opencode-wait-a-minute 0.0.0-stage → 1.1.0-rc.10

package/src/policy/risk-engine.js

@@ -0,0 +1,266 @@
+/**
+ * Action Risk Envelope — Runtime risk classification for agent actions.
+ *
+ * Implementa spec: action-risk-envelope.
+ *
+ * Categorías:
+ * - SAFE: Read-only o efectos reversibles mínimos. Autónoma.
+ * - GUARDED: Mutaciones bounded y reversibles. Autónoma si está dentro del scope.
+ * - BLOCKED: Destructivo, irreversible, o sensible. Requiere autorización explícita.
+ * - UNKNOWN: herramienta no catalogada. Se trata como BLOCKED (fail-closed).
+ *
+ * Las capabilities explícitas viven en `src/policy/action-capabilities.js`.
+ * Aquí solo se aplica la evaluación contextual (path, scope, contenido del comando).
+ */
+
+import nodePath from "node:path";
+import nodeFs from "node:fs";
+import {
+  CAPABILITY_LEVELS,
+  getEffectiveCapability,
+  isMutatingCapability,
+} from "./action-capabilities.js";
+
+const PROTECTED_PATHS = [
+  "/etc/", "/root/", "/boot/", "/sys/", "/proc/",
+  "/var/lib/", "/usr/bin/", "/usr/sbin/",
+  "C:\\Windows", "C:\\System32",
+];
+
+function isProtectedPath(path) {
+  if (!path || typeof path !== "string") return false;
+  return PROTECTED_PATHS.some((p) => path.startsWith(p) || path.includes(p));
+}
+
+/**
+ * Canonicalize and resolve a path against the task root.
+ *
+ * Estrategia:
+ * 1. Si la ruta es absoluta, se resuelve contra el cwd.
+ * 2. Si es relativa y hay taskRoot, se resuelve contra taskRoot.
+ * 3. Si el path resuelto existe en disco → se usa `fs.realpathSync` para
+ *    resolver symlinks (un symlink que apunta fuera del scope se bloquea).
+ * 4. Si el path NO existe todavía (caso típico: write de archivo nuevo) →
+ *    se usa el realpath del directorio padre. Esto evita que un symlink en
+ *    un directorio padre redirija el archivo fuera del scope.
+ * 5. Si el padre tampoco existe → se devuelve la ruta absoluta resuelta
+ *    (resolución lexical), suficiente para validar prefijo.
+ *
+ * Returns the absolute canonical path, or null if unsafe (path traversal).
+ */
+function canonicalPath(p, taskRoot) {
+  if (!p || typeof p !== "string") return null;
+  try {
+    let resolved;
+    if (nodePath.isAbsolute(p)) {
+      resolved = nodePath.resolve(p);
+    } else if (taskRoot) {
+      resolved = nodePath.resolve(taskRoot, p);
+    } else {
+      return null;
+    }
+
+    // Resolver symlinks usando realpath. Rama depende de si el path existe.
+    if (nodeFs.existsSync(resolved)) {
+      try {
+        return nodeFs.realpathSync(resolved);
+      } catch {
+        return resolved;
+      }
+    }
+
+    // El path no existe: usamos realpath del padre (cuando el padre existe)
+    // para que un symlink en el directorio padre no redirija fuera del scope.
+    const parent = nodePath.dirname(resolved);
+    if (nodeFs.existsSync(parent)) {
+      try {
+        const realParent = nodeFs.realpathSync(parent);
+        return nodePath.join(realParent, nodePath.basename(resolved));
+      } catch {
+        return resolved;
+      }
+    }
+
+    // Padre tampoco existe: devolvemos la ruta absoluta resuelta (lexical).
+    return resolved;
+  } catch {
+    return null;
+  }
+}
+
+function isWithinScope(absPath, taskRoot) {
+  if (!taskRoot) return true; // No scope constraint
+  try {
+    const resolvedRoot = nodePath.resolve(taskRoot);
+    // Si el root tiene symlinks, también los resolvemos para la comparación.
+    let canonicalRoot;
+    try {
+      canonicalRoot = nodeFs.realpathSync(resolvedRoot);
+    } catch {
+      canonicalRoot = resolvedRoot;
+    }
+    const rel = nodePath.relative(canonicalRoot, absPath);
+    return !rel.startsWith("..") && !nodePath.isAbsolute(rel);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Structured error for policy blocks. MUST NOT be swallowed by catch.
