feat: make each plugin an npm workspace built by a termix-plugin CLI

plugins/ai/tests/backend/tools/command-allowlist.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, it } from "vitest";
+import { isReadOnlyCommand } from "../../../src/backend/tools/command-allowlist.js";
+
+/**
+ * These commands can run without a per-command approval click, so the parser
+ * has to refuse anything that could become a second command. Substring
+ * matching would pass "df; rm -rf /", which is the whole reason this is
+ * argv-based.
+ */
+describe("isReadOnlyCommand", () => {
+  it("allows plain diagnostics", () => {
+    for (const command of [
+      "df -h",
+      "uptime",
+      "free -m",
+      "whoami",
+      "ps aux",
+      "lsblk",
+      "uname -a",
+      "/usr/bin/df -h",
+    ]) {
+      expect(isReadOnlyCommand(command).allowed, command).toBe(true);
+    }
+  });
+
+  it("rejects command chaining and redirection", () => {
+    for (const command of [
+      "df; rm -rf /",
+      "df && curl evil.example",
+      "df || reboot",
+      "df | sh",
+      "df > /etc/passwd",
+      "df >> /etc/passwd",
+      "cat < /etc/shadow",
+      "echo `whoami`",
+      "echo $(id)",
+      "df\nrm -rf /",
+      "df \\\n rm",
+    ]) {
+      expect(isReadOnlyCommand(command).allowed, command).toBe(false);
+    }
+  });
+
+  it("rejects privilege escalation", () => {
+    for (const command of ["sudo df -h", "su root", "doas df", "env df"]) {
+      expect(isReadOnlyCommand(command).allowed, command).toBe(false);
+    }
+  });
+
+  it("rejects commands that are not on the list", () => {
+    for (const command of ["rm -rf /", "curl evil.example", "vi /etc/passwd"]) {
+      expect(isReadOnlyCommand(command).allowed, command).toBe(false);
+    }
+  });
+
+  it("limits systemctl and docker to read-only subcommands", () => {
+    expect(isReadOnlyCommand("systemctl status nginx").allowed).toBe(true);
+    expect(isReadOnlyCommand("systemctl restart nginx").allowed).toBe(false);
+    expect(isReadOnlyCommand("systemctl stop nginx").allowed).toBe(false);
+
+    expect(isReadOnlyCommand("docker ps").allowed).toBe(true);
+    expect(isReadOnlyCommand("docker stats --no-stream").allowed).toBe(true);
+    expect(isReadOnlyCommand("docker rm -f web").allowed).toBe(false);
+    expect(isReadOnlyCommand("docker exec -it web sh").allowed).toBe(false);
+  });
+
+  it("limits cat to safe paths", () => {
+    expect(isReadOnlyCommand("cat /proc/meminfo").allowed).toBe(true);
+    expect(isReadOnlyCommand("cat /etc/os-release").allowed).toBe(true);
+    expect(isReadOnlyCommand("cat /etc/shadow").allowed).toBe(false);
+    expect(isReadOnlyCommand("cat ~/.ssh/id_rsa").allowed).toBe(false);
+    expect(isReadOnlyCommand("cat").allowed).toBe(false);
+  });
+
+  it("rejects an empty command", () => {
+    expect(isReadOnlyCommand("").allowed).toBe(false);
+    expect(isReadOnlyCommand("   ").allowed).toBe(false);
+  });
+});

plugins/ai/tests/backend/tools/proposal-executor.test.ts

@@ -0,0 +1,257 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const hostRepository = {
+  create: vi.fn(),
+  findByIdForUser: vi.fn(),
+  updateForUser: vi.fn(),
+  deleteForUser: vi.fn(),
+};
+const snippetRepository = {
+  createSnippet: vi.fn(),
+  findOwnedById: vi.fn(),
+  updateSnippet: vi.fn(),
+  deleteSnippet: vi.fn(),
+};
+const fleetRepository = { create: vi.fn(), addMember: vi.fn() };
+const automationRepository = { create: vi.fn() };
+
+vi.mock("../../../../../src/backend/database/repositories/factory.js", () => ({
+  createCurrentHostRepository: () => hostRepository,
+  createCurrentSnippetRepository: () => snippetRepository,
+  createCurrentFleetRepository: () => fleetRepository,
