mstro-app 0.4.20 → 0.4.22

package/server/cli/headless/types.ts

@@ -123,6 +123,8 @@ export interface HeadlessConfig {
   extraEnv?: Record<string, string>;
   /** Tools to disallow in the spawned Claude session (passed as --disallowedTools) */
   disallowedTools?: string[];
+  /** Enable deploy-mode patterns in the bouncer (stricter rules for end-user-driven sessions) */
+  deployMode?: boolean;
 }
 
 export interface SessionState {
@@ -209,7 +211,7 @@ export interface ExecutionResult {
 }
 
 /** Resolved config with all defaults applied */
-export type ResolvedHeadlessConfig = Omit<Required<HeadlessConfig>, 'outputCallback' | 'thinkingCallback' | 'toolUseCallback' | 'tokenUsageCallback' | 'continueSession' | 'claudeSessionId' | 'imageAttachments' | 'model' | 'toolTimeoutProfiles' | 'onToolTimeout' | 'extraEnv' | 'disallowedTools'> & {
+export type ResolvedHeadlessConfig = Omit<Required<HeadlessConfig>, 'outputCallback' | 'thinkingCallback' | 'toolUseCallback' | 'tokenUsageCallback' | 'continueSession' | 'claudeSessionId' | 'imageAttachments' | 'model' | 'toolTimeoutProfiles' | 'onToolTimeout' | 'extraEnv' | 'disallowedTools' | 'deployMode'> & {
   outputCallback?: (text: string) => void;
   thinkingCallback?: (text: string) => void;
   toolUseCallback?: (event: ToolUseEvent) => void;
@@ -222,6 +224,7 @@ export type ResolvedHeadlessConfig = Omit<Required<HeadlessConfig>, 'outputCallb
   onToolTimeout?: (checkpoint: ExecutionCheckpoint) => void;
   extraEnv?: Record<string, string>;
   disallowedTools?: string[];
+  deployMode?: boolean;
 };
 
 

package/server/index.ts

@@ -27,6 +27,7 @@ import {
 import { createPlatformRelayContext, ensureClaudeSettings, setTerminalTitle, wrapWebSocket } from './server-setup.js'
 import { AnalyticsEvents, initAnalytics, shutdownAnalytics, trackEvent } from './services/analytics.js'
 import { AuthService } from './services/auth.js'
+import { createAiBrokerRoutes, setDeployHealthUpdateListener, setDeployUsageReportListener } from './services/deploy/ai-broker.js'
 import { FileService } from './services/files.js'
 import { InstanceRegistry, type MstroInstance } from './services/instances.js'
 import { PlatformConnection } from './services/platform.js'
@@ -81,7 +82,7 @@ app.use('*', cors({
 app.use('*', logger())
 
 const authMiddleware = async (c: Context, next: Next) => {
-  const publicPaths = ['/health', '/api/config']
+  const publicPaths = ['/health', '/api/config', '/api/deploy/ai']
   if (publicPaths.some(path => c.req.path.startsWith(path))) {
     return next()
   }
@@ -104,6 +105,7 @@ app.route('/api/shutdown', createShutdownRoute(instanceRegistry))
 app.route('/api/improvise', createImproviseRoutes(WORKING_DIR))
 app.route('/api/files', createFileRoutes(fileService))
 app.route('/api/notifications', createNotificationRoutes(WORKING_DIR))
+app.route('/api/deploy/ai', createAiBrokerRoutes())
 
 app.post('/api/reload-pty', async (c) => {
   const success = await reloadPty()
@@ -193,6 +195,12 @@ async function startServer() {
       wsHandler.setUsageReporter((report) => {
         platformConnection.send({ type: 'reportUsage', data: report })
       })
+      setDeployUsageReportListener((report) => {
+        platformConnection.send({ type: 'deployUsageReport', data: report })
+      })
+      setDeployHealthUpdateListener((update) => {
+        platformConnection.send({ type: 'deployAiHealthUpdate', data: update })
+      })
     },
     onDisconnected: () => {
       if (platformRelayContext) {

