thanhnvandClaude Opus 4.8
c51e0f88a3
C1 (V17) action-gate.sh: gates the ACTION, not just the tool name. Outcome model ALLOW/WARN/REQUIRE_APPROVAL/BLOCK. BLOCK on sensitive-file writes (.env, *.pem, id_rsa, .github/workflows, .ssh, .aws/credentials, .npmrc) and destructive/ remote-exec commands (rm -rf /, curl|bash, chmod 777, git push --force); REQUIRE_APPROVAL on dependency installs and non-local network egress (clears only with an audited CASAN_ACTION_APPROVER). Decisions logged to action-gate.jsonl. C2 (V18) supply-chain-gate.sh + supply-chain-scan.py: diffs package.json / requirements.txt / pom.xml / build.gradle against a baseline (explicit or git HEAD). BLOCK on denylisted/known-malicious packages, typosquats (edit-distance 1 to a known package), and dangerous lifecycle scripts (pre/post/install); REQUIRE_APPROVAL on any new dependency. Emits a dep-diff report and records which live scanners (npm audit / pip-audit / osv-scanner) are available. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
157 lines
5.8 KiB
Bash
Executable File
157 lines
5.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN Track C-MVP — Tool authorization / ACTION gating (C1, V17).
|
|
#
|
|
# tool-registry-gate.sh authorizes by tool NAME + agent. This complements it by
|
|
# inspecting the ACTION itself — the command to run and the files it would
|
|
# write — because a legitimately-named tool can still attempt an illegitimate
|
|
# action (overwrite .env, curl|bash, rm -rf /, exfiltrate to an unknown host).
|
|
#
|
|
# Outcome model (per Plan-07 C0): ALLOW | WARN | REQUIRE_APPROVAL | BLOCK.
|
|
# BLOCK sensitive-file write, destructive/remote-exec command -> exit 2
|
|
# REQUIRE_APPROVAL network egress, dependency install -> exit 3
|
|
# (becomes ALLOW+audit when CASAN_ACTION_APPROVER is set)
|
|
# WARN noteworthy but permitted -> exit 0 (logged)
|
|
# ALLOW ordinary action -> exit 0
|
|
#
|
|
# Usage:
|
|
# action-gate.sh --command "<cmd>" [--write <path> ...]
|
|
# action-gate.sh -- <cmd> [args...]
|
|
#
|
|
# BLOCK is never overridable. REQUIRE_APPROVAL clears only with an explicit
|
|
# approver identity (audited) — approval is never silent.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
|
LOG="$PROJECT_ROOT/.specify/logs/level5/action-gate.jsonl"
|
|
mkdir -p "$(dirname "$LOG")"
|
|
# shellcheck source=casan-log.sh
|
|
source "$SCRIPT_DIR/casan-log.sh"
|
|
|
|
CMD=""
|
|
WRITES=()
|
|
while [[ "$#" -gt 0 ]]; do
|
|
case "$1" in
|
|
--command) CMD="${2:-}"; shift 2 ;;
|
|
--write) WRITES+=("${2:-}"); shift 2 ;;
|
|
--) shift; CMD="$*"; break ;;
|
|
*) CMD="${CMD:+$CMD }$1"; shift ;;
|
|
esac
|
|
done
|
|
|
|
if [[ -z "$CMD" && "${#WRITES[@]}" -eq 0 ]]; then
|
|
echo "Usage: action-gate.sh --command \"<cmd>\" [--write <path>...] | -- <cmd...>" >&2
|
|
exit 64
|
|
fi
|
|
|
|
APPROVER="${CASAN_ACTION_APPROVER:-}"
|
|
|
|
RESULT="$(CASAN_AG_CMD="$CMD" CASAN_AG_WRITES="$(printf '%s\n' "${WRITES[@]:-}")" python - <<'PY'
|
|
import os, re
|
|
|
|
cmd = os.environ.get("CASAN_AG_CMD", "")
|
|
writes = [w for w in os.environ.get("CASAN_AG_WRITES", "").splitlines() if w]
|
|
low = cmd.lower()
|
|
|
|
# Sensitive-write targets (BLOCK). Checked against both explicit --write paths
|
|
# and any path-looking token in the command.
|
|
SENSITIVE = [
|
|
r"(^|/)\.env(\.[a-z]+)?$", r"\.pem$", r"\.key$", r"(^|/)id_rsa$", r"(^|/)id_ed25519$",
|
|
r"\.p12$", r"\.pfx$", r"(^|/)\.ssh/", r"(^|/)\.github/workflows/", r"(^|/)\.git/hooks/",
|
|
r"(^|/)\.aws/credentials", r"(^|/)\.npmrc$", r"(^|/)\.pypirc$", r"(^|/)\.netrc$",
|
|
r"^/etc/", r"(^|/)\.dockercfg", r"(^|/)docker/config\.json$",
|
|
]
