KeiSei84
65d17007c3
Some checks are pending
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / preflight (push) Waiting to run
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / vps-smoke (push) Waiting to run
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:frustration-matrix,kei-frustration-loop,kei-skill-importer,kei-projects-index,kei-projects-watcher,kei-gdrive-import,kei-leak-matrix,kei-skills,kei-gateway,kei-cron-scheduler,kei-export-trajectories,kei-backend-daytona,kei-d… (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-compute-baremetal,kei-compute-vultr,kei-compute-linode,kei-compute-digitalocean,kei-svc-systemd,kei-llm-bridge-mlx name:hosted-sleep-compute]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-diff,kei-scheduler,kei-watch,kei-prune,kei-discover,kei-brain-view,kei-hibernate,kei-ledger-sign,kei-fork name:wave13-15]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-git-gitea,kei-git-forgejo,kei-git-gitlab,kei-git-bitbucket,kei-memory-sled,kei-memory-redis,kei-memory-postgres,kei-memory-sqlite,kei-auth-google,kei-auth-apple,kei-auth-magiclink,kei-auth-webauthn,kei-notify-slack,kei-n… (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-ledger,kei-migrate,kei-changelog,kei-memory,kei-store,kei-conflict-scan,kei-refactor-engine,kei-graph-check,kei-shared,kei-dna-index,kei-pet name:core]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-machine-probe,kei-llm-ollama,kei-llm-llamacpp,kei-llm-mlx,kei-llm-router,kei-model name:llm-stack]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-router,kei-sage,kei-task,kei-chat-store,kei-crossdomain,kei-search-core,kei-content-store,kei-social-store,kei-curator,kei-auth,kei-artifact name:mcp-lbm]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:keisei,kei-forge,kei-runtime,kei-runtime-core,kei-atom-discovery,kei-agent-runtime,kei-capability,kei-provision,kei-entity-store,kei-pipe,kei-cache,kei-spawn,kei-replay name:atom-substrate]) (push) Blocked by required conditions
Convergent dogfood audit by Claude+Grok+Gemini+Copilot on v0.41 surfaced that the v0.41 'fixes' were incomplete. 3 of 4 reviewers independently found the same CRITICAL bypass; Gemini wrote a Rust test suite to verify. ## Convergent findings → v0.42 fixes [#1 CRITICAL] Symlink leaf bypass (3-of-4 convergent) v0.41 only canonicalized PARENT, then re-attached leaf as-is. Exploit: 1. kei_bash 'ln -s ~/.ssh/authorized_keys ./cfg.txt' (passes the bash hook chain — ln itself is non-destructive) 2. kei_write file_path=cfg.txt content=<key> validate_path saw $PWD/cfg.txt (allowed) → fs::write followed leaf symlink → overwrote authorized_keys. Fix: canonicalize FULL path (incl. leaf) when file exists; for new files, symlink_metadata on leaf and reject is_symlink. Now the denylist check sees the real target. [#2 HIGH] $HOME blanket-allowed = self-neutering (2-of-4 convergent) allowed_roots() defaulted to [$PWD, $HOME], denylist only had 4 secret dirs. So kei_write $HOME/.claude/hooks/no-github-push.sh content='exit 0' was ALLOWED — agent could overwrite the substrate's own policy hooks. Similar attacks on ~/.zshrc (RCE on next shell), ~/.gitconfig, ~/.npmrc. Fix: default to $PWD only. Denylist extended with .claude/, .grok/, .gemini/, .copilot/, .kimi/, all major shell-init files, and additional credential paths. KEI_ALLOWED_ROOTS for explicit widening. [#3 HIGH] Empty-section fail-OPEN (Gemini test-verified) v0.41 'fail-closed on missing config' fix was incomplete: if config file existed but section [bash]/[edit]/[write] was empty, load_chain returned Ok(vec![]) → run_chain early-returned Ok → action ran ungated. Fix: empty chain also FAIL-CLOSED with same KEI_POLICY_CHAIN_OPTIONAL opt-in. [#4 MEDIUM] load_chain still blocked tokio worker (Claude) v0.41 fix #4 converted handle_edit/handle_write reads to tokio::fs but left load_chain on std::fs. Slow/hung mount on policy-chain.toml would freeze a worker for every safe_* invocation. Fix: load_chain → async + tokio::fs::{try_exists, read_to_string}. [#5 MEDIUM] process_group only applied to bash, not hooks (Claude) v0.41 fix #5 set_process_group on kei_bash's child shell, but the hook subprocess (spawned per-hook in