talos-code 0.0.1 → 0.2.0

package/dist/security/plugin-guard.js

@@ -0,0 +1,230 @@
+import { createHash } from 'node:crypto';
+import { lstat, open, readFile, readdir, realpath } from 'node:fs/promises';
+import path from 'node:path';
+export const PLUGIN_GUARD_MAX_FILES = 10_000;
+export const PLUGIN_GUARD_MAX_SOURCE_FILE_BYTES = 1024 * 1024;
+export const PLUGIN_GUARD_MAX_SOURCE_BYTES = 16 * 1024 * 1024;
+const SOURCE_FILE = /\.(?:[cm]?[jt]sx?|mjs|cjs|mts|cts|ps1|sh|bash|zsh)$/iu;
+function inside(root, candidate) { const relative = path.relative(root, candidate); return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative)); }
+function verdict(findings) { return findings.some(finding => finding.severity === 'dangerous') ? 'dangerous' : findings.length ? 'caution' : 'safe'; }
+function report(findings, capabilities) { return { verdict: verdict(findings), findings, capabilities: [...capabilities].sort() }; }
+function finding(severity, code, origin, message) { return { severity, code, origin, message }; }
+function safePluginId(id) { return /^[A-Za-z0-9][A-Za-z0-9._-]{0,120}$/u.test(id) && !id.includes('..'); }
+function boundedLimit(value, ceiling) { if (value === undefined)
+    return ceiling; if (!Number.isFinite(value))
+    return ceiling; return Math.max(1, Math.min(Math.floor(value), ceiling)); }
+function packageRelative(pluginId, relative) { return path.posix.join('.harness-ui-plugins', pluginId, relative); }
+function pluginResourceFingerprint(relativePath, content) { return createHash('sha256').update('talos-executable-resource-v1').update('\0').update('plugin').update('\0').update(relativePath).update('\0').update(relativePath).update('\0').update(content).digest('hex'); }
+function reviewedBytesMatch(review, relativePath, content, origin, findings) {
+    if (!review)
+        return true;
+    const expected = review.resources.find(row => row.relativePath === relativePath);
+    if (expected && expected.fingerprint === pluginResourceFingerprint(relativePath, content))
+        return true;
+    findings.push(finding('dangerous', 'PACKAGE_REVIEW_CHANGED', origin, 'package bytes differ from the reviewed trust snapshot; remediation: review the current package again before trusting it'));
+    return false;
+}
+export function pluginReviewFromSnapshot(snapshot, pluginId) {
+    const prefix = `.harness-ui-plugins/${pluginId}/`;
+    return { workspaceIdentityHash: snapshot.workspace.identityHash, resources: snapshot.resources.flatMap(row => row.kind === 'plugin' && row.relativePath.startsWith(prefix) && row.current ? [{ relativePath: row.current.relativePath, fingerprint: row.current.fingerprint }] : []) };
+}
+async function readSourceBounded(sourcePath, maxBytes) {
+    const handle = await open(sourcePath, 'r');
+    try {
+        const buffer = Buffer.allocUnsafe(maxBytes + 1);
+        let bytes = 0;
+        while (bytes < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, bytes, buffer.length - bytes, bytes);
+            if (bytesRead === 0)
+                break;
+            bytes += bytesRead;
+        }
+        const content = buffer.subarray(0, bytes);
+        return { bytes, overflow: bytes > maxBytes, content, text: bytes > maxBytes ? '' : content.toString('utf8') };
+    }
+    finally {
+        await handle.close();
+    }
+}
+function scanDangerousText(text, origin, findings, capabilities) {
+    const network = /\b(?:curl|wget|Invoke-WebRequest|iwr|nc|ncat)\b|\bfetch\s*\(|\bWebSocket\s*\(|\baxios(?:\.[A-Za-z]+)?\s*\(|\bhttps?\s*\.\s*(?:request|get)\s*\(/iu.test(text);
+    const credentials = /\b(?:process|Bun)\.env(?:\[['"][^'"]*(?:KEY|TOKEN|SECRET|PASSWORD|AUTHORIZATION)[^'"]*['"]\]|\.[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|AUTHORIZATION))|\$env:[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|AUTHORIZATION)|\$[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|AUTHORIZATION)/iu.test(text);
