trustdex 0.5.0 → 0.6.0

package/src/codex-settings.mjs

@@ -0,0 +1,247 @@
+import { parseValue, stripComment, unquote, valueComplete } from './codex-config.mjs';
+
+const APPROVAL_POLICIES = new Set(['on-request', 'never']);
+const APPROVAL_REVIEWERS = new Set(['user', 'auto_review']);
+const SANDBOX_MODES = new Set(['read-only', 'workspace-write', 'danger-full-access']);
+const BUILTIN_PERMISSIONS = new Set([':read-only', ':workspace', ':danger-full-access']);
+const WEB_SEARCH_MODES = new Set(['disabled', 'cached', 'indexed', 'live']);
+const GRANULAR_KEYS = new Set([
+  'sandbox_approval',
+  'rules',
+  'mcp_elicitations',
+  'request_permissions',
+  'skill_approval'
+]);
+const SANDBOX_KEYS = new Set([
+  'network_access',
+  'writable_roots',
+  'exclude_slash_tmp',
+  'exclude_tmpdir_env_var'
+]);
+const INSPECTED_ROOT_KEYS = new Set([
+  'approval_policy',
+  'approvals_reviewer',
+  'sandbox_mode',
+  'default_permissions',
+  'web_search'
+]);
+
+function isObject(value) {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+function requireBoolean(value, key) {
+  if (typeof value !== 'boolean') throw new Error(`Codex ${key} must be a boolean.`);
+  return value;
+}
+
+function requireStringArray(value, key) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || !item.trim())) {
+    throw new Error(`Codex ${key} must be an array of non-empty strings.`);
+  }
+  return value;
+}
+
+function parseApprovalPolicy(value) {
+  if (typeof value === 'string') {
+    if (!APPROVAL_POLICIES.has(value)) throw new Error('Unsupported Codex approval_policy value.');
+    return { mode: value, promptCategories: [] };
+  }
+  if (!isObject(value) || !isObject(value.granular) || Object.keys(value).some((key) => key !== 'granular')) {
+    throw new Error('Codex approval_policy must be "on-request", "never", or a granular policy.');
+  }
+  for (const [key, enabled] of Object.entries(value.granular)) {
+    if (!GRANULAR_KEYS.has(key) || typeof enabled !== 'boolean') {
+      throw new Error(`Unsupported Codex granular approval setting: ${key}`);
+    }
+  }
+  return {
+    mode: 'granular',
+    promptCategories: Object.entries(value.granular)
+      .filter(([, enabled]) => enabled)
+      .map(([key]) => key)
+      .sort()
+  };
+}
+
+function parseTomlAssignments(text) {
+  const lines = String(text || '').split(/\r?\n/);
+  const root = Object.create(null);
+  const sandbox = Object.create(null);
+  const agents = Object.create(null);
+  const approvalGranular = Object.create(null);
+  const sections = new Set();
+  let section = '';
+
+  for (let i = 0; i < lines.length; i += 1) {
+    const cleaned = stripComment(lines[i]).trim();
+    if (!cleaned) continue;
+
+    const header = cleaned.match(/^\[([^\]]+)\]$/);
+    if (header) {
+      section = header[1].trim();
+      if (section.startsWith('sandbox_workspace_write.') ||
+          (section.startsWith('approval_policy.') && section !== 'approval_policy.granular')) {
+        throw new Error(`Unsupported Codex security section: ${section}`);
+      }
+      sections.add(section);
+      continue;
+    }
+
+    const eq = cleaned.indexOf('=');
+    if (eq < 1) {
+      if (section === 'sandbox_workspace_write' || !section) {
+        throw new Error(`Unsupported Codex TOML line ${i + 1}: expected key = value`);
+      }
+      continue;
+    }
+
+    const key = unquote(cleaned.slice(0, eq).trim());
+    let raw = cleaned.slice(eq + 1).trim();
+    while (!valueComplete(raw)) {
+      i += 1;
+      if (i >= lines.length) throw new Error(`Unterminated TOML value for ${key}`);
