thumbgate 1.35.0 → 1.37.1

package/scripts/hidden-entry-points.js

@@ -0,0 +1,284 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Hidden-entry-points scorecard — misconfigs attackers / runaway agents rely on.
+ *
+ * Process steal from a BrightTALK weekly rec digest (not BrightTALK, SailPoint,
+ * Strike48, Abnormal, A-LIGN, or ISO 42001 product):
+ *   - "Watch everything" is not the digest — rank by interest, drop vendor theater
+ *   - Hidden entry points = PreToolUse / identity / dynamic-tool misconfigs
+ *   - Going agentic without a pre-action gate is the SOC pitfall
+ *
+ * Existing surfaces: agent-security-central hook drift + claw evaluateClawPretool.
+ * Not a new SOC / ISO 42001 SKU. Not BrightTALK affiliation.
+ *
+ * Usage:
+ *   node scripts/hidden-entry-points.js
+ *   node scripts/hidden-entry-points.js --json
+ *   npm run hidden:entry
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const SCHEMA = 'thumbgate.hidden_entry_points.v1';
+const DEFAULT_INTERESTS = ['hidden-entry', 'identity', 'agentic-soc', 'ai-security'];
+const DEFAULT_MAX_DIGEST = 5;
+
+/**
+ * Fixture set: load-all is "watch every webinar"; digest is interest-ranked.
+ * `iso42001-theater` and vendor webinars are noise (not attacker entry points).
+ */
+const ENTRY_POINTS = [
+  {
+    id: 'pretooluse-unwired',
+    theme: 'hidden-entry',
+    label: 'PreToolUse hook not on the wire',
+    attackerReliesOn: true,
+    noise: false,
+    open: true,
+    severity: 9,
+  },
+  {
+    id: 'dynamic-tool-ungated',
+    theme: 'agentic-soc',
+    label: 'Runtime dynamic tool creation without approval',
+    attackerReliesOn: true,
+    noise: false,
+    open: true,
+    severity: 8,
+  },
+  {
+    id: 'computer-use-ungated',
+    theme: 'hidden-entry',
+    label: 'Screen / computer-use without a pre-action gate',
+    attackerReliesOn: true,
+    noise: false,
+    open: true,
+    severity: 8,
+  },
+  {
+    id: 'agent-identity-missing',
+    theme: 'identity',
+    label: 'Tool calls without agent_identity',
+    attackerReliesOn: true,
+    noise: false,
+    open: true,
+    severity: 7,
+  },
+  {
+    id: 'review-volume-as-control',
+    theme: 'agentic-soc',
+    label: 'Human review volume treated as the control',
+    attackerReliesOn: true,
+    noise: false,
+    open: true,
+    severity: 6,
+  },
+  {
+    id: 'iso42001-theater',
+    theme: 'compliance',
+    label: 'Treat ISO 42001 marketing as an attestation',
+    attackerReliesOn: false,
+    noise: true,
+    open: false,
+    severity: 1,
+  },
+  {
+    id: 'vendor-webinar-sailpoint',
+    theme: 'identity',
+    label: 'SailPoint / BrightTALK vendor webinar as a product claim',
+    attackerReliesOn: false,
+    noise: true,
+    open: false,
+    severity: 0,
+  },
+];
+
+function rankDigest(entries, options = {}) {
+  const interests = Array.isArray(options.interests) && options.interests.length
+    ? options.interests
+    : DEFAULT_INTERESTS;
+  const maxDigest = Number.isFinite(options.maxDigest) && options.maxDigest > 0
+    ? options.maxDigest
+    : DEFAULT_MAX_DIGEST;
+  const interestSet = new Set(interests);
+  return [...entries]
+    .filter((e) => !e.noise && interestSet.has(e.theme))
+    .sort((a, b) => (b.severity || 0) - (a.severity || 0))
+    .slice(0, maxDigest);
+}
+
+function applyLiveHookDrift(entries, projectRoot, homeDir, assessHookDriftFn) {
+  if (!projectRoot) return { entries, error: null };
+  try {
+    const assessHookDrift = typeof assessHookDriftFn === 'function'
+      ? assessHookDriftFn
+      : require('./agent-security-central').assessHookDrift;
+    const assessment = assessHookDrift(projectRoot, homeDir);
+    const drifted = Boolean(assessment && assessment.drifted);
+    return {
+      entries: entries.map((e) => (
+        e.id === 'pretooluse-unwired' ? { ...e, open: drifted } : e
+      )),
+      error: null,
+    };
+  } catch (err) {
+    return {
+      entries,
+      error: `Live hook drift assessment failed: ${err.message}`,
+    };
+  }
+}
+
+function runHiddenEntryScorecard(options = {}) {
+  const base = Array.isArray(options.entries) && options.entries.length
+    ? options.entries
+    : ENTRY_POINTS;
+  const { entries, error: liveError } = applyLiveHookDrift(
+    base,
+    options.projectRoot,
+    options.homeDir,
+    options.assessHookDrift
+  );
+  const loadAll = entries.map((e) => e.id);
+  const digest = rankDigest(entries, options);
+  const openAttacker = entries.filter((e) => e.attackerReliesOn && e.open);