+    if (network)
+        capabilities.add('network');
+    if (credentials)
+        capabilities.add('credentials');
+    if (/\b(?:curl|wget)\b[^|\r\n]*\|\s*(?:sh|bash|zsh|pwsh|powershell)\b|\b(?:iwr|Invoke-WebRequest)\b[^|\r\n]*\|\s*(?:iex|Invoke-Expression)\b/iu.test(text))
+        findings.push(finding('dangerous', 'REMOTE_PIPE_EXECUTION', origin, 'downloads and executes remote content in one step'));
+    if (credentials && network)
+        findings.push(finding('dangerous', 'CREDENTIAL_EXFILTRATION', origin, 'combines credential access with an outbound network primitive'));
+    if (/\bnc\s+-[A-Za-z]*e\b|\/dev\/tcp\/|\b(?:Invoke-Expression|iex)\b[^\r\n]*(?:FromBase64String|-enc(?:odedcommand)?\b)/iu.test(text))
+        findings.push(finding('dangerous', 'DYNAMIC_REMOTE_SHELL', origin, 'contains a reverse-shell or encoded dynamic execution pattern'));
+}
+export function scanPluginManifest(plugin) {
+    const findings = [];
+    const capabilities = new Set();
+    for (const [kind, rows] of [['tool', plugin.tools ?? []], ['hook', plugin.hooks ?? []]]) {
+        for (const [index, row] of rows.entries()) {
+            const command = String(row.comando ?? '');
+            const origin = `${kind}:${String(row.nome ?? row.id ?? index)}`;
+            capabilities.add('process');
+            findings.push(finding('caution', 'LOCAL_COMMAND_EXECUTION', origin, 'executes a local command'));
+            if (/\b(?:curl|wget|Invoke-WebRequest|iwr|fetch)\b/iu.test(command)) {
+                capabilities.add('network');
+                findings.push(finding('caution', 'NETWORK_ACCESS', origin, 'command can access the network'));
+            }
+            if (/\b(?:API_KEY|SECRET|TOKEN|PASSWORD|AUTHORIZATION)\b|\$(?:env:)?(?:[A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD))/iu.test(command))
+                capabilities.add('credentials');
+            if (/\b(?:rm\s+-[A-Za-z]*r[A-Za-z]*f|del\s+\/[sq]|Remove-Item\b[^\r\n]*-Recurse|format\s+[A-Za-z]:)/iu.test(command))
+                capabilities.add('filesystem-write');
+            if (/\b(?:curl|wget)\b[^|\r\n]*\|\s*(?:sh|bash|zsh|pwsh|powershell)\b|\b(?:iwr|Invoke-WebRequest)\b[^|\r\n]*\|\s*(?:iex|Invoke-Expression)\b/iu.test(command))
+                findings.push(finding('dangerous', 'REMOTE_PIPE_EXECUTION', origin, 'downloads and executes remote content in one command'));
+            if (/(?:API_KEY|SECRET|TOKEN|PASSWORD|AUTHORIZATION)/iu.test(command) && /\b(?:curl|wget|nc|ncat|Invoke-WebRequest|iwr)\b/iu.test(command))
+                findings.push(finding('dangerous', 'CREDENTIAL_EXFILTRATION', origin, 'combines credential access with a network command'));
+            if (/\bnc\s+-[A-Za-z]*e\b|\/dev\/tcp\/|\b(?:Invoke-Expression|iex)\b[^\r\n]*(?:FromBase64String|-enc(?:odedcommand)?\b)/iu.test(command))
+                findings.push(finding('dangerous', 'DYNAMIC_REMOTE_SHELL', origin, 'contains a reverse-shell or encoded dynamic execution pattern'));
+            if (/\brm\s+-[A-Za-z]*r[A-Za-z]*f\s+(?:\/|[A-Za-z]:\\)(?:\s|$)|\bdel\s+\/[sq]\s+[A-Za-z]:\\/iu.test(command))
+                findings.push(finding('dangerous', 'FILESYSTEM_ROOT_DELETION', origin, 'recursively deletes a filesystem root'));
+        }
+    }
+    return report(findings, capabilities);
+}
+export async function scanPluginPackage({ projectRoot, plugin, limits, expectedReview }) {
+    const base = path.join(projectRoot, '.harness-ui-plugins');
+    const findings = [];
+    const capabilities = new Set();
+    const maxFiles = boundedLimit(limits?.maxFiles, PLUGIN_GUARD_MAX_FILES);
+    const maxSourceFileBytes = boundedLimit(limits?.maxSourceFileBytes, PLUGIN_GUARD_MAX_SOURCE_FILE_BYTES);