run_chain) was NOT in its own group. On hook timeout, kill_on_drop killed only the immediate hook process; grandchildren orphaned — the exact failure mode fix #5 was meant to prevent. Fix: set_process_group + killpg also on hook spawn in run_chain. [#6 MEDIUM] Per-step vs aggregate timeout (Claude) Doc claimed 'Hard cap on single chain + action — 60s'. Actual: each hook gets independent 60s, then action gets another 60s. For a 3-hook bash chain that's 240s max — 4× documented. Status: documented as known-limit; single-deadline impl deferred to v0.43 (not security-blocking, just a doc/correctness drift). ## Verification (8 smokes — all green) /etc/passwd → denied (system dir) ✓ ../escape.txt → denied (../ segment) ✓ /tmp/symlink → /etc/passwd writeable → denied (resolved /private/etc) ✓ NEW ~/.claude/hooks/no-github-push.sh → denied (substrate dir) ✓ NEW ~/.zshrc → denied (shell-init file) ✓ NEW policy-chain.toml empty [bash] → FAIL-CLOSED ✓ NEW KEI_POLICY_CHAIN_OPTIONAL=1 → opt-in pass-through ✓ kei_bash git-push-github → BLOCKED (regression) ✓ kei_bash echo HELLO → returns content (regression) ✓ cargo test -p kei-mcp: 3/3 still pass. ## Architecture note from Grok Grok architect flagged: safe_tools.rs is 474 LOC, exceeds Constructor Pattern 200-line threshold. v0.42 does NOT refactor (security fixes shipped first); v0.43 will extract path_guard.rs + chain_runner.rs. ## Per-CLI audit value demonstrated Claude — 5 issues + 5 minor, exhaustive line-anchored analysis Grok — architectural review with grep-verified citations Gemini — wrote Rust test project to verify findings (PoC code!) Copilot — partial fact-check, ran out of mid-task |
||
|---|---|---|
| .. | ||
| .cargo | ||
| firewall-diff | ||
| frustration-matrix | ||
| kei-agent-runtime | ||
| kei-artifact | ||
| kei-atom-discovery | ||
| kei-auth | ||
| kei-auth-apple | ||
| kei-auth-google | ||
| kei-auth-magiclink | ||
| kei-auth-webauthn | ||
| kei-backend-daytona | ||
| kei-brain-view | ||
| kei-buddy | ||
| kei-cache | ||
| kei-capability | ||
| kei-changelog | ||
| kei-chat-store | ||
| kei-compute-baremetal | ||
| kei-compute-digitalocean | ||
| kei-compute-linode | ||
| kei-compute-vultr | ||
| kei-conflict-scan | ||
| kei-contacts-apple | ||
| kei-contacts-google | ||
| kei-content-store | ||
| kei-cortex | ||
| kei-cron-scheduler | ||
| kei-crossdomain | ||
| kei-curator | ||
| kei-db-contract | ||
| kei-decision | ||
| kei-decompose | ||
| kei-diff | ||
| kei-discover | ||
| kei-dna-index | ||
| kei-entity-store | ||
| kei-export-trajectories | ||
| kei-forge | ||
| kei-fork | ||
| kei-frustration-loop | ||
| kei-gateway | ||
| kei-gdrive-import | ||
| kei-git-bitbucket | ||
| kei-git-forgejo | ||
| kei-git-gitea | ||
| kei-git-gitlab | ||
| kei-graph-check | ||
| kei-graph-export | ||
| kei-graph-stream | ||
| kei-hibernate | ||
| kei-import-project | ||
| kei-leak-matrix | ||
| kei-ledger | ||
| kei-ledger-sign | ||
| kei-llm-bridge-mlx | ||
| kei-llm-llamacpp | ||
| kei-llm-mlx | ||
| kei-llm-ollama | ||
| kei-llm-router | ||
| kei-machine-probe | ||
| kei-mcp | ||
| kei-memory | ||
| kei-memory-postgres | ||
| kei-memory-redis | ||
| kei-memory-sled | ||
| kei-memory-sqlite | ||
| kei-migrate | ||
| kei-model | ||
| kei-model-router | ||
| kei-net-ipsec | ||
| kei-net-openvpn | ||
| kei-net-wireguard | ||
| kei-notify-discord | ||
| kei-notify-slack | ||
| kei-notify-sms | ||
| kei-notify-telegram | ||
| kei-pet | ||
| kei-ping | ||
| kei-pipe | ||
| kei-projects-index | ||
| kei-projects-watcher | ||
| kei-provision | ||
| kei-prune | ||
| kei-refactor-engine | ||
| kei-registry | ||
| kei-replay | ||
| kei-router | ||
| kei-runtime | ||
| kei-runtime-core | ||
| kei-sage | ||
| kei-scheduler | ||
| kei-search-core | ||
| kei-shared | ||
| kei-skill-importer | ||
| kei-skills | ||
| kei-social-store | ||
| kei-spawn | ||
| kei-store | ||
| kei-stt | ||
| kei-svc-systemd | ||
| kei-task | ||
| kei-telegram-webhook | ||
| kei-tlog | ||
| kei-token-tracker | ||
| kei-tts | ||
| kei-tty | ||
| kei-watch | ||
| keisei | ||
| mock-render | ||
| ssh-check | ||
| tokens-sync | ||
| visual-diff | ||
| .gitignore | ||
| Cargo.lock | ||
| Cargo.toml | ||