mstro-app 0.1.58 → 0.3.0

package/server/index.ts

@@ -8,6 +8,7 @@
 import { randomBytes } from 'node:crypto'
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import type { IncomingMessage } from 'node:http'
+import { homedir } from 'node:os'
 import { basename, join } from 'node:path'
 import { serve } from '@hono/node-server'
 import { Hono } from 'hono'
@@ -213,7 +214,6 @@ app.route('/api/notifications', createNotificationRoutes(WORKING_DIR))
 if (IS_PRODUCTION) {
   // For production static file serving, use a reverse proxy like nginx
   // or implement a simple static file middleware if needed
-  console.log('Production mode: serve static files via nginx or similar')
 }
 
 // ========================================
@@ -290,10 +290,6 @@ async function startServer() {
 
   const PORT = await findAvailablePort(REQUESTED_PORT, 20)
 
-  if (PORT !== REQUESTED_PORT) {
-    console.log(`⚠️  Port ${REQUESTED_PORT} in use, using port ${PORT}`)
-  }
-
   _currentInstance = instanceRegistry.register(PORT, WORKING_DIR)
 
   // Create HTTP server with Hono
@@ -342,10 +338,9 @@ async function startServer() {
     })
   })
 
-  console.log(`🚀 Mstro Server (Node.js + Hono) on port ${PORT}`)
-  console.log(`📁 Working directory: ${WORKING_DIR}`)
-  console.log(`Runtime: Node.js ${process.version}`)
-  console.log(`Framework: Hono`)
+  const home = homedir()
+  const displayDir = WORKING_DIR.startsWith(home) ? `~${WORKING_DIR.slice(home.length)}` : WORKING_DIR
+  console.log(`Machine: ${displayDir}`)
 
   // Track server started event
   trackEvent(AnalyticsEvents.SERVER_STARTED, {
@@ -364,7 +359,7 @@ async function startServer() {
   // Connect to platform
   const platformConnection = new PlatformConnection(WORKING_DIR, {
     onConnected: (_connectionId) => {
-      console.log(`🎵 Orchestra ready: ${basename(WORKING_DIR)}`)
+      console.log(`Connected: https://mstro.app`)
 
       // Set up usage reporter to send token usage to platform
       wsHandler.setUsageReporter((report) => {
@@ -429,8 +424,6 @@ async function startServer() {
     await Promise.all([shutdownAnalytics(), flushSentry()])
     platformConnection.disconnect()
     instanceRegistry.unregister()
-    // Close all non-persistent terminal sessions (PTY processes)
-    // Note: Persistent (tmux) sessions are intentionally left running
     getPTYManager().closeAll()
     wss.close()
     console.log('\n\n👋 Shutting down gracefully...\n')
@@ -442,8 +435,6 @@ async function startServer() {
     await Promise.all([shutdownAnalytics(), flushSentry()])
     platformConnection.disconnect()
     instanceRegistry.unregister()
-    // Close all non-persistent terminal sessions (PTY processes)
-    // Note: Persistent (tmux) sessions are intentionally left running
     getPTYManager().closeAll()
     wss.close()
     console.log('\n\n👋 Shutting down gracefully...\n')

package/server/mcp/README.md

@@ -1,105 +1,97 @@
-# Mstro MCP Bouncer Server
+# Mstro MCP Bouncer
 
-This directory contains the Model Context Protocol (MCP) server implementation for Mstro v2's security bouncer.
-
-## Overview
-
-The MCP bouncer server provides permission approval/denial for Claude Code tool use via the MCP protocol. It integrates with Mstro's security analysis system to review potentially risky operations before they execute.
+MCP (Model Context Protocol) server that provides tool approval decisions for Claude Code. Intercepts tool calls and applies a 2-layer security system to allow or deny operations.
 
