npm - opensocrates - Versions diffs - 1.3.1 → 1.5.0 - Mend

opensocrates 1.3.1 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/CHANGELOG.md +60 -0
package/README.ko.md +90 -82
package/README.md +93 -88
package/SECURITY.md +102 -141
package/VERSION +1 -1
package/installer/managed-hosts.mjs +659 -0
package/installer/opensocrates.mjs +686 -1362
package/installer/windows.ps1 +164 -0
package/package.json +7 -12

package/SECURITY.md CHANGED Viewed

@@ -2,151 +2,112 @@
 ## Supported versions
-Security fixes are provided for the latest `1.x` release. Pre-1.0 builds are
-not supported.
-| Version | Supported |
-| --- | --- |
-| 1.x | Yes |
-| < 1.0 | No |
+Security fixes are provided for the latest `1.x` release. Version 1.5.0 preserves
+the v1.4 Codex foundation and adds native Mac Claude
+Code, content-only Claude account delivery, and modular Antigravity content.
+The Windows continuation supports content-only Claude account verification/export
+and Antigravity modular lifecycle on x64; native Windows Claude Code is excluded.
+Live account selection and conversation-app loading require separate observations.
+Pre-1.0 builds and retired
+host integrations are unsupported; they are not silently adopted by a new profile.
 ## Report a vulnerability
 Do not publish credentials, private prompts, transcripts, workspace data, or
-exploit details in a public issue.
-Use GitHub's
-[private vulnerability reporting](https://github.com/ParkerHwang/OpenSocrates/security/advisories/new)
-to send a confidential report. Include:
-- the affected version and platform;
-- the smallest reproducible example;
-- expected and observed impact;
-- whether credentials or private user data may be exposed;
-- any suggested mitigation.
-If private reporting is unavailable, open a public issue requesting a private
-contact channel without including vulnerability details.
-Reports are reviewed as maintainer capacity allows. Acknowledgement,
-assessment, remediation, and disclosure timing depend on reproducibility,
-severity, and the availability of a safe fix.
+exploit details in a public issue. Use GitHub's
+[private vulnerability reporting](https://github.com/ParkerHwang/OpenSocrates/security/advisories/new).
+Include the affected version and platform, a minimal reproduction, the observed
+impact, whether private user data is exposed, and any suggested mitigation.
+If private reporting is unavailable, request a private contact channel in an
+issue without vulnerability details. Response timing depends on reproducibility,
+severity, safe fixes, and maintainer availability.
 ## Security boundary
-The v1.3 default Claude/Codex submission entry emits discovery guidance only. It
-selects no initial method, starts no selector model call and creates no grounding
-artifact that an abandoned candidate must read at Stop. The decision command
-loads fixed canonical content, keeps only volatile context-scoped delivery
-identities and agent availability assertions, and never claims applied reasoning
-from an assertion. It does not use CWD-controlled fallback content when its fixed
-package/source content pair is absent. No disk state, raw prompt, conversation,
-reasoning, screenshot, authentication call or telemetry is added by that command.
-The selector and native receipt details below describe retained compatibility
-adapters; they must not be presented as observations made by the new default path.
-OpenSocrates 1.x:
-- runs its integration locally through Claude or Codex and uses the user's
-  existing host login;
-- does not require or store an Anthropic or OpenAI API key;
-- does not host an OpenSocrates backend or add telemetry;
-- verifies downloadable packages with SHA-256 release and package manifests;
-- keeps cross-host activation transactional and restores prior managed
-  registrations when a coordinated activation fails;
-- leaves scheduled updates disabled until explicitly enabled and stores only
-  owner-readable desired state, a single-instance lock, and content-free update
-  receipts;
-- fails open when the selector cannot safely complete.
-The installed `diagnose` command verifies the exact package inventory against
-`checksums.sha256` and validates release-manifest identity for the running
-version, host, and content revision. A mismatch is reported explicitly. These
-files are not signed, so this is local integrity and damage detection, not an
-authenticity guarantee against an attacker able to replace the complete
-package and its checksum metadata.
-The Claude selector runs a bounded, non-persistent `claude --safe-mode -p`
-process. Safe mode disables user, project, and plugin customizations, and
-OpenSocrates additionally passes `--tools ""`, `--disallowedTools "mcp__*"`, and
-`--strict-mcp-config` so no built-in or MCP tool remains. It receives the current
-prompt and authored selection catalog only. The process uses the user's Claude
-login, so model requests remain subject to Anthropic's service and data-handling
-terms. The Codex selector uses the pinned Codex SDK and existing OAuth session in
-its own isolated worker.
-The selector environment is default-deny. `CLAUDE_CONFIG_DIR` is one of the
-small set of allowed path variables because the child needs it to locate the
