => !v), BLINK_INTERVAL_MS);
+        return () => clearInterval(id);
+    }, []);
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", paddingX: 1, children: [_jsx(Text, { children: "kritya is an AI agent" }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { children: "You are interacting with an AI system: kritya reads/writes files and runs shell commands here, acting on an AI model's output \u2014 not a human." }) }), _jsx(Text, { children: "Mutating actions ask for approval first." }), _jsx(Text, { children: "Details: /help, SECURITY.md (EU AI Act Art. 50)." }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: ["Shown once. ", _jsx(Text, { color: "yellow", children: blinkOn ? "AI Disclosure" : " " })] }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { children: "Press Enter to continue\u2026" }) })] }));
+}