session-orchestrator 5.2.0 → 5.4.0

package/hooks/pre-bash-destructive-guard.mjs

@@ -29,6 +29,12 @@
  *          generic pattern path — its `pattern: ">"` would FP-match nearly
  *          every redirect. Unresolved targets (variable/substitution) warn
  *          on stderr (fail-visible) and never block.
+ *        rule.type === 'path-delete' (#1401): decided by the DELETE/RENAME
+ *          operand via firstDeniedDeleteTarget (same target-denylist globs,
+ *          same compiler), likewise shadowing the generic pattern path. The
+ *          redirect class answers "what does this command WRITE"; nothing
+ *          answered "what does it REMOVE", so `rm -f <ledger>` was allowed
+ *          while `> <ledger>` was denied — 53,896 lines of telemetry lost.
  *   G6 no match → exit 0
  *
  * Telemetry (Epic #803 process-safety dimension): best-effort
@@ -46,8 +52,7 @@ import crypto from 'node:crypto';
 import { pathToFileURL } from 'node:url';
 
 import { shouldRunHook } from './_lib/profile-gate.mjs';
-// #211: exit 0 immediately (silent allow) when this hook is disabled via profile/env
-if (!shouldRunHook('pre-bash-destructive-guard')) process.exit(0);
+import { isMainModule } from '../scripts/lib/is-main-module.mjs';
 
 // ---------------------------------------------------------------------------
 // #992 — late-bound repo dependencies
@@ -179,6 +184,8 @@ async function bootstrap() {
           'redirectSpanEnd',
           'resolveSegmentVerb',
           'splitChainSegments',
+          'extractDeleteTargets',
+          'firstDeniedDeleteTarget',
         ],
       },
     },
@@ -877,6 +884,61 @@ async function main() {
       continue; // unreachable (blockCommand never returns) — kept for clarity
     }
 
+    // #1401 — path-delete rules are decided by the DELETE/RENAME operand via
+    // firstDeniedDeleteTarget, never by the generic pattern path below (same
+    // full-shadow contract as redirect-truncate above: this rule's `pattern` is
+    // a human-readable label, and routing it through commandMatchesBlocked
+    // would match either nothing or every `rm`).
+    //
+    // Why a second surface at all: the redirect rule answers "what does this
+    // command WRITE". Nothing answered "what does it REMOVE" — so `rm -f
+    // .orchestrator/metrics/events.jsonl.1` was ALLOWED while `> ` on the same
+    // file was DENIED (measured 2026-09-19, #1401: 53,896 ledger lines lost).
+    if (rule.type === 'path-delete') {
+      const collected = blocker.extractDeleteTargets(command);
+      const cutOff = collected.filter(
+        (e) => e.unresolved && (e.reason === 'budget-exhausted' || e.reason === 'depth-exceeded')
+      );
+      if (cutOff.length > 0) {
+        // A recursion cap that drops payloads silently is a bypass, not a cap
+        // (#988 T2) — surface it on the VISIBLE channel (#995).
+        //
+        // Deliberately NARROWER than the redirect branch above, which also
+        // surfaces `variable/substitution` operands: `rm -rf "$WORK"` is the
+        // ORDINARY spelling of a temp cleanup, so notifying on it would fire on
+        // a large share of benign commands and train the operator to ignore the
+        // channel (host-resources.md § HR-101 — a signal may only warn if it is
+        // rare). A cut-off marker, by contrast, needs 32+ payload segments or
+        // 3 levels of nesting: pathological by construction. Unresolved
+        // operands stay fail-visible on stderr below; neither class ever blocks.
+        const reasons = [...new Set(cutOff.map((e) => e.reason))].join(', ');
+        const msg = `pre-bash-destructive-guard: delete-target traversal cut off (${reasons}) — not matched (fail-visible)`;
+        process.stderr.write(`⚠ ${msg}\n`);
+        notices.push(msg);
+      }
+      const unresolvedOperands = collected.filter(
+        (e) => e.unresolved && e.reason === 'variable/substitution'
+      );
+      if (unresolvedOperands.length > 0) {
+        process.stderr.write(
+          `ℹ pre-bash-destructive-guard: ${unresolvedOperands.length} delete target(s) carry a variable/substitution — not matched (rule: ${id})\n`
+        );
+      }
+      const hit = blocker.firstDeniedDeleteTarget(rule, collected, { repoRoot: projectDir });
+      if (!hit) continue;
+      if (severity !== 'block') {
+        const msg = `pre-bash-destructive-guard: protected delete target matched (rule: ${id}) — ${rationale}`;
+        process.stderr.write(`⚠ ${msg}\n`);
+        notices.push(msg);
+        continue;
+      }
+      // Reason stays short (stdout-budget): verb + target, never the command.
+      // The policy `rationale` is long by design (it carries the measurement
+      // trail); blockCommand puts only its first line in the systemMessage.
+      await blockCommand(`${hit.verb} ${hit.target}`, id, rationale, command, sessionId);
+      continue; // unreachable (blockCommand never returns) — kept for clarity
+    }
+
     // The rm-rf-destructive rule also fires for recursive+force rm flag variants
     // the literal "rm -rf" pattern misses (`rm -r -f`, `rm -fr`) — #641 gap closure.
     const matched = id === 'rm-rf-destructive'
@@ -984,10 +1046,19 @@ try {
   process.exit(0); // fail-open, but no longer fail-silent
 }
 
