scalix 0.0.1 → 1.1.0

package/dist/safe-math.js

@@ -0,0 +1,194 @@
+const FUNCTIONS = {
+    sqrt: Math.sqrt,
+    abs: Math.abs,
+    sin: Math.sin,
+    cos: Math.cos,
+    tan: Math.tan,
+    log: Math.log,
+    log10: Math.log10,
+    floor: Math.floor,
+    ceil: Math.ceil,
+    round: Math.round,
+    min: Math.min,
+    max: Math.max,
+    pow: Math.pow,
+};
+const CONSTANTS = {
+    pi: Math.PI,
+    e: Math.E,
+};
+function tokenize(expr) {
+    const tokens = [];
+    let i = 0;
+    while (i < expr.length) {
+        if (/\s/.test(expr[i])) {
+            i++;
+            continue;
+        }
+        if (/[0-9.]/.test(expr[i])) {
+            let num = '';
+            while (i < expr.length && /[0-9.]/.test(expr[i])) {
+                num += expr[i++];
+            }
+            if (i < expr.length && (expr[i] === 'e' || expr[i] === 'E')) {
+                num += expr[i++];
+                if (i < expr.length && (expr[i] === '+' || expr[i] === '-')) {
+                    num += expr[i++];
+                }
+                while (i < expr.length && /[0-9]/.test(expr[i])) {
+                    num += expr[i++];
+                }
+            }
+            const value = parseFloat(num);
+            if (isNaN(value))
+                throw new Error(`Invalid number: ${num}`);
+            tokens.push({ type: 'number', value });
+            continue;
+        }
+        if (/[a-zA-Z_]/.test(expr[i])) {
+            let name = '';
+            while (i < expr.length && /[a-zA-Z0-9_]/.test(expr[i])) {
+                name += expr[i++];
+            }
+            const lower = name.toLowerCase();
+            if (lower in CONSTANTS)
+                tokens.push({ type: 'number', value: CONSTANTS[lower] });
+            else if (lower in FUNCTIONS)
+                tokens.push({ type: 'func', value: lower });
+            else
+                throw new Error(`Unknown identifier: ${name}`);
+            continue;
+        }
+        if (expr[i] === '(') {
+            tokens.push({ type: 'lparen' });
+            i++;
+            continue;
+        }
+        if (expr[i] === ')') {
+            tokens.push({ type: 'rparen' });
+            i++;
+            continue;
+        }
+        if (expr[i] === ',') {
+            tokens.push({ type: 'comma' });
+            i++;
+            continue;
+        }
+        if ('+-*/%^'.includes(expr[i])) {
+            tokens.push({ type: 'op', value: expr[i] });
+            i++;
+            continue;
+        }
+        throw new Error(`Unexpected character: ${expr[i]}`);
+    }
+    return tokens;
+}
+class Parser {
+    tokens;
+    pos = 0;
+    constructor(tokens) { this.tokens = tokens; }
+    peek() { return this.tokens[this.pos]; }
+    consume() { return this.tokens[this.pos++]; }
+    parse() {
+        const result = this.expression();
+        if (this.pos < this.tokens.length)
+            throw new Error('Unexpected token after expression');
+        return result;
+    }
+    peekOp() {
+        const t = this.peek();
+        return t?.type === 'op' ? t.value : null;
+    }
+    expression() {
+        let left = this.term();
+        let op = this.peekOp();
+        while (op === '+' || op === '-') {
+            this.consume();
+            const right = this.term();
+            left = op === '+' ? left + right : left - right;
+            op = this.peekOp();
+        }
+        return left;
+    }
+    term() {
+        let left = this.power();
+        let op = this.peekOp();
+        while (op === '*' || op === '/' || op === '%') {
+            this.consume();
+            const right = this.power();
+            if (op === '*')
+                left *= right;