+  const noiseDropped = entries.filter((e) => e.noise).map((e) => e.id);
+  const digestIds = digest.map((e) => e.id);
+  const digestHasNoise = digest.some((e) => e.noise);
+  const digestHasClosedTheater = digest.some((e) => !e.attackerReliesOn);
+
+  const failures = [];
+  if (liveError) {
+    failures.push(liveError);
+  }
+  if (openAttacker.length === 0) {
+    failures.push('no open hidden entry — fixture is not a misconfig case');
+  }
+  if (digest.length === 0) {
+    failures.push('interest digest is empty');
+  }
+  if (digest.length >= loadAll.length) {
+    failures.push('digest did not rank — load-all still shown');
+  }
+  if (digestHasNoise || digestHasClosedTheater) {
+    failures.push('digest still contains vendor/ISO theater');
+  }
+  if (!digestIds.includes('pretooluse-unwired') && openAttacker.some((e) => e.id === 'pretooluse-unwired')) {
+    failures.push('open PreToolUse miss not in digest');
+  }
+
+  let mode = 'simulation';
+  if (options.projectRoot) {
+    mode = liveError ? 'live-assessment-failed' : 'live-overlay';
+  }
+
+  return {
+    schema: SCHEMA,
+    mode,
+    generatedAt: new Date().toISOString(),
+    autoApply: false,
+    humanOversightRequired: true,
+    reviewVolumeIsNotTheControl: true,
+    capturedRevenueUsd: 0,
+    affiliation: 'none',
+    iso42001Certified: false,
+    process: {
+      source: 'BrightTALK weekly-rec process — not BrightTALK/SailPoint/ISO 42001 product',
+      interestRankedDigest: true,
+      unifiedAlertManager: false,
+    },
+    interests: options.interests || DEFAULT_INTERESTS,
+    loadAll,
+    digest: digestIds,
+    openAttacker: openAttacker.map((e) => e.id),
+    noiseDropped,
+    summary: {
+      ok: failures.length === 0,
+      failures,
+    },
+    disclaimers: [
+      'SIMULATION unless --project. Does not install hooks.',
+      'Not BrightTALK, SailPoint, Strike48, Abnormal, A-LIGN, or ISO 42001.',
+      'Review volume is not the control — PreToolUse is. capturedRevenueUsd is 0.',
+      'ThumbGate is not ISO 42001 certified. Do not treat this scorecard as an attestation.',
+    ],
+  };
+}
+
+function formatReport(report) {
+  return [
+    '# Hidden entry points vs interest digest',
+    '',
+    `Result: ${report.summary.ok ? 'PASS' : 'FAIL'}  open=${(report.openAttacker || []).length}`,
+    '',
+    `| Path | Count |`,
+    `|------|------:|`,
+    `| Load-all webinars | ${report.loadAll.length} |`,
+    `| Interest digest | ${report.digest.length} |`,
+    `| Open attacker entries | ${report.openAttacker.length} |`,
+    '',
+    `Digest: ${(report.digest || []).join(', ') || '—'}`,
+    `Noise dropped: ${(report.noiseDropped || []).join(', ') || '—'}`,
+    `iso42001Certified=${report.iso42001Certified}  autoApply=${report.autoApply}  capturedRevenueUsd=${report.capturedRevenueUsd}`,
+    '',
+    ...report.disclaimers.map((d) => `- ${d}`),
+    '',
+  ].join('\n');
+}
+
+function mainCli(argv = process.argv.slice(2)) {
+  const json = argv.includes('--json');
+  const writeIdx = argv.indexOf('--write');
+  let writePath = null;
+  if (writeIdx >= 0) {
+    const candidate = argv[writeIdx + 1];
+    if (!candidate || candidate.startsWith('-')) {
+      process.stderr.write('Error: --write requires a valid file path\n');
+      return 1;
+    }
+    writePath = candidate;
+  }
+  const projectIdx = argv.indexOf('--project');
+  let projectRoot = null;
+  if (projectIdx >= 0) {
+    const candidate = argv[projectIdx + 1];
+    if (!candidate || candidate.startsWith('-')) {
+      process.stderr.write('Error: --project requires a valid directory path\n');
+      return 1;
+    }
+    projectRoot = candidate;
+  }
+  const report = runHiddenEntryScorecard(projectRoot ? { projectRoot } : {});
+
+  if (writePath) {
+    const abs = path.resolve(writePath);
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    const jsonPath = /\.json$/i.test(abs) ? abs : `${abs}.json`;
+    fs.writeFileSync(jsonPath, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+  }
+
+  if (json) {
+    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  } else {
+    process.stdout.write(formatReport(report));
+  }
+  return report.summary.ok ? 0 : 1;
+}
+
+module.exports = {
+  SCHEMA,
+  DEFAULT_INTERESTS,
+  ENTRY_POINTS,
+  rankDigest,
+  applyLiveHookDrift,
+  runHiddenEntryScorecard,
+  formatReport,
+  mainCli,
+};
+
+if (path.resolve(process.argv[1] || '') === path.resolve(__filename)) {
+  process.exitCode = mainCli();
+}

