kritya 0.8.62-beta → 0.8.63-beta

package/dist/agent/toolExecutor.js

@@ -3,6 +3,7 @@ import { classifyLaterExec, classifyLaterExecInShell, recordLaterExec, workspace
 import { acknowledgeUnsandboxedFallback, sandboxAvailable, sandboxFallbackWarning, } from "../shell/sandbox.js";
 import { isPlanningDocWrite, loadProjectState } from "./workflow.js";
 import { redactSecrets } from "../tools/secretScan.js";
+import { classifyReconCall, ReconTripwire, RECON_TRIP_THRESHOLD, RECON_WINDOW_CALLS, } from "../permissions/recon.js";
 /** How much tool output to hand the UI (it shows a preview and expands on toggle). */
 const PREVIEW_CHARS = 4000;
 /**
@@ -91,6 +92,12 @@ function fenceExternal(output) {
 export class ToolExecutor {
     tools;
     host;
+    /**
+     * Per-session recon-pattern score (see permissions/recon.ts). One
+     * executor serves one agent session, so the tripwire's state naturally
+     * spans exactly that session's calls and resets with it.
+     */
+    tripwire = new ReconTripwire();
     constructor(tools, host) {
         this.tools = tools;
         this.host = host;
@@ -211,6 +218,33 @@ export class ToolExecutor {
         };
         if (host.kill.active)
             return killBlocked();
+        // Recon-pattern tripwire. The gates below (and the tools' own checks)
+        // judge calls one at a time; this is the one place that sees the
+        // sequence. Every call is scored, including ones another gate is about
+        // to block anyway — an attempt at a credential file is a signal whether
+        // or not it succeeds. Recording happens in this synchronous stretch,
+        // before any await, so a parallel batch of read-only calls can't race
+        // the score. Once tripped, only recon-carrying calls are blocked;
+        // ordinary work flows through the normal gates below.
+        const recon = this.tripwire.record(classifyReconCall(name, args));
+        if (recon.blocked) {
+            host.audit?.logPermission({
+                tool: name,
+                summary,
+                verdict: "denied",
+                source: "recon-tripwire",
+            });
+            logToolOutcome("blocked");
+            finishSpan("ERROR", "blocked: recon-pattern tripwire");
+            handlers.onToolEnd(id, name, summary, "blocked: recon-pattern tripwire", true);
+            return (`Stopped by the recon-pattern tripwire: this session's recent calls form a ` +
+                `reconnaissance-like pattern (${this.tripwire.tripKinds.join(", ")}) — ${recon.score} ` +
+                `points across the last ${RECON_WINDOW_CALLS} calls, over the limit of ` +
+                `${RECON_TRIP_THRESHOLD}. This call was blocked, and further reconnaissance-like ` +
+                `calls stay blocked for the rest of the session. Ordinary work (reading and ` +
+                `editing project files, builds, tests) can continue. If this is legitimate ` +
+                `debugging, tell the user what you are doing and why; a new session resets the tripwire.`);
+        }
         // The planning-doc exemption is scoped to the active project's own
         // docs/<slug>/ folder, so plan mode can persist its artifact without
         // becoming a way to edit unrelated documentation.