-user's existing Claude login when a non-default config directory is in use.
-OpenSocrates does not copy, inspect, or log credentials from that directory.
-For fail-open diagnosis, each Claude selector attempt increments one
-owner-only local aggregate under a closed nine-label vocabulary. The aggregate
-stores counts only: it has no timestamp, prompt, transcript, session or turn
-identifier, path, model output, credential, or reasoning. It is shown by the
-local `diagnose` command and is never transmitted.
-An unreadable aggregate is reported as `unavailable`, never as zero observed
-attempts. The next valid selector outcome atomically replaces only a malformed
-current-schema aggregate with a fresh bounded count document; an unknown future
-schema is preserved. Rejected malformed bytes are never copied into another
-file.
-Managed policy settings are part of the host trust boundary and are not disabled.
-Anthropic's [CLI reference](https://code.claude.com/docs/en/cli-reference) states
-that under `--safe-mode` "managed settings policy still applies, including
-policy-configured hooks". Consequences on an organization-managed machine:
-- a managed `UserPromptSubmit` hook executes inside the selector process,
-  receives the current prompt on standard input, and can return
-  `additionalContext` that enters selection;
-- managed plugins, managed skills, managed `CLAUDE.md`, and policy-configured
-  MCP servers do not load.
-OpenSocrates does not detect or override managed policy. Selection remains
-bounded regardless: the model's returned instruction text is discarded, and only
-authored catalog content assembled by OpenSocrates is ever injected. Operators
-who cannot accept managed-hook visibility of the selector prompt should not
-enable OpenSocrates selection on those machines.
-On Claude surfaces that deliver the packaged hooks, the grounding gate observes
-only successful `Read` callbacks for the current turn's exact instruction file.
-It transiently checks that the response reached an authored terminal marker and
-does not retain the response. The owner-only authenticated receipt stores only
-the artifact digest, content revision, selected method IDs, and keyed
-authentication/tool-use tags; prompts, transcripts, raw tool output,
-credentials, workspace paths, and artifact paths are excluded. `Stop` removes
-the receipt with the turn artifact. If `Stop` is absent, the next
-`UserPromptSubmit` in that session removes prior prompt trees without touching
-the new active tree. `SessionEnd` remains the session backstop, and the
-24-hour `SessionStart` sweep covers crash leftovers when neither event arrives.
-The gate's scope is deliberate and worth stating plainly. It establishes that a
-successful `Read` callback naming the exact current-turn artifact returned
-content reaching the authored terminal marker. It does not cryptographically
-prove that every artifact byte was returned: a synthetic payload carrying only
-the marker would satisfy the marker test. That is not reachable by the model,
-which does not author `tool_response`, and the marker is the artifact's last
-line, so a truncated read loses it. Anything able to forge that callback already
-controls the hook's standard input and is outside the boundary this gate
-defends. The gate raises the cost of an ungrounded answer; it is not a proof of
-delivery, and it fails open by design.
-The optional macOS LaunchAgent invokes the selected published npm channel and
-then uses the same verified installer path as a manual update. It does not read
-or terminate active Claude or Codex sessions. Its receipt contains only the
-checked version, timestamp, per-host result, and an error category; prompts,
-transcripts, workspace paths, credentials, and raw error output are excluded.
-Automatic major-version upgrades are disabled unless the user explicitly
-changes that policy.
-Installer rollback mutates only its owner-marked managed marketplace root. If
-the failed root cannot be removed and the previous backup therefore cannot be
-renamed into place, the installer preserves that backup and prints quoted,
-executable recovery commands naming only those two managed paths.
-Signing, notarization, clean-machine installation, platforms other than
-`darwin-arm64`, Claude Chat automatic hooks, and live delivery on every host
-surface are not claimed as validated. Native plugin archives ship only
-`bin/launch.sh`; it rejects macOS Intel, Linux, Windows, and every other target,
-and no PowerShell launcher is included. See the release limitations file for
-the complete measured boundary.
+The default native submission entry emits discovery guidance only. It starts no
+selector-model request and creates no initial method artifact. The decision
+command loads fixed canonical content and retains only volatile, context-scoped
+delivery identities and agent availability assertions. It never treats an agent
+assertion as proof of applied reasoning. Missing fixed package/source content
+does not authorize a CWD-controlled fallback. This command adds no disk state,
+raw prompt logging, conversation retention, screenshot capture, authentication
+call, or telemetry.
+The Claude adapter has its own bounded JSON normalization and native response
