daemonaudit 0.1.0__tar.gz

daemonaudit-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,50 @@
+name: ci
+on:
+  push:
+    branches: [master]
+    tags: ["v*"]
+  pull_request:
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ["3.10", "3.12"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - run: python -m pip install -e ".[dev]"
+      - run: python -m pytest -q
+      - name: smoke-scan a demo home
+        shell: bash
+        run: |
+          python scripts/demo_home.py demo-hermes
+          daemonaudit scan --red --home demo-hermes --json out.json --html out.html || test $? -eq 2
+          python -c "import json; d=json.load(open('out.json')); assert d['summary']['attack_paths'] >= 1, d['summary']"
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - run: python -m pip install build && python -m build
+      - uses: actions/upload-artifact@v4
+        with: { name: dist, path: dist/ }
+  # Publishes to PyPI via Trusted Publishing (OIDC — no API token stored).
+  # One-time setup on pypi.org before the first release can publish: see below.
+  publish:
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # mint the OIDC token PyPI trusts; no secrets needed
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: dist, path: dist/ }
+      - uses: pypa/gh-action-pypi-publish@release/v1

daemonaudit-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+.venv/
+__pycache__/
+*.pyc
+*.egg-info/
+dist/
+build/
+.pytest_cache/
+# never commit real scan output
+*.daemonaudit.json
+daemonaudit-report.*

daemonaudit-0.1.0/AGENTS.md

@@ -0,0 +1,53 @@
+# daemonaudit — shared brief for every agent working here
+
+This file is read by Codex (AGENTS.md) and by Claude Code (CLAUDE.md points here).
+It holds the invariants. BUILD.md holds the plan and the task queue.
+
+## What this is
+A Python CLI that audits self-hosted AI agent daemons (Hermes Agent first; OpenClaw
+and generic MCP configs later) for secrets on disk, exposed ports, weak policy config
+and risky skills, then reports **attack paths and blast radius**, grouped by attacker
+position (remote / injected content / supply-chain / local).
+
+## Invariants — never break these
+1. **Read-only.** The scanner never modifies the host. `Remediation.apply()` is v0.2
+   and is not wired to anything.
+2. **Zero network egress.** No telemetry, no update checks, no "phone home". Red-team
+   probes connect to **localhost only** and must hard-fail on any non-loopback target.
+3. **Secrets are redacted at detection.** `RedactedSecret` has no raw-value field on
+   purpose. Evidence strings are redacted. All report output passes through
+   `redact.scrub()` as a safety net. A test asserts no fixture secret appears in output.
+4. **No false passes.** A check that cannot run raises `Skipped` → status `skip`.
+   An exception → status `error`. Neither ever renders as `pass`.
+5. **Never follow symlinks** when walking the daemon home. A hostile skill can plant one.
+6. **Every Finding** has `why`, `fix`, and (almost always) `verify_cmd`. If you can't
+   tell the user how to verify the fix, the finding isn't done.
+7. **Framework layout knowledge lives in `discover/<framework>.py` only.** Checks ask
+   the Target for paths; they never hard-code `~/.hermes`.
+8. **Fixtures use obviously fake secrets** (`FAKE` in the body, correct shape). Never
+   commit a real key, a real chat ID, or a real phone number — not even in a report.
+
+## Layout
+```
+src/daemonaudit/
+  model.py       Finding / CheckResult / Target / ScanReport / RedactedSecret
+  redact.py      detection patterns, display(), fingerprint(), scrub()
+  registry.py    @check decorator, run_all(), Skipped
+  platform/      OS abstraction (posix now, windows v0.2); psutil-backed
+  discover/      framework adapters (hermes.py)
+  checks/        BLUE passive checks — one file per area
+  probes/        RED active probes — localhost only (milestone 3)
+  chain/         attack-path rules (milestone 3)
+  report/        terminal (rich), json, html (milestone 4)
+tests/           pytest; conftest.py builds a fake ~/.hermes with one of everything
+reviews/codex/   Codex writes its reports here (see BUILD.md)
+reviews/claude/  Claude's responses to those reports
+```
+
+## Conventions
+- Python ≥ 3.10, deps: psutil, rich, pyyaml. Don't add more without a reason in BUILD.md.
+- Check ids: `AREA-NNN` (SEC, PERM, NET, POL, SKILL, PROC, RED). Stable forever once shipped.
+- Severity: CRITICAL = remote unauth → code exec or all secrets; HIGH = secrets exposed
+  or unauth reachable service; MEDIUM = policy weakness that needs one more hop; LOW = hygiene.
+- Run `pytest` before declaring anything done. `daemonaudit scan` against a real home is
+  the smoke test.

daemonaudit-0.1.0/BUILD.md

@@ -0,0 +1,218 @@
+# BUILD.md — plan, status, and the Codex task queue
+
+Two agents work on this repo. **Claude Code** builds `src/` during milestones 1–2.