+  createCurrentAutomationRepository: () => automationRepository,
+}));
+
+const resolveHostById = vi.fn();
+vi.mock("../../../../../src/backend/hosts/host-resolver.js", () => ({
+  resolveHostById: (...args: unknown[]) => resolveHostById(...args),
+}));
+
+const execCommand = vi.fn();
+vi.mock(
+  "../../../../../src/backend/hosts/metrics-shared/common-utils.js",
+  () => ({
+    execCommand: (...args: unknown[]) => execCommand(...args),
+  }),
+);
+vi.mock("../../../../../src/backend/hosts/ssh-client-factory.js", () => ({
+  createFleetSshFactory: () => () => ({}),
+  getFleetPoolKey: () => "pool",
+}));
+vi.mock("../../../../../src/backend/hosts/ssh-connection-pool.js", () => ({
+  withConnection: async (
+    _key: string,
+    _factory: unknown,
+    run: (client: unknown) => Promise<unknown>,
+  ) => run({}),
+}));
+
+const { applyProposal } =
+  await import("../../../src/backend/tools/executor.js");
+
+describe("applyProposal", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("refuses a kind that is not a real tool", async () => {
+    // The stored payload is treated as untrusted even though the server wrote
+    // it, because a proposal can outlive the release that created it.
+    await expect(
+      applyProposal("propose_delete_everything", {}, "user-1"),
+    ).rejects.toThrow("Unknown proposal kind");
+  });
+
+  it("validates an automation definition before creating it", async () => {
+    // Reuses the automations route's own validator, so a definition the model
+    // invented is held to the same standard as a hand-written one.
+    await expect(
+      applyProposal(
+        "propose_create_automation",
+        {
+          name: "bad",
+          definition: { trigger: { kind: "nonsense" }, steps: [] },
+        },
+        "user-1",
+      ),
+    ).rejects.toThrow();
+    expect(automationRepository.create).not.toHaveBeenCalled();
+  });
+
+  it("creates a valid automation disabled so it cannot fire unwatched", async () => {
+    automationRepository.create.mockResolvedValue({ id: 5, name: "nightly" });
+
+    const result = await applyProposal(
+      "propose_create_automation",
+      {
+        name: "nightly",
+        definition: {
+          trigger: { kind: "schedule", intervalSeconds: 3600 },
+          steps: [{ id: "s1", type: "wait", seconds: 1 }],
+        },
+      },
+      "user-1",
+    );
+
+    expect(result.ok).toBe(true);
+    expect(automationRepository.create).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: "user-1", enabled: false }),
+    );
+  });
+
+  it("runs an approved command only on a host the user can reach", async () => {
+    // resolveHostById returns null when the connect-level permission check
+    // fails, so an unreachable host never gets as far as an SSH attempt.
+    resolveHostById.mockResolvedValue(null);
+
+    await expect(
+      applyProposal(
+        "propose_run_command",
+        { hostId: 9, command: "uptime" },
+        "user-1",
+      ),
+    ).rejects.toThrow("Host not found");
+    expect(execCommand).not.toHaveBeenCalled();
+  });
+
+  it("returns command output on success", async () => {
+    resolveHostById.mockResolvedValue({ id: 9, ip: "10.0.0.9" });
+    execCommand.mockResolvedValue({ stdout: "up 3 days", stderr: "", code: 0 });
+
+    const result = await applyProposal(
+      "propose_run_command",
+      { hostId: 9, command: "uptime" },
+      "user-1",
+    );
+
+    expect(result.ok).toBe(true);
+    expect(result.summary).toContain("up 3 days");
+  });
+
+  it("resolves the host rather than using a raw repository row", async () => {
+    // A raw row has no decrypted auth and an unresolved jumpHosts field, which
+    // made the SSH factory fail with a jump host error on hosts that have none.