package/server/mcp/bouncer-integration.ts

@@ -19,6 +19,13 @@
  * │ - Defaults to ALLOW - user is actively working with Claude │
  * └─────────────────────────────────────────────────────────────┘
  *
+ * SECURITY BOUNDARY: Layer 1 is a performance optimization, NOT a
+ * security boundary. Haiku (Layer 2) is the security boundary.
+ * Layer 1 patterns are public (open-source repo) and should be
+ * treated as a fast-path filter only. Never expand SAFE_OPERATIONS
+ * to include operations with side effects beyond the user's
+ * working directory.
+ *
  * Haiku AI analysis lives in bouncer-haiku.ts.
  * Pattern definitions live in security-patterns.ts.
  * Analysis logic lives in security-analysis.ts.
@@ -168,8 +175,9 @@ async function runHaikuAnalysis(
   startTime: number,
   fin: (d: BouncerDecision, layer: string, opts?: Parameters<typeof finalizeDecision>[6]) => BouncerDecision,
 ): Promise<BouncerDecision> {
-  if (process.env.BOUNCER_USE_AI === 'false') {
-    console.error('[Bouncer] AI analysis disabled (BOUNCER_USE_AI=false)');
+  const aiDisabledByEnv = process.env.BOUNCER_USE_AI === 'false' && process.env.NODE_ENV !== 'production';
+  if (aiDisabledByEnv || request.context?._skipAI === true) {
+    console.error('[Bouncer] AI analysis disabled');
     return fin({ decision: 'warn_allow', confidence: 60, reasoning: 'Operation requires review but AI analysis is disabled. Proceeding with caution.', threatLevel: 'medium' }, 'ai-disabled', { skipCache: true, skipAnalytics: true });
   }
 
@@ -263,26 +271,20 @@ export { classifyRisk as classifyOperationRisk } from './security-patterns.js';
 
 /**
  * Legacy compatibility — redirects to reviewOperation.
- * When useAI=false, temporarily sets BOUNCER_USE_AI env var.
- * Uses a saved/restored pattern to avoid race conditions with concurrent calls.
+ * When useAI=false, skips AI analysis by injecting a context flag
+ * that runHaikuAnalysis checks (avoids racy process.env mutation).
  */
 export async function launchBouncerAgent(
   request: BouncerReviewRequest,
   useAI: boolean = true
 ): Promise<BouncerDecision> {
-  const prevValue = process.env.BOUNCER_USE_AI;
   if (!useAI) {
-    process.env.BOUNCER_USE_AI = 'false';
-  }
-  try {
-    return await reviewOperation(request);
-  } finally {
-    if (!useAI) {
-      if (prevValue !== undefined) {
-        process.env.BOUNCER_USE_AI = prevValue;
-      } else {
-        delete process.env.BOUNCER_USE_AI;
-      }
-    }
+    // Inject skipAI flag into the request context so runHaikuAnalysis
+    // can check it without mutating process.env (which races under concurrency).
+    request = {
+      ...request,
+      context: { ...request.context, _skipAI: true },
+    };
   }
+  return reviewOperation(request);
 }

package/server/mcp/security-analysis.ts

@@ -10,6 +10,7 @@
 
 import {
   CRITICAL_THREATS,
+  DEPLOY_PATTERNS,
   matchesPattern,
   NEEDS_AI_REVIEW,
   normalizeOperation,
@@ -62,6 +63,17 @@ function isSafeExpansionUse(operation: string): boolean {
   return safePrefix.test(cmd);
 }
 
+// ── Deploy Mode Detection ────────────────────────────────────
+
+/**
+ * Check if the bouncer is running in deploy mode.
+ * Set by the MCP config when spawned for deploy (board/headless) executions.
+ * Deploy mode activates additional security patterns for end-user-driven sessions.
+ */
+export function isDeployMode(): boolean {
+  return process.env.BOUNCER_DEPLOY_MODE === 'true';
+}
+
 // ── Public API ────────────────────────────────────────────────
 
 /**
@@ -104,6 +116,13 @@ export function requiresAIReview(operation: string): boolean {
     return true;
   }
 
+  // Deploy-specific patterns: when running in deploy mode (end-user driven),
+  // additional operations are flagged for AI review. These take precedence
+  // over safe operations because deploy context has stricter requirements.
+  if (isDeployMode() && matchesPattern(op, DEPLOY_PATTERNS)) {
+    return true;
+  }
+
   if (matchesPattern(op, SAFE_OPERATIONS)) {
     // Safe bash commands must not contain chain operators, dangerous pipes,
     // or subshell/backtick expansion that could hide dangerous operations.