+**Codex** reviews, writes adversarial fixtures, and (milestone 3) builds the Windows
+platform adapter. Both read `AGENTS.md` first. Humans read this file to see where things are.
+
+## Milestones
+
+| # | Scope | Status |
+|---|-------|--------|
+| 1 | Skeleton, model, redaction, Hermes discovery, checks SEC-001 / PERM-001..003, terminal + JSON report, tests | **done 2026-08-27** (pending Codex review) |
+| 2 | NET-001/002 listeners + unix sockets; POL-001..010 (yolo/exec-ask, approvals, sandbox, allow-all users, API server, webhooks/dashboard, debug leaks, SSRF/tirith/project plugins, env passthrough, MCP literal secrets); SKILL-001 (8 categories, bundled-skill detection); ADV-001 (local update cache + acked advisories) | **done 2026-08-27** (pending Codex C3) |
+| 3 | RED-001 unauth HTTP probe (localhost gate, hard-fail otherwise), RED-002 exec-time process env, RED-003 vault blast radius; `chain/rules.py` (9 rules, tag-based, foothold floor) → attack paths with kill-hop + per-kind blast radius table; `info` status; exit codes ignore INFO | **done 2026-08-27** (pending Codex C4) |
+| 4 | `--html` self-contained report; mascot SVG + `assets/demo-report.svg` screenshot from `scripts/demo_home.py`; LICENSE (MIT); GitHub Actions CI on Linux/macOS/Windows × py3.10/3.12 with a demo smoke-scan + build; README; version 0.1.0 + tag | **done 2026-08-27** |
+| v0.2 | Windows ACL adapter, canary-injection probe, OpenClaw + generic MCP adapters, local-Ollama semantic skill review, guided remediation with rollback, `dir_fd`-relative walking for hostile trees, scrub-only pattern set broader than finding patterns | |
+
+## Threat model (what every check maps to)
+- **remote** — unauthenticated, on the network: exposed gateway/dashboard/API, no auth, default tokens
+- **content** — controls something the agent reads: prompt injection → tool use with no allowlist/sandbox
+- **supply-chain** — ships a skill / MCP server / plugin: install scripts, env passthrough, tool descriptions that instruct exfil
+- **local** — another user/process on the host: file perms, secrets in transcripts/backups/process env
+
+## How Codex and Claude hand work to each other
+
+### Where reports go
+- Codex writes every report to `reviews/codex/YYYY-MM-DD-<task-slug>.md`.
+- Claude answers in `reviews/claude/YYYY-MM-DD-<task-slug>.md` with one line per item:
+  `fixed (commit/diff ref)` · `rejected — <why>` · `deferred to M<n>`.
+- A report is "closed" when every item has a disposition. Don't reopen closed reports; write a new one.
+
+### Rules for Codex tasks
+- **Review tasks: do not edit `src/`.** Report only. Suggested patches go in the report as diff blocks.
+- **Fixture tasks:** add files only under `tests/fixtures/` and new `tests/test_evasion_*.py`. Fake secrets only (see AGENTS.md §8). A fixture that the current scanner *misses* is the goal — mark those tests `xfail` with a reason so the suite stays green until Claude patches the detector.
+- **Code tasks (M3 Windows adapter):** branch `codex/<slug>`, touch only the files the task lists, run `pytest` before finishing.
+- Never run the scanner against a real home and paste output into a report without checking it for secrets/chat IDs/phone numbers first. Prefer the pytest fixture home.
+
+### Report template
+```markdown
+# <task slug> — Codex report, <date>
+
+## Scope
+What was reviewed / produced, with file paths.
+
+## Findings
+### <n>. <title>  [severity: blocker | should-fix | nit]
+- **Where:** path:line
+- **What:** one paragraph
+- **Why it matters:** one paragraph
+- **Suggested fix:** diff block or description
+
+## Things I checked that are fine
+Bullet list. This matters as much as the findings — it tells Claude what not to re-verify.
+
+## Open questions for Claude
+```
+
+## Lessons from the first real run (2026-08-27, WSL2 box)
+Codex: read these before C1/C2 — they are the known state, don't re-report them.
+- **Two false positives shipped and were fixed the same night.** A placeholder
+  (`your-password-here`) in a world-readable backup was reported as a HIGH credential leak,
+  and an English hyphenated word inside `state.db` matched the `sk-` regex. Fixes: left
+  boundary lookbehind on prefix patterns, `_looks_random()` (digits + mixed case) on
+  non-structural kinds, broader placeholder substrings. **This is exactly the class of bug C2
+  should hunt** — the detector now leans toward false negatives, and that trade-off is untested.
+- `verify_cmd` uses GNU `stat -c`; macOS needs `stat -f`. Not yet platform-aware.