package/scripts/human-escalation.js

@@ -49,6 +49,7 @@ function requestEscalation(input = {}, options = {}) {
   const ttlMs = Math.min(MAX_TTL_MS, Math.max(1, finiteNumber(input.ttlMs, DEFAULT_TTL_MS)));
   const idempotencyKey = requiredString(input.idempotencyKey || taskId, 'idempotencyKey');
   const approvalContextDigest = optionalDigest(input.approvalContextDigest, 'approvalContextDigest');
+  const requiredReviewerRole = optionalString(input.requiredReviewerRole);
   const request = {
     escalationId: input.escalationId || `esc_${crypto.randomUUID()}`,
     idempotencyKey,
@@ -63,6 +64,7 @@ function requestEscalation(input = {}, options = {}) {
     eventType: 'requested',
   };
   if (approvalContextDigest) request.approvalContextDigest = approvalContextDigest;
+  if (requiredReviewerRole) request.requiredReviewerRole = requiredReviewerRole;
   return withEscalationLock(options, () => {
     const ledger = readLedger(options);
     assertLedgerHealthy(ledger);
@@ -107,6 +109,9 @@ function decideEscalation(input = {}, options = {}) {
     if (!current) throw escalationError(`unknown escalation '${escalationId}'`);
     if (current.status !== 'pending') throw escalationError(`escalation '${escalationId}' is already ${current.status}`);
     if (sameIdentity(current.requester, actor)) throw escalationError('requester cannot decide their own escalation');
+    if (current.requiredReviewerRole && actor.role !== current.requiredReviewerRole) {
+      throw escalationError(`authenticated reviewer must have role '${current.requiredReviewerRole}'`);
+    }
 
     const now = options.now || new Date();
     const event = {
@@ -145,6 +150,8 @@ function getVerifiedApprovalUnlocked(escalationId, options = {}) {
   const events = ledger.events.filter((event) => event.escalationId === escalationId);
   const requested = events.find((event) => event.eventType === 'requested');
   const decided = events.findLast((event) => event.eventType === 'decided');
+  const consumed = events.findLast((event) => event.eventType === 'consumed');
+  if (consumed && options.allowConsumed !== true) return null;
   if (!requested || !decided || decided.status !== 'approved') return null;
   if (decided.taskId !== requested.taskId) throw escalationError('approval task does not match its request');
   if ((requested.approvalContextDigest || null) !== (decided.approvalContextDigest || null)) {
@@ -153,6 +160,9 @@ function getVerifiedApprovalUnlocked(escalationId, options = {}) {
   if (decided.actor?.kind !== 'human' || sameIdentity(requested.requester, decided.actor)) {
     throw escalationError('approval is not from an independent human actor');
   }
+  if (requested.requiredReviewerRole && decided.actor.role !== requested.requiredReviewerRole) {
+    throw escalationError('approval is not from the required reviewer role');
+  }
   const verificationKey = optionalString(
     options.approvalVerificationKey || process.env.THUMBGATE_HUMAN_REVIEWER_KEY
   );
@@ -162,6 +172,33 @@ function getVerifiedApprovalUnlocked(escalationId, options = {}) {
   return { ...requested, ...decided };
 }
 