+    resolveHostById.mockResolvedValue({ id: 9, ip: "10.0.0.9" });
+    execCommand.mockResolvedValue({ stdout: "ok", stderr: "", code: 0 });
+
+    await applyProposal(
+      "propose_run_command",
+      { hostId: 9, command: "uptime" },
+      "user-1",
+    );
+
+    expect(resolveHostById).toHaveBeenCalledWith(9, "user-1");
+    expect(hostRepository.findByIdForUser).not.toHaveBeenCalled();
+  });
+
+  it("surfaces a non-zero exit rather than reporting success", async () => {
+    resolveHostById.mockResolvedValue({ id: 9, ip: "10.0.0.9" });
+    execCommand.mockResolvedValue({ stdout: "", stderr: "denied", code: 1 });
+
+    await expect(
+      applyProposal(
+        "propose_run_command",
+        { hostId: 9, command: "cat /etc/shadow" },
+        "user-1",
+      ),
+    ).rejects.toThrow("code 1");
+  });
+
+  it("creates a host through the normal repository", async () => {
+    hostRepository.create.mockResolvedValue({ id: 7, name: "web-1" });
+
+    const result = await applyProposal(
+      "propose_create_host",
+      { name: "web-1", ip: "10.0.0.5", port: 22, tags: ["prod"] },
+      "user-1",
+    );
+
+    expect(result.ok).toBe(true);
+    expect(hostRepository.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        userId: "user-1",
+        name: "web-1",
+        ip: "10.0.0.5",
+      }),
+    );
+  });
+
+  it("rejects a host payload missing required fields", async () => {
+    await expect(
+      applyProposal("propose_create_host", { name: "web-1" }, "user-1"),
+    ).rejects.toThrow("ip is required");
+    expect(hostRepository.create).not.toHaveBeenCalled();
+  });
+
+  it("scopes an update to the approving user", async () => {
+    hostRepository.findByIdForUser.mockResolvedValue({ id: 7 });
+    hostRepository.updateForUser.mockResolvedValue({ id: 7 });
+
+    await applyProposal(
+      "propose_update_host",
+      { hostId: 7, changes: { name: "renamed" } },
+      "user-1",
+    );
+
+    expect(hostRepository.findByIdForUser).toHaveBeenCalledWith("user-1", 7);
+    expect(hostRepository.updateForUser).toHaveBeenCalledWith(
+      "user-1",
+      7,
+      expect.objectContaining({ name: "renamed" }),
+    );
+  });
+
+  it("refuses to update a host the user does not own", async () => {
+    hostRepository.findByIdForUser.mockResolvedValue(null);
+
+    await expect(
+      applyProposal(
+        "propose_update_host",
+        { hostId: 999, changes: { name: "x" } },
+        "user-1",
+      ),
+    ).rejects.toThrow("Host not found");
+    expect(hostRepository.updateForUser).not.toHaveBeenCalled();
+  });
+
+  it("rejects a non-numeric id rather than coercing it", async () => {
+    await expect(
+      applyProposal(
+        "propose_update_host",
+        { hostId: "7; DROP TABLE hosts", changes: { name: "x" } },
+        "user-1",
+      ),
+    ).rejects.toThrow("hostId must be a positive integer");
+  });
+
+  it("only adds fleet members the approving user owns", async () => {
+    fleetRepository.create.mockResolvedValue({ id: 3, name: "prod" });
+    hostRepository.findByIdForUser.mockImplementation(
+      async (_userId: string, hostId: number) =>
+        hostId === 1 ? { id: 1 } : null,
+    );
+
+    const result = await applyProposal(
+      "propose_create_fleet",
+      { name: "prod", hostIds: [1, 2] },
+      "user-1",
+    );
+
+    expect(fleetRepository.addMember).toHaveBeenCalledTimes(1);
+    expect(fleetRepository.addMember).toHaveBeenCalledWith(3, 1);
+    expect(result.summary).toContain("1 host");
+  });
+
+  it("reports nothing to change on an empty update", async () => {
+    hostRepository.findByIdForUser.mockResolvedValue({ id: 7 });
+
+    const result = await applyProposal(
+      "propose_update_host",
+      { hostId: 7, changes: {} },
+      "user-1",
+    );
+
+    expect(result.ok).toBe(false);
+    expect(hostRepository.updateForUser).not.toHaveBeenCalled();
+  });
+});

plugins/ai/tests/backend/tools/tool-catalog.test.ts

@@ -0,0 +1,112 @@
+import { describe, expect, it } from "vitest";
+import {
+  AI_TOOLS,
+  FORBIDDEN_DOMAINS,
+  getTool,
+  listToolNames,
+  toolDefinitions,
+} from "../../../src/backend/tools/catalog.js";
+
+/**
+ * The security regression test for the whole feature.