+      raw += `\n${stripComment(lines[i]).trim()}`;
+    }
+    const value = parseValue(raw);
+
+    if (!section) {
+      if (key.startsWith('sandbox_workspace_write.')) {
+        const nestedKey = key.slice('sandbox_workspace_write.'.length);
+        if (!nestedKey || nestedKey.includes('.')) throw new Error(`Unsupported Codex sandbox key: ${key}`);
+        if (Object.hasOwn(sandbox, nestedKey)) throw new Error(`Duplicate Codex sandbox setting: ${nestedKey}`);
+        sandbox[nestedKey] = value;
+      } else if (key.startsWith('approval_policy.granular.')) {
+        const nestedKey = key.slice('approval_policy.granular.'.length);
+        if (!nestedKey || nestedKey.includes('.')) throw new Error(`Unsupported Codex approval setting: ${key}`);
+        if (Object.hasOwn(approvalGranular, nestedKey)) throw new Error(`Duplicate Codex approval setting: ${nestedKey}`);
+        approvalGranular[nestedKey] = value;
+      } else {
+        if (Object.hasOwn(root, key)) throw new Error(`Duplicate Codex root setting: ${key}`);
+        root[key] = value;
+      }
+    } else if (section === 'sandbox_workspace_write') {
+      if (Object.hasOwn(sandbox, key)) throw new Error(`Duplicate Codex sandbox setting: ${key}`);
+      sandbox[key] = value;
+    } else if (section === 'agents') {
+      if (Object.hasOwn(agents, key)) throw new Error(`Duplicate Codex agents setting: ${key}`);
+      agents[key] = value;
+    } else if (section === 'approval_policy.granular') {
+      if (Object.hasOwn(approvalGranular, key)) throw new Error(`Duplicate Codex approval setting: ${key}`);
+      approvalGranular[key] = value;
+    }
+  }
+
+  if (Object.keys(approvalGranular).length) {
+    if (root.approval_policy !== undefined) {
+      throw new Error('Codex approval_policy cannot be declared in more than one form.');
+    }
+    root.approval_policy = { granular: approvalGranular };
+  }
+
+  return { root, sandbox, agents, sections: [...sections].sort() };
+}
+
+function validateSandbox(sandbox) {
+  for (const key of Object.keys(sandbox)) {
+    if (!SANDBOX_KEYS.has(key)) throw new Error(`Unsupported Codex sandbox_workspace_write setting: ${key}`);
+  }
+  if (sandbox.network_access !== undefined) requireBoolean(sandbox.network_access, 'sandbox network_access');
+  if (sandbox.writable_roots !== undefined) requireStringArray(sandbox.writable_roots, 'sandbox writable_roots');
+  if (sandbox.exclude_slash_tmp !== undefined) requireBoolean(sandbox.exclude_slash_tmp, 'sandbox exclude_slash_tmp');
+  if (sandbox.exclude_tmpdir_env_var !== undefined) {
+    requireBoolean(sandbox.exclude_tmpdir_env_var, 'sandbox exclude_tmpdir_env_var');
+  }
+}
+
+export function inspectCodexSettingsText(text, sourceName = 'config.toml') {
+  const { root, sandbox, agents, sections } = parseTomlAssignments(text);
+  validateSandbox(sandbox);
+
+  const signals = new Set();
+  let approval = { mode: null, promptCategories: [] };
+  if (root.approval_policy !== undefined) {
+    approval = parseApprovalPolicy(root.approval_policy);
+    if (approval.mode === 'never') signals.add('codex-no-approvals');
+  }
+
+  if (root.approvals_reviewer !== undefined) {
+    if (!APPROVAL_REVIEWERS.has(root.approvals_reviewer)) {
+      throw new Error('Unsupported Codex approvals_reviewer value.');
+    }
+    if (root.approvals_reviewer === 'auto_review') signals.add('codex-auto-review');
+  }
+
+  if (root.sandbox_mode !== undefined) {
+    if (!SANDBOX_MODES.has(root.sandbox_mode)) throw new Error('Unsupported Codex sandbox_mode value.');