+            else if (op === '/') {
+                if (right === 0)
+                    throw new Error('Division by zero');
+                left /= right;
+            }
+            else
+                left %= right;
+            op = this.peekOp();
+        }
+        return left;
+    }
+    power() {
+        let base = this.unary();
+        if (this.peekOp() === '^') {
+            this.consume();
+            base = Math.pow(base, this.power());
+        }
+        return base;
+    }
+    unary() {
+        const op = this.peekOp();
+        if (op === '+' || op === '-') {
+            this.consume();
+            const val = this.unary();
+            return op === '-' ? -val : val;
+        }
+        return this.primary();
+    }
+    primary() {
+        const tok = this.peek();
+        if (!tok)
+            throw new Error('Unexpected end of expression');
+        if (tok.type === 'number') {
+            this.consume();
+            return tok.value;
+        }
+        if (tok.type === 'func') {
+            const name = tok.value;
+            this.consume();
+            if (this.peek()?.type !== 'lparen')
+                throw new Error(`Expected ( after ${name}`);
+            this.consume();
+            const args = [];
+            if (this.peek()?.type !== 'rparen') {
+                args.push(this.expression());
+                while (this.peek()?.type === 'comma') {
+                    this.consume();
+                    args.push(this.expression());
+                }
+            }
+            if (this.peek()?.type !== 'rparen')
+                throw new Error(`Expected ) after ${name} arguments`);
+            this.consume();
+            return FUNCTIONS[name](...args);
+        }
+        if (tok.type === 'lparen') {
+            this.consume();
+            const val = this.expression();
+            if (this.peek()?.type !== 'rparen')
+                throw new Error('Expected closing )');
+            this.consume();
+            return val;
+        }
+        throw new Error(`Unexpected token: ${JSON.stringify(tok)}`);
+    }
+}
+export function safeEvaluate(expression) {
+    if (expression.length > 10_000)
+        throw new Error('Expression too long (max 10000 chars)');
+    const tokens = tokenize(expression);
+    if (tokens.length === 0)
+        throw new Error('Empty expression');
+    return new Parser(tokens).parse();
+}

package/dist/sandbox.js

@@ -0,0 +1,403 @@
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import { execSync } from 'node:child_process';
+import { TOOL_DEFAULTS, UNIX_SHELL_FALLBACK } from './constants.js';
+let _sandboxRoot = null;
+const IS_WINDOWS = process.platform === 'win32';
+export function setSandboxRoot(root) {
+    _sandboxRoot = path.resolve(root);
+}
+function getSandboxRoot() {
+    return _sandboxRoot || process.cwd();
+}
+function normalizeSep(p) {
+    return process.platform === 'win32' ? p.replace(/\//g, '\\') : p;
+}
+function isWithinRoot(p, root) {
+    const np = normalizeSep(p).toLowerCase();
+    const nr = normalizeSep(root).toLowerCase();
+    return np === nr || np.startsWith(nr + path.sep);
+}
+export function sandboxPath(filePath) {
+    const root = getSandboxRoot();
+    const resolved = path.resolve(root, filePath);
+    if (!isWithinRoot(resolved, root)) {
+        throw new Error(`Path traversal blocked: "${filePath}" resolves outside working directory`);
+    }
+    return resolved;
+}
+export async function sandboxPathAsync(filePath) {
+    const root = getSandboxRoot();
+    const resolved = path.resolve(root, filePath);
+    if (!isWithinRoot(resolved, root)) {