+    const maxSourceBytes = boundedLimit(limits?.maxSourceBytes, PLUGIN_GUARD_MAX_SOURCE_BYTES);
+    if (!safePluginId(plugin.id)) {
+        findings.push(finding('dangerous', 'PLUGIN_ID_INVALID', 'package', 'plugin id is not a single safe path component'));
+        return report(findings, capabilities);
+    }
+    const pluginPath = path.join(base, plugin.id);
+    try {
+        const [canonicalBase, canonicalRoot] = await Promise.all([realpath(base), realpath(pluginPath)]);
+        if (!inside(canonicalBase, canonicalRoot)) {
+            findings.push(finding('dangerous', 'PLUGIN_ROOT_ESCAPE', 'package', 'plugin root resolves outside the plugin directory'));
+            return report(findings, capabilities);
+        }
+        const manifestBytes = await readFile(path.join(canonicalRoot, 'plugin.json'));
+        reviewedBytesMatch(expectedReview, packageRelative(plugin.id, 'plugin.json'), manifestBytes, 'plugin.json', findings);
+        const diskManifest = JSON.parse(manifestBytes.toString('utf8'));
+        const initial = scanPluginManifest({ id: plugin.id, tools: diskManifest.tools ?? [], hooks: diskManifest.hooks ?? [] });
+        findings.push(...initial.findings);
+        for (const capability of initial.capabilities)
+            capabilities.add(capability);
+        const sources = [];
+        let regularFiles = 0;
+        let fileLimitHit = false;
+        async function walk(directory) {
+            if (fileLimitHit)
+                return;
+            for (const entry of await readdir(directory, { withFileTypes: true })) {
+                if (fileLimitHit)
+                    return;
+                const entryPath = path.join(directory, entry.name);
+                const relative = path.relative(canonicalRoot, entryPath).split(path.sep).join('/');
+                const metadata = await lstat(entryPath);
+                if (metadata.isSymbolicLink()) {
+                    const target = await realpath(entryPath);
+                    if (!inside(canonicalRoot, target))
+                        findings.push(finding('dangerous', 'SYMLINK_ESCAPE', relative, 'symbolic link resolves outside the plugin root'));
+                    else
+                        findings.push(finding('caution', 'SYMLINK_PRESENT', relative, 'package contains a symbolic link'));
+                    continue;
+                }
+                if (metadata.isDirectory()) {
+                    await walk(entryPath);
+                    continue;
+                }
+                if (!metadata.isFile())
+                    continue;
+                regularFiles += 1;
+                if (regularFiles > maxFiles) {
+                    findings.push(finding('dangerous', 'PACKAGE_FILE_LIMIT', 'package', `package exceeds the Plugin Guard file limit (${maxFiles}); remediation: remove generated/vendor files or split the plugin before trust review`));
+                    fileLimitHit = true;
+                    return;
+                }
+                if (/\.(?:exe|dll|node|com|msi)$/iu.test(entry.name)) {
+                    capabilities.add('native-code');
+                    findings.push(finding('caution', 'NATIVE_BINARY', relative, 'package contains native executable code'));
+                }
+                if (SOURCE_FILE.test(entry.name))
+                    sources.push({ path: entryPath, relative, size: metadata.size });
+            }
+        }
+        await walk(canonicalRoot);
+        if (fileLimitHit)
+            return report(findings, capabilities);
+        if (expectedReview) {
+            const prefix = `.harness-ui-plugins/${plugin.id}/`;
+            const seen = new Set(sources.map(source => source.relative));
+            for (const row of expectedReview.resources) {