+- PERM-001 emits one finding per *directory* for logs/sessions/etc. (was one per file —
+  8 near-identical panels). Top-level files still get individual findings.
+- Real result on a fresh, default Hermes 0.20.6 install: 0 high, 4 medium, 3 low. The
+  mediums are all Hermes writing `state.db`, logs and history with the default umask
+  (644) despite its docs saying 0600. Worth an upstream issue once we're confident.
+- Dev env: no system `venv`/`pip` on this box; `uv` is at `~/.local/bin`. `uv venv --python 3.12 .venv && uv pip install -p .venv/bin/python -e '.[dev]'`.
+
+## Decisions recorded from C1 (2026-08-27)
+- Result statuses: `pass · fail · skip · off · error · incomplete`. `off` = deliberate opt-out
+  (red probes without `--red`) and does not make a scan incomplete.
+- Exit codes: 0 clean+complete · 1 findings · 2 high/critical · 3 no target · 4 no findings but
+  incomplete · 5 tool error. Precedence 2 > 1 > 4 > 0. Source of truth: `model.EXIT_CODE_HELP`.
+- Checks return `CheckOutput(findings, coverage_notes)`; anything not inspected is a note, never silence.
+- `--home` may be a symlink: resolved once at discovery (`meta.home_as_given` kept). Nothing below
+  the root is ever followed; reads use `O_NOFOLLOW` + `fstat`. Full `dir_fd` walking → v0.2.
+- Framework layout lives in `model.Layout`, filled by `discover/<fw>.py`. Checks never import adapter constants.
+- Shell snippets in findings: paths via `platform.q()` (shlex), `stat` via `Platform.stat_cmd()` (Darwin-aware).
+
+## Decisions recorded from C2 (2026-08-27)
+- Detection runs over bounded derived streams (`shell`, `nfkc`, `yaml-fold`, `nulls`, `base64`, `hex`).
+  **Derived streams only yield structural/provider kinds; `generic-credential` must match as written.**
+- Two randomness heuristics: prefixed (strict) vs assignment-anchored generic (relaxed) + a
+  non-secret-name denylist. Change one without the other and you re-open a known bug.
+- `scrub()` is deliberately broader than findings: replaces hit carriers and any 40+-char opaque blob.
+- The evasion matrix is enforced (no xfails left). New evasions go in as `xfail`; promote when fixed.
+- `Hit.via` is user-visible evidence; `Hit.carrier` never leaves memory.
+
+## Lessons from M2 (2026-08-27)
+- **SKILL-001's first cut cried wolf.** Against the 82 vendor skills it flagged `tmux send-keys … 'JWT tokens'` as
+  exfiltration, `cat ~/.ssh/id_ed25519.pub` as a secret read, a review rubric saying "exfiltration" as injection,
+  and `<!-- ascii-guard-ignore -->` as a hidden instruction. Fixes: object+destination required for "send … token … to",
+  `id_*\b(?!\.pub)` (the `\b` matters — backtracking defeats a bare lookahead), imperative-to-the-agent required in comments,
+  credential-*named* env reads only. Then: **bundled detection** — a flagged file byte-identical to `hermes-agent/skills/…`
+  is labelled `(bundled)` and the category is downgraded one notch (never for invisible-unicode / vault requests / scripts piping to shell).
+- `hermes-agent` and `bin` are excluded **only at the home root** now (`Layout.exclude_root_dirs`); a skill named
+  `hermes-agent` was being swallowed. Any-depth exclusions are just venv/node_modules/__pycache__/.git.
+- Settings come from `discover/hermes_config.py`: config.yaml + .env + (fallback) the audit shell env, with source
+  tracking. Findings show env var *names* and policy values, never credential values.
+- NET-001 attributes sockets to the gateway **and its children** (the node sidecar is a child). psutil `net_connections`
+  needs root on macOS → NotSupported → `skip`, honestly.
+- ADV-001 reads Hermes's own `.update_check` cache. Zero egress preserved.
+- Real box after M2: 0 high · 5 medium · 9 low · complete · 1.2 s. The mediums: unsandboxed local backend, world-readable
+  state/logs/history (Hermes umask), and nothing else.
+
+## Decisions recorded from C3 (2026-08-27)
+- SKILL-001 normalises before matching: scripts (continuations, quote-splitting, `+` concat, simple `VAR=` substitution),
+  docs (NFKC, homoglyphs, default-ignorables incl. soft hyphen, link text, bounded base64), Python via stdlib `ast` taint.
+- Credentials are two-tier: `MASTER_ENV` names (Hermes's own provider/platform keys) are risk; scoped names are inventory.
+- Frontmatter is parsed as YAML; `metadata:` declarations are parsed but tagged non-runtime and graded down (Hermes reads top level only).
+- `DEFENSIVE` vocabulary suppresses injection matches on lines that discuss attacks — a known, documented evasion trade-off.