+        throw new Error(`Path traversal blocked: "${filePath}" resolves outside working directory`);
+    }
+    try {
+        const real = await fs.realpath(resolved);
+        if (!isWithinRoot(real, root)) {
+            throw new Error(`Symlink traversal blocked: "${filePath}" resolves to "${real}" outside working directory`);
+        }
+        return real;
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return resolved;
+        throw err;
+    }
+}
+// ─── Security Configuration ───
+let _securityConfig = {};
+export function setSecurityConfig(config) {
+    _securityConfig = config;
+    _effectiveToolSets = null; // invalidate cache
+}
+export function getSecurityConfig() {
+    return _securityConfig;
+}
+// ─── Tool Classification (configurable) ───
+const DEFAULT_READ_ONLY_TOOLS = new Set([
+    'get_current_time',
+    'calculate',
+    'read_file',
+    'read_file_lines',
+    'list_files',
+    'search_files',
+    'find_files',
+    'tree',
+    'git_status',
+    'git_diff',
+    'web_search',
+    'monitor',
+]);
+const DEFAULT_WRITE_TOOLS = new Set([
+    'write_file',
+    'edit_file',
+    'web_fetch',
+    'todo_write',
+    'notebook_edit',
+    'send_message',
+    'task_create',
+    'task_claim',
+    'task_update',
+    'task_list',
+]);
+const DEFAULT_DANGEROUS_TOOLS = new Set([
+    'run_command',
+    'git_commit',
+    'add_mcp_server',
+    'agent',
+]);
+let _effectiveToolSets = null;
+function getEffectiveToolSets() {
+    if (_effectiveToolSets)
+        return _effectiveToolSets;
+    const readOnly = new Set(DEFAULT_READ_ONLY_TOOLS);
+    const write = new Set(DEFAULT_WRITE_TOOLS);
+    const dangerous = new Set(DEFAULT_DANGEROUS_TOOLS);
+    if (_securityConfig.additionalReadOnlyTools) {
+        for (const t of _securityConfig.additionalReadOnlyTools)
+            readOnly.add(t);
+    }
+    if (_securityConfig.additionalWriteTools) {
+        for (const t of _securityConfig.additionalWriteTools)
+            write.add(t);
+    }
+    if (_securityConfig.additionalDangerousTools) {
+        for (const t of _securityConfig.additionalDangerousTools)
+            dangerous.add(t);
+    }
+    if (_securityConfig.toolOverrides) {
+        for (const [tool, level] of Object.entries(_securityConfig.toolOverrides)) {
+            readOnly.delete(tool);
+            write.delete(tool);
+            dangerous.delete(tool);
+            if (level === 'read-only')
+                readOnly.add(tool);
+            else if (level === 'write')
+                write.add(tool);
+            else if (level === 'dangerous')
+                dangerous.add(tool);
+        }
+    }
+    _effectiveToolSets = { readOnly, write, dangerous };
+    return _effectiveToolSets;
+}
+// Keep backward-compatible exports
+const READ_ONLY_TOOLS = DEFAULT_READ_ONLY_TOOLS;
+const WRITE_TOOLS = DEFAULT_WRITE_TOOLS;
+const DANGEROUS_TOOLS = DEFAULT_DANGEROUS_TOOLS;
+export function getToolPermission(toolName, mode) {
+    const sets = getEffectiveToolSets();
+    switch (mode) {
+        case 'plan':
+            return sets.readOnly.has(toolName) ? 'allow' : 'block';
+        case 'default':
+            if (sets.readOnly.has(toolName))
+                return 'allow';
+            return 'ask';
+        case 'auto':
+            if (sets.readOnly.has(toolName))
+                return 'allow';
+            if (sets.write.has(toolName))
+                return 'allow';
+            return 'ask';
+        case 'yolo':
+            return 'allow';
+        default:
+            return 'ask';
+    }
+}
+export function isDangerousTool(toolName) {
+    const sets = getEffectiveToolSets();
+    return sets.dangerous.has(toolName) || sets.write.has(toolName);
+}
