KeiSei84
8086bec486
Some checks are pending
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / preflight (push) Waiting to run
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / vps-smoke (push) Waiting to run
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:frustration-matrix,kei-frustration-loop,kei-skill-importer,kei-projects-index,kei-projects-watcher,kei-gdrive-import,kei-leak-matrix,kei-skills,kei-gateway,kei-cron-scheduler,kei-export-trajectories,kei-backend-daytona,kei-d… (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-compute-baremetal,kei-compute-vultr,kei-compute-linode,kei-compute-digitalocean,kei-svc-systemd,kei-llm-bridge-mlx name:hosted-sleep-compute]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-diff,kei-scheduler,kei-watch,kei-prune,kei-discover,kei-brain-view,kei-hibernate,kei-ledger-sign,kei-fork name:wave13-15]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-git-gitea,kei-git-forgejo,kei-git-gitlab,kei-git-bitbucket,kei-memory-sled,kei-memory-redis,kei-memory-postgres,kei-memory-sqlite,kei-auth-google,kei-auth-apple,kei-auth-magiclink,kei-auth-webauthn,kei-notify-slack,kei-n… (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-ledger,kei-migrate,kei-changelog,kei-memory,kei-store,kei-conflict-scan,kei-refactor-engine,kei-graph-check,kei-shared,kei-dna-index,kei-pet name:core]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-machine-probe,kei-llm-ollama,kei-llm-llamacpp,kei-llm-mlx,kei-llm-router,kei-model name:llm-stack]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-router,kei-sage,kei-task,kei-chat-store,kei-crossdomain,kei-search-core,kei-content-store,kei-social-store,kei-curator,kei-auth,kei-artifact name:mcp-lbm]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:keisei,kei-forge,kei-runtime,kei-runtime-core,kei-atom-discovery,kei-agent-runtime,kei-capability,kei-provision,kei-entity-store,kei-pipe,kei-cache,kei-spawn,kei-replay name:atom-substrate]) (push) Blocked by required conditions
Audit pass via Phase C dogfooding (security-auditor @ Agy/Gemini reviewing our own safe_tools.rs) surfaced 5 real bugs. All fixed. ## Gemini findings (5 real bugs) [#1 HIGH] FAIL-OPEN on missing config/hook Before: missing policy-chain.toml → "passing through" warning; missing hook script → "skipped" warning. Misconfig silently disabled enforcement. After: both paths FAIL-CLOSED with clear error surfaced to caller. Tests/dev can opt in to pass-through via KEI_POLICY_CHAIN_OPTIONAL=1. [#2 HIGH] Path traversal in kei_edit/kei_write Before: no validation; attacker could pass file_path=/etc/passwd or $HOME/.ssh/authorized_keys. After: validate_path() rejects '..' segments, system dirs (/etc/, /usr/, /System/, /var/, /root/), and dotfile-secret dirs (~/.ssh/, ~/.aws/, ~/.gnupg/, ~/.config/gcloud/). Override via KEI_ALLOWED_ROOTS for explicit single-root confinement. [#3 HIGH] CLAUDECODE/GROKCODE env bypass Behavior unchanged — this guard is a perf/UX optimization to avoid double-firing hooks when called from inside Claude/Grok (which already ran their own PreToolUse). Documented explicitly as NOT a security boundary: attacker controlling parent env already owns the invocation. Module header gains a DESIGN NOTE making this load-bearing. [#4 MED] std::fs in async context Before: handle_edit/handle_write used std::fs::{read_to_string,write}, which block the tokio worker thread. Pathological paths like /dev/random would freeze a worker indefinitely. After: tokio::fs::{read_to_string,write}.await — async I/O, worker stays responsive. [#5 MED] kill_on_drop only kills immediate child Before: timeout in kei_bash drops the Child handle; tokio's kill_on_drop SIGKILLs only the shell. Grandchildren (e.g., 'sleep 1000 &') orphaned. After: Unix-only: spawn child in its own process group (Command::process_group(0)), and on timeout libc::kill(-pid, SIGKILL) to take down the whole group. New libc dep on Unix. ## Copilot doc fix Doc claimed "kei-mcp exposes 4 built-in tools" without saying spawn_agent lives in tools.rs while kei_bash/edit/write live in safe_tools.rs. Validator agent flagged this as FALSE/MISLEADING. Now the doc spells out the two-file structure + adds a v0.41 hardening summary. ## claude/grok subprocess permissions Cross-CLI audit demo revealed that 'claude -p' and 'grok --print' returned empty when invoked headless with a real audit task — they need explicit permission flags to use Read/Grep tools in non-interactive mode. Added: claude: --permission-mode=bypassPermissions grok: --always-approve agy: --dangerously-skip-permissions Override via KEI_AGENT_PERMISSIVE=0 to keep strict default. Re-verified: claude+grok both echo SMOKE-OK-V41 with the flag. ## Verification cargo test -p kei-mcp --release → 3/3 pass MCP JSON-RPC smoke (all 7): - tools/list shows 4 built-ins ✓ - kei_bash blocks RULE 0.1 push ✓ - kei_bash passes 'echo OK' ✓ - kei_write rejects /etc/passwd ✓ - kei_write rejects ../ traversal ✓ - kei_write rejects ~/.ssh/* ✓ - missing policy-chain → FAIL-CLOSED with clear error ✓ - KEI_POLICY_CHAIN_OPTIONAL=1 → opt-in pass-through ✓ |
||
|---|---|---|
| .. | ||
| .cargo | ||
| firewall-diff | ||
| frustration-matrix | ||
| kei-agent-runtime | ||
| kei-artifact | ||
| kei-atom-discovery | ||
| kei-auth | ||
| kei-auth-apple | ||
| kei-auth-google | ||
| kei-auth-magiclink | ||
| kei-auth-webauthn | ||
| kei-backend-daytona | ||
| kei-brain-view | ||
| kei-buddy | ||
| kei-cache | ||
| kei-capability | ||
| kei-changelog | ||
| kei-chat-store | ||
| kei-compute-baremetal | ||
| kei-compute-digitalocean | ||
| kei-compute-linode | ||
| kei-compute-vultr | ||
| kei-conflict-scan | ||
| kei-contacts-apple | ||
| kei-contacts-google | ||
| kei-content-store | ||
| kei-cortex | ||
| kei-cron-scheduler | ||
| kei-crossdomain | ||
| kei-curator | ||
| kei-db-contract | ||
| kei-decision | ||
| kei-decompose | ||
| kei-diff | ||
| kei-discover | ||
| kei-dna-index | ||
| kei-entity-store | ||
| kei-export-trajectories | ||
| kei-forge | ||
| kei-fork | ||
| kei-frustration-loop | ||
| kei-gateway | ||
| kei-gdrive-import | ||
| kei-git-bitbucket | ||
| kei-git-forgejo | ||
| kei-git-gitea | ||
| kei-git-gitlab | ||
| kei-graph-check | ||
| kei-graph-export | ||
| kei-graph-stream | ||
| kei-hibernate | ||
| kei-import-project | ||
| kei-leak-matrix | ||
| kei-ledger | ||
| kei-ledger-sign | ||
| kei-llm-bridge-mlx | ||
| kei-llm-llamacpp | ||
| kei-llm-mlx | ||
| kei-llm-ollama | ||
| kei-llm-router | ||
| kei-machine-probe | ||
| kei-mcp | ||
| kei-memory | ||
| kei-memory-postgres | ||
| kei-memory-redis | ||
| kei-memory-sled | ||
| kei-memory-sqlite | ||
| kei-migrate | ||
| kei-model | ||
| kei-model-router | ||
| kei-net-ipsec | ||
| kei-net-openvpn | ||
| kei-net-wireguard | ||
| kei-notify-discord | ||
| kei-notify-slack | ||
| kei-notify-sms | ||
| kei-notify-telegram | ||
| kei-pet | ||
| kei-ping | ||
| kei-pipe | ||
| kei-projects-index | ||
| kei-projects-watcher | ||
| kei-provision | ||
| kei-prune | ||
| kei-refactor-engine | ||
| kei-registry | ||
| kei-replay | ||
| kei-router | ||
| kei-runtime | ||
| kei-runtime-core | ||
| kei-sage | ||
| kei-scheduler | ||
| kei-search-core | ||
| kei-shared | ||
| kei-skill-importer | ||
| kei-skills | ||
| kei-social-store | ||
| kei-spawn | ||
| kei-store | ||
| kei-stt | ||
| kei-svc-systemd | ||
| kei-task | ||
| kei-telegram-webhook | ||
| kei-tlog | ||
| kei-token-tracker | ||
| kei-tts | ||
| kei-tty | ||
| kei-watch | ||
| keisei | ||
| mock-render | ||
| ssh-check | ||
| tokens-sync | ||
| visual-diff | ||
| .gitignore | ||
| Cargo.lock | ||
| Cargo.toml | ||