+- Binary files (by extension or NUL sniff) are never scanned by doc heuristics. Scrub's blob pattern excludes `/` so paths survive.
+- Every C3 fixture row is enforced; the corpus is SKILL-001's regression floor.
+
+## Lessons from M3 (2026-08-27)
+- `/proc/<pid>/environ` is the **exec-time** environment. Hermes loads `.env` after start, so RED-002 came back
+  clean on a box whose daemon plainly holds keys. The check now says exactly what it proved; RED-003 (read the vault
+  as a same-user process) is the real local blast-radius number.
+- INFO-only findings used to mark a check `fail` and would have exited 1 on a clean box. New status `info`;
+  `ScanReport.actionable` excludes INFO from exit codes and counts.
+- First chain run produced two "attack paths" on the default install, both footed on the vendor's own `curl | bash`
+  install docs (bundled, LOW). Rule now: hop 1 ≥ MEDIUM, intermediates ≥ LOW, final hop any. Default install → 0 paths.
+- The localhost gate is one function (`probes/red._assert_local`) and it is tested against public IPs and hostnames.
+  Every probe goes through `_http_get()` which calls it first. Keep it that way.
+- Real box with `--red`: 0 high · 5 medium · 10 low · 0 paths · vault = 5 credentials / 3 kinds (JWTs in auth.json).
+
+## Releasing to PyPI (Trusted Publishing)
+The `publish` job in `.github/workflows/ci.yml` runs on any `v*` tag and publishes via OIDC —
+no API token is stored anywhere. One-time setup on pypi.org, then every `vX.Y.Z` tag publishes.
+
+**One-time (user, on pypi.org, logged in):** Account → *Publishing* → *Add a pending publisher*:
+- PyPI Project Name: `daemonaudit`
+- Owner: `TLLABS-dev`   Repository: `daemonaudit`
+- Workflow name: `ci.yml`   Environment: `pypi`
+
+Then in the GitHub repo: Settings → Environments → **New environment** named `pypi` (no secrets needed).
+To publish v0.1.0 after that: re-push the tag so CI re-runs with the publish job present —
+`git push origin :refs/tags/v0.1.0 && git push origin v0.1.0` (delete + repush). Future releases:
+bump `version` in pyproject.toml + `__init__.py`, tag `vX.Y.Z`, push the tag.
+
+Token fallback (if Trusted Publishing is ever a problem): add a `PYPI_API_TOKEN` repo secret and
+give the publish step `with: { password: ${{ secrets.PYPI_API_TOKEN }} }`. Trusted Publishing is preferred.
+
+## Lessons from M4 (2026-08-27)
+- **Process attribution was too loose.** `find_processes("hermes_cli")` substring-matches any command
+  line mentioning the string — including daemonaudit's own shell wrapper. Discovery now requires a
+  *python interpreter running hermes_cli* (`GATEWAY_RE`) AND that the process belong to the home being
+  scanned (path in cmdline, or matching `HERMES_HOME`). Scanning a demo/backup home no longer probes the
+  real daemon. Test fixtures were unrealistic (fake gateway cmdlines lacked the venv path); fixed.
+- Screenshot + demo home use only FAKE credentials (`scripts/demo_home.py`); the screenshot is rendered
+  from a home under `$HOME` and deleted, so no scratch path leaks into the committed SVG.
+- HTML report is one file: inlined CSS, no `<script>`, no external asset, light/dark via prefers-color-scheme,
+  everything scrubbed + HTML-escaped. Test asserts no raw secret and no `http(s)://` in the output.
+- PyPI publish is wired but commented in CI — needs the project created + Trusted Publisher. `uvx --from git+…`
+  works today.
+
+## Lessons from C4 native verification (2026-08-27)
+- **There is no Hermes on the Windows side of TLlabs.** No `%USERPROFILE%\.hermes`, no `HERMES_HOME`, no process.
+  The "PowerShell" Hermes is the WSL install reached through Windows Terminal. `daemonaudit scan` on native
+  Windows correctly exits 3. Real installs to audit: WSL2 and the Mac. The Windows box's job is the adapter.
+- Windows Python defaults to cp1252 for `read_text()/write_text()`. Every test touching a non-ASCII fixture
+  must pass `encoding="utf-8"`. The scanner itself reads bytes and is unaffected.
+- PowerShell non-terminating errors exit 0. Any generated PowerShell verify command needs `-ErrorAction Stop`.
+- WSL can drive the Windows side (`powershell.exe` from bash); a fresh WSL session is needed to see PATH
+  changes made on Windows after the session started — use full interpreter paths instead.
+- Follow-up: the `posix_only` markers now skip PERM/SEC tests on Windows even though `posix_modes=True`;
+  port those fixtures to `icacls` so the checks are exercised natively (v0.2, with the richer principal model).
+
+## Codex task queue
+
+Take the top unclaimed task. Mark it `claimed <date>` here, then `done <date> → reviews/codex/<file>` when the report is written.
