talentos 1.1.5 → 1.2.0

package/dist/agent/native/policy.js

@@ -0,0 +1,653 @@
+import { ROOM_TOOLS } from "../codex-policy.js";
+import { canonical, isInside, protectedPaths, protectedReason, reachesProtected, } from "./paths.js";
+import { parseShell } from "./shell.js";
+const NON_ALNUM = /[^A-Za-z\d]+/u;
+const GREP_R_DIFF = /^-\w*r|^--recursive/u;
+const GREP_R = /^-\w*[rR]|^--recursive|^--dereference-recursive/u;
+const LS_R = /^-\w*R|^--recursive/u;
+const PATTERN_FLAG = /^-\w*e|^--regexp|^-\w*f|^--file/u;
+const GLOB_CHARS = /[*?[{]/u;
+const ASK = "This needs the owner's approval, which isn't available yet. Tell the owner in your reply what you wanted to do and why. Do not retry or work around it.";
+const BLOCKED = "Blocked: this touches credentials or the settings that protect this session. Do not retry or work around it.";
+const allow = (mutates = false) => ({ allow: true, mutates });
+const deny = (tier, reason) => ({
+    allow: false,
+    reason: reason ?? (tier === 0 ? BLOCKED : ASK),
+    tier,
+});
+const PLAIN_TOOLS = new Set([
+    "Agent",
+    "AskUserQuestion",
+    "BashOutput",
+    "ExitPlanMode",
+    "Glob",
+    "Grep",
+    "KillShell",
+    "LS",
+    "NotebookRead",
+    "Read",
+    "Skill",
+    "TaskCreate",
+    "TaskGet",
+    "TaskList",
+    "TaskStop",
+    "TaskUpdate",
+    "TodoWrite",
+    "ToolSearch",
+    "WebSearch",
+]);
+const EDIT_TOOLS = new Set(["Edit", "MultiEdit", "NotebookEdit", "Write"]);
+const READ_VERBS = new Set([
+    "count",
+    "describe",
+    "find",
+    "get",
+    "list",
+    "lookup",
+    "read",
+    "retrieve",
+    "search",
+    "show",
+    "view",
+]);
+// Any of these anywhere in an MCP tool name makes it a write, whatever it starts
+// with. Outward verbs also match their inflections (sends, sending, deleted, ...).
+const OUTWARD_VERBS = [
+    "add",
+    "approve",
+    "archive",
+    "assign",
+    "cancel",
+    "close",
+    "comment",
+    "create",
+    "delete",
+    "deploy",
+    "destroy",
+    "edit",
+    "execute",
+    "forward",
+    "insert",
+    "invite",
+    "merge",
+    "move",
+    "post",
+    "publish",
+    "push",
+    "remove",
+    "rename",
+    "reply",
+    "revoke",
+    "run",
+    "send",
+    "set",
+    "share",
+    "submit",
+    "trash",
+    "trigger",
+    "update",
+    "upload",
+    "write",
+];
+const OTHER_WRITE_WORDS = [
+    "accept",
+    "append",
+    "apply",
+    "clear",
+    "commit",
+    "confirm",
+    "disable",
+    "download",
+    "draft",
+    "enable",
+    "export",
+    "fire",
+    "import",
+    "invoke",
+    "kill",
+    "label",
+    "mark",
+    "notify",
+    "pin",
+    "ping",
+    "reject",
+    "reset",
+    "restore",
+    "schedule",
+    "sms",
+    "star",
+    "start",
+    "stop",
+    "sync",
+    "text",
+    "toggle",
+    "unpin",
+    "unsubscribe",
+];
+const CONSONANT_VOWEL_CONSONANT = /[^aeiou][aeiou][^aeiouwy]$/u;
+function inflections(verb) {
+    const stem = verb.endsWith("e") ? verb.slice(0, -1) : verb;
+    const doubled = CONSONANT_VOWEL_CONSONANT.test(verb)
+        ? `${verb}${verb.slice(-1)}`
+        : verb;
+    return [
+        verb,
+        `${verb}s`,
+        `${verb}es`,
+        `${verb}d`,
+        `${verb}ed`,
+        `${stem}ing`,
+        `${doubled}ing`,
+        `${doubled}ed`,
+    ];
+}
+const WRITE_WORDS = new Set([
+    ...OUTWARD_VERBS.flatMap(inflections),
+    ...OTHER_WRITE_WORDS,
+]);
+/** Splits `search_emails`, `search-emails` and `searchEmails` into lower-case words. */
+function nameWords(name) {
+    return name
+        .replace(/([a-z\d])([A-Z])/gu, "$1 $2")
+        .split(NON_ALNUM)
+        .filter(Boolean)
+        .map((word) => word.toLowerCase());
+}
+export function classifyMcpTool(server, tool) {
+    if (server === "talentos_room") {
+        return ROOM_TOOLS.includes(tool) ? allow() : deny(0);
+    }
+    // The owner's personal-key TalentOS server carries owner authority; a room
+    // job never gets it (it is also removed from the tool list at launch).