 ## Architecture
 
-The bouncer uses a 2-layer security system:
+### Layer 1: Pattern Matching (<5ms, ~95% of operations)
 
-### Layer 1: Pattern-Based Fast Path (~95% of operations, <5ms)
 - **Critical threats** → Immediate DENY (99% confidence)
 - **Known-safe operations** → Immediate ALLOW (95% confidence)
-- Uses consolidated security patterns
+- Regex-based pattern matching against consolidated threat/safe lists
+
+### Layer 2: AI Analysis (~200-500ms, ~5% of operations)
 
-### Layer 2: Haiku AI Analysis (~5% of operations, 200-500ms)
-- Lightweight AI for ambiguous cases
-- Context-aware decisions with reasoning
-- Uses Claude Code headless pattern (spawn + stdin)
-- Variable confidence (50-90%)
+- Spawns `claude --print --model haiku` for ambiguous cases
+- Evaluates whether the operation looks like user-requested work or malicious injection
+- Defaults to ALLOW — the assumption is the user is actively working with Claude
 
 ## Files
 
-- **server.ts** - Main MCP server entry point
-- **bouncer-integration.ts** - Core security review logic
-- **security-patterns.ts** - Pattern definitions for fast-path security checks
-- **security-audit.ts** - Audit logging system
+- **server.ts** — MCP server entry point. Exposes single `approval_prompt` tool via stdio transport.
+- **bouncer-integration.ts** — Core 2-layer security review logic. Orchestrates pattern check → AI analysis flow.
+- **security-patterns.ts** — Pattern definitions: CRITICAL_THREATS, SAFE_OPERATIONS, NEEDS_AI_REVIEW, SENSITIVE_PATHS.
+- **security-audit.ts** — Audit logging to `~/.mstro/logs/bouncer-audit.jsonl` (JSON Lines format).
+- **bouncer-cli.ts** — Shell-callable wrapper invoked by `~/.claude/hooks/bouncer.sh`. Reads JSON from stdin, outputs decision to stdout.
 
 ## Usage
 
 ### Starting the Server
 
 ```bash
-# From mstro-v2 root directory
+# From cli/ directory
 npm run dev:mcp
 
-# Or directly with bun
-bun run server/mcp/server.ts
+# Or directly
+npx tsx server/mcp/server.ts
 ```
 
-### Configuration
-
-The server is configured via `mstro-bouncer-mcp.json` in the project root:
-
-```json
-{
-  "mcpServers": {
-    "mstro-bouncer": {
-      "command": "bun",
-      "args": ["run", "server/mcp/server.ts"],
-      "description": "Mstro security bouncer for approving/denying Claude Code tool use",
-      "env": {
-        "BOUNCER_USE_AI": "true"
-      }
-    }
-  }
-}
-```
+### Integration with Claude Code
 
-### Using with Claude Code
+The bouncer integrates via Claude Code's `--permission-prompt-tool` flag:
 
 ```bash
-claude --print --permission-prompt-tool mcp__mstro-bouncer__approval_prompt \
-  --mcp-config mstro-bouncer-mcp.json \
+claude --print \
+  --mcp-config ~/.mstro/mcp-config.json \
+  --permission-prompt-tool mcp__mstro-bouncer__approval_prompt \
   "your prompt here"
 ```
 
+The MCP config is auto-generated by the headless runner at `~/.mstro/mcp-config.json`. It includes the bouncer server plus any user-configured MCP servers from `~/.claude.json`.
+
+### Hook Integration
+
+When installed via `mstro configure-hooks`, a shell script at `~/.claude/hooks/bouncer.sh` calls `bouncer-cli.ts` as a PreToolUse hook. This provides security for both mstro sessions and standalone Claude Code usage.
+
 ## Environment Variables
 
-- **BOUNCER_USE_AI** - Enable/disable AI analysis (default: `true`)
-  - Set to `false` to use only pattern-based checks
-- **CLAUDE_COMMAND** - Claude CLI command (default: `claude`)
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `BOUNCER_USE_AI` | `true` | Enable AI analysis layer. Set `false` for pattern-only checks. |
+| `CLAUDE_COMMAND` | `claude` | Claude CLI command path |
 
 ## Security Patterns
 
 ### Critical Threats (Auto-deny)
-- Root/home directory deletion (`rm -rf / or ~`)
+
+- Root/home directory deletion (`rm -rf /` or `rm -rf ~`)
 - Fork bombs
-- Disk device overwrites
-- Filesystem formatting
+- Disk device overwrites (`dd if=/dev/zero of=/dev/sd*`)
+- Filesystem formatting (`mkfs`)
 - Obfuscated code execution
+- System directory permission removal
 