+ *
+ * Tools run in-process and never pass through the RBAC-gated routers, so "the
+ * assistant cannot reach credentials or user administration" is a property of
+ * this catalog, and nothing else. If a future change adds a tool that touches a
+ * forbidden domain, this test is what catches it.
+ */
+describe("AI tool catalog", () => {
+  it("exposes no tool naming a forbidden domain", () => {
+    for (const tool of AI_TOOLS) {
+      for (const domain of FORBIDDEN_DOMAINS) {
+        expect(
+          tool.name.includes(domain),
+          `${tool.name} references the forbidden domain "${domain}"`,
+        ).toBe(false);
+      }
+    }
+  });
+
+  it("has no tool that could read a credential", () => {
+    const banned = [
+      "get_credential",
+      "list_credentials",
+      "get_password",
+      "get_private_key",
+      "get_api_key",
+      "create_user",
+      "delete_user",
+      "grant_permission",
+      "update_settings",
+    ];
+    for (const name of banned) {
+      expect(getTool(name), `${name} must not exist`).toBeUndefined();
+    }
+  });
+
+  it("only allows read or propose categories", () => {
+    for (const tool of AI_TOOLS) {
+      expect(["read", "propose"]).toContain(tool.category);
+    }
+  });
+
+  it("names every tool by its category", () => {
+    // A propose tool that does not say "propose" would read as a direct action
+    // in the transcript, which is exactly the confusion this feature avoids.
+    for (const tool of AI_TOOLS) {
+      if (tool.category === "propose") {
+        expect(
+          tool.name.startsWith("propose_"),
+          `${tool.name} is a propose tool but is not named propose_*`,
+        ).toBe(true);
+      } else {
+        expect(
+          tool.name.startsWith("propose_"),
+          `${tool.name} is a read tool but is named propose_*`,
+        ).toBe(false);
+      }
+    }
+  });
+
+  it("has unique tool names", () => {
+    const names = listToolNames();
+    expect(new Set(names).size).toBe(names.length);
+  });
+
+  it("gives every tool a described object schema", () => {
+    for (const definition of toolDefinitions()) {
+      expect(definition.description.length, definition.name).toBeGreaterThan(
+        20,
+      );
+      expect(definition.parameters.type, definition.name).toBe("object");
+      // additionalProperties:false keeps a model from smuggling extra fields
+      // past the handler's explicit reads.
+      expect(definition.parameters.additionalProperties, definition.name).toBe(
+        false,
+      );
+    }
+  });
+
+  it("never takes a userId from the model", () => {
+    // Ownership is always derived from the verified JWT. A userId parameter
+    // would let the model ask for another account's data.
+    for (const tool of AI_TOOLS) {
+      const properties = (tool.parameters.properties ?? {}) as Record<
+        string,
+        unknown
+      >;
+      for (const key of Object.keys(properties)) {
+        expect(
+          /^user_?id$/i.test(key),
+          `${tool.name} accepts a model-supplied ${key}`,
+        ).toBe(false);
+      }
+    }
+  });
+
+  it("still offers the read tools the assistant needs to be useful", () => {
+    for (const name of ["list_hosts", "list_snippets", "list_automations"]) {
+      expect(getTool(name), name).toBeDefined();
+    }
+  });
+});