package/server/mcp/security-patterns.ts

@@ -13,6 +13,12 @@
  * - Sensitive operations (system paths, credentials) get AI review with context
  * - The question is: "Does this operation make sense given user intent?"
  *
+ * SECURITY NOTE: These patterns are public (open-source repo). Pattern
+ * visibility is intentional and follows industry practice (OWASP CRS,
+ * Snort, ModSecurity all publish rules publicly). The Haiku AI layer
+ * in bouncer-integration.ts is the actual security boundary — these
+ * patterns are a performance optimization for the fast path only.
+ *
  * Analysis logic (requiresAIReview, classifyRisk) lives in security-analysis.ts
  * and is re-exported here for backward compatibility.
  */
@@ -34,7 +40,7 @@ export interface SecurityPattern {
 export const SENSITIVE_PATHS: SecurityPattern[] = [
   // System directories - might be legitimate (e.g., user asked to configure something)
   { pattern: /^(Write|Edit):\s*\/etc\//i, reason: 'System configuration - verify user intent' },
-  { pattern: /^(Write|Edit):\s*\/(bin|sbin|usr\/bin|usr\/sbin)\//i, reason: 'System binaries - verify user intent' },
+  { pattern: /^(Write|Edit):\s*\/(bin|sbin|usr\/bin|usr\/sbin|usr\/local\/bin|usr\/local\/sbin)\//i, reason: 'System binaries - verify user intent' },
   { pattern: /^(Write|Edit):\s*\/boot\//i, reason: 'Boot directory - verify user intent' },
   { pattern: /^(Write|Edit):\s*\/root\//i, reason: 'Root home - verify user intent' },
   { pattern: /^(Write|Edit):\s*\/System\//i, reason: 'macOS system - verify user intent' },
@@ -63,7 +69,7 @@ export const SENSITIVE_PATHS: SecurityPattern[] = [
  */
 export const CRITICAL_THREATS: SecurityPattern[] = [
   {
-    pattern: /rm\s+-rf\s+(\/|~)($|\s)/i,
+    pattern: /rm\s+-rf\s+(\/|~)($|\s|;|&&|\|\|)/i,
     reason: 'Deleting root (/) or home (~) directory is never a legitimate dev task'
   },
   {
@@ -239,6 +245,51 @@ export const NEEDS_AI_REVIEW: SecurityPattern[] = [
   { pattern: /\bclaude\b.*\bmcp\b.*\badd\b/i, reason: 'Adding MCP server - verify source is trusted' },
 ];
 
+/**
+ * Deploy-specific patterns — additional restrictions for board/headless executions
+ * triggered by end-user prompts (untrusted input from deployed app users).
+ *
+ * These catch operations that are unusual in an automated board execution context
+ * and should be routed to AI review. They supplement NEEDS_AI_REVIEW above.
+ */
+export const DEPLOY_PATTERNS: SecurityPattern[] = [
+  // Credential access from deploy context is suspicious
+  {
+    pattern: /\b(cat|head|tail|less|more)\b.*\.(env|pem|key|crt|p12|pfx|jks)\b/i,
+    reason: 'Deploy execution reading credential/certificate files — verify intent'
+  },
+
+  // Git push from deploy context — end-user code should not push upstream
+  {
+    pattern: /\bgit\b.*\bpush\b/i,
+    reason: 'Deploy execution attempting git push — verify this is intended'
+  },
+
+  // Network listeners — deploy executions should not open ports
+  {
+    pattern: /\b(nc|netcat|ncat|socat)\b.*(\blisten\b|\s-l\b)/i,
+    reason: 'Deploy execution opening network listener — potential backdoor'
+  },
+
+  // Process manipulation from deploy context
+  {
+    pattern: /\b(kill|killall|pkill)\b/i,
+    reason: 'Deploy execution attempting process termination — verify intent'
+  },
+
+  // SSH/SCP from deploy context
+  {
+    pattern: /\b(ssh|scp|sftp)\b.*@/i,
+    reason: 'Deploy execution initiating SSH/SCP connection — verify intent'
+  },
+
+  // Cron/systemd manipulation
+  {
+    pattern: /\b(crontab|systemctl|launchctl)\b/i,
+    reason: 'Deploy execution manipulating scheduled tasks — verify intent'
+  },
+];
+
 // ── Utility functions ─────────────────────────────────────────
 
 /**