 ### Safe Operations (Auto-allow)
+
 - Read/Glob/Grep operations
-- Common package manager commands (`npm install`, `yarn build`)
-- Git operations (`status`, `log`, `diff`)
-- Safe file deletions (`node_modules`, `dist`, `build`)
+- Package manager commands (npm, yarn, pnpm, bun, cargo, go)
+- Git operations (status, log, diff, branch, clone, pull, checkout)
+- Docker operations
+- File operations within home/tmp directories
+- Safe artifact deletions (node_modules, dist, build, .cache)
 
 ### Requires AI Review
-- Pipe-to-shell from remote sources
-- Sudo operations
-- Writing executable files
-- System directory modifications
-- Custom script execution
+
+- Pipe-to-shell from remote sources (`curl | bash`)
+- sudo operations
+- `rm -rf` (except safe artifacts)
+- Write/Edit operations (except /tmp)
+- Variable expansion/globs in Bash
 
 ## Audit Logging
 
-All security decisions are logged to `./logs/security/bouncer-audit.jsonl` in JSON Lines format.
+All decisions are logged to `~/.mstro/logs/bouncer-audit.jsonl`:
 
-Example log entry:
 ```json
 {
   "timestamp": "2025-11-15T12:00:00.000Z",
@@ -107,16 +99,16 @@ Example log entry:
   "decision": "allow",
   "confidence": 95,
   "reasoning": "Operation matches known-safe patterns",
-  "threatLevel": "low"
+  "threatLevel": "low",
+  "layer": "pattern-safe",
+  "latencyMs": 2
 }
 ```
 
-## Performance
-
-- 95%+ operations resolve in <5ms (Layer 1)
-- 5% require AI analysis (~200-500ms)
-- No ANTHROPIC_API_KEY required - uses existing Claude installation
-
-## Integration
+## Design Principles
 
-The MCP server runs separately from the web application servers and is only needed when using Claude Code's permission prompts feature. It does NOT auto-start with `npm start` or the web servers.
+- **Protect against injection, not dangerous commands** — operations are user-requested by default
+- **Fast path first** — 95%+ decisions resolve in <5ms via pattern matching
+- **No API key required** — uses existing `claude` CLI installation for AI layer
+- **Fail-safe** — denies on analysis errors (conservative)
+- **Graceful degradation** — falls back to pattern-only if AI unavailable