package/dist/permissions/recon.js

@@ -0,0 +1,162 @@
+import { commandTouchesSensitivePath, isSensitivePath } from "../tools/common.js";
+const WEIGHTS = {
+    "credential-probe": 5,
+    "env-dump": 4,
+    enumeration: 2,
+    "system-probe": 2,
+};
+/** Score at or above which the tripwire latches for the rest of the session. */
+export const RECON_TRIP_THRESHOLD = 10;
+/** How many recent calls the rolling score covers. */
+export const RECON_WINDOW_CALLS = 20;
+function signal(kind, detail) {
+    return { kind, weight: WEIGHTS[kind], detail };
+}
+/**
+ * Whole-environment dumps. Only the bare forms score: `env FOO=1 cmd` runs a
+ * command with one variable set and `printenv PATH` reads one variable —
+ * both ordinary. Dumping *everything* is the recon move.
+ */
+const ENV_DUMP_PATTERNS = [
+    { re: /(^|[|;&]\s*)(env|printenv)(\s*$|\s*[|;&])/, detail: "bare env/printenv dump" },
+    { re: /\bexport\s+-p\b/, detail: "export -p dump" },
+    { re: /\bdeclare\s+-x\b/, detail: "declare -x dump" },
+    { re: /\bcompgen\s+-e\b/, detail: "compgen -e env listing" },
+    { re: /\/proc\/(\d+|self)\/environ\b/, detail: "reads /proc environ" },
+    { re: /\b(dir|ls|gci|Get-ChildItem)\s+env:/i, detail: "PowerShell env: drive listing" },
+];
+/** Identity and network-shape questions — cheap to ask, classic to ask first. */
+const SYSTEM_PROBE_PATTERNS = [
+    { re: /\bwhoami\b/, detail: "whoami" },
+    { re: /\bhostname\b/, detail: "hostname" },
+    { re: /\buname\b/, detail: "uname" },
+    { re: /\bsysteminfo\b/, detail: "systeminfo" },
+    { re: /(^|[|;&]\s*)id\s*($|[|;&])/, detail: "bare id" },
+    { re: /\bnetstat\b/, detail: "netstat" },
+    { re: /\bifconfig\b/, detail: "ifconfig" },
+    { re: /\bipconfig\b/, detail: "ipconfig" },
+    { re: /\bip\s+(addr|address|link|route)\b/, detail: "ip addr/link/route" },
+    { re: /\barp\s+-a\b/, detail: "arp -a" },
+    { re: /\bps\s+(aux|ef|-ef|-aux)\b/, detail: "full process listing" },
+];
+/**
+ * Listing the places a person keeps things, rather than the project: home,
+ * the filesystem root, /etc, other users' folders. A listing of the
+ * workspace itself (relative paths, /tmp, project dirs) scores nothing.
+ */
+const ENUMERATION_PATTERNS = [
+    {
+        re: /(?:^|[|;&]\s*)(?:ls|dir|find|tree)\b[^|;&]*?\s(?:~|\$HOME|\/etc|\/home|[A-Za-z]:\\Users)(?=[\s|;&]|$)/,
+        detail: "lists home/system directories",
+    },
+    {
+        re: /(?:^|[|;&]\s*)(?:ls|dir|find|tree)\b[^|;&]*?\s\/(?=[\s|;&]|$)/,
+        detail: "lists the filesystem root",
+    },
+];
+/** Tools whose path/pattern arguments can aim at a credential file or a system directory. */
+const PATH_ARG_TOOLS = new Set([
+    "read_file",
+    "read_document",
+    "read_notebook",
+    "edit_file",
+    "write_file",
+    "grep",
+    "glob",
+    "list_dir",
+]);
+/**
+ * Classify one tool call into recon signals — at most one signal per kind,
+ * so a single busy command can't trip the wire on repetition alone; it
+ * takes either one heavy call (a credential probe plus a dump) or a genuine
+ * sequence across calls.
+ */
+export function classifyReconCall(toolName, args) {
+    const byKind = new Map();
+    const add = (s) => {
+        if (!byKind.has(s.kind))
+            byKind.set(s.kind, s);
+    };
+    if (toolName === "shell") {
+        const command = String(args.command ?? "");
+        if (command) {
+            const sensitive = commandTouchesSensitivePath(command);
+            if (sensitive)
+                add(signal("credential-probe", `command references "${sensitive}"`));
+            for (const { re, detail } of ENV_DUMP_PATTERNS) {
+                if (re.test(command)) {
+                    add(signal("env-dump", detail));
+                    break;
+                }
+            }
+            for (const { re, detail } of ENUMERATION_PATTERNS) {
+                if (re.test(command)) {
+                    add(signal("enumeration", detail));
+                    break;
+                }
+            }
+            for (const { re, detail } of SYSTEM_PROBE_PATTERNS) {
+                if (re.test(command)) {
+                    add(signal("system-probe", detail));
+                    break;
+                }
+            }
+        }
+    }
+    else if (PATH_ARG_TOOLS.has(toolName)) {
+        for (const key of ["path", "pattern"]) {
+            const value = args[key];
+            if (typeof value !== "string" || !value)
+                continue;
+            if (isSensitivePath(value)) {
+                add(signal("credential-probe", `${toolName} targets "${value}"`));
+            }
+            if ((toolName === "list_dir" || toolName === "glob") &&
+                /^(~|\$HOME|\/|\/etc|\/home)([\\/]|$)/.test(value)) {
+                add(signal("enumeration", `${toolName} targets "${value}"`));
+            }
+        }
+    }
+    return [...byKind.values()];
+}
+/**
+ * The rolling score and the latch. One instance per agent session (the
+ * tool executor owns it). Blocked calls are recorded too — the executor
+ * records before it blocks — so continued probing keeps the score pinned
+ * above the threshold instead of decaying while the caller retries.
+ */
+export class ReconTripwire {
+    window = [];
+    latchedKinds = null;
+    get tripped() {
+        return this.latchedKinds !== null;
+    }
+    /** The signal kinds that contributed to the trip, for the block message. */
+    get tripKinds() {
+        return this.latchedKinds ?? [];
+    }
+    windowScore() {
+        return this.window.reduce((acc, w) => acc + w.score, 0);
+    }
+    /**
+     * Record one call's signals. Returns whether this call must be blocked:
+     * the call that pushes the score to the threshold, and — once latched —
+     * every later call that carries any recon signal. Signal-free calls are
+     * never blocked, tripped or not.
+     */
+    record(signals) {
+        const score = signals.reduce((acc, s) => acc + s.weight, 0);
+        this.window.push({ score, kinds: signals.map((s) => s.kind) });
+        if (this.window.length > RECON_WINDOW_CALLS)
+            this.window.shift();
+        const total = this.windowScore();
+        if (this.latchedKinds) {
+            return { blocked: signals.length > 0, score: total };
+        }
+        if (total >= RECON_TRIP_THRESHOLD) {
+            this.latchedKinds = [...new Set(this.window.flatMap((w) => w.kinds))];
+            return { blocked: signals.length > 0, score: total };
+        }
+        return { blocked: false, score: total };
+    }
+}

package/dist/tools/common.js

@@ -45,7 +45,7 @@ const SENSITIVE_PATH_PATTERNS = [
     /\.p12$/i,
     /\.pfx$/i,
 ];
-function isSensitivePath(relPath) {
+export function isSensitivePath(relPath) {
     return SENSITIVE_PATH_PATTERNS.some((re) => re.test(relPath));
 }
 /** Splits a shell command into path-like tokens, stripping quotes/metacharacters. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.62-beta",
+  "version": "0.8.63-beta",
   "description": "Kritya — Superintelligence at your command line",
   "type": "module",
   "publishConfig": {