-// Top-level error handler — never let exit 1 leak
-main().catch((e) => {
-  process.stderr.write(
-    `⚠ pre-bash-destructive-guard: internal error — ${e?.message || e}\n`
-  );
-  process.exit(0); // fail-open on internal errors to avoid blocking legitimate work
-});
+// Entry guard (#1393): run only as the node script the harness execs — a bare
+// `import()` must run no handler and must not exit the importing process.
+// Placed strictly AFTER all decision logic: it gates whether main() is invoked,
+// never what main() decides, so no deny path can be short-circuited by it.
+if (isMainModule(import.meta.url)) {
+  // #211: exit 0 immediately (silent allow) when this hook is disabled via profile/env
+  if (!shouldRunHook('pre-bash-destructive-guard')) process.exit(0);
+
+  // Top-level error handler — never let exit 1 leak
+  main().catch((e) => {
+    process.stderr.write(
+      `⚠ pre-bash-destructive-guard: internal error — ${e?.message || e}\n`
+    );
+    process.exit(0); // fail-open on internal errors to avoid blocking legitimate work
+  });
+}

package/hooks/pre-bash-issue-budget.mjs

@@ -67,13 +67,10 @@ import {
 } from '../scripts/lib/issue-budget.mjs';
 
 import { shouldRunHook } from './_lib/profile-gate.mjs';
+import { isMainModule } from '../scripts/lib/is-main-module.mjs';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 
-// Opt-out per session via SO_DISABLED_HOOKS=pre-bash-issue-budget; the
-// "minimal"/"off" profiles disable it like every other non-core hook.
-if (!shouldRunHook('pre-bash-issue-budget')) process.exit(0);
-
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -500,10 +497,18 @@ async function main() {
   return emitAllow();
 }
 
-// Top-level error handler — fail open, same posture as the sibling hooks.
-main().catch((e) => {
-  process.stderr.write(
-    `⚠ pre-bash-issue-budget: internal error — ${e?.message || e}\n`,
-  );
-  process.exit(0);
-});
+// Entry guard (#1393): run only as the node script the harness execs — a bare
+// `import()` must run no handler and must not exit the importing process.
+if (isMainModule(import.meta.url)) {
+  // Opt-out per session via SO_DISABLED_HOOKS=pre-bash-issue-budget; the
+  // "minimal"/"off" profiles disable it like every other non-core hook.
+  if (!shouldRunHook('pre-bash-issue-budget')) process.exit(0);
+
+  // Top-level error handler — fail open, same posture as the sibling hooks.
+  main().catch((e) => {
+    process.stderr.write(
+      `⚠ pre-bash-issue-budget: internal error — ${e?.message || e}\n`,
+    );
+    process.exit(0);
+  });
+}