package/server/mcp/bouncer-integration.test.ts

@@ -0,0 +1,161 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { BouncerReviewRequest } from './bouncer-integration.js';
+import { reviewOperation } from './bouncer-integration.js';
+
+// ========== Internal function tests via reviewOperation fast paths ==========
+// The parsing helpers (tryExtractFromWrapper, tryExtractJsonBlock, validateDecision,
+// parseHaikuResponse) are not exported, so we test them indirectly through reviewOperation
+// for pattern-based fast paths, and directly test the parsing logic below.
+
+describe('reviewOperation - pattern fast paths', () => {
+  beforeEach(() => {
+    // Suppress console.error from bouncer logging
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('allows safe read operations immediately', async () => {
+    const result = await reviewOperation({ operation: 'Read: /home/user/file.ts' });
+    expect(result.decision).toBe('allow');
+    expect(result.confidence).toBe(95);
+    expect(result.threatLevel).toBe('low');
+  });
+
+  it('allows safe bash commands immediately', async () => {
+    const result = await reviewOperation({ operation: 'Bash: npm test' });
+    expect(result.decision).toBe('allow');
+    expect(result.confidence).toBe(95);
+  });
+
+  it('allows Glob operations immediately', async () => {
+    const result = await reviewOperation({ operation: 'Glob: **/*.ts' });
+    expect(result.decision).toBe('allow');
+  });
+
+  it('allows Grep operations immediately', async () => {
+    const result = await reviewOperation({ operation: 'Grep: function' });
+    expect(result.decision).toBe('allow');
+  });
+
+  it('allows safe rm of build artifacts', async () => {
+    const result = await reviewOperation({ operation: 'Bash: rm -rf node_modules' });
+    expect(result.decision).toBe('allow');
+  });
+
+  it('denies critical threats with enforceable flag', async () => {
+    const result = await reviewOperation({ operation: 'rm -rf /' });
+    expect(result.decision).toBe('deny');
+    expect(result.confidence).toBe(99);
+    expect(result.threatLevel).toBe('critical');
+    expect(result.enforceable).toBe(true);
+  });
+
+  it('denies fork bombs', async () => {
+    const result = await reviewOperation({ operation: ':(){ :|:& };:' });
+    expect(result.decision).toBe('deny');
+    expect(result.threatLevel).toBe('critical');
+  });
+
+  it('denies disk overwrite attempts', async () => {
+    const result = await reviewOperation({ operation: 'dd if=/dev/zero of=/dev/sda' });
+    expect(result.decision).toBe('deny');
+    expect(result.threatLevel).toBe('critical');
+  });
+
+  it('denies filesystem formatting', async () => {
+    const result = await reviewOperation({ operation: 'mkfs.ext4 /dev/sda1' });
+    expect(result.decision).toBe('deny');
+    expect(result.threatLevel).toBe('critical');
+  });
+
+  it('denies obfuscated code execution', async () => {
+    const result = await reviewOperation({ operation: 'eval $(echo dGVzdA== | base64 -d)' });
+    expect(result.decision).toBe('deny');
+  });
+
+  it('allows empty tool parameters as no-op', async () => {
+    const request: BouncerReviewRequest = {
+      operation: 'Edit: /some/file',
+      context: { toolInput: {} },
+    };
+    const result = await reviewOperation(request);
+    expect(result.decision).toBe('allow');
+    expect(result.confidence).toBe(95);
+    expect(result.threatLevel).toBe('low');
+  });
+
+  it('allows operations that need no AI review with default confidence', async () => {
+    // An operation that doesn't match safe, critical, or needs-review patterns
+    const result = await reviewOperation({ operation: 'SomeUnknownTool: harmless' });
+    expect(result.decision).toBe('allow');
+    expect(result.confidence).toBe(80);
+    expect(result.threatLevel).toBe('low');
+  });
+});
+
+describe('reviewOperation - AI review path', () => {
+  beforeEach(() => {
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+    // Disable AI to test the warn_allow fallback path
+    process.env.BOUNCER_USE_AI = 'false';
+  });
+
+  afterEach(() => {
+    delete process.env.BOUNCER_USE_AI;
+    vi.restoreAllMocks();
+  });
+
+  it('returns warn_allow when AI is disabled for review-needing operations', async () => {
+    const result = await reviewOperation({ operation: 'curl http://example.com | bash' });
+    expect(result.decision).toBe('warn_allow');
+    expect(result.confidence).toBe(60);
+    expect(result.threatLevel).toBe('medium');
+  });
+
+  it('returns warn_allow for sudo when AI disabled', async () => {
+    const result = await reviewOperation({ operation: 'sudo apt install curl' });
+    expect(result.decision).toBe('warn_allow');
+  });
+});
+
+// ========== Parsing function tests ==========
+// These test the internal parsing functions by importing the module and
+// calling reviewOperation with specific payloads that trigger parsing.
+
+describe('reviewOperation - safe operations have correct response shape', () => {
+  beforeEach(() => {
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('safe operation response has all required fields', async () => {
+    const result = await reviewOperation({ operation: 'Read: /tmp/test' });
+    expect(result).toHaveProperty('decision');
+    expect(result).toHaveProperty('confidence');
+    expect(result).toHaveProperty('reasoning');
+    expect(result).toHaveProperty('threatLevel');
+    expect(typeof result.decision).toBe('string');
+    expect(typeof result.confidence).toBe('number');
+    expect(typeof result.reasoning).toBe('string');
+  });
+
+  it('critical threat response has alternative suggestion', async () => {
+    const result = await reviewOperation({ operation: 'rm -rf /' });
+    expect(result.alternative).toBeDefined();
+    expect(typeof result.alternative).toBe('string');
+  });
+
+  it('checks safe operations before critical threats', async () => {
+    // rm -rf node_modules matches both SAFE_OPERATIONS and technically could
+    // match patterns. Verify safe wins.
+    const result = await reviewOperation({ operation: 'Bash: rm -rf node_modules' });
+    expect(result.decision).toBe('allow');
+    expect(result.confidence).toBe(95);
+  });
+});

package/server/mcp/bouncer-integration.ts

@@ -251,6 +251,34 @@ export async function reviewOperation(request: BouncerReviewRequest): Promise<Bo
     console.error(`[Bouncer] User request: ${request.context.userRequest}`);
   }
 