+                if (!row.relativePath.startsWith(prefix))
+                    continue;
+                const relative = row.relativePath.slice(prefix.length);
+                if (SOURCE_FILE.test(relative) && !seen.has(relative))
+                    findings.push(finding('dangerous', 'PACKAGE_REVIEW_CHANGED', relative, 'a reviewed source file was missing during inspection; remediation: review the current package again before trusting it'));
+            }
+        }
+        let metadataSourceBytes = 0;
+        let sourceLimitHit = false;
+        for (const source of sources) {
+            if (source.size > maxSourceFileBytes) {
+                findings.push(finding('dangerous', 'SOURCE_FILE_BYTE_LIMIT', source.relative, `source file exceeds the Plugin Guard per-file byte limit (${maxSourceFileBytes}); remediation: split or reduce this source file before trust review`));
+                sourceLimitHit = true;
+            }
+            metadataSourceBytes += source.size;
+        }
+        if (metadataSourceBytes > maxSourceBytes) {
+            findings.push(finding('dangerous', 'PACKAGE_SOURCE_BYTE_LIMIT', 'package', `scannable source exceeds the Plugin Guard total-byte limit (${maxSourceBytes}); remediation: remove generated/vendor source or split the plugin before trust review`));
+            sourceLimitHit = true;
+        }
+        if (sourceLimitHit)
+            return report(findings, capabilities);
+        let remainingSourceBytes = maxSourceBytes;
+        for (const source of sources) {
+            if (remainingSourceBytes <= 0) {
+                findings.push(finding('dangerous', 'PACKAGE_SOURCE_BYTE_LIMIT', 'package', `scannable source exceeds the Plugin Guard total-byte limit (${maxSourceBytes}); remediation: stop concurrent generation, remove generated/vendor source or split the plugin before trust review`));
+                break;
+            }
+            const readLimit = Math.min(maxSourceFileBytes, remainingSourceBytes);
+            const bounded = await readSourceBounded(source.path, readLimit);
+            if (bounded.overflow) {
+                if (readLimit === maxSourceFileBytes)
+                    findings.push(finding('dangerous', 'SOURCE_FILE_BYTE_LIMIT', source.relative, `source file exceeded the Plugin Guard per-file byte limit while being read (${maxSourceFileBytes}); remediation: stop concurrent generation or split/reduce this source file before trust review`));
+                if (readLimit === remainingSourceBytes)
+                    findings.push(finding('dangerous', 'PACKAGE_SOURCE_BYTE_LIMIT', 'package', `scannable source exceeded the Plugin Guard total-byte limit while being read (${maxSourceBytes}); remediation: stop concurrent generation, remove generated/vendor source or split the plugin before trust review`));
+                if (readLimit === remainingSourceBytes)
+                    break;
+                continue;
+            }
+            remainingSourceBytes -= bounded.bytes;
+            if (!reviewedBytesMatch(expectedReview, packageRelative(plugin.id, source.relative), bounded.content, source.relative, findings))
+                continue;
+            scanDangerousText(bounded.text, source.relative, findings, capabilities);
+        }
+    }
+    catch (error) {
+        findings.push(finding('dangerous', 'PACKAGE_SCAN_FAILED', 'package', error instanceof Error ? error.message : 'package scan failed'));
+    }
+    return report(findings, capabilities);
+}
+export function createGuardedPluginTrustVerifier({ projectRoot, inspectReview, verifyTrusted }) {
+    return async (input) => {
+        if (!safePluginId(input.pluginId))
+            return false;
+        try {
+            const snapshot = inspectReview ? await inspectReview() : undefined;