+ */
+export class WamPolicyBlock extends Error {
+  constructor(message, policy = {}) {
+    super(message);
+    this.name = "WamPolicyBlock";
+    this.wamPolicyBlock = true;
+    this.policy = policy;
+  }
+}
+
+function evaluateBashCommand(cmd) {
+  if (!cmd || typeof cmd !== "string") return { safe: true };
+
+  // NOTE: en este regex NO se usa `\b` al final del grupo porque alternativas
+  // como `dd if=` terminan en `=` (no-word), por lo que `\b` no aplica.
+  // Tampoco se envuelve todo el grupo en `\b...\b` por la misma razón.
+  const destructive = /(rm\s+-rf|rm\s+-fr|dd\s+if=|mkfs|format|:()\s*\{|\bdrop\s+database\b|\bdrop\s+table\b|\btruncate\s+table\b|delete\s+from\s+\S+\s+where|pkill\b|killall\b)/i;
+  const privileged = /\b(sudo|chmod\s+777|chown\s+root|iptables|ufw\s+disable)\b/i;
+  const network = /\b(curl[^|]*\|\s*sh|wget[^|]*\|\s*sh|nc\s+-|netcat)\b/i;
+  const gitDestructive = /\bgit\s+push\s+(-f|--force)|git\s+reset\s+--hard|git\s+clean\s+-fd|git\s+filter-branch/i;
+
+  if (destructive.test(cmd)) return { safe: false, reason: `Comando destructivo detectado: ${cmd.slice(0, 80)}` };
+  if (privileged.test(cmd)) return { safe: false, reason: `Comando privilegiado detectado: ${cmd.slice(0, 80)}` };
+  if (gitDestructive.test(cmd)) return { safe: false, reason: `Operación git destructiva: ${cmd.slice(0, 80)}` };
+  if (network.test(cmd)) return { safe: false, reason: `Pipe a shell desde red: ${cmd.slice(0, 80)}` };
+
+  return { safe: true };
+}
+
+/**
+ * Evalúa una acción propuesta por el agente y retorna su clasificación de riesgo.
+ *
+ * Política fail-closed (C01):
+ * - Herramientas catalogadas como SAFE/GUARDED/BLOCKED se evalúan normalmente.
+ * - Herramientas NO catalogadas → se clasifican como UNKNOWN y se tratan como
+ *   BLOCKED con reason "fail-closed: herramienta no catalogada".
+ *
+ * El match contra el catálogo es EXACTO (no sub-string), para evitar colisiones
+ * como "bash-safe" resolviendo a "bash".
+ *
+ * Las validaciones de scope y rutas protegidas aplican a TODAS las
+ * herramientas (incluso SAFE): un `read` de `/etc/passwd` o de un symlink
+ * fuera del root sigue siendo un escape de scope.
+ *
+ * @param {string} tool — Nombre de la herramienta invocada.
+ * @param {object} args — Argumentos de la invocación.
+ * @param {string} taskRoot — Root de la tarea activa (para validación de scope).
+ * @returns {{level: string, reason?: string, requiresUser: boolean}}
+ */
+export function evaluateAction(tool, args = {}, taskRoot = "") {
+  const lowerTool = (tool || "").toLowerCase();
+
+  // 0. Resolución de capability explícita (fail-closed para UNKNOWN).
+  const capability = getEffectiveCapability(lowerTool);
+
+  // Fail-closed: herramientas no catalogadas → BLOCKED inmediato.
+  if (capability === CAPABILITY_LEVELS.BLOCKED) {
+    // Si la herramienta tampoco está en el catálogo (UNKNOWN → BLOCKED),
+    // el reason debe indicar fail-closed para que el guard lo registre.
+    const knownBlocked = new Set([
+      "rm", "rmdir", "mv", "sudo", "chmod", "chown",
+      "docker", "ssh", "scp", "rsync",
+      "push", "force_push",
+    ]);
+    if (!knownBlocked.has(lowerTool)) {
+      return {
+        level: "BLOCKED",
+        reason: `fail-closed: herramienta no catalogada (${tool})`,
+        requiresUser: true,
+      };
+    }
+    return {
+      level: "BLOCKED",
+      reason: `Herramienta peligrosa por defecto: ${tool}`,
+      requiresUser: true,
+    };
+  }
+
+  // 1. Extracción de path crudo y validaciones universales (aplican a
+  //    SAFE y GUARDED). Las rutas protegidas o fuera del scope elevan
+  //    la acción a BLOCKED independientemente del capability original.