+
+### C1 — Milestone 1 review  `[closed 2026-08-27 → reviews/codex/2026-08-27-m1-review.md · answered in reviews/claude/2026-08-27-m1-review.md]`
+Review everything under `src/daemonaudit/` and `tests/` against the AGENTS.md invariants. Specifically:
+1. **Redaction end-to-end.** Can a raw secret reach stdout, the JSON file, a traceback, or a `rich` panel title? Trace `Finding.evidence`, `title`, `why`, `CheckResult.note` (tracebacks!), and `to_json()`. Try to construct a Finding that leaks.
+2. **False passes.** Any code path where a check returns `[]` because of an error it swallowed (look at every `except OSError` / `except NotSupported` in `checks/`). Each one should be judged: is silently skipping that *file* acceptable, or should the whole check SKIP?
+3. **Symlink / traversal safety.** `checks/_walk.py` and `platform/base.py`. Can a symlink inside the home make the scanner read or report a path outside it?
+4. **Regex quality in `redact.py`.** False positives you'd expect on real config (e.g. `generic-credential` on `HERMES_SESSION_KEY=` style non-secrets, base64 blobs), and false negatives for common providers (OpenRouter, Google, Discord, Azure, Slack app tokens, JWTs, `Bearer …`).
+5. **macOS.** Anything here that behaves differently on Darwin (psutil `net_connections` needs root on macOS; `os.lstat` fine; `stat -c` in `verify_cmd` is GNU-only — macOS is `stat -f '%A'`). Propose how `verify_cmd` should be platform-aware.
+6. **Exit codes / CLI ergonomics.** Anything that would surprise someone wiring this into cron or CI.
+Output: `reviews/codex/YYYY-MM-DD-m1-review.md`. Do not edit `src/`.
+
+### C2 — Evasion fixtures for the secret scanner  `[closed 2026-08-27 → reviews/codex/2026-08-27-evasion-secrets.md · answered in reviews/claude/2026-08-27-evasion-secrets.md — all 10 rows now enforced]`
+Your own C1 item #6 is the brief: the detector now leans toward false negatives (`_looks_random()` rejects lowercase-only tokens with <4 digits; `generic-credential` is keyword-context only; no Azure/Google-OAuth/Discord-bot coverage tests). Pin all of that. Write `tests/fixtures/evasion/` + `tests/test_evasion_secrets.py`: a set of files that contain credential-shaped secrets the current `redact.find_secrets()` **misses** or **mis-classifies** — split across lines, base64/hex-wrapped, in YAML block scalars, in sqlite pages with interleaved nulls, URL-embedded (`https://user:token@host`), in `.env` with `export`, quoted with backslashes, unicode look-alikes. Also files that should produce **no** hit (docs with example keys marked as examples, `${VAR}` references, `op://` refs). Every missed case is an `xfail` test with a one-line reason. Report: `reviews/codex/YYYY-MM-DD-evasion-secrets.md` summarising the detection matrix.
+
+### C3 — Evasion fixtures for skill heuristics  `[closed 2026-08-27 → reviews/codex/2026-08-27-evasion-skills.md · answered in reviews/claude/2026-08-27-evasion-skills.md — all 15 rows enforced]`  (M2 shipped SKILL-001 — go)
+`src/daemonaudit/checks/skills.py`. It is regex-only by design (v0.1); your job is to show where regex
+is not enough and pin it. Two directions, both matter:
+1. **Evasions** (false negatives): fixtures under `tests/fixtures/evasion-skills/<skill>/` + `tests/test_evasion_skills.py`,
+   `xfail` per row like C2. Ideas: `curl … | sh` split across lines / variables / `$(…)` / `eval` / python `subprocess`;
+   network calls via `python -c`, `nc`, `openssl s_client`, DNS exfil; secret reads via `cat $HOME/."env"`, `find ~ -name '*.env'`,
+   `env | grep`, `printenv`; injection phrasing with homoglyphs, markdown link text, split words, base64 in SKILL.md;
+   frontmatter tricks (`required_environment_variables` as YAML block list, quoted, or in a `metadata:` subtree);
+   `required_credential_files` pointing at the vault via `../`.
+2. **False positives** (the harder problem — a default Hermes install has 82 vendor skills and the tool must not cry wolf):
+   build fixtures from *legitimate* patterns you'd expect in real skills — API clients reading their own key, install
+   docs, review rubrics that mention "exfiltration", `id_*.pub` public keys, HTML comment markers — and assert **no**
+   finding. Note `_is_bundled()` downgrades vendor-identical files; test that a modified vendor file is NOT downgraded.
+Report: `reviews/codex/YYYY-MM-DD-evasion-skills.md` with a detection matrix like C2. No `src/` edits.