+            const expectedReview = snapshot ? pluginReviewFromSnapshot(snapshot, input.pluginId) : undefined;
+            const guard = await scanPluginPackage({ projectRoot, plugin: { id: input.pluginId }, ...(expectedReview ? { expectedReview } : {}) });
+            if (guard.verdict === 'dangerous')
+                return false;
+            return await verifyTrusted(input);
+        }
+        catch {
+            return false;
+        }
+    };
+}

package/dist/security/process-tree-evidence-store.js

@@ -0,0 +1,74 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+const RECORD_SCHEMA = 'talos.cli.process-tree-evidence-store.v1';
+const RECORD_FILE = 'process-tree-evidence.json';
+const POSITIVE_TTL_MS = 24 * 60 * 60 * 1000;
+const NEGATIVE_TTL_MS = 15 * 60 * 1000;
+/**
+ * A process-tree measurement is only meaningful on the host that produced it. Any change in
+ * platform, kernel release, architecture, or machine name invalidates the cached evidence rather
+ * than carrying a stale "verified" across a host that is no longer the same machine.
+ */
+export function hostFingerprint(input = {}) {
+    const platform = input.platform ?? os.platform();
+    const release = input.release ?? os.release();
+    const arch = input.arch ?? os.arch();
+    const hostname = input.hostname ?? os.hostname();
+    return createHash('sha256').update('talos.cli.process-tree-host.v1\0').update(`${platform}\0${release}\0${arch}\0${hostname}`).digest('hex');
+}
+export function createProcessTreeEvidenceStore(options) {
+    const file = path.join(options.cacheRoot, RECORD_FILE);
+    const now = options.now ?? (() => Date.now());
+    const positiveTtlMs = options.positiveTtlMs ?? POSITIVE_TTL_MS;
+    const negativeTtlMs = options.negativeTtlMs ?? NEGATIVE_TTL_MS;
+    const fingerprint = options.fingerprint ?? hostFingerprint();
+    return {
+        async read() {
+            let record;
+            try {
+                record = JSON.parse(await readFile(file, 'utf8'));
+            }
+            catch {
+                return null;
+            }
+            if (record?.schema !== RECORD_SCHEMA)
+                return null;
+            if (record.hostFingerprint !== fingerprint)
+                return null;
+            if (typeof record.recordedAtMs !== 'number' || typeof record.result?.verified !== 'boolean')
+                return null;
+            const age = now() - record.recordedAtMs;
+            if (age < 0)
+                return null;
+            return age > (record.result.verified ? positiveTtlMs : negativeTtlMs) ? null : record.result;
+        },
+        /**
+         * Never written in place. A project incident recorded `open(path,'w')` truncating a 36 KB file
+         * before the write that was meant to replace it, so the record is serialized first, written to
+         * a temporary file in the same directory, flushed, and only then renamed over the target.
+         */
+        async write(result) {
+            const record = { schema: RECORD_SCHEMA, hostFingerprint: fingerprint, recordedAtMs: now(), result };
+            const serialized = `${JSON.stringify(record, null, 2)}\n`;
+            await mkdir(options.cacheRoot, { recursive: true, mode: 0o700 });
+            const temporary = `${file}.tmp-${process.pid}-${now()}`;
+            try {
+                await writeFile(temporary, serialized, { encoding: 'utf8', mode: 0o600 });
+                const handle = await open(temporary, 'r+');
+                try {
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+                await rename(temporary, file);
+            }
+            catch (error) {
+                await rm(temporary, { force: true });
+                throw error;
+            }
+        }
+    };
+}