+  const rawPath = args?.path || args?.file || args?.file_path || args?.target || "";
+  if (isProtectedPath(rawPath)) {
+    return {
+      level: "BLOCKED",
+      reason: `Ruta protegida: ${rawPath}`,
+      requiresUser: true,
+    };
+  }
+
+  if (taskRoot && rawPath) {
+    const canonical = canonicalPath(rawPath, taskRoot);
+    if (canonical && !isWithinScope(canonical, taskRoot)) {
+      return {
+        level: "BLOCKED",
+        reason: `Acción fuera del scope de tarea (path traversal): ${rawPath} → ${canonical} (root: ${taskRoot})`,
+        requiresUser: true,
+      };
+    }
+  }
+
+  // 2. SAFE: autónoma (post validación de scope).
+  if (capability === CAPABILITY_LEVELS.SAFE) {
+    return { level: "SAFE", requiresUser: false };
+  }
+
+  // 3. GUARDED: requiere validación contextual adicional (bash commands).
+  if (capability === CAPABILITY_LEVELS.GUARDED) {
+    if (lowerTool === "bash" || lowerTool === "sh" || lowerTool === "pty_spawn") {
+      const cmd = args?.command || args?.cmd || args?.script || "";
+      const bashEval = evaluateBashCommand(cmd);
+      if (!bashEval.safe) {
+        return {
+          level: "BLOCKED",
+          reason: bashEval.reason,
+          requiresUser: true,
+        };
+      }
+    }
+
+    return { level: "GUARDED", requiresUser: false };
+  }
+
+  // Cualquier otro nivel no debería ocurrir (SAFE/GUARDED/BLOCKED cubren todo
+  // gracias a fail-closed), pero por seguridad devolvemos BLOCKED.
+  return {
+    level: "BLOCKED",
+    reason: `fail-closed: capacidad no resuelta (${tool})`,
+    requiresUser: true,
+  };
+}
+
+export const RISK_LEVELS = { SAFE: "SAFE", GUARDED: "GUARDED", BLOCKED: "BLOCKED" };
+
+/**
+ * Conjunto de herramientas mutantes (GUARDED + BLOCKED explícitos).
+ * NOTA: las herramientas UNKNOWN NO aparecen aquí — la verificación
+ * de mutación se hace preferentemente con `isMutatingTool`, que aplica
+ * fail-closed para UNKNOWN. Este Set se conserva por compatibilidad.
+ */
+export const MUTATING_TOOLS = new Set([
+  // GUARDED
+  "write", "edit", "apply_patch", "patch",
+  "todo_write", "todowrite",
+  "bash", "sh", "pty_spawn", "pty_write",
+  "task",
+  // BLOCKED
+  "rm", "rmdir", "mv", "sudo", "chmod", "chown",
+  "docker", "ssh", "scp", "rsync",
+  "push", "force_push",
+]);
+
+export function isMutatingTool(tool) {
+  // Fail-closed: una herramienta desconocida también se considera mutante.
+  return isMutatingCapability(tool);
+}

package/src/policy/scope-enforcement.js

@@ -0,0 +1,140 @@
+/**
+ * Scope & Strategy Enforcement — scope drift detection.
+ * Implements spec: scope-and-strategy-enforcement.
+ *
+ * Strategy = objective, scope, allowedActions, prohibitedActions
+ * Current Execution = hypothesis, experiment, files touched, actions, evidence
+ * Drift = deviation between strategy and current execution.
+ *
+ * Policy:
+ *   none / small_safe → allow + record
+ *   material          → require authorization
+ *   prohibited        → block
+ */
+
+const DRIFT_LEVELS = {
+  NONE: "none",
+  SMALL_SAFE: "small_safe",
+  MATERIAL: "material",
+  PROHIBITED: "prohibited",
+};
+
+const SAFE_FAMILIES = new Set([
+  "read", "search", "inspect", "test", "lint", "typecheck", "list", "glob", "grep",
+]);
+
+const MATERIAL_FAMILIES = new Set([
+  "refactor", "rename", "migrate", "schema", "schema-change", "restructure", "rewrite",
+  "scope expansion", "scope-expansion", "architectural change",
+]);
+
+const PROHIBITED_FAMILIES = new Set([
+  "drop database", "drop schema", "production deploy", "delete production data",
+  "credential modification", "destructive operation", "rm -rf", "git reset --hard",
+  "wipe", "truncate", "shred",
+]);
+
+function familyOf(action = "", command = "") {
+  const text = `${action} ${command}`.toLowerCase();
+  for (const p of PROHIBITED_FAMILIES) {
+    if (text.includes(p)) return { level: DRIFT_LEVELS.PROHIBITED, family: p };
+  }
+  for (const m of MATERIAL_FAMILIES) {
+    if (text.includes(m)) return { level: DRIFT_LEVELS.MATERIAL, family: m };
+  }
+  for (const s of SAFE_FAMILIES) {
+    if (text.includes(s)) return { level: DRIFT_LEVELS.SMALL_SAFE, family: s };
+  }