+export function getModeDescription(mode) {
+    switch (mode) {
+        case 'plan':
+            return 'Read-only. Allowed: read, search, list, git status/diff. Blocked: writes, commands, git commit.';
+        case 'default':
+            return 'Ask before writes & commands. Auto-approve: reads, search. Confirm: edit, write, run_command, git commit.';
+        case 'auto':
+            return 'Auto-approve reads & writes. Confirm only: run_command, git_commit, agent, add_mcp_server.';
+        case 'yolo':
+            return 'Full autonomy. All tools execute without confirmation. Sandbox safety checks still apply.';
+    }
+}
+export const PERMISSION_MODES = ['plan', 'default', 'auto', 'yolo'];
+let cachedShell = null;
+function detectShellFromEnv() {
+    if (process.env.SCALIX_SHELL)
+        return process.env.SCALIX_SHELL;
+    if (process.env.SHELL)
+        return process.env.SHELL;
+    if (IS_WINDOWS && process.env.COMSPEC)
+        return process.env.COMSPEC;
+    return null;
+}
+function classifyShell(shellPath) {
+    const name = path.basename(shellPath).toLowerCase().replace(/\.exe$/i, '');
+    if (name === 'bash')
+        return 'bash';
+    if (name === 'zsh')
+        return 'zsh';
+    if (name === 'fish')
+        return 'fish';
+    if (name === 'pwsh' || name === 'powershell')
+        return 'pwsh';
+    if (name === 'cmd')
+        return 'cmd';
+    return 'sh';
+}
+export function getShellInfo() {
+    if (cachedShell)
+        return cachedShell;
+    const envShell = detectShellFromEnv();
+    if (envShell) {
+        const shellType = classifyShell(envShell);
+        cachedShell = {
+            type: shellType,
+            path: envShell,
+            args: shellType === 'cmd' ? ['/d', '/s', '/c'] : ['-c'],
+        };
+        return cachedShell;
+    }
+    if (IS_WINDOWS) {
+        // Prefer PowerShell if available
+        try {
+            execSync('pwsh --version', { stdio: 'ignore', timeout: TOOL_DEFAULTS.shellDetectionTimeoutMs });
+            cachedShell = { type: 'pwsh', path: 'pwsh', args: ['-NoProfile', '-NonInteractive', '-Command'] };
+            return cachedShell;
+        }
+        catch { }
+        try {
+            execSync('powershell -Command "exit 0"', { stdio: 'ignore', timeout: TOOL_DEFAULTS.shellDetectionTimeoutMs });
+            cachedShell = { type: 'pwsh', path: 'powershell', args: ['-NoProfile', '-NonInteractive', '-Command'] };
+            return cachedShell;
+        }
+        catch { }
+        cachedShell = { type: 'cmd', path: process.env.COMSPEC || 'cmd.exe', args: ['/d', '/s', '/c'] };
+        return cachedShell;
+    }
+    // Unix fallback
+    cachedShell = { type: 'sh', path: UNIX_SHELL_FALLBACK, args: ['-c'] };
+    return cachedShell;
+}
+export function isPowerShell() {
+    const shell = getShellInfo();
+    return shell.type === 'pwsh';
+}
+export function isCmd() {
+    const shell = getShellInfo();
+    return shell.type === 'cmd';
+}
+// ─── Command Security ───
+// Unix command blocklist
+const UNIX_BLOCKLIST = [
+    /\brm\s+-rf\s+\//,
+    /\bmkfs\b/,
+    /\bdd\s+if=/,
+    />(\/dev\/[a-z])/,
+    /\bshutdown\b/,
+    /\breboot\b/,
+    /\bcurl\b.*\|\s*(ba)?sh/,
+    /\bwget\b.*\|\s*(ba)?sh/,
+];
+// Windows/PowerShell command blocklist
+const WINDOWS_BLOCKLIST = [
+    /\bdel\s+\/[sf]/i,
+    /\brd\s+\/s/i,
+    /\brmdir\s+\/s/i,
+    /\bformat\s+[a-z]:/i,
+    /\bdiskpart\b/i,
+    /\bnet\s+user\b/i,
+    /\bnet\s+localgroup\s+administrators/i,
+    /\breg\s+delete\b/i,
+    /\bsc\s+(delete|stop)\b/i,
+    /\bbcdedit\b/i,
+    /\bsfc\s+\/scannow/i,
+];
+// PowerShell-specific blocklist
+const POWERSHELL_BLOCKLIST = [
