4 Commits

Include renames

Author	SHA1	Message	Date
Anandan	96859c9bd1	feat(sandbox): unify command execution and enforcement (#781) ... * feat(sandbox): unify command execution and enforcement * test(sandbox): make platform contracts portable * fix(sandbox): close execution lifecycle races Bound retained interactive output, preserve interruption state, and start workspace observation before process launch. Protect active runtime roots with cross-platform leases, capture transient protected-path creation events, and restore process attributes after PTY fallback. * fix(sandbox): restore strict macOS isolation Remove Seatbelt host-local network allowances after native validation showed localhost filters can reach host interfaces. Track process reap completion so retained sessions cannot signal a stale numeric PID.	2026-07-21 18:55:13 +05:30
beardthelionandKevin Codex	a880ce80a6	feat: gate project-scoped hooks, plugins, and MCP servers behind workspace trust (#529) ... * feat(workspacetrust): add exact-match trust store for project config gating * feat(hooks): add ExcludeProject option to LoadConfig * feat(plugins): add ExcludeProject option to Load * feat(cli): gate project hooks and plugins behind workspace trust Trust check lives inside newHookDispatcherWithExtra and activatePlugins (fail-closed by construction); trustRoot is the original launch dir so a --worktree run inherits the source repo's trust. Callers OR the skip reports and emit one combined stderr notice. * feat(cli): add zero trust command (trust/list/remove) * fix(review): key spec-draft trust on the original launch dir; cover trust CLI edge branches Spec-draft runs (zero exec --use-spec --worktree) passed the reassigned worktree path as trustRoot, dropping a trusted repo's project hooks (fail-closed, but breaks worktree-inheritance). Thread the captured pre-worktree trustRoot into execSpecDraftRun. Add tests for the trust 'remove' too-many-args and --help branches, and a resolveTrust comment noting the per-chokepoint check must not be hoisted to callers. * test(cli): end-to-end trust-gate coverage through agent.Run and exec --worktree Drives the real agent loop with a fake tool-calling provider so a project beforeTool hook actually fires (or is gated away) through production code: gate blocks a tool call via agent.Run, and --worktree / --use-spec --worktree key trust on the original launch dir. All three are load-bearing (RED when the gate or the trustRoot threading regresses). * style(cli): gofmt struct alignment in exec_spec.go * fix(workspacetrust): compare stored trust entries literally, no symlink re-resolution External adversarial review (codex) found a false positive: IsTrusted re-normalized stored entries on every check (Abs+EvalSymlinks), so a trusted path later replaced by a symlink to attacker content re-resolved to the new target and matched. Stored entries are already canonical (normalized once at Trust time); compare them as literals and only normalize the incoming query. Add a regression test for the symlink-retarget case. * feat(mcp): gate project-scoped MCP servers behind workspace trust Closes the P0 an external adversarial review (codex) found: project ./.zero/config.json stdio MCP servers spawned before the hook/plugin gate, an ungated arbitrary-execution path that could also self-trust the workspace. Add ExcludeProject to config.ResolveMCP (skips the project layer) and thread a fail-closed trust check into every MCP spawn site (exec, TUI setup+refresh, mcp tools list, mcp check); reporting sites stay ungated. Verified the sole server-command exec (mcp/client.go) is reachable only through the now-gated RegisterTools paths. * test(cli): cover default-mode beforeTool firing through the trust gate Assert a project beforeTool hook fires in the default auto and ask permission modes (not only under unsafe), and is blocked when the workspace is untrusted, so the gate is verified in the mode a normal run actually uses. * docs(cli): note MCP servers in zero trust help text and doc comment The gate covers project hooks, plugins, and MCP servers, but the help string and runTrust doc comment listed only hooks and plugins. * test(cli): make workspace-trust tests portable on macOS and Windows setTrustConfigRoot set HOME on darwin, but config.UserConfigDir is XDG-first there (=$HOME/.config), so tests wrote trust.json and user hooks.json where the code never read them; set XDG_CONFIG_HOME on every non-Windows platform instead. writeMarkerHook shells out to /bin/sh, absent on Windows, so its trusted-case marker never appeared; skip it there like writeMarkerHookScript already does. TestRunTrustAddThenList compared `trust list` output (canonicalized via EvalSymlinks) against the raw cwd, which diverges on the Windows runner's 8.3 short names (RUNNER~1 -> runneradmin); compare the resolved path, and add TestRunTrustListShowsCanonicalPath to exercise that via a symlink on any platform. * feat(cli): surface the project MCP skip in the workspace-trust notice Project MCP servers were dropped silently in an untrusted workspace: the trust notice covered hooks and plugins but not MCP, and app.go discarded the resolveTrust error. registerMCPToolsForWorkspace now returns a trustSkip, gated on a new projectMCPConfigExists check plus the previously-dropped store-read error, and emitTrustNotice is variadic so the exec, spec-draft, interactive, and `mcp tools list` paths all fold in the MCP skip. The skip drives the notice only; the gate stays on resolveTrust/excludeProject, so a trusted workspace is unaffected and an untrusted one still fails closed. * fix(cli): print zero trust --help to stdout with a success exit zero trust -h/--help/help routed usage to stderr with the usage exit code, unlike every