+  // ========================================
+  // PRE-CHECK: Malformed/empty tool calls
+  // ========================================
+  // Empty-param Edit/Write calls are no-ops that will fail validation anyway.
+  // Allow immediately instead of wasting ~8s on Haiku analysis.
+  const toolInput = request.context?.toolInput;
+  if (toolInput && typeof toolInput === 'object' && Object.keys(toolInput).length === 0) {
+    console.error('[Bouncer] ⚡ Fast path: Empty tool parameters (no-op)');
+    const latencyMs = Math.round(performance.now() - startTime);
+
+    const decision: BouncerDecision = {
+      decision: 'allow',
+      confidence: 95,
+      reasoning: 'Empty tool parameters - operation is a no-op with no side effects.',
+      threatLevel: 'low'
+    };
+
+    logBouncerDecision(
+      operation,
+      decision.decision,
+      decision.confidence,
+      decision.reasoning,
+      { context: request.context, threatLevel: decision.threatLevel, layer: 'pattern-noop', latencyMs }
+    );
+
+    return decision;
+  }
+
   // ========================================
   // LAYER 1: Pattern-Based Fast Path (< 5ms)
   // ========================================

package/server/mcp/security-audit.ts

@@ -10,8 +10,8 @@
 import { appendFileSync, existsSync, mkdirSync, } from 'node:fs';
 import { join } from 'node:path';
 
-// Default log directory inside .mstro/ sibling directory
-const DEFAULT_LOG_DIR = './.mstro/logs/security';
+// Default log subdirectory inside .mstro/
+const DEFAULT_LOG_SUBDIR = '.mstro/logs';
 
 export type BouncerLayer = 'pattern-critical' | 'pattern-safe' | 'pattern-default' | 'haiku-ai' | 'ai-disabled' | 'ai-error';
 
@@ -33,7 +33,8 @@ export interface AuditLogEntry {
 export class SecurityAuditLogger {
   private logFile: string;
 
-  constructor(logDir: string = DEFAULT_LOG_DIR) {
+  constructor(workingDir?: string) {
+    const logDir = join(workingDir || process.cwd(), DEFAULT_LOG_SUBDIR);
     this.logFile = join(logDir, 'bouncer-audit.jsonl');
 
     // Ensure log directory exists
@@ -88,12 +89,14 @@ export class SecurityAuditLogger {
 
 }
 
-// Singleton instance
+// Singleton instance (keyed by workingDir to support multiple projects)
 let auditLogger: SecurityAuditLogger | null = null;
+let auditLoggerWorkingDir: string | undefined;
 
-export function getAuditLogger(): SecurityAuditLogger {
-  if (!auditLogger) {
-    auditLogger = new SecurityAuditLogger();
+export function getAuditLogger(workingDir?: string): SecurityAuditLogger {
+  if (!auditLogger || (workingDir && workingDir !== auditLoggerWorkingDir)) {
+    auditLogger = new SecurityAuditLogger(workingDir);
+    auditLoggerWorkingDir = workingDir;
   }
   return auditLogger;
 }
@@ -113,7 +116,8 @@ export function logBouncerDecision(
   const validDecisions = ['allow', 'deny', 'warn_allow'];
   const normalizedDecision = validDecisions.includes(safeDecision) ? safeDecision : 'deny';
 
-  const logger = getAuditLogger();
+  const workingDir = metadata?.context?.workingDirectory;
+  const logger = getAuditLogger(workingDir);
   logger.logDecision(operation, normalizedDecision as 'allow' | 'deny' | 'warn_allow', confidence, reasoning, metadata);
 
   // Also log to console for real-time monitoring