+    if (server === "talentos" || server.startsWith("talentos_")) {
+        return deny(0);
+    }
+    const words = nameWords(tool);
+    const [first] = words;
+    if (first !== undefined &&
+        READ_VERBS.has(first) &&
+        !words.some((word) => WRITE_WORDS.has(word))) {
+        return allow();
+    }
+    // Outward or unknown MCP tool: the owner may allow it once, or always for this
+    // exact tool. The name is the only identity the hook has.
+    return askDeny(ASK, {
+        detail: tool,
+        kind: `tool:mcp__${server}__${tool}`.slice(0, 80),
+        summary: `${server}: ${tool}`.slice(0, 200),
+        tier: 2,
+    });
+}
+const SECRET_WORDS = /(bearer\s+)\S+|((?:token|key|secret|password|passwd|auth)[=:]\s*)\S+/giu;
+const LONG_BLOB = /\b[A-Za-z\d+/_-]{32,}\b/gu;
+/** Owner-only summaries still never carry what looks like a credential. */
+export function redactSummary(value) {
+    return value
+        .replace(SECRET_WORDS, (_m, bearer, named) => `${bearer ?? named}…`)
+        .replace(LONG_BLOB, "…")
+        .replace(/\s+/gu, " ")
+        .trim()
+        .slice(0, 200);
+}
+const askDeny = (reason, ask) => ({
+    allow: false,
+    ask,
+    reason,
+    tier: ask.tier,
+});
+// ---- shell ----------------------------------------------------------------
+const SECRET_PROGRAMS = new Set([
+    "env",
+    "export",
+    "gpg",
+    "history",
+    "op",
+    "pass",
+    "printenv",
+    "security",
+    "set",
+    "ssh-add",
+    "ssh-keygen",
+]);
+const READ_ONLY = {
+    basename: { paths: "none" },
+    cat: { paths: "all" },
+    cut: { paths: "all" },
+    date: { badFlags: /^-s|^--set/u, paths: "none" },
+    df: { paths: "all" },
+    diff: {
+        paths: "all",
+        recursive: (a) => a.some((x) => GREP_R_DIFF.test(x)),
+    },
+    dirname: { paths: "none" },
+    du: { paths: "all", recursive: () => true },
+    echo: { paths: "none" },
+    false: { paths: "none" },
+    file: { badFlags: /^-C|^-m|^--magic/u, paths: "all" },
+    find: {
+        badFlags: /^-(exec|execdir|ok|okdir|delete|fprint0?|fprintf|fls)$/u,
+        paths: "find",
+        recursive: () => true,
+    },
+    grep: {
+        paths: "after-pattern",
+        recursive: (a) => a.some((x) => GREP_R.test(x)),
+    },
+    head: { paths: "all" },
+    ls: {
+        paths: "all",
+        recursive: (a) => a.some((x) => LS_R.test(x)),
+    },
+    printf: { paths: "none" },
+    pwd: { paths: "none" },
+    readlink: { paths: "all" },
+    realpath: { paths: "all" },
+    rg: {
+        badFlags: /^--pre|^-z$|^--search-zip|^--hostname-bin/u,
+        paths: "after-pattern",
+        recursive: () => true,
+    },
+    sort: { badFlags: /^-o|^--output|^--compress-program/u, paths: "all" },
+    stat: { paths: "all" },
+    tail: { badFlags: /^-\w*f|^--follow/u, paths: "all" },
+    tr: { paths: "none" },
+    tree: { badFlags: /^-o$/u, paths: "all", recursive: () => true },
+    true: { paths: "none" },
+    uniq: { paths: "all" },
+    wc: { paths: "all" },
+    which: { paths: "none" },
+};
+const RUNNER_SCRIPTS = new Set(["build", "check", "lint", "test", "typecheck"]);
+const SAFE_ARG = /^--?[A-Za-z][\w-]*(=[\w./:@-]+)?$|^--$/u;
+function isFlag(word) {
+    return word.text.startsWith("-") && word.text !== "-";
+}
+function pathCheck(word, ctx, recursive) {
+    if (word.glob) {
+        // A glob can only be judged by its literal directory; keep it inside cwd.