+  return { level: DRIFT_LEVELS.NONE, family: null };
+}
+
+function isInScope(action, strategy) {
+  if (!strategy) return false;
+  const allowed = strategy.allowedActions || [];
+  const prohibited = strategy.prohibitedActions || [];
+  const a = (action || "").toLowerCase();
+  for (const p of prohibited) {
+    if (a.includes(p.toLowerCase())) return { allowed: false, reason: `prohibited: ${p}` };
+  }
+  for (const allow of allowed) {
+    if (a.includes(allow.toLowerCase())) return { allowed: true, reason: `matched: ${allow}` };
+  }
+  return { allowed: false, reason: "no allowed action matched" };
+}
+
+export function detectScopeDrift(strategy, execution) {
+  const action = execution?.action || execution?.description || "";
+  const command = execution?.command || execution?.args?.command || "";
+  
+  // Empty action = no drift
+  if (!action && !command) {
+    return {
+      level: DRIFT_LEVELS.NONE,
+      family: null,
+      allowed: true,
+      reason: "no action",
+      action,
+      command,
+    };
+  }
+  
+  const result = familyOf(action, command);
+  const scopeCheck = isInScope(action, strategy);
+
+  let drift = result.level;
+  
+  // If action is explicitly allowed by strategy, it's at most SMALL_SAFE
+  if (scopeCheck.allowed === true) {
+    // Allowed by strategy: if it's already a safe family, keep it; otherwise make it SMALL_SAFE
+    if (result.level === DRIFT_LEVELS.NONE) {
+      drift = DRIFT_LEVELS.SMALL_SAFE;
+    }
+  } else if (scopeCheck.allowed === false && result.level !== DRIFT_LEVELS.PROHIBITED) {
+    // Not allowed by strategy
+    if (result.level === DRIFT_LEVELS.SMALL_SAFE) {
+      drift = DRIFT_LEVELS.SMALL_SAFE;
+    } else if (result.level === DRIFT_LEVELS.NONE) {
+      drift = DRIFT_LEVELS.MATERIAL;
+    } else {
+      drift = result.level;
+    }
+  }
+
+  return {
+    level: drift,
+    family: result.family,
+    allowed: scopeCheck.allowed,
+    reason: scopeCheck.reason,
+    action,
+    command,
+  };
+}
+
+export function policyFor(drift) {
+  switch (drift.level) {
+    case DRIFT_LEVELS.NONE:
+    case DRIFT_LEVELS.SMALL_SAFE:
+      return "allow+record";
+    case DRIFT_LEVELS.MATERIAL:
+      return "require-authorization";
+    case DRIFT_LEVELS.PROHIBITED:
+      return "block";
+    default:
+      return "block";
+  }
+}
+
+export function recordDrift(taskState, drift) {
+  if (!taskState) return taskState;
+  if (!Array.isArray(taskState.driftLog)) taskState.driftLog = [];
+  taskState.driftLog.push({
+    at: Date.now(),
+    level: drift.level,
+    family: drift.family,
+    action: drift.action,
+    reason: drift.reason,
+  });
+  return taskState;
+}
+
+export const SCOPE_DRIFT = DRIFT_LEVELS;

package/src/policy/secret-scanner.js

@@ -0,0 +1,68 @@
+/**
+ * Secret Scanner — regex-based detection of common secret patterns.
+ *
+ * Detects: AWS keys, GitHub tokens, generic API keys, JWTs, private
+ * keys, Slack tokens. Returns findings with line numbers. Production
+ * hardening (M5-56).
+ */
+
+/**
+ * @typedef {Object} Finding
+ * @property {string} type
+ * @property {number} line
+ * @property {number} column
+ * @property {string} match
+ * @property {string} severity
+ */
+
+/**
+ * @typedef {Object} ScanResult
+ * @property {Finding[]} findings
+ * @property {boolean} clean
+ * @property {number} count
+ */
+
+/** @type {Array<{type: string, severity: string, regex: RegExp}>} */
+const PATTERNS = [
+  { type: "aws_access_key", severity: "high", regex: /AKIA[0-9A-Z]{16}/g },
+  { type: "github_token", severity: "high", regex: /gh[pousr]_[A-Za-z0-9]{36,}/g },
+  { type: "slack_token", severity: "high", regex: /xox[abprs]-[A-Za-z0-9-]{10,}/g },
+  { type: "private_key", severity: "high", regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
+  { type: "jwt", severity: "medium", regex: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g },
+  { type: "generic_api_key", severity: "medium", regex: /(?:api[_-]?key|apikey|secret)\s*[:=]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?/gi },
+  { type: "stripe_key", severity: "high", regex: /sk_(?:live|test)_[A-Za-z0-9]{24,}/g },
+];
+
+/**
+ * Scan text for secret patterns.