other subcommand (mcp, sandbox, skills, cron, ...) which prints help to stdout and returns success. Align it; the unknown-subcommand path still writes to stderr with the usage exit code. * fix(cli): gate oauth MCP login and surface mcp-check trust notice Two project-scoped MCP activation sites were left outside the workspace trust gate. zero mcp oauth login loaded a project-defined OAuth server from an untrusted workspace and ran the full discovery/registration/token-exchange flow against its configured URL. Gate resolveOAuthServer with resolveTrust so an untrusted clone's ./.zero/config.json OAuth server is dropped before login, and emit the same one-line trust notice the other spawn sites use. zero mcp check already gated the project layer but discarded the trust-check result and never emitted the notice, so a gated project server read as a bare "not configured". Emit the notice on the not-found branch. The three remaining ungated resolveMCPConfig(cwd, false) sites (backends doctor/snapshot and the extensions listing) are enumeration-only and stay ungated. * test(cli): adapt MCP startup-skip tests to two-arg resolveMCPConfig --------- Co-authored-by: Kevin Codex <[email protected]>	2026-07-09 10:51:09 +08:00
KRATOS	6beb0b0908	wedge stage 09: finish plugin wiring (tools/hooks/skills) (#185) ... * stage 09: finish plugin wiring (tools/hooks/skills) Activate resolved plugin manifests so their declared tools, hooks, and skills take effect at runtime instead of being parsed-but-unconsumed. - internal/plugins/activate.go: Activate() registers each plugin tool into the tools.Registry via a command-runner adapter (JSON args on stdin, stdout/exit -> tools.Result, ${AGENT_PLUGIN_ROOT} expansion + env), builds hooks.Definition values for plugin hooks, and exposes plugin skill search roots. Permission maps allow/prompt/deny -> tools.Safety; allow only survives load-time clamping when manifest auto-approval is enabled, so mutating plugin tools are not auto-approved by default. A plugin-aware skill tool merges the default skills dir with plugin roots (recording duplicate names, never crashing). Malformed plugins/extensions are skipped with a warning; activation order is deterministic. - internal/cli: activatePlugins() invokes activation in both bootstrap paths (interactive TUI in app.go and one-shot exec in exec.go), after core/specialist/MCP registration. newHookDispatcherWithExtra folds plugin hooks into the dispatcher's hook set. Fails open: a bad plugin warns and is skipped, never wedging startup. - internal/plugins/plugins.go: update the stale 'not yet registered' note. * stage 09: normalize plugin command path separators for Windows expandPluginRoot kept the manifest's forward slashes, so a ${AGENT_PLUGIN_ROOT}/bin/x command became a mixed-separator path on Windows (C:\...\001/bin/x), failing the path tests. Added expandPluginRootPath (filepath.FromSlash on the placeholder-expanded executable path only; args keep their slashes since they may be URLs/flags) and used it for the tool and hook command paths. * stage 09: address plugin wiring review - surface per-plugin load diagnostics on stderr (not just top-level errors) - skip plugin tools whose name collides with an already-registered tool - resolve manifest-relative plugin skill paths against the plugin dir * stage 09: fall back to plugin path/id when manifest path unknown in load diagnostic	2026-06-13 10:21:14 +05:30
KRATOS	06ea4f004b	Edit safety: file read/write tracking, external-modification detection, post-apply hooks (#172) ... * Edit safety: file version tracking, conflict detection, hook wiring Phase 1 — FileTracker (internal/tools/file_tracker.go): per-session map[absPath]{sha256, size, mtime}; CheckConflict flags drift only against a known baseline, so first-touch writes are unaffected. nil = no-op. Phase 2 — external-modification detection: read_file records the whole-file baseline; edit_file and write_file --overwrite refuse to clobber a file whose on-disk content drifted from it and tell the model to re-read first, then re-baseline to what they wrote. apply_patch forgets the files it rewrote (git apply has its own context guard). Threaded via RunOptions/agent.Options FileTracker, built once per session in the exec, spec, and TUI paths. Phase 3 — post-apply validation via hooks: the dormant hooks.Dispatcher is wired into executeToolCall. beforeTool hooks can veto a call (DenialHookBlocked); afterTool hook output is scrubbed and surfaced to the model. DispatchOutcome now collects hook stdout/stderr. Per-session dispatcher built from merged user+project hooks.json; fails open and runs nothing until a hook is configured. * edit-safety: address review — fail closed on read, redact hook reason - write_file overwrite: if a tracked file cannot be re-read to verify it, fail CLOSED (refuse the overwrite) instead of silently proceeding — the read error previously skipped the conflict check and could clobber an externally modified or replaced file. - blockedByHookResult: scrub outcome.Reason through redaction before placing it in model-visible ToolResult.Output; this intercepted path bypassed the registry's normal output-redaction boundary. - TestHashContentIsStableAndDistinguishing: compare separately stored hashes so the stability check is not a same-expression comparison (SA4000). * edit-safety: flag ToolResult.Redacted when hook output is scrubbed appendHookFeedback now reports whether scrubbing changed the afterTool feedback, and blockedByHookResult reports whether it scrubbed the reason; both set ToolResult.Redacted so the hook-intercepted paths match the registry's redaction contract. Adds tests asserting a secret-bearing hook reason/feedback is scrubbed and flips Redacted.	2026-06-11 20:34:35 +05:30