+    if (root.sandbox_mode === 'workspace-write') signals.add('codex-workspace-write');
+    if (root.sandbox_mode === 'danger-full-access') signals.add('codex-full-access');
+  }
+
+  if (root.default_permissions !== undefined) {
+    if (typeof root.default_permissions !== 'string' || !root.default_permissions.trim()) {
+      throw new Error('Codex default_permissions must be a non-empty string.');
+    }
+    if (root.sandbox_mode !== undefined || sections.includes('sandbox_workspace_write') || Object.keys(sandbox).length) {
+      throw new Error('Codex default_permissions cannot be combined with sandbox_mode or sandbox_workspace_write.');
+    }
+    if (root.default_permissions === ':workspace') signals.add('codex-workspace-write');
+    else if (root.default_permissions === ':danger-full-access') signals.add('codex-full-access');
+    else if (!BUILTIN_PERMISSIONS.has(root.default_permissions)) signals.add('codex-custom-permissions');
+  }
+
+  if (root.web_search !== undefined) {
+    if (!WEB_SEARCH_MODES.has(root.web_search)) throw new Error('Unsupported Codex web_search value.');
+    if (root.web_search === 'live') signals.add('codex-live-web-search');
+  }
+
+  if (sandbox.network_access === true) signals.add('codex-network-access');
+  const writableRoots = sandbox.writable_roots || [];
+  if (writableRoots.length) signals.add('codex-additional-writable-roots');
+  if (sandbox.exclude_slash_tmp === false || sandbox.exclude_tmpdir_env_var === false) {
+    signals.add('codex-temp-write-access');
+  }
+  if (agents.enabled !== undefined) {
+    requireBoolean(agents.enabled, 'agents.enabled');
+    if (agents.enabled) signals.add('codex-subagents-enabled');
+  }
+  const uninspectedAgentKeys = Object.keys(agents).filter((key) => key !== 'enabled').sort();
+  if (uninspectedAgentKeys.length) signals.add('codex-subagent-settings');
+
+  const uninspectedRootKeys = Object.keys(root).filter((key) => !INSPECTED_ROOT_KEYS.has(key)).sort();
+  if (uninspectedRootKeys.length) signals.add('uninspected-codex-settings');
+
+  const sectionKinds = new Set(sections.map((section) => section.split('.')[0]));
+  sectionKinds.delete('sandbox_workspace_write');
+  sectionKinds.delete('approval_policy');
+  sectionKinds.delete('mcp_servers');
+  if (!uninspectedAgentKeys.length) sectionKinds.delete('agents');
+  if (sectionKinds.has('permissions')) signals.add('codex-custom-permissions');
+  if (sectionKinds.has('apps') || sectionKinds.has('plugins')) signals.add('codex-extension-settings');
+  if (sectionKinds.size) signals.add('uninspected-codex-sections');
+
+  return {
+    name: sourceName,
+    kind: 'codex-settings',
+    source: { type: 'local', format: 'codex-settings', path: sourceName },
+    metadata: {
+      approvalPolicy: approval.mode,
+      granularPromptCategories: approval.promptCategories,
+      approvalsReviewer: root.approvals_reviewer || null,
+      sandboxMode: root.sandbox_mode || null,
+      defaultPermissionsKind: BUILTIN_PERMISSIONS.has(root.default_permissions)
+        ? root.default_permissions
+        : root.default_permissions ? 'custom' : null,
+      webSearch: root.web_search || null,
+      networkAccess: sandbox.network_access === true,
+      additionalWritableRootCount: writableRoots.length,
+      tempRootsExcluded: sandbox.exclude_slash_tmp === true && sandbox.exclude_tmpdir_env_var === true,
+      subagentsEnabled: agents.enabled === true,
+      uninspectedAgentKeys,
+      uninspectedRootKeys,
+      uninspectedSectionKinds: [...sectionKinds].sort()
+    },
+    signals: [...signals].sort(),
+    envKeys: []
+  };
+}