+        if (word.text.startsWith("/") ||
+            word.text.startsWith("~") ||
+            word.text.split("/").includes("..")) {
+            return deny(1, "This command uses a pattern the hook cannot check. Ask the owner.");
+        }
+        return;
+    }
+    const real = canonical(word.text, ctx.cwd, ctx.home);
+    if (protectedReason(real, "read", ctx.home, ctx.guard)) {
+        return deny(0);
+    }
+    if (recursive && reachesProtected(real, ctx.home, ctx.guard)) {
+        return deny(0);
+    }
+    return;
+}
+function classifyReadOnly(spec, args, ctx) {
+    const flags = args.filter(isFlag).map((word) => word.text);
+    if (spec.badFlags && flags.some((flag) => spec.badFlags?.test(flag))) {
+        return deny(2);
+    }
+    const recursive = spec.recursive?.(flags) ?? false;
+    let targets = [];
+    if (spec.paths === "all") {
+        targets = args.filter((word) => !isFlag(word));
+    }
+    else if (spec.paths === "after-pattern") {
+        const positional = args.filter((word) => !isFlag(word));
+        const patternGiven = flags.some((flag) => PATTERN_FLAG.test(flag));
+        targets = patternGiven ? positional : positional.slice(1);
+    }
+    else if (spec.paths === "find") {
+        const leading = [];
+        for (const word of args) {
+            if (isFlag(word) || word.text === "(" || word.text === "!") {
+                break;
+            }
+            leading.push(word);
+        }
+        targets = leading;
+    }
+    if (recursive && targets.length === 0) {
+        targets = [{ glob: false, text: "." }];
+    }
+    for (const target of targets) {
+        const refused = pathCheck(target, ctx, recursive);
+        if (refused) {
+            return refused;
+        }
+    }
+    // `echo $x > file` style writes are handled as redirects by the caller.
+    return allow();
+}
+function classifyRunner(args, ctx) {
+    const [first, second, third] = args.map((word) => word.text);
+    let rest;
+    if (first !== undefined &&
+        ["npm", "pnpm", "yarn"].includes(first) &&
+        ((second !== undefined && RUNNER_SCRIPTS.has(second)) ||
+            (second === "run" && third !== undefined && RUNNER_SCRIPTS.has(third)))) {
+        rest = args.slice(second === "run" ? 3 : 2);
+    }
+    else if (first === "pytest") {
+        rest = args.slice(1);
+    }
+    else if (first !== undefined &&
+        ["go", "cargo"].includes(first) &&
+        second === "test") {
+        rest = args.slice(2);
+    }
+    else {
+        return;
+    }
+    // Runners execute repository code. That is the owner's own repo until the
+    // model has changed it; after an edit, a run asks (R5).
