Merge branch 'main' into hardening/egress-defaults

Author: devGregA

.changeset/hardening-address-blocking-and-artifact-integrity.md

@@ -0,0 +1,10 @@
+---
+'@moonshot-ai/agent-core-v2': patch
+'@moonshot-ai/agent-core': patch
+---
+
+Extend the URL-fetch private-address blocklist to cover NAT64-embedded IPv4
+ranges (RFC 6052 `64:ff9b::/96` and the RFC 8215 local-use prefix), and give the
+capability downloader optional SHA-256 verification that discards an artifact
+whose digest does not match. The macOS computer-use bundle keeps its quarantine
+attribute so Gatekeeper still evaluates it.

.changeset/hardening-permission-enforcement.md

@@ -0,0 +1,14 @@
+---
+'@moonshot-ai/agent-core-v2': minor
+---
+
+Make the permission layer enforce what it is configured to enforce:
+
+- Seed each agent with the user's `[permission]` rules from config. The rules Op
+  is not persisted, so the model always started empty and configured
+  allow/deny/ask rules never reached the policy chain.
+- Order the sensitive-file and git-control asks ahead of the blanket auto-mode
+  approval, so auto mode no longer waives them. An explicit prior approval or a
+  user `allow` rule still wins, so nothing already approved re-prompts.
+- Fail closed when no approval broker is bound: a call that reached the "ask"
+  path is now blocked instead of being treated as approved.

.changeset/hardening-sensitive-file-coverage.md

@@ -0,0 +1,17 @@
+---
+'@moonshot-ai/agent-core-v2': minor
+'@moonshot-ai/agent-core': minor
+---
+
+Widen sensitive-file coverage for the file tools. Credential directories
+(`.ssh`, `.gnupg`, `.aws`, `.azure`, `.kube`, `.config/gcloud`, the CLI's own
+`credentials` dir) are now treated as sensitive whatever the file inside is
+called, since private keys and cloud credential files routinely carry local
+names a basename list cannot predict. Adds the common credential files
+(`.git-credentials`, `.netrc`, `.npmrc`, `.pypirc`, `.docker/config.json`,
+`kubeconfig`, the CLI's own `config.toml`). Public keys, `known_hosts`,
+`.ssh/config` and `.aws/config` stay readable.
+
+Grep and Glob now apply the sensitive-file check that Read, Write and Edit
+already applied, so searching cannot return the contents of files those tools
+refuse to open.

.changeset/hardening-symlink-containment.md

@@ -0,0 +1,12 @@
+---
+'@moonshot-ai/agent-core-v2': minor
+---
+
+Re-check file-tool paths against their symlink-resolved target before reading,
+writing or editing. Path canonicalization is lexical, so a symlink sitting
+inside the workspace reads as inside it while the OS follows the link at open
+time. Read, Write and Edit now resolve the longest existing prefix of the path
+and require that a path which looked in-workspace is still in-workspace once
+symlinks are resolved, and that the resolved target is not a sensitive file even
+when the link itself is innocuously named. Paths the caller already gave as
+outside the workspace are unaffected — those remain the approval layer's call.

packages/agent-core-v2/src/agent/permissionPolicy/permissionPolicyService.ts

@@ -42,15 +42,24 @@ export class AgentPermissionPolicyService
     @IInstantiationService private readonly instantiation: IInstantiationService,
   ) {
     super();
+    // Order matters: the first policy to return a result wins.
+    //
+    // `AutoModeApprove` sits after the two content-sensitive asks (secrets on
+    // disk, and the .git control directory) rather than ahead of them, so
+    // enabling auto mode speeds up ordinary work without also silently
+    // waiving the checks that exist for the highest-consequence paths.
+    // Everything else keeps its previous relative order: an explicit prior
+    // approval (`SessionApprovalHistory`) or a user `allow` rule still wins,
+    // so this does not re-prompt for something already approved.
     this.policies = [
       this.instantiation.createInstance(AutoModeAskUserQuestionDenyPermissionPolicyService),
       this.instantiation.createInstance(UserConfiguredDenyPermissionPolicyService),
-      this.instantiation.createInstance(AutoModeApprovePermissionPolicyService),
       this.instantiation.createInstance(SessionApprovalHistoryPermissionPolicyService),
       this.instantiation.createInstance(UserConfiguredAskPermissionPolicyService),
       this.instantiation.createInstance(UserConfiguredAllowPermissionPolicyService),
       this.instantiation.createInstance(SensitiveFileAccessAskPermissionPolicyService),
       this.instantiation.createInstance(GitControlPathAccessAskPermissionPolicyService),
+      this.instantiation.createInstance(AutoModeApprovePermissionPolicyService),
       this.instantiation.createInstance(YoloModeApprovePermissionPolicyService),
       this.instantiation.createInstance(DefaultToolApprovePermissionPolicyService),
       this.instantiation.createInstance(GitCwdWriteApprovePermissionPolicyService),