+Same idea against the skills scanner: `SKILL.md` and scripts that hide `curl | sh`, network calls, secret reads, and invisible-Unicode instructions in ways a regex misses.
+
+### C4 — Windows platform adapter  `[done 2026-08-27 — natively verified: 64 passed / 17 skipped on Windows 3.12.10]`
+`src/daemonaudit/platform/base.py` → new `WindowsPlatform` (replace the stub). Interface is fixed; report anything it can't express rather than changing it.
+Scope, in order:
+1. `file_mode()` semantics on ACLs: `FileMode.other_readable/other_writable/group_*` should mean "a principal other than the owner, SYSTEM and Administrators has that right". Use `ctypes`/`win32security` only if stdlib can't — prefer stdlib (`subprocess icacls` parsing is acceptable as a first cut if documented). `posix_modes = True` once this works, so PERM-* checks run.
+2. `read_nofollow()`: open with `FILE_FLAG_OPEN_REPARSE_POINT` semantics or reject reparse points — never follow a junction/symlink at the final component.
+3. `stat_cmd()`: a PowerShell one-liner printing the ACL (`(Get-Acl <path>).AccessToString`).
+4. `listening_sockets()` / `process_env()` / `children()`: verify psutil behaves; document what needs elevation.
+5. Hermes home on Windows is `%USERPROFILE%\.hermes` — confirm `discover/hermes.py` finds it (`Path.home()` should).
+Tests: `tests/test_windows.py`, skipped unless `sys.platform == "win32"`. Run the full suite on the Windows box and paste the summary line into the report. Branch `codex/windows-adapter`. Report: `reviews/codex/YYYY-MM-DD-windows-adapter.md`.
+
+## Claude's queue (for the record)
+- M2 checks, in the order listed in the milestone table; `NET-001` listening sockets first because it's the only remote-position check and the report is lopsided without it.
+- Answer C1 in `reviews/claude/` before starting M2 if the report is in by then.

daemonaudit-0.1.0/CLAUDE.md

@@ -0,0 +1,4 @@
+Read AGENTS.md (invariants) and BUILD.md (plan + task queue) before doing anything here.
+Claude Code is the primary builder of src/ during milestones 1–2; Codex reviews and writes
+adversarial fixtures. Check reviews/codex/ for new reports at the start of each session and
+answer them in reviews/claude/.

daemonaudit-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TL
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

daemonaudit-0.1.0/PKG-INFO

@@ -0,0 +1,113 @@
+Metadata-Version: 2.5
+Name: daemonaudit
+Version: 0.1.0
+Summary: Red/blue security audit for self-hosted AI agent daemons. Finds the secrets, the open doors, and the blast radius.
+Project-URL: Homepage, https://github.com/TLLABS-dev/daemonaudit
+Author: TL
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai-agent,audit,hermes,mcp,openclaw,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Requires-Dist: psutil>=5.9
+Requires-Dist: pyyaml>=6
+Requires-Dist: rich>=13
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+<img src="assets/daemon.svg" align="right" width="120" alt="daemonaudit mascot">
+
+# daemonaudit
+
+> Who can hurt your AI agent — and how badly.
+
+`daemonaudit` is a red/blue security audit for self-hosted AI agent daemons. It finds the
+secrets, the open doors and the weak policies on the machine your agent runs on, then tells
+you the **attack paths** and the **blast radius**: what an attacker gets, from where, and
+which single fix kills the whole chain.
+
+Supports **Hermes Agent** today. OpenClaw and generic MCP configs are on the roadmap.
+
+![daemonaudit scan --red](assets/demo-report.svg)
+
+*(above: `daemonaudit scan --red` against a deliberately-broken demo home — build your own with `python scripts/demo_home.py`)*
+
+## Why not just the built-in audit?
+Framework auditors ask *"is my config right?"*. `daemonaudit` asks *"what does an attacker
+standing here actually get?"* — and it looks at the **host**, not just the config: backups,
+transcripts, sqlite state, process environments, listening sockets, and the skills you installed.
+Then it **chains** the findings: an exposed port *plus* an unsandboxed backend *plus* keys in the
+environment is one attack path, and it names the one hop whose fix breaks it.
+
+## Install
+```bash
+uvx --from git+https://github.com/TLLABS-dev/daemonaudit daemonaudit scan     # zero-install run
+# or
+pipx install git+https://github.com/TLLABS-dev/daemonaudit
+```
+From a clone:
+```bash
+python -m pip install -e '.[dev]'
+daemonaudit scan
+```
+Requires Python ≥ 3.10. Dependencies: `psutil`, `rich`, `pyyaml`. Linux, macOS and Windows.