package/src/inspect.mjs

@@ -42,6 +42,57 @@ function looksLikePath(value) {
     value.startsWith('../') || /^[A-Za-z]:\\/.test(value);
 }
 
+function fingerprintUrl(value) {
+  try {
+    const url = new URL(String(value));
+    return {
+      origin: `${url.protocol.toLowerCase()}//${url.host.toLowerCase()}`,
+      pathname: url.pathname,
+      queryKeys: [...new Set(url.searchParams.keys())].sort()
+    };
+  } catch {
+    return { invalid: true };
+  }
+}
+
+function fingerprintArgs(args) {
+  const values = Array.isArray(args) ? args.map(String) : [];
+  const sanitized = [];
+  let redactNext = false;
+
+  for (const value of values) {
+    if (redactNext) {
+      sanitized.push('<redacted>');
+      redactNext = false;
+      continue;
+    }
+
+    const assignment = value.match(/^(-{1,2}[^=]+)=(.*)$/);
+    if (assignment && SECRET_KEY_RE.test(assignment[1])) {
+      sanitized.push(`${assignment[1]}=<redacted>`);
+      continue;
+    }
+    if (/^-{1,2}/.test(value) && SECRET_KEY_RE.test(value)) {
+      sanitized.push(value);
+      redactNext = true;
+      continue;
+    }
+    if (value === '-H' || value === '--header') {
+      sanitized.push(value);
+      redactNext = true;
+      continue;
+    }
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) {
+      sanitized.push(fingerprintUrl(value));
+      continue;
+    }
+
+    sanitized.push(value);
+  }
+
+  return sanitized;
+}
+
 function extractRemoteEndpoint(server) {
   const candidate = server?.url || server?.endpoint;
   if (!candidate) return null;
@@ -53,6 +104,8 @@ function extractRemoteEndpoint(server) {
       host: url.hostname.toLowerCase(),
       origin: `${protocol}//${url.host.toLowerCase()}`,
       protocol,
+      pathname: url.pathname,
+      queryKeys: [...new Set(url.searchParams.keys())].sort(),
       hasEmbeddedCredentials: Boolean(url.username || url.password),
       hasQuery: Boolean(url.search)
     };
@@ -95,9 +148,13 @@ function normalizeServer(name, server = {}) {
 
   const fingerprint = sha256Json({
     command,
-    args,
-    url: server.url || null,
-    endpoint: server.endpoint || null,
+    args: fingerprintArgs(args),
+    remoteEndpoint: remote ? {
+      origin: remote.origin,
+      pathname: remote.pathname,
+      queryKeys: remote.queryKeys
+    } : null,
+    invalidEndpoint: (server.url || server.endpoint) && !remote ? true : null,
     envKeys,
     adapter: server._trustdexFingerprintData || null
   });

package/src/policy-packs.mjs

@@ -14,7 +14,39 @@ const BASE_SIGNALS = {
   'embedded-credentials': 'block',
   'insecure-transport': 'block',
   'url-query-parameters': 'ask',
-  'artifact-version-mismatch': 'block'
+  'artifact-version-mismatch': 'block',
+  'claude-auto-approve': 'ask',
+  'claude-broad-auto-approve': 'block',
+  'claude-shell-auto-approve': 'block',
+  'claude-filesystem-auto-approve': 'ask',
+  'claude-network-auto-approve': 'ask',
+  'claude-subagent-auto-approve': 'ask',
+  'claude-mcp-auto-approve': 'ask',
+  'claude-mcp-wildcard': 'ask',
+  'claude-bypass-permissions': 'block',
+  'claude-auto-mode': 'ask',
+  'claude-additional-directories': 'ask',
+  'claude-outside-read-access': 'ask',
+  'claude-hooks': 'block',
+  'claude-credential-helper': 'block',
+  'claude-environment': 'ask',
+  'claude-sandbox-settings': 'ask',
+  'claude-extension-loading': 'ask',
+  'uninspected-claude-settings': 'ask',
+  'codex-no-approvals': 'ask',
+  'codex-auto-review': 'ask',
+  'codex-workspace-write': 'ask',
+  'codex-full-access': 'block',
+  'codex-network-access': 'ask',
+  'codex-additional-writable-roots': 'ask',
+  'codex-temp-write-access': 'ask',
+  'codex-live-web-search': 'ask',
+  'codex-custom-permissions': 'ask',
+  'codex-subagents-enabled': 'ask',
+  'codex-subagent-settings': 'ask',
+  'codex-extension-settings': 'ask',
+  'uninspected-codex-settings': 'ask',
+  'uninspected-codex-sections': 'ask'
 };
 
 export const POLICY_PACKS = Object.freeze({
@@ -59,7 +91,11 @@ export const POLICY_PACKS = Object.freeze({
     signalActions: {
       ...BASE_SIGNALS,
       'shell-execution': 'ask',
-      'insecure-transport': 'ask'
+      'insecure-transport': 'ask',
+      'claude-broad-auto-approve': 'ask',
+      'claude-shell-auto-approve': 'ask',
+      'claude-hooks': 'ask',
+      'claude-credential-helper': 'ask'
     }
   })
 });