+    if (ctx.dirty) {
+        return deny(2, "You changed files in this job, so running tests or builds needs the owner's approval, which isn't available yet. Tell the owner what you changed and how to run it.");
+    }
+    for (const word of rest) {
+        if (isFlag(word) || word.text === "--") {
+            if (!SAFE_ARG.test(word.text)) {
+                return deny(2);
+            }
+            continue;
+        }
+        const real = canonical(word.text, ctx.cwd, ctx.home);
+        if (word.glob ||
+            protectedReason(real, "read", ctx.home, ctx.guard) ||
+            !ctx.writeRoots.some((root) => isInside(real, root))) {
+            return deny(2);
+        }
+    }
+    return allow();
+}
+// Read-only git. Flags that run programs, write files or read outside the
+// repository are refused; anything that changes a ref or the network is not here.
+const GIT_READ = new Set([
+    "blame",
+    "branch",
+    "describe",
+    "diff",
+    "log",
+    "ls-files",
+    "rev-parse",
+    "shortlog",
+    "show",
+    "status",
+]);
+const GIT_BAD_FLAG = /^(--output|-c$|-C$|--exec-path|--upload-pack|--git-dir|--work-tree|--no-index|--ext-diff|--textconv|--open-files-in-pager|-O)/u;
+const GIT_LIST_FLAG = /^(-a|-r|-v|-vv|--all|--remotes|--list|--show-current)$/u;
+function classifyGit(args, ctx) {
+    const [sub, ...rest] = args;
+    if (!(sub && GIT_READ.has(sub.text))) {
+        return deny(2);
+    }
+    const flags = rest.filter(isFlag);
+    const positional = rest.filter((word) => !isFlag(word));
+    if (flags.some((flag) => GIT_BAD_FLAG.test(flag.text))) {
+        return deny(2);
+    }
+    // `git branch NAME` creates a branch; only the listing forms pass.
+    if (sub.text === "branch" &&
+        (positional.length > 0 ||
+            flags.some((flag) => !GIT_LIST_FLAG.test(flag.text)))) {
+        return deny(2);
+    }
+    for (const word of positional) {
+        const refused = pathCheck(word, ctx, false);
+        if (refused) {
+            return refused;
+        }
+    }
+    return allow();
+}
+// What an always-allow rule can name: local repository work the owner expects
+// from a coding agent. Network, interpreters, installs and anything else ask
+// every time (tier 1).
+const GIT_TIER2 = new Set([
+    "add",
+    "checkout",
+    "clone",
+    "commit",
+    "fetch",
+    "pull",
+    "push",
+    "restore",
+    "stash",
+    "switch",
+]);
+const PROTECTED_BRANCH = /^(?:main|master|trunk|develop|dev|release|production|prod|stable)$|^release[/-]/u;
+const PUSH_RISKY_FLAG = /^(-f$|--force|--delete$|-d$|--mirror|--all$|--prune)/u;
+const HEADS_PREFIX = /^refs\/heads\//u;
+const FILE_UTILS = new Set(["cp", "mkdir", "mv", "touch"]);
+function gitPushTier(args) {
+    const rest = args.slice(1);
+    const flags = rest.filter(isFlag).map((word) => word.text);
+    if (flags.some((flag) => PUSH_RISKY_FLAG.test(flag))) {
+        return 1;
+    }
+    const positional = rest
+        .filter((word) => !isFlag(word))
+        .map((word) => word.text);
+    const refspec = positional[1];
+    if (!refspec || refspec.startsWith("+") || refspec.startsWith(":")) {
+        return 1;
+    }
+    const target = refspec.includes(":")
+        ? (refspec.split(":")[1] ?? "")
+        : refspec;
+    const branch = target.replace(HEADS_PREFIX, "");
+    return branch.startsWith("talentos/") && !PROTECTED_BRANCH.test(branch)
+        ? 2
+        : 1;
+}
+function shellAsk(command, ctx) {
+    const [programWord, ...args] = command.argv;
+    const program = programWord?.text ?? "?";
+    if (command.redirects.some((redirect) => redirect.mode === "write" &&
+        redirect.target.text !== "/dev/null" &&
+        !ctx.writeRoots.some((root) => isInside(canonical(redirect.target.text, ctx.cwd, ctx.home), root)))) {
+        return { kind: "shell:redirect-outside", tier: 1 };
+    }
+    if (program.includes("/")) {
+        return { kind: "shell:script", tier: 1 };
+    }
+    if (program === "git") {
+        const sub = args[0]?.text ?? "";