+
+## Use
+```bash
+daemonaudit scan                       # passive audit (safe anywhere): secrets, perms, policy, skills, listeners
+daemonaudit scan --red                 # + active probes against THIS host, attack paths, blast radius
+daemonaudit scan --html report.html    # a self-contained HTML report (also --json)
+daemonaudit scan --home /path/to/.hermes
+daemonaudit checks                     # list every check
+```
+`--red` adds three probes that only ever touch **localhost**: it connects to the daemon's own
+listeners to see which answer without a password, reads the daemon's process environment, and
+reads the vault the way any process running as you could — to measure the real local blast radius.
+
+## What it checks (v0.1, Hermes)
+- **Secrets** outside the vault — config, backups, transcripts, sqlite state — with encoded/obfuscated variants
+- **Permissions** — world-readable vault/state, backups looser than their originals, writable sockets
+- **Policy** — yolo/approval bypasses, unsandboxed host execution, allow-all users, exposed/unauthenticated API server, unverified webhooks, secret-leaking debug flags, SSRF guard, credentials forwarded into tool shells, literal secrets in MCP config
+- **Skills** — `curl | sh` (incl. split/`eval`/Python-subprocess forms), exfiltration shapes, prompt-injection and invisible-Unicode in `SKILL.md`, frontmatter that asks for master keys or the vault; vendor-shipped skills are recognised and graded down
+- **Freshness** — updates behind and dismissed advisories, from the daemon's own local cache
+- **Red probes** — unauthenticated HTTP, process-environment secrets, vault blast radius
+
+Each finding says **why it matters**, the exact **fix**, and a command to **verify** it.
+
+## Principles
+- **Read-only.** It never changes your system.
+- **Zero network egress.** Nothing leaves the box. The active probes connect to localhost only, and refuse any target that isn't this host.
+- **Redacted by construction.** The report can show you `sk-ant-…4f2a`; it cannot show you the key. Nothing that leaves the process — terminal, JSON, HTML — contains a raw credential.
+- **No false passes.** A check that can't run says *skipped*, never *ok*. A scan that couldn't complete exits non-zero.
+
+## Exit codes (for cron / CI)
+| code | meaning |
+|---|---|
+| 0 | clean, and every check completed |
+| 1 | findings (low/medium) |
+| 2 | high or critical findings |
+| 3 | no supported daemon found (use `--home`) |
+| 4 | no findings, but a check was skipped/errored/incomplete — **not** a clean bill |
+| 5 | the tool itself failed (`--debug` for a scrubbed traceback) |
+
+Precedence 2 > 1 > 4 > 0. INFO-only findings don't affect the exit code.
+
+## Roadmap
+- **v0.1** — Hermes: secrets, permissions, policy, skills, exposed services, localhost red probes, attack-path report. Linux · macOS · Windows.
+- **v0.2** — OpenClaw + generic MCP adapters, canary-injection probe, local-LLM (Ollama) semantic skill review, guided remediation with rollback, richer Windows ACL model, continuous monitoring / drift alerts.
+
+## Development
+`pytest` runs the suite (Linux/macOS/Windows in CI). The design invariants live in
+[`AGENTS.md`](AGENTS.md); the plan and history in [`BUILD.md`](BUILD.md). Built with a two-model
+workflow — one model builds, another reviews and writes adversarial fixtures; the review
+rounds are under [`reviews/`](reviews/).
+
+## License
+MIT — see [LICENSE](LICENSE).

daemonaudit-0.1.0/README.md

@@ -0,0 +1,89 @@
+<img src="assets/daemon.svg" align="right" width="120" alt="daemonaudit mascot">
+
+# daemonaudit
+
+> Who can hurt your AI agent — and how badly.
+
+`daemonaudit` is a red/blue security audit for self-hosted AI agent daemons. It finds the
+secrets, the open doors and the weak policies on the machine your agent runs on, then tells
+you the **attack paths** and the **blast radius**: what an attacker gets, from where, and
+which single fix kills the whole chain.
+
+Supports **Hermes Agent** today. OpenClaw and generic MCP configs are on the roadmap.
+
+![daemonaudit scan --red](assets/demo-report.svg)
+
+*(above: `daemonaudit scan --red` against a deliberately-broken demo home — build your own with `python scripts/demo_home.py`)*
+
+## Why not just the built-in audit?
+Framework auditors ask *"is my config right?"*. `daemonaudit` asks *"what does an attacker
+standing here actually get?"* — and it looks at the **host**, not just the config: backups,
+transcripts, sqlite state, process environments, listening sockets, and the skills you installed.
+Then it **chains** the findings: an exposed port *plus* an unsandboxed backend *plus* keys in the
+environment is one attack path, and it names the one hop whose fix breaks it.
+
+## Install
+```bash
+uvx --from git+https://github.com/TLLABS-dev/daemonaudit daemonaudit scan     # zero-install run
+# or
+pipx install git+https://github.com/TLLABS-dev/daemonaudit
+```
+From a clone:
+```bash
+python -m pip install -e '.[dev]'
+daemonaudit scan
+```
+Requires Python ≥ 3.10. Dependencies: `psutil`, `rich`, `pyyaml`. Linux, macOS and Windows.