package/hooks/pre-bash-memory-propose-audit.mjs

@@ -13,7 +13,8 @@
  *   G3 — regex match /\bnode\b.*\bmemory-propose\.mjs\b/i (no match → exit 0)
  *   G4 — resolve session_id (from stdin payload or .orchestrator/current-session.json)
  *   G5 — resolve wave (from the active wave-scope.json `wave` field, default 0)
- *   G6 — redact argv: strip --insight/--subject/--evidence/--content/--reason values
+ *   G6 — derive a NON-REVERSIBLE argv summary: sha256 command_hash + known flag
+ *        NAMES + raw length. The command text itself never leaves this process.
  *   G7 — append event JSON line to .orchestrator/metrics/events.jsonl
  *   Always: exit 0 (never block)
  *
@@ -22,15 +23,16 @@
  */
 
 import { readStdin, emitAllow } from '../scripts/lib/io.mjs';
-import { existsSync } from 'node:fs';
+import crypto from 'node:crypto';
+import { existsSync, realpathSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
+import os from 'node:os';
 import path from 'node:path';
 import { emitEvent } from '../scripts/lib/events.mjs';
 import { findScopeFile } from '../scripts/lib/hardening.mjs';
 
 import { shouldRunHook } from './_lib/profile-gate.mjs';
-// exit 0 immediately when this hook is disabled via profile/env
-if (!shouldRunHook('pre-bash-memory-propose-audit')) process.exit(0);
+import { isMainModule } from '../scripts/lib/is-main-module.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -48,59 +50,126 @@ if (!shouldRunHook('pre-bash-memory-propose-audit')) process.exit(0);
 const MEMORY_PROPOSE_REGEX = /\bnode\b.*\bmemory-propose\.mjs\b/i;
 
 /**
- * Flags whose VALUES are privacy-sensitive and must be redacted from the log.
- * The flag name itself is preserved; only the value is replaced with [REDACTED].
+ * The flag NAMES `scripts/memory-propose.mjs` accepts (its `parseArgs` options
+ * block, plus `--help`). CLOSED LIST BY DESIGN: `flags_present` is built by
+ * intersecting the command with this constant, never by scraping `--\S+` tokens
+ * out of the command. A scrape would re-open the leak this file just closed —
+ * `--insight --my-secret-value` would publish the value as if it were a flag.
  *
- * Matches both forms:
- *   --insight=value            → --insight=[REDACTED]
- *   --insight "quoted value"   → --insight [REDACTED]
- *   --insight unquoted         → --insight [REDACTED]
+ * A flag the CLI does not know is simply not reported. That is the correct
+ * trade: the field exists to say WHICH of the audited CLI's switches were used,
+ * not to mirror the command line.
  */
-// CAVEAT (#554 A3, low severity): The regex operates on the unparsed Bash
-// tool_input.command string. Exotic shell forms bypass redaction by hiding
-// the value behind shell expansion the regex cannot see:
-//   --insight=$VAR           (env-var indirection)
-//   --insight=$(cat secret)  (command substitution)
-//   --insight <<<heredoc     (here-string)
-// The literal token (e.g. `$VAR`) is logged, NOT the resolved value — so an
-// audit-trail leak requires the resolved value to also appear literally
-// elsewhere in the command. Acceptable per the project's local-trust model.
-//
-// Issue #546: `\S+` would match an opening quote `"` or `'` (non-whitespace),
-// and on malformed inputs (e.g. unbalanced or shell-already-unescaped values)
-// could partial-match the value, leaving the tail unredacted. The negative
-// lookahead `(?!["'])` forces `\S+` to be tried only on values that do not
-// start with a quote, preserving the quoted-alt as the sole path for quoted
-// values and preventing tail-leaks on malformed inputs.
-const SENSITIVE_FLAGS_REGEX = /--(?:insight|subject|evidence|content|reason)(?:=("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|(?!["'])\S+)|\s+("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|(?!["'])\S+))/g;
+const KNOWN_FLAGS = Object.freeze([
+  'type',
+  'subject',
+  'insight',
+  'evidence',
+  'confidence',
+  'dry-run',
+  'file-paths',
+  'help',
+]);
 