+        const badFlag = args.some((word) => isFlag(word) && GIT_BAD_FLAG.test(word.text));
+        if (!GIT_TIER2.has(sub) || badFlag) {
+            return { kind: `git:${sub || "?"}`, tier: 1 };
+        }
+        return { kind: `git:${sub}`, tier: sub === "push" ? gitPushTier(args) : 2 };
+    }
+    if (FILE_UTILS.has(program)) {
+        const inside = args
+            .filter((word) => !isFlag(word))
+            .every((word) => !word.glob &&
+            ctx.writeRoots.some((root) => isInside(canonical(word.text, ctx.cwd, ctx.home), root)) &&
+            !protectedReason(canonical(word.text, ctx.cwd, ctx.home), "write", ctx.home, ctx.guard));
+        return { kind: `shell:${program}`, tier: inside ? 2 : 1 };
+    }
+    const [first, second, third] = command.argv.map((word) => word.text);
+    if (ctx.dirty &&
+        ["npm", "pnpm", "yarn"].includes(first ?? "") &&
+        (RUNNER_SCRIPTS.has(second ?? "") ||
+            (second === "run" && RUNNER_SCRIPTS.has(third ?? "")))) {
+        return {
+            kind: `run:${first} ${second === "run" ? third : second}`,
+            tier: 1,
+        };
+    }
+    if (ctx.dirty &&
+        (first === "pytest" ||
+            (["go", "cargo"].includes(first ?? "") && second === "test"))) {
+        return {
+            kind: `run:${first}${first === "pytest" ? "" : " test"}`,
+            tier: 1,
+        };
+    }
+    return { kind: `shell:${program}`, tier: 1 };
+}
+function classifySimple(command, ctx) {
+    const [programWord, ...args] = command.argv;
+    if (!programWord) {
+        return deny(1);
+    }
+    const program = programWord.text;
+    if (program.includes("/") || programWord.glob) {
+        return deny(2);
+    }
+    let verdict;
+    if (SECRET_PROGRAMS.has(program)) {
+        verdict = deny(0);
+    }
+    else {
+        const spec = READ_ONLY[program];
+        if (program === "git") {
+            verdict = classifyGit(args, ctx);
+        }
+        else {
+            verdict = spec
+                ? classifyReadOnly(spec, args, ctx)
+                : (classifyRunner(command.argv, ctx) ?? deny(2));
+        }
+    }
+    if (!verdict.allow) {
+        return verdict;
+    }
+    let mutates = false;
+    for (const redirect of command.redirects) {
+        if (redirect.mode === "read") {
+            const refused = pathCheck(redirect.target, ctx, false);
+            if (refused) {
+                return refused;
+            }
+            continue;
+        }
+        if (redirect.target.text === "/dev/null") {
+            continue;
+        }
+        const real = canonical(redirect.target.text, ctx.cwd, ctx.home);
+        if (protectedReason(real, "write", ctx.home, ctx.guard)) {
+            return deny(0);
+        }
+        if (redirect.target.glob ||
+            !ctx.writeRoots.some((root) => isInside(real, root))) {
+            return deny(2);
+        }
+        mutates = true;
+    }
+    return allow(mutates);
+}
+export function classifyShell(source, ctx) {
+    const parsed = parseShell(source);
+    const summary = redactSummary(source);
+    if (!parsed.ok) {
+        return askDeny("The hook could not read this command safely. Use a simpler command, or ask the owner.", { detail: source, kind: "shell:unparseable", summary, tier: 1 });
+    }
+    let mutates = false;
+    let worst;
+    const asked = [];
+    for (const command of parsed.commands) {
+        const verdict = classifySimple(command, ctx);
+        if (verdict.allow) {
+            mutates ||= verdict.mutates;
+            continue;
+        }
+        if (verdict.tier === 0) {
+            return verdict;
+        }
+        asked.push(shellAsk(command, ctx));
+        if (!worst || (!worst.allow && verdict.tier < worst.tier)) {
+            worst = verdict;
+        }
+    }
+    if (!worst || worst.allow) {
+        return allow(mutates);
+    }
+    // One ask covers the whole command. Its tier is the strictest part's, and its
+    // kind names every part, so a rule for one program never covers a chain.