+    /Remove-Item\s+.*-Recurse\s+.*-Force/i,
+    /Remove-Item\s+.*[/\\]\s*\*/i,
+    /Format-Volume\b/i,
+    /Clear-Disk\b/i,
+    /Stop-Service\b.*-Force/i,
+    /Set-ExecutionPolicy\s+Unrestricted/i,
+    /Invoke-WebRequest\b.*\|\s*Invoke-Expression/i,
+    /iwr\b.*\|\s*iex\b/i,
+    /Invoke-Expression\b/i,
+    /\biex\s+/i,
+    /New-LocalUser\b/i,
+    /Add-LocalGroupMember\b.*Administrators/i,
+];
+const COMMAND_BLOCKLIST = [
+    ...UNIX_BLOCKLIST,
+    ...WINDOWS_BLOCKLIST,
+    ...POWERSHELL_BLOCKLIST,
+];
+// Unix injection patterns
+const UNIX_INJECTION_PATTERNS = [
+    /`[^`]*`/,
+    /\$\([^)]*\)/,
+    /;\s*(rm|mkfs|dd|shutdown|reboot|curl|wget)\b/,
+    /\|\s*(ba)?sh\b/,
+    /\beval\s+/,
+    />\s*\/etc\//,
+    /\bchmod\s+[0-7]*7[0-7]*\s/,
+    /\bchown\s+root\b/,
+    /\bnc\s+-[elp]/,
+    /\bpython[23]?\s+-c\b.*__(import|exec|eval)/,
+];
+// Windows/PowerShell injection patterns
+const WINDOWS_INJECTION_PATTERNS = [
+    /&\s*\{[^}]*\}/,
+    /\$\([^)]*\)/,
+    /;\s*(del|rd|rmdir|format|diskpart|net\s+user|reg\s+delete)\b/i,
+    /\|\s*powershell\b/i,
+    /\|\s*pwsh\b/i,
+    /\|\s*cmd\b/i,
+    /\bStart-Process\b.*-Verb\s+RunAs/i,
+    /-EncodedCommand\b/i,
+    /-e\s+[A-Za-z0-9+/=]{20,}/i,
+    /\[System\.Reflection\.Assembly\]::Load/i,
+    /\[Net\.WebClient\].*DownloadString/i,
+    /\bAdd-Type\b.*-TypeDefinition/i,
+];
+const INJECTION_PATTERNS = [
+    ...UNIX_INJECTION_PATTERNS,
+    ...WINDOWS_INJECTION_PATTERNS,
+];
+const SENSITIVE_ENV_PATTERNS = [
+    /API_KEY/i, /SECRET/i, /TOKEN/i, /PASSWORD/i, /CREDENTIAL/i, /AUTH/i, /PRIVATE/i,
+];
+function getEffectiveBlocklist() {
+    const disabled = new Set(_securityConfig.disabledBlockedCommands || []);
+    const base = disabled.size > 0
+        ? COMMAND_BLOCKLIST.filter(re => !disabled.has(re.source))
+        : COMMAND_BLOCKLIST;
+    const additional = (_securityConfig.additionalBlockedCommands || []).map(p => {
+        try {
+            return new RegExp(p);
+        }
+        catch {
+            return null;
+        }
+    }).filter((r) => r !== null);
+    return [...base, ...additional];
+}
+function getEffectiveInjectionPatterns() {
+    const disabled = new Set(_securityConfig.disabledInjectionPatterns || []);
+    const base = disabled.size > 0
+        ? INJECTION_PATTERNS.filter(re => !disabled.has(re.source))
+        : INJECTION_PATTERNS;
+    const additional = (_securityConfig.additionalInjectionPatterns || []).map(p => {
+        try {
+            return new RegExp(p);
+        }
+        catch {
+            return null;
+        }
+    }).filter((r) => r !== null);
+    return [...base, ...additional];
+}
+function getEffectiveEnvPatterns() {
+    const additional = (_securityConfig.additionalSensitiveEnvPatterns || []).map(p => {
+        try {
+            return new RegExp(p);
+        }
+        catch {
+            return null;
+        }
+    }).filter((r) => r !== null);
+    const allowedPatterns = (_securityConfig.allowedEnvPatterns || []).map(p => {
+        try {
+            return new RegExp(p);
+        }
+        catch {
+            return null;
+        }
+    }).filter((r) => r !== null);
+    return {
+        sensitive: [...SENSITIVE_ENV_PATTERNS, ...additional],
+        allowed: new Set(), // will check against allowedPatterns dynamically
+    };
+}
+export function isBlockedCommand(command) {
+    return getEffectiveBlocklist().some((re) => re.test(command));
+}
+export function detectInjection(command) {
+    for (const pattern of getEffectiveInjectionPatterns()) {
+        if (pattern.test(command)) {
+            return `Suspicious pattern detected: ${pattern.source}`;
+        }
+    }
+    return null;
+}
