morluto
53fe7d6d3b
* fix(platform): accept absolute paths for any host and stop blaming the ceiling for a missing grant Addresses #548 and #545. #548: processScenarioSchema required a leading "/" for executable, working_directory and filesystem_roots, so no process scenario could be expressed on Windows at all. The report suggested node:path's isAbsolute, but that answers for the host running the check: on Linux `C:\tools` is not absolute, so a scenario captured on Windows would fail validation when it is replayed, compared, or asserted in a test on another host. A boundary schema must not vary with its evaluator, so the check accepts the POSIX form, a Windows drive path and a UNC share everywhere. The rejection message now names the constraint instead of leaving the caller to infer it from "invalid request". The HTTP `path` field inside `checkpoints` is an URL path and is deliberately left alone. I checked whether this merely moved the failure downstream: containment is enforced by isPathWithinRoot, which already uses host-aware path.relative, so validation really was the only blocker. #545: when a scope is inside the administrator ceiling but no grant was ever issued, the denial still pointed at widening the ceiling -- advice that cannot help, since the ceiling already permits the operation. The `missing` payload is computed against candidate *grants*, so it describes what a grant must cover, not a ceiling gap. `PermissionRemediation` gains a `grant` variant saying exactly that, and PermissionAuthority selects it when the denial is not a ceiling violation. An explicitly requested remediation is still honoured, and a genuine ceiling violation still says "configure". * refactor(config): take the environment as an input at every configuration read Completes B-2. Every `parseConfig(process.env)` site now reads from an injected environment, so configuration-driven behaviour is a function of an argument rather than of the machine running it. The twelve sites were not equivalent, and treating them as one number would have hidden the difference: - **src/application/ (3 sites) were genuine defects.** `runSessionStatus` already injected its `logger` but hardcoded `process.env` for config, so the MCP path's `dependencies.env` never reached it; `captureProcessScenarioFile` and `runAnalysis` had the same problem. `runAnalysis` gained `environment` on the options object it already had, which is where its other injected dependencies live. - **The CLI command layer (9 sites) is a documented boundary,** where `process.env` is legitimate. Rather than 9 independent ambient reads, they now share one seam: `createCli(environment)` passes it to the seven registrars that need configuration, and the nested helpers (`electronContext`, `runtimeContext`, `loadConfiguredAuthority`, `inspectJavaScriptReplay`) take it explicitly. Every new parameter defaults to `process.env`, so all existing call sites are unchanged and production behaviour is identical. The point is that the ambient read is now a documented default at a boundary rather than a hidden dependency deep inside behaviour. `process.env` now survives in `src/` only as those default parameters — nothing reads it at the point of use. * style(cli): apply prettier formatting to the runtime observation command
71 lines
3.1 KiB
TypeScript
71 lines
3.1 KiB
TypeScript
import { Cli } from "incur";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
import { createLogger, parseLogLevel } from "./logger.js";
|
|
import { PRODUCT_IDENTITY } from "./identity.js";
|
|
import { registerSetupCommands } from "./cli/setupCommands.js";
|
|
import { registerCoreAnalysisCommands } from "./cli/coreAnalysisCommands.js";
|
|
import { registerUtilityCommands } from "./cli/utilityCommands.js";
|
|
import { registerArtifactCommands } from "./cli/artifactCommands.js";
|
|
import { registerManagedCommands } from "./cli/managedCommands.js";
|
|
import { registerEvidenceCommands } from "./cliEvidenceCommands.js";
|
|
import { registerProcessCommands } from "./cliProcessCommands.js";
|
|
import { registerPolicyCommands } from "./cliPolicyCommands.js";
|
|
import { registerBrowserCommands } from "./cliBrowserCommands.js";
|
|
import { registerAdvancedBrowserCommands } from "./cliBrowserAdvancedCommands.js";
|
|
import { registerBrowserScenarioCommands } from "./cliBrowserScenarioCommands.js";
|
|
import { registerElectronCommands } from "./cliElectronCommands.js";
|
|
import { registerJavaScriptRuntimeObservationCommands } from "./cliJavaScriptRuntimeCommands.js";
|
|
import { registerApplicationCommands } from "./cliApplicationCommands.js";
|
|
import type { CliInstance } from "./cli/types.js";
|
|
|
|
/**
|
|
* Build the one-shot Incur CLI without starting Hopper at import time.
|
|
* Analysis commands acquire and close their own sessions; bare `mcp` and
|
|
* `--mcp` are intercepted by the executable dispatcher before this module loads.
|
|
*/
|
|
export const createCli = (
|
|
environment: Readonly<Record<string, string | undefined>> = process.env,
|
|
): CliInstance => {
|
|
const logger = createLogger(
|
|
"cli",
|
|
environment.REA_LOG_LEVEL === undefined
|
|
? "silent"
|
|
: parseLogLevel(environment.REA_LOG_LEVEL),
|
|
);
|
|
const cli = Cli.create(PRODUCT_IDENTITY.cliBinary, {
|
|
version: PRODUCT_IDENTITY.packageVersion,
|
|
description: "Reverse engineer anything from your terminal or agent.",
|
|
mcp: {
|
|
command: PRODUCT_IDENTITY.mcpCommand,
|
|
instructions:
|
|
"Ask what software, artifact, protocol, or behavior the user wants to understand, then choose the available investigation capabilities that can produce evidence.",
|
|
},
|
|
sync: {
|
|
cwd: fileURLToPath(new URL("..", import.meta.url)),
|
|
include: ["skills/*"],
|
|
suggestions: [
|
|
"understand how a software feature works",
|
|
"investigate an artifact or observed behavior",
|
|
"check my REA setup",
|
|
],
|
|
},
|
|
});
|
|
|
|
registerSetupCommands(cli, logger);
|
|
registerCoreAnalysisCommands(cli, logger);
|
|
registerUtilityCommands(cli, logger, environment);
|
|
registerArtifactCommands(cli, logger);
|
|
registerManagedCommands(cli, logger, environment);
|
|
registerEvidenceCommands(cli, logger);
|
|
registerProcessCommands(cli, logger);
|
|
registerPolicyCommands(cli, logger, environment);
|
|
registerBrowserCommands(cli, logger);
|
|
registerAdvancedBrowserCommands(cli, logger);
|
|
registerBrowserScenarioCommands(cli, logger, environment);
|
|
registerElectronCommands(cli, logger, environment);
|
|
registerJavaScriptRuntimeObservationCommands(cli, logger, environment);
|
|
registerApplicationCommands(cli, logger, environment);
|
|
return cli;
|
|
};
|