packages/agent-core-v2/src/agent/toolApproval/toolApprovalService.ts

@@ -131,7 +131,14 @@ export class AgentToolApprovalService extends Service implements IAgentToolAppro
     let response: ApprovalResponse;
     const approvalService = this.tryApprovalService();
     if (approvalService === undefined) {
-      response = { decision: 'approved' };
+      // Fail closed. Reaching here means a policy decided this call needs
+      // confirmation, but no broker is bound to ask (an embedding host that
+      // never wired one up). Treating "nobody to ask" as consent would let
+      // every gated tool call through unreviewed.
+      response = {
+        decision: 'rejected',
+        feedback: 'No approval broker is available to confirm this tool call.',
+      };
     } else {
       this.eventBus.publish({ type: 'permission.approval.requested', ...approvalContext });
       try {

packages/agent-core-v2/src/agent/tools/edit/editTool.ts

@@ -21,13 +21,15 @@
 
 import {
   extendWorkspaceWithSkillRoots,
+  assertRealPathAccess,
   resolvePathAccessPath,
   type WorkspaceConfig,
 } from '#/tool/path-access';
 import { toInputJsonSchema } from '#/tool/input-schema';
 import { literalRulePattern, matchesPathRuleSubject } from '#/tool/rule-match';
 import { IFileEditService } from '#/app/edit/fileEdit';
 import { IHostEnvironment } from '#/os/interface/hostEnvironment';
+import { IHostFileSystem } from '#/os/interface/hostFileSystem';
 import { ISessionSkillCatalog } from '#/session/sessionSkillCatalog/skillCatalog';
 import { ISessionWorkspaceContext } from '#/session/workspaceContext/workspaceContext';
 import {
@@ -48,6 +50,7 @@ export class EditTool implements IEditTool {
 
   constructor(
     @IFileEditService private readonly editor: IFileEditService,
+    @IHostFileSystem private readonly fs: IHostFileSystem,
     @IHostEnvironment private readonly env: IHostEnvironment,
     @ISessionWorkspaceContext private readonly workspaceCtx: ISessionWorkspaceContext,
     @ISessionSkillCatalog private readonly skillCatalog?: ISessionSkillCatalog,
@@ -92,6 +95,11 @@ export class EditTool implements IEditTool {
   }
 
   private async execution(args: EditInput, safePath: string): Promise<ExecutableToolResult> {
+    // The path was canonicalized lexically; re-check it against what the
+    // symlinks actually resolve to before editing through them.
+    await assertRealPathAccess(safePath, args.path, this.workspaceConfig, this.fs, {
+      pathClass: this.env.pathClass,
+    });
     if (args.old_string === args.new_string) {
       return {
         isError: true,

packages/agent-core-v2/src/agent/tools/os/glob/globTool.ts

@@ -152,7 +152,7 @@ export class GlobTool implements IGlobTool {
         env: this.env,
         workspace: this.workspaceConfig,
         operation: 'search',
-        policy: { guardMode: 'absolute-outside-allowed', checkSensitive: false },
+        policy: { guardMode: 'absolute-outside-allowed', checkSensitive: true },
       });
     }
     const searchRoots = [path ?? this.workspaceConfig.workspaceDir];

packages/agent-core-v2/src/agent/tools/os/grep/grepTool.ts

@@ -127,7 +127,7 @@ export class GrepTool implements IGrepTool {
         env: this.env,
         workspace: this.workspace,
         operation: 'search',
-        policy: { guardMode: 'absolute-outside-allowed', checkSensitive: false },
+        policy: { guardMode: 'absolute-outside-allowed', checkSensitive: true },
       });
     }
     const searchPaths = [path ?? this.workspace.workspaceDir];

packages/agent-core-v2/src/agent/tools/os/read/readTool.ts

@@ -35,6 +35,7 @@ import {
 import { registerAgentToolService } from '#/agent/toolRegistry/toolContribution';
 import {
   extendWorkspaceWithSkillRoots,
+  assertRealPathAccess,
   resolvePathAccessPath,
   type WorkspaceConfig,
 } from '#/tool/path-access';
@@ -271,6 +272,11 @@ export class ReadTool implements IReadTool {
   }
 
   private async execution(args: ReadInput, safePath: string): Promise<ExecutableToolResult> {
+    // The path was canonicalized lexically; re-check it against what the
+    // symlinks actually resolve to before reading through them.
+    await assertRealPathAccess(safePath, args.path, this.workspaceConfig, this.fs, {
+      pathClass: this.env.pathClass,
+    });
     try {
       let stat: Awaited<ReturnType<IHostFileSystem['stat']>>;
       try {