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 
 /**
- * Redact values of privacy-sensitive flags from a command string.
- * Preserves flag names; replaces values with [REDACTED].
+ * sha256(command), truncated to 16 hex characters.
+ *
+ * WORD-FOR-WORD the `hashCommand()` of `hooks/enforce-commands.mjs:69` (itself
+ * taken from `hooks/pre-bash-destructive-guard.mjs:253`, which mirrors
+ * `loop-guard.mjs` `hashArgs()`). Deliberately duplicated rather than shared:
+ * a PreToolUse hook must not gain another loadable module that can fail at
+ * start — three lines are cheaper than a load error on the hot path. Verified
+ * before duplicating that no helper is EXPORTED at any of those sites.
+ *
+ * WHY THE HASH IS HERE (#1415, 2026-09-21): until today this hook wrote a
+ * merely flag-redacted `argv_truncated` (512 chars of command text) into
+ * `orchestrator.memory.propose_invoked` — an `events.jsonl` line (gitignored
+ * here via `.gitignore:57`; consumer repos may track it) and,
+ * with the webhook configured, a network payload. Redaction covered only the
+ * five `--insight/--subject/--evidence/--content/--reason` values and said so
+ * in its own caveat: `$VAR`, `$(cat secret)` and any value written elsewhere
+ * on the line passed through. This was the THIRD and last open site of the
+ * class closed by `8f15f77b` (enforce-commands) and #1404 (staging-fence).
+ *
+ * The hash keeps the event COUNTABLE and GROUPABLE — repeat invocations of the
+ * same command still collapse to one key — which is the only property any
+ * consumer needed. Measured 2026-09-21 (`rg argv_truncated` over `scripts/
+ * hooks/ skills/ docs/`): ZERO production readers, the field's only consumers
+ * were this hook's own tests.
  *
  * @param {string} command
  * @returns {string}
  */
-function redactArgv(command) {
-  return command.replace(SENSITIVE_FLAGS_REGEX, (match, eqValue, spaceValue) => {
-    if (eqValue !== undefined) {
-      // --insight=value form: preserve up to and including '=', replace value
-      const eqIndex = match.indexOf('=');
-      return match.slice(0, eqIndex + 1) + '[REDACTED]';
-    }
-    if (spaceValue !== undefined) {
-      // --insight value form: preserve flag + whitespace, replace value
-      const valueIndex = match.lastIndexOf(spaceValue);
-      return match.slice(0, valueIndex) + '[REDACTED]';
-    }
-    // Fallback: keep flag name, drop value
-    const flagMatch = match.match(/^(--[\w-]+)/);
-    return flagMatch ? flagMatch[1] + ' [REDACTED]' : match;
-  });
+function hashCommand(command) {
+  return crypto.createHash('sha256').update(command).digest('hex').slice(0, 16);
+}
+
+/**
+ * The subset of KNOWN_FLAGS that appears in the command, in KNOWN_FLAGS order.
+ *
+ * Names only — a value can never reach this array, because the array is built
+ * from the constant above and the command is only ever TESTED against it. Both
+ * spellings count (`--insight=x` and `--insight x`); the trailing boundary
+ * `(?![\w-])` keeps `--insightful` from reporting `insight`.
+ *
+ * @param {string} command
+ * @returns {string[]}
+ */
+function flagsPresent(command) {
+  return KNOWN_FLAGS.filter((flag) =>
+    new RegExp(`--${flag}(?![\\w-])`).test(command),
+  );
+}
+
+/**
+ * The working directory as a value that carries no absolute host path (#1439).
+ *
+ * Relative to `projectDir` (`.` when equal); a directory OUTSIDE the project is
+ * written as `sha256:<12 hex>` of its resolved path instead — still groupable,
+ * never the path itself. Until 2026-09-25 this was `process.cwd()` verbatim,
+ * i.e. `/Users/<name>/…` in an events.jsonl line (gitignored here via
+ * `.gitignore:57`; consumer repos may track it) and, with the webhook
+ * configured, in a network payload. No production reader consumes `cwd`.
+ *
+ * Both sides are realpath-resolved before comparing: on macOS the tmp dir is
+ * `/var/…` while `process.cwd()` reports `/private/var/…`, and a naive
+ * `path.relative` then calls the project dir itself `../../../private/var/…`.
+ * A path that cannot be resolved falls back to `path.resolve` — never throws.
+ *
+ * A project dir that is no project boundary — the filesystem root, the home
+ * dir, or an ancestor of it (`/Users`) — also gets the hash form: relative to
+ * `/` the cwd reads `Users/<name>/…`, i.e. the username in a webhook-bound
+ * event, the very leak the relative form exists to prevent. The ancestor test
+ * is path-segment-wise (`path.relative`), so `/Users/al` is NOT an ancestor of
+ * `/Users/alice` the way a string prefix would claim.
+ *
+ * @param {string} cwd
+ * @param {string} projectDir
+ * @returns {string}
+ */
+function relativeCwd(cwd, projectDir) {
+  const real = (p) => {
+    try { return realpathSync(p); } catch { return path.resolve(p); }
+  };
+  // `..`-prefixed (above the base) or absolute (another Windows drive).
+  const escapes = (rel) =>
+    rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
+  const realCwd = real(cwd);
+  const realProject = real(projectDir);
+  const rel = path.relative(realProject, realCwd);
+  if (rel === '') return '.';
+  // Same sha256 recipe as `command_hash`, cut to 12 hex.
+  const hashed = `sha256:${hashCommand(realCwd).slice(0, 12)}`;
+  if (escapes(rel)) return hashed;
+  if (path.dirname(realProject) === realProject) return hashed; // filesystem root
+  let home = null;
+  try { home = real(os.homedir()); } catch { /* no home dir: root check above still holds */ }
+  if (home !== null && !escapes(path.relative(realProject, home))) return hashed;
+  return rel;
 }
 
