talentos 1.1.5 → 1.2.0

package/dist/agent/native/paths.js

@@ -0,0 +1,137 @@
+import { realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep, } from "node:path";
+// Path canonicalisation and the protected-path rules of the owner-native hook
+// (#10987). Everything is compared after realpath of the nearest existing
+// ancestor (symlinks), Unicode NFC and, on case-insensitive filesystems
+// (macOS APFS, Windows), case folding, so `..`, symlinks and `~/.SSH` all land
+// on the same name.
+const FOLD = process.platform === "darwin" || process.platform === "win32";
+/** Home-relative directories whose contents are never readable or writable by the model. */
+const HOME_DIRS = [
+    ".ssh",
+    ".aws",
+    ".gnupg",
+    ".kube",
+    ".talentos",
+    ".claude",
+    ".codex",
+    ".cursor",
+    ".docker",
+    ".config/gcloud",
+    ".config/gh",
+    ".config/op",
+    ".config/fish",
+    "Library/Keychains",
+    "Library/Cookies",
+    "Library/Application Support/Google/Chrome",
+    "Library/Application Support/Firefox",
+    "Library/Application Support/Arc",
+    "Library/Application Support/BraveSoftware",
+    "Library/Application Support/Microsoft Edge",
+    "Library/Application Support/1Password",
+];
+/** Home-relative files: credentials, provider config and shell start-up files. */
+const HOME_FILES = [
+    ".claude.json",
+    ".npmrc",
+    ".netrc",
+    ".git-credentials",
+    ".pgpass",
+    ".pypirc",
+    ".zshrc",
+    ".zprofile",
+    ".zshenv",
+    ".zlogin",
+    ".bashrc",
+    ".bash_profile",
+    ".bash_login",
+    ".profile",
+];
+/** Writable only by the owner: git config can run commands, so the model may read but not write it. */
+const HOME_WRITE_ONLY = [".gitconfig", ".config/git"];
+const SECRET_NAME = /^(\.env(\..+)?|\.envrc|\.netrc|\.npmrc|\.pgpass|\.pypirc|\.git-credentials|credentials(\.json)?|id_(rsa|dsa|ecdsa|ed25519)(\.pub)?|.+\.(pem|p12|pfx|key|keystore|jks))$/iu;
+const SECRET_NAME_OK = /\.(example|sample|template|dist)$|\.pub$/iu;
+/** Names that configure the provider, the hook or what runs on commit: the model may read, never write. */
+const WRITE_PROTECTED_SEGMENTS = [
+    ".claude",
+    ".codex",
+    ".cursor",
+    ".husky",
+    ".githooks",
+];
+const WRITE_PROTECTED_NAMES = [".mcp.json"];
+export const fold = (path) => (FOLD ? path.toLowerCase() : path).normalize("NFC");
+/** realpath of the nearest existing ancestor, with the unresolved remainder re-appended. */
+export function canonical(path, cwd, home) {
+    let target = path;
+    if (target === "~" || target.startsWith("~/")) {
+        target = join(home, target.slice(1));
+    }
+    target = resolve(isAbsolute(target) ? target : join(cwd, target));
+    const rest = [];
+    let existing = target;
+    for (;;) {
+        try {
+            const real = realpathSync.native(existing);
+            return join(real, ...rest.reverse());
+        }
+        catch {
+            const parent = dirname(existing);
+            if (parent === existing) {
+                return target;
+            }
+            rest.push(basename(existing));
+            existing = parent;
+        }
+    }
+}
+export function isInside(child, parent) {
+    const rel = relative(fold(parent), fold(child));
+    return rel === "" || !(rel.startsWith("..") || isAbsolute(rel));
+}
+function homeEntries(home, names) {
+    return names.map((name) => canonical(join(home, name), home, home));
+}
+export function protectedPaths(home) {
+    return {
+        readWrite: [
+            ...homeEntries(home, HOME_DIRS),
+            ...homeEntries(home, HOME_FILES),
+        ],
+        writeOnly: homeEntries(home, HOME_WRITE_ONLY),
+    };
+}
+/** Why a canonical path is off limits, or undefined. `mode` "read" skips write-only protections. */
+export function protectedReason(path, mode, home, guard = protectedPaths(home)) {
+    for (const entry of guard.readWrite) {
+        if (isInside(path, entry)) {
+            return "credentials or provider settings";
+        }
+    }
+    const name = basename(path);
+    if (SECRET_NAME.test(name) && !SECRET_NAME_OK.test(name)) {
+        return "a secrets file";
+    }
+    if (mode === "write") {
+        for (const entry of guard.writeOnly) {
+            if (isInside(path, entry)) {
+                return "a configuration file that can run commands";
+            }
+        }
+        const segments = path.split(sep);
+        if (segments.some((segment) => WRITE_PROTECTED_SEGMENTS.includes(fold(segment))) ||
+            WRITE_PROTECTED_NAMES.includes(fold(name))) {
+            return "provider, hook or MCP settings";
+        }
+        const gitAt = segments.lastIndexOf(".git");
+        if (gitAt >= 0 &&
+            (segments[gitAt + 1] === "hooks" || segments[gitAt + 1] === "config")) {
+            return "git hooks or config";
+        }
+    }
+    return;
+}
+/** True when `dir` contains a protected path, so a recursive read from it would reach it. */
+export function reachesProtected(dir, home, guard = protectedPaths(home)) {
+    return guard.readWrite.some((entry) => isInside(entry, dir));
+}