|
|
# Destructive / remote-exec commands (BLOCK).
|
|
DANGEROUS = [
|
|
r"\brm\s+-rf?\s+(/|~|\$home|/\*|\.\s*$|\.\s|\*)", r":\(\)\s*\{\s*:\s*\|\s*:", r"\bmkfs\b",
|
|
r"\bdd\b[^\n]*of=/dev/", r"\bchmod\s+(-r\s+)?777\b", r">\s*/dev/sd", r"\bgit\s+push\b[^\n]*(--force|\s-f\b)",
|
|
r"(curl|wget)\b[^\n]*\|\s*(sudo\s+)?(ba)?sh\b", r"\bshred\b\s+/", r"\bchown\s+-r\s+root",
|
|
]
|
|
# Dependency install (REQUIRE_APPROVAL) — imperative form; C2 covers manifest diffs.
|
|
DEP_INSTALL = [
|
|
r"\bnpm\s+(install|i|add)\s+\S", r"\byarn\s+add\s+\S", r"\bpnpm\s+add\s+\S",
|
|
r"\bpip3?\s+install\s+\S", r"\bpoetry\s+add\s+\S", r"\bgem\s+install\s+\S",
|
|
r"\bgo\s+get\s+\S", r"\bcargo\s+add\s+\S", r"\b(apt|apt-get|apk|brew|dnf|yum)\s+install\s+\S",
|
|
]
|
|
# Network egress (REQUIRE_APPROVAL) unless clearly local.
|
|
EGRESS = [r"\bcurl\b", r"\bwget\b", r"\bnc\b", r"\bncat\b", r"\bscp\b", r"\brsync\b[^\n]*::", r"\bssh\b\s+\S"]
|
|
LOCAL_OK = [r"127\.0\.0\.1", r"localhost", r"0\.0\.0\.0", r"::1", r"/api/tags"]
|
|
|
|
def any_match(pats, text):
|
|
return next((p for p in pats if re.search(p, text)), None)
|
|
|
|
# 1. Sensitive writes -> BLOCK
|
|
for path in writes + re.findall(r"[\w./~-]+", cmd):
|
|
m = any_match(SENSITIVE, path.lower())
|
|
if m:
|
|
print(f"BLOCK|sensitive_file_write:{path}")
|
|
raise SystemExit(0)
|
|
|
|
# 2. Destructive / remote-exec -> BLOCK
|
|
m = any_match(DANGEROUS, low)
|
|
if m:
|
|
print(f"BLOCK|dangerous_command:{m}")
|
|
raise SystemExit(0)
|
|
|
|
# 3. Dependency install -> REQUIRE_APPROVAL
|
|
m = any_match(DEP_INSTALL, low)
|
|
if m:
|
|
print(f"REQUIRE_APPROVAL|dependency_install:{m}")
|
|
raise SystemExit(0)
|
|
|
|
# 4. Network egress -> REQUIRE_APPROVAL unless clearly local
|
|
if any_match(EGRESS, low) and not any_match(LOCAL_OK, low):
|
|
print("REQUIRE_APPROVAL|network_egress")
|
|
raise SystemExit(0)
|
|
|
|
# 5. sudo (non-destructive) -> WARN
|
|
if re.search(r"\bsudo\b", low):
|
|
print("WARN|privilege_escalation")
|
|
raise SystemExit(0)
|
|
|
|
print("ALLOW|ok")
|
|
PY
|
|
)"
|
|
|
|
OUTCOME="${RESULT%%|*}"
|
|
REASON="${RESULT#*|}"
|
|
TS="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
|
|
|
|
# Approval clears REQUIRE_APPROVAL only with an explicit (audited) approver.
|
|
EFFECTIVE="$OUTCOME"
|
|
if [[ "$OUTCOME" == "REQUIRE_APPROVAL" && -n "$APPROVER" ]]; then
|
|
EFFECTIVE="ALLOW_APPROVED"
|
|
fi
|
|
|
|
python - "$LOG" "$TS" "$OUTCOME" "$REASON" "$EFFECTIVE" "$APPROVER" "$CMD" <<'PY'
|
|
import json, sys
|
|
log, ts, outcome, reason, eff, approver, cmd = sys.argv[1:]
|
|
with open(log, "a", encoding="utf-8") as f:
|
|
f.write(json.dumps({
|
|
"timestamp": ts, "harness": "C1-action-gate", "outcome": outcome,
|
|
"effective": eff, "reason": reason, "approver": approver, "command": cmd[:400],
|
|
}) + "\n")
|
|
PY
|
|
|
|
case "$EFFECTIVE" in
|
|
BLOCK)
|
|
casan_log error action-gate "ACTION_BLOCKED reason=$REASON"
|
|
echo "ACTION_GATE outcome=BLOCK reason=$REASON" >&2
|
|
exit 2 ;;
|
|
REQUIRE_APPROVAL)
|
|
casan_log warn action-gate "ACTION_REQUIRES_APPROVAL reason=$REASON (set CASAN_ACTION_APPROVER=<id> to approve)"
|
|
echo "ACTION_GATE outcome=REQUIRE_APPROVAL reason=$REASON" >&2
|
|
exit 3 ;;
|
|
ALLOW_APPROVED)
|
|
echo "ACTION_GATE outcome=ALLOW reason=approved_by:$APPROVER ($REASON)"
|
|
exit 0 ;;
|
|
WARN)
|
|
casan_log warn action-gate "ACTION_WARN reason=$REASON"
|
|
echo "ACTION_GATE outcome=WARN reason=$REASON"
|
|
exit 0 ;;
|
|
*)
|
|
echo "ACTION_GATE outcome=ALLOW reason=$REASON"
|
|
exit 0 ;;
|
|
esac
|