+export function sanitizeEnvForCommand() {
+    const { sensitive } = getEffectiveEnvPatterns();
+    const allowedPatterns = (_securityConfig.allowedEnvPatterns || []).map(p => {
+        try {
+            return new RegExp(p);
+        }
+        catch {
+            return null;
+        }
+    }).filter((r) => r !== null);
+    const clean = {};
+    for (const [key, val] of Object.entries(process.env)) {
+        if (val === undefined)
+            continue;
+        if (sensitive.some((p) => p.test(key))) {
+            if (allowedPatterns.length > 0 && allowedPatterns.some(p => p.test(key))) {
+                clean[key] = val;
+            }
+            continue;
+        }
+        clean[key] = val;
+    }
+    return clean;
+}
+export function getMaxImageSize() {
+    return _securityConfig.maxImageSize ?? 20 * 1024 * 1024;
+}

package/dist/scoped-rules.js

@@ -0,0 +1,82 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { logger } from './logger.js';
+import { PROJECT_LOOKUP_DIRS } from './constants.js';
+const RULE_DIRS = PROJECT_LOOKUP_DIRS.map(d => `${d}/rules`);
+const RULE_EXTENSIONS = ['.md', '.txt'];
+export async function loadScopedRules(cwd) {
+    const rules = [];
+    for (const dir of RULE_DIRS) {
+        const fullDir = path.resolve(cwd, dir);
+        let entries;
+        try {
+            entries = await fs.readdir(fullDir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            if (!RULE_EXTENSIONS.some((ext) => entry.name.endsWith(ext)))
+                continue;
+            const filePath = path.join(fullDir, entry.name);
+            try {
+                const raw = await fs.readFile(filePath, 'utf-8');
+                const { pattern, body } = parseRuleFrontmatter(raw);
+                rules.push({
+                    pattern: pattern || '*',
+                    content: body.trim(),
+                    source: filePath,
+                });
+            }
+            catch (err) {
+                logger.warn('Failed to load scoped rule', { file: filePath, error: err.message });
+            }
+        }
+    }
+    return rules;
+}
+function parseRuleFrontmatter(content) {
+    const normalized = content.replace(/\r\n/g, '\n');
+    const match = normalized.match(/^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/);
+    if (!match)
+        return { pattern: '*', body: normalized };
+    let pattern = '*';
+    for (const line of match[1].split('\n')) {
+        const idx = line.indexOf(':');
+        if (idx > 0) {
+            const key = line.slice(0, idx).trim();
+            const val = line.slice(idx + 1).trim();
+            if (key === 'pattern' || key === 'glob' || key === 'match')
+                pattern = val;
+        }
+    }
+    return { pattern, body: match[2] };
+}
+export function matchRulesForFile(rules, filePath) {
+    return rules.filter((rule) => {
+        if (rule.pattern === '*')
+            return true;
+        const normalized = filePath.replace(/\\/g, '/');
+        const pattern = rule.pattern.replace(/\\/g, '/');
+        if (pattern.startsWith('*')) {
+            return normalized.endsWith(pattern.slice(1));
+        }
+        if (pattern.endsWith('*')) {
+            return normalized.startsWith(pattern.slice(0, -1));
+        }
+        return normalized === pattern || normalized.endsWith('/' + pattern);
+    });
+}
+export function rulesToContext(rules) {
+    if (rules.length === 0)
+        return '';
+    const lines = ['## Project Rules'];
+    for (const rule of rules) {
+        if (rule.pattern !== '*')
+            lines.push(`### Rules for ${rule.pattern}`);
+        lines.push(rule.content);
+    }
+    return lines.join('\n\n');
+}