 /**
@@ -180,8 +249,11 @@ async function main() {
   // G5 — resolve wave
   const wave = await resolveWave(projectDir);
 
-  // G6 — redact argv: strip sensitive flag values, keep flag names
-  const argvRedacted = redactArgv(command);
+  // G6 — derive the non-reversible argv summary (#1415). Nothing downstream
+  // ever sees the command text: hash for grouping, known flag NAMES for
+  // shape, raw length for size — no operands, no paths, no values.
+  const commandHash = hashCommand(command);
+  const flags = flagsPresent(command);
 
   // G7 — emit canonical event via emitEvent (single emission path: schema + webhook,
   // replacing the local hand-rolled appendFileSync bypass).
@@ -193,8 +265,10 @@ async function main() {
     await emitEvent('orchestrator.memory.propose_invoked', {
       session_id: sessionId,
       wave,
-      argv_truncated: argvRedacted.slice(0, 512),
-      cwd: process.cwd(),
+      command_hash: commandHash,
+      flags_present: flags,
+      argv_length: command.length,
+      cwd: relativeCwd(process.cwd(), projectDir),
       exit_code: null,
     });
   } catch { /* telemetry never blocks the hook (#1183) */ }
@@ -203,10 +277,17 @@ async function main() {
   return emitAllow();
 }
 
-// Top-level error handler — never let exit 1 leak
-main().catch((e) => {
-  process.stderr.write(
-    `⚠ pre-bash-memory-propose-audit: internal error — ${e?.message || e}\n`,
-  );
-  process.exit(0); // fail-open on internal errors
-});
+// Entry guard (#1393): run only as the node script the harness execs — a bare
+// `import()` must run no handler and must not exit the importing process.
+if (isMainModule(import.meta.url)) {
+  // exit 0 immediately when this hook is disabled via profile/env
+  if (!shouldRunHook('pre-bash-memory-propose-audit')) process.exit(0);
+
+  // Top-level error handler — never let exit 1 leak
+  main().catch((e) => {
+    process.stderr.write(
+      `⚠ pre-bash-memory-propose-audit: internal error — ${e?.message || e}\n`,
+    );
+    process.exit(0); // fail-open on internal errors
+  });
+}