+function consumeVerifiedApproval(escalationId, input = {}, options = {}) {
+  const consumer = requiredIdentity(input.consumer, 'consumer');
+  return withEscalationLock(options, () => {
+    const ledger = readLedger(options);
+    assertLedgerHealthy(ledger);
+    const events = ledger.events.filter((event) => event.escalationId === escalationId);
+    const existingConsumption = events.findLast((event) => event.eventType === 'consumed');
+    if (existingConsumption) {
+      return { consumed: false, replayed: true, consumption: existingConsumption };
+    }
+    const approval = getVerifiedApprovalUnlocked(escalationId, { ...options, allowConsumed: true });
+    if (!approval || Date.parse(approval.expiresAt) <= (options.now || new Date()).getTime()) {
+      return { consumed: false, replayed: false, consumption: null };
+    }
+    const consumedAt = (options.now || new Date()).toISOString();
+    const consumption = appendEventUnlocked({
+      escalationId,
+      taskId: approval.taskId,
+      eventType: 'consumed',
+      consumer,
+      consumedAt,
+      approvalContextDigest: approval.approvalContextDigest || null,
+    }, options, ledger.events);
+    return { consumed: true, replayed: false, approval, consumption };
+  });
+}
+
 function listEscalations(options = {}) {
   return projectEscalations(readEvents(options), options);
 }
@@ -454,7 +491,7 @@ function approvalPayload(event) {
     taskId: event.taskId,
     status: event.status,
     decision: event.decision,
-    actor: event.actor,
+    actor: event.actor ? { ...event.actor } : event.actor,
     reason: event.reason,
     decidedAt: event.decidedAt,
   };
@@ -470,6 +507,8 @@ function requiredIdentity(value, field) {
   };
   const displayName = optionalString(value.displayName);
   if (displayName) identity.displayName = displayName;
+  const role = optionalString(value.role);
+  if (role) identity.role = role;
   return identity;
 }
 
@@ -521,6 +560,7 @@ function eventComparableHash(event) {
     evidence: event.evidence,
   };
   if (event.approvalContextDigest) comparable.approvalContextDigest = event.approvalContextDigest;
+  if (event.requiredReviewerRole) comparable.requiredReviewerRole = event.requiredReviewerRole;
   return crypto.createHash('sha256').update(stableStringify(comparable)).digest('hex');
 }
 