+
+## Use
+```bash
+daemonaudit scan                       # passive audit (safe anywhere): secrets, perms, policy, skills, listeners
+daemonaudit scan --red                 # + active probes against THIS host, attack paths, blast radius
+daemonaudit scan --html report.html    # a self-contained HTML report (also --json)
+daemonaudit scan --home /path/to/.hermes
+daemonaudit checks                     # list every check
+```
+`--red` adds three probes that only ever touch **localhost**: it connects to the daemon's own
+listeners to see which answer without a password, reads the daemon's process environment, and
+reads the vault the way any process running as you could — to measure the real local blast radius.
+
+## What it checks (v0.1, Hermes)
+- **Secrets** outside the vault — config, backups, transcripts, sqlite state — with encoded/obfuscated variants
+- **Permissions** — world-readable vault/state, backups looser than their originals, writable sockets
+- **Policy** — yolo/approval bypasses, unsandboxed host execution, allow-all users, exposed/unauthenticated API server, unverified webhooks, secret-leaking debug flags, SSRF guard, credentials forwarded into tool shells, literal secrets in MCP config
+- **Skills** — `curl | sh` (incl. split/`eval`/Python-subprocess forms), exfiltration shapes, prompt-injection and invisible-Unicode in `SKILL.md`, frontmatter that asks for master keys or the vault; vendor-shipped skills are recognised and graded down
+- **Freshness** — updates behind and dismissed advisories, from the daemon's own local cache
+- **Red probes** — unauthenticated HTTP, process-environment secrets, vault blast radius
+
+Each finding says **why it matters**, the exact **fix**, and a command to **verify** it.
+
+## Principles
+- **Read-only.** It never changes your system.
+- **Zero network egress.** Nothing leaves the box. The active probes connect to localhost only, and refuse any target that isn't this host.
+- **Redacted by construction.** The report can show you `sk-ant-…4f2a`; it cannot show you the key. Nothing that leaves the process — terminal, JSON, HTML — contains a raw credential.
+- **No false passes.** A check that can't run says *skipped*, never *ok*. A scan that couldn't complete exits non-zero.
+
+## Exit codes (for cron / CI)
+| code | meaning |
+|---|---|
+| 0 | clean, and every check completed |
+| 1 | findings (low/medium) |
+| 2 | high or critical findings |
+| 3 | no supported daemon found (use `--home`) |
+| 4 | no findings, but a check was skipped/errored/incomplete — **not** a clean bill |
+| 5 | the tool itself failed (`--debug` for a scrubbed traceback) |
+
+Precedence 2 > 1 > 4 > 0. INFO-only findings don't affect the exit code.
+
+## Roadmap
+- **v0.1** — Hermes: secrets, permissions, policy, skills, exposed services, localhost red probes, attack-path report. Linux · macOS · Windows.
+- **v0.2** — OpenClaw + generic MCP adapters, canary-injection probe, local-LLM (Ollama) semantic skill review, guided remediation with rollback, richer Windows ACL model, continuous monitoring / drift alerts.
+
+## Development
+`pytest` runs the suite (Linux/macOS/Windows in CI). The design invariants live in
+[`AGENTS.md`](AGENTS.md); the plan and history in [`BUILD.md`](BUILD.md). Built with a two-model
+workflow — one model builds, another reviews and writes adversarial fixtures; the review
+rounds are under [`reviews/`](reviews/).
+
+## License
+MIT — see [LICENSE](LICENSE).

daemonaudit-0.1.0/assets/daemon.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="160" height="160" viewBox="0 0 64 64" role="img" aria-label="daemonaudit mascot: a small purple demon">
+  <path d="M14 22 L8 6 L22 16 Z" fill="#c0392b"/>
+  <path d="M50 22 L56 6 L42 16 Z" fill="#c0392b"/>
+  <circle cx="32" cy="36" r="22" fill="#7d3c98"/>
+  <circle cx="24" cy="32" r="4.5" fill="#fff"/>
+  <circle cx="40" cy="32" r="4.5" fill="#fff"/>
+  <circle cx="25" cy="33" r="2.2" fill="#111"/>
+  <circle cx="41" cy="33" r="2.2" fill="#111"/>
+  <path d="M21 44 Q32 53 43 44" stroke="#fff" stroke-width="3" fill="none" stroke-linecap="round"/>
+  <path d="M27 45 l2 4 M37 45 l-2 4" stroke="#fff" stroke-width="2.5" stroke-linecap="round"/>
+  <path d="M52 44 q10 4 4 14 q-2 3 -6 1" stroke="#7d3c98" stroke-width="3" fill="none" stroke-linecap="round"/>
+  <path d="M54 62 l4 -4 l2 5 Z" fill="#c0392b"/>
+</svg>