+    const kinds = [...new Set(asked.map((entry) => entry.kind))].sort();
+    const joined = kinds.join(" + ");
+    const kind = joined.length <= 80 ? joined : `${kinds[0]} +${kinds.length - 1}`;
+    const tier = Math.min(...asked.map((entry) => entry.tier));
+    return { ...worst, ask: { detail: source, kind, summary, tier }, tier };
+}
+// ---- tools ----------------------------------------------------------------
+function text(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+export function classifyCall(call, context) {
+    const guard = context.guard ?? protectedPaths(context.home);
+    const ctx = { ...context, guard, cwd: call.cwd };
+    const { tool, toolInput: input } = call;
+    if (tool.startsWith("mcp__")) {
+        const [, server, ...rest] = tool.split("__");
+        return server && rest.length > 0
+            ? classifyMcpTool(server, rest.join("__"))
+            : deny(2);
+    }
+    if (tool === "Bash") {
+        const command = text(input.command);
+        return command ? classifyShell(command, ctx) : deny(1);
+    }
+    if (EDIT_TOOLS.has(tool)) {
+        const target = text(input.file_path) ?? text(input.notebook_path);
+        if (!target) {
+            return deny(1);
+        }
+        const real = canonical(target, call.cwd, context.home);
+        if (protectedReason(real, "write", context.home, guard)) {
+            return deny(0);
+        }
+        return context.writeRoots.some((root) => isInside(real, root))
+            ? allow(true)
+            : askDeny("That file is outside this job's workspace. Needs the owner's approval.", {
+                detail: `${tool} ${real}`,
+                kind: "write-outside-workspace",
+                summary: redactSummary(`${tool} ${real}`),
+                tier: 1,
+            });
+    }
+    if (PLAIN_TOOLS.has(tool)) {
+        const raw = text(input.file_path) ?? text(input.notebook_path) ?? text(input.path);
+        const recursive = tool === "Grep" || tool === "Glob" || tool === "LS";
+        const patternPath = tool === "Glob" ? text(input.pattern) : undefined;
+        for (const candidate of [
+            raw ?? (recursive ? "." : undefined),
+            patternPath,
+        ]) {
+            if (candidate === undefined) {
+                continue;
+            }
+            // A glob pattern is judged by its literal directory prefix.
+            const literal = candidate.split(GLOB_CHARS)[0] ?? candidate;
+            const refused = pathCheck({ glob: false, text: literal === "" ? "." : literal }, ctx, recursive);
+            if (refused) {
+                return refused;
+            }
+        }
+        return allow();
+    }
+    // WebFetch (a GET carries data; rules are per domain), scheduling, messaging,
+    // worktree switches and every tool this list does not know: ask.
+    if (tool === "WebFetch") {
+        let host;
+        try {
+            host = new URL(text(input.url) ?? "").hostname.toLowerCase();
+        }
+        catch {
+            host = undefined;
+        }
+        return askDeny(ASK, {
+            detail: text(input.url) ?? "",
+            kind: host ? `web:${host}`.slice(0, 80) : "web:?",
+            summary: redactSummary(text(input.url) ?? ""),
+            tier: host ? 2 : 1,
+        });
+    }
+    return askDeny(ASK, {
+        detail: JSON.stringify(input).slice(0, 4000),
+        kind: `tool:${tool}`.slice(0, 80),
+        summary: redactSummary(`${tool} ${JSON.stringify(input)}`),
+        tier: 1,
+    });
+}