+ * @param {string} text
+ * @returns {ScanResult}
+ */
+export function scanSecrets(text) {
+  if (typeof text !== "string") {
+    throw new TypeError("text must be string");
+  }
+  const findings = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const p of PATTERNS) {
+      p.regex.lastIndex = 0;
+      let m;
+      while ((m = p.regex.exec(line)) !== null) {
+        findings.push({
+          type: p.type,
+          severity: p.severity,
+          line: i + 1,
+          column: m.index + 1,
+          match: m[0],
+        });
+      }
+    }
+  }
+  return {
+    findings,
+    clean: findings.length === 0,
+    count: findings.length,
+  };
+}

package/src/policy/skill-routing.js

@@ -0,0 +1,104 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+/**
+ * Portable skill discovery.
+ *
+ * Resolution order (deterministic precedence — first wins):
+ *   1. project-local: <root>/.opencode/skills
+ *   2. project-local: <root>/.opencode/.skills
+ *   3. user-global:   <homedir>/.config/opencode/skills
+ *   4. user-global:   <homedir>/.config/opencode/.skills
+ *   5. user-global:   <homedir>/.claude/skills
+ *   6. user-global:   <homedir>/.agents/skills
+ *   7. user-global:   <homedir>/.opencode/skills
+ *   8. bundled:       <thisFile>/../../skills
+ *
+ * The first occurrence of a skill name wins. All paths are computed
+ * dynamically from `os.homedir()` and the optional `root` argument so the
+ * module is portable across machines.
+ */
+
+function fileExists(filePath) {
+  try {
+    fs.accessSync(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Build the ordered list of skill directories to scan.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.root] - Project root. Defaults to process.cwd().
+ * @param {string} [opts.home] - Override homedir (used by tests).
+ * @returns {{ dir: string, tier: string }[]}
+ */
+export function getSkillSearchPaths({ root, home } = {}) {
+  const effectiveRoot = root || process.cwd();
+  const effectiveHome = home || os.homedir();
+  const thisDir = path.dirname(new URL(import.meta.url).pathname);
+
+  return [
+    { dir: path.join(effectiveRoot, ".opencode", "skills"), tier: "project-local" },
+    { dir: path.join(effectiveRoot, ".opencode", ".skills"), tier: "project-local" },
+    { dir: path.join(effectiveHome, ".config", "opencode", "skills"), tier: "user-global" },
+    { dir: path.join(effectiveHome, ".config", "opencode", ".skills"), tier: "user-global" },
+    { dir: path.join(effectiveHome, ".claude", "skills"), tier: "user-global" },
+    { dir: path.join(effectiveHome, ".agents", "skills"), tier: "user-global" },
+    { dir: path.join(effectiveHome, ".opencode", "skills"), tier: "user-global" },
+    { dir: path.join(thisDir, "..", "..", "skills"), tier: "bundled" },
+  ];
+}
+
+/**
+ * Discover all available skills across the configured search paths.
+ * Earlier tiers override later ones (project-local > user-global > bundled).
+ *
+ * @param {object} [opts] - forwarded to getSkillSearchPaths
+ * @returns {Object<string, { name: string, path: string, dir: string, tier: string }>}
+ */
+export function discoverSkills(opts = {}) {
+  const searchPaths = getSkillSearchPaths(opts);
+  const candidates = {};
+
+  for (const { dir: skillDir, tier } of searchPaths) {
+    if (!fileExists(skillDir)) continue;
+
+    let entries;
+    try {
+      entries = fs.readdirSync(skillDir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const skillPath = path.join(skillDir, entry.name, "SKILL.md");
+      if (fileExists(skillPath)) {
+        if (!candidates[entry.name]) {
+          candidates[entry.name] = {
+            name: entry.name,
+            path: skillPath,
+            dir: skillDir,
+            tier,
+          };
+        }
+      }
+    }
+  }
+
+  return candidates;
+}
+
+/**
+ * Return the list of configured search paths (useful for debugging and tests).
+ * @param {object} [opts]
+ * @returns {string[]}
+ */
+export function getSkillSearchDirs(opts = {}) {
+  return getSkillSearchPaths(opts).map((p) => p.dir);
+}