+shape. It drops private prompt/transcript fields, resolves complete controller
+locations only inside the installed package, and never opens a transcript or
+initializes a database. Stop and SessionEnd do not require a repair or assert a
+native application receipt. Unavailable native entry fails open with empty output.
+Claude account exports and Antigravity modular packages contain complete authored
+content without hooks, runtimes, or credential access. An Antigravity standing
+rule links the owned controller; it never authorizes unrelated account or file
+actions. Workspace/global origins and existing user instructions remain separate.
+Windows addon operations refuse junctions/reparse ancestors, foreign ownership,
+untrusted writable DACLs, unknown files and changed inventories. New directories
+are created with the current user's explicit owner and protected DACL. A held
+directory lease blocks ancestor rename during mutations; an exclusive operation
+lock is never removed as stale automatically. Rollback preserves changed
+replacement content and its recovery backup. Local drive paths are required;
+network shares are not qualified. Existing settings are not normalized by
+rewriting permissions. ZIP paths reject aliases, streams, links, special entries,
+case collisions and file/directory conflicts before extraction. Portable content
+archives carry fixed regular-file modes and no executables. Account exports use
+verified captured bytes and refuse conflicting output files.
+The retained legacy Codex selector is a separate compatibility path. It uses the
+pinned SDK and existing Codex authentication in an isolated worker, with bounded
+read-only context access, disabled recursive hooks/plugins, a deadline, and
+fail-open cleanup. Its temporary method artifacts contain authored content only.
+A native read receipt is limited to the supported callback and exact artifact;
+it cannot prove model understanding, method application, or improved answers.
+Legacy SDK credential-copy and POSIX context access are unavailable on Windows.
+OpenSocrates has no backend, telemetry, separate account, or API-key requirement.
+Ordinary model requests and host conversation storage remain subject to the
+chosen host's authentication, privacy settings, permissions, and service terms.
+The product's no-retention contract does not replace the host's retention policy.
+Host-managed policy
+and hook approvals remain part of the host trust boundary. Installation and
+synthetic fixtures do not establish live hook delivery.
+Release and package SHA-256 inventories detect corruption and enforce complete
+closed payloads. `diagnose` checks the installed package against its manifest.
+Unsigned checksums cannot authenticate bytes against an attacker who can replace
+both the payload and its metadata. Release publication requires exact source
+identity, verified asset transport, and immutable GitHub releases.
+The installer validates managed-path ownership and preserves unrelated files.
+Installation and removal are transactional; a failed activation restores verified
+prior state. If rollback cannot safely restore a backup, it preserves the backup
+and reports its exact recovery path. Purge refuses unknown, changed, linked, or
+in-use payloads. Codex trust is preserved unless the explicit `--reset-trust`
+option requests removal of the seven exact OpenSocrates trust entries through a
+validated transactional configuration update. Conversation history is preserved.
+Retired-host installation state must be reconciled with the installer version
+that owned it; the new profiles do not reinterpret it as Codex or addon state.
+The additive Mac driver verifies exact package inventories and owned markers,
+preserves disabled state, and rejects unknown or modified collisions. Native
+Claude registration uses supported host operations; Antigravity touches only its
+owned rule/skill files. New profiles support exact owned removal, without purge,
+trust reset, or automatic updates. Account export never activates an account
+skill; preserve the old skill and its backup until replacement qualification.
+The optional macOS LaunchAgent uses the verified installer and the selected npm
+channel. It does not read or terminate active Codex sessions. Its owner-only
+receipt contains version, timestamp, host result, and an error category, without
+prompts, transcripts, credentials, workspace paths, or raw errors. Automatic
+updates and automatic major upgrades are opt-in. Windows scheduled updates are
+unavailable; use manual updates.
+Those scheduler controls remain in the existing Codex lane. `--host all` does
+not expand it to the additional profiles. Local archive installation
+requires paired `--asset` and `--checksum`; checksum matching does not create a
+published release or establish live host trust.
+Windows x64 packages use real owner/DACL checks, binary I/O, file locks, and ZIP
+path validation. Signing, notarization, SmartScreen reputation, Windows ARM64,
+and separate clean-machine or GUI behavior are not inferred from package tests.
+See [Windows support](docs/windows-support.md) and the version-specific release
+record for measured evidence.

package/VERSION CHANGED Viewed

	@@ -1 +1 @@
1	- 1.3.1
1	+ 1.5.0