@@ -548,6 +588,160 @@ function escalationError(message) {
   return error;
 }
 
+function createMemoryGrantStore() {
+  const consumed = new Set();
+  return {
+    consume(grantId) {
+      const id = String(grantId || '').trim();
+      if (!id) return { ok: false, reason: 'missing_grant_id' };
+      if (consumed.has(id)) return { ok: false, reason: 'grant_already_consumed' };
+      consumed.add(id);
+      return { ok: true };
+    },
+  };
+}
+
+function createDurableGrantStore(options = {}) {
+  const storePath = options.grantStorePath || path.join(
+    getFeedbackPaths(options).FEEDBACK_DIR,
+    'harness-grants.jsonl'
+  );
+  return {
+    consume(grantId) {
+      const id = String(grantId || '').trim();
+      if (!id) return { ok: false, reason: 'missing_grant_id' };
+      return withFileLedgerLock(`${storePath}.lock`, () => {
+        let raw = '';
+        try {
+          raw = fs.readFileSync(storePath, 'utf8');
+        } catch (error) {
+          if (error.code !== 'ENOENT') throw error;
+        }
+        for (const line of raw.split('\n')) {
+          if (!line.trim()) continue;
+          try {
+            if (JSON.parse(line).grantId === id) {
+              return { ok: false, reason: 'grant_already_consumed' };
+            }
+          } catch {
+            return { ok: false, reason: 'grant_store_corrupt' };
+          }
+        }
+        fs.mkdirSync(path.dirname(storePath), { recursive: true });
+        fs.appendFileSync(storePath, `${JSON.stringify({
+          grantId: id,
+          consumedAt: (options.now || new Date()).toISOString(),
+        })}\n`);
+        return { ok: true };
+      }, {
+        now: options.now,
+        lockStaleMs: options.lockStaleMs,
+        errorFactory: (message) => escalationError(message),
+      });
+    },
+  };
+}
+const ALLOW_ONCE_GRANT_MODES = new Set(['once', 'allow-once', 'allowed-once', 'allow_once']);
+const ALLOW_ALWAYS_GRANT_MODES = new Set(['always', 'allow-always', 'allow_always']);
+
+/**
+ * DeepSeek-style harness grant.
+ * Missing or throwing/failing approver fails closed (never silent-allow).
+ * Grants are allow-once only; allow-always is rejected.
+ */
+function evaluateHarnessGrant(input = {}, options = {}) {
+  const grantMode = String(input.grantMode || input.mode || 'once').trim().toLowerCase();
+  if (ALLOW_ALWAYS_GRANT_MODES.has(grantMode)) {
+    return { allowed: false, failClosed: true, reason: 'allow_always_forbidden' };
+  }
+  if (!ALLOW_ONCE_GRANT_MODES.has(grantMode)) {
+    return { allowed: false, failClosed: true, reason: 'unsupported_grant_mode' };
+  }
+  if (input.approver == null) {
+    return { allowed: false, failClosed: true, reason: 'missing_approver' };
+  }
+
+  let verdict;
+  try {
+    verdict = typeof input.approver === 'function' ? input.approver(input.action) : input.approver;
+  } catch (error) {
+    return {
+      allowed: false,
+      failClosed: true,
+      reason: 'approver_failed',
+      detail: String(error && error.message ? error.message : error),
+    };
+  }
+  if (verdict && typeof verdict.then === 'function') {
+    return {
+      allowed: false,
+      failClosed: true,
+      reason: 'approver_failed',
+      detail: 'async approver must be resolved by caller',
+    };
+  }
+  if (!verdict || verdict.allow !== true) {
+    return {
+      allowed: false,
+      failClosed: true,
+      reason: (verdict && verdict.reason) || 'approver_denied',
+    };
+  }
+
+  const grantStore = options.grantStore || createDurableGrantStore(options);
+  const grantId = String(input.grantId || input.actionId || '').trim();
+  if (!grantId) {
+    return { allowed: false, failClosed: true, reason: 'missing_grant_id' };
+  }
+  let consumed;
+  try {
+    consumed = grantStore.consume(grantId);
+  } catch (error) {
+    return {
+      allowed: false,
+      failClosed: true,
+      reason: 'grant_store_failed',
+      detail: String(error && error.message ? error.message : error),
+    };
+  }
+  if (!consumed || !consumed.ok) {
+    return { allowed: false, failClosed: true, reason: (consumed && consumed.reason) || 'grant_already_consumed' };
+  }
+
+  const facts = {
+    actionId: grantId,
+    toolName: input.toolName || (input.action && input.action.toolName) || 'harness_action',
+    toolInput: (input.action && input.action.toolInput) || input.toolInput || {},
+    decision: 'allow',
+    grantMode: 'allow-once',
+    principal: input.principal || 'harness',
+  };
+
+  if (options.recordReceipt === false) {
+    return { allowed: true, failClosed: true, grantMode: 'allow-once', grantId, facts };
+  }
+
+  try {
+    const { recordReceipt } = require('./action-receipts');
+    const receipt = recordReceipt({
+      actionId: facts.actionId,
+      toolName: facts.toolName,
+      toolInput: facts.toolInput,
+      decision: facts.decision,
+      principal: facts.principal,
+      outcome: { testOutcome: 'approved-once' },
+    }, options);
+    return { allowed: true, failClosed: true, grantMode: 'allow-once', grantId, facts, receipt };
+  } catch (error) {
+    return {
+      allowed: false,
+      failClosed: true,
+      reason: 'receipt_record_failed',
+      detail: String(error && error.message ? error.message : error),
+    };
+  }
+}
+
 function isCliInvocation() {
   return Boolean(process.argv[1]) && path.resolve(process.argv[1]) === __filename;
 }
@@ -565,7 +759,11 @@ if (isCliInvocation()) {
 
 module.exports = {
   calculateEscalationMetrics,
+  consumeVerifiedApproval,
+  createDurableGrantStore,
+  createMemoryGrantStore,
   decideEscalation,
+  evaluateHarnessGrant,
   getEscalation,
   getEscalationsHeadPath,
   getEscalationsJournalPath,