mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 09:13:14 +00:00
Some checks are pending
CI / Lint (push) Waiting to run
CI / Format check (push) Waiting to run
CI / Typecheck (push) Waiting to run
CI / Unit tests (push) Waiting to run
CI / Playwright E2E (push) Waiting to run
CI / Docker build smoke (push) Waiting to run
CI / Triage ledger up to date (push) Waiting to run
CI / ui bun.lock in sync (push) Waiting to run
* feat(open-swe): add Jira tool plane (Phase 1)
Curated Jira Cloud REST v3 toolset for the agent, mirroring the Linear
tools:
- utils/jira.py: service-account REST client (Basic auth) with get/
create/update issue, comments, list projects, trace comment; issue and
comment bodies normalized to markdown.
- utils/adf.py: minimal ADF <-> markdown conversion (read paths convert
Jira ADF to markdown; agent comments convert prose to ADF).
- tools/jira_{comment,get_issue,get_issue_comments,create_issue,
update_issue,list_projects}.py wired into the tool registry and the
main agent tool list.
- tests/test_jira_utils.py: ADF conversion + mocked-transport util tests.
Reads JIRA_BASE_URL / JIRA_SERVICE_EMAIL / JIRA_API_TOKEN; unset env
returns a clean error, so this is safe to land dark. Trigger plane,
prompt guidance, and config plumbing follow in Phase 2.
* feat(open-swe): add Confluence tool plane (Phase 3)
Curated Confluence Cloud REST toolset for the agent, mirroring the Jira
tools:
- utils/confluence.py: service-account REST client (Basic auth) with
get/create/update page, add comment, CQL search. Page bodies are XHTML
storage format (not ADF), with minimal storage<->text converters;
update_page reads the current version and bumps it, as Confluence
requires.
- tools/confluence_{get_page,create_page,update_page,comment,search}.py
registered in the tool registry.
- tests/test_confluence_utils.py: converter + mocked-transport tests
including the version-bump path.
Reads CONFLUENCE_BASE_URL / CONFLUENCE_EMAIL / CONFLUENCE_API_TOKEN;
unset env returns a clean error. Activation in the agent tool list lands
with the Phase 2 server.py wiring.
* feat(open-swe): add Jira trigger plane (Phase 2)
Make an @openswe comment on a Jira issue spawn an agent run, mirroring
the Linear trigger plane:
- webhooks/jira.py: process_jira_issue clones process_linear_issue —
deterministic thread id, full-issue fetch, actor accountId->email
attribution feeding resolve_login_from_email_async (PRs open as the
human), multimodal image handling, source="jira" + jira_issue config.
- webapp.py: POST/GET /webhooks/jira, verify_jira_secret (constant-time
X-Automation-Webhook-Token check, fails closed), repo-resolution
cascade, get_repo_config_from_jira_mapping.
- utils/jira_project_repo_map.py: JIRA_PROJECT_TO_REPO (placeholder
entry — real project->repo mappings still needed).
- utils/jira.py: get_user_email (accountId -> email) for attribution.
- completion.py: source=="jira" failure-reply branch.
- prompt.py: Jira-triggered notify guidance + Refs:/branch key from
{jira_project_key}-{jira_issue_number}.
- server.py: read jira_issue config + pass jira key to the system
prompt; also activates the Phase 3 Confluence tools in the agent list.
Jira Automation lacks native webhook HMAC signing, so trust is a shared
secret header (decision D2); replay protection is weaker than Linear's
HMAC+timestamp. /sh-security-review + an Atlassian IP allowlist are the
outstanding gate/hardening before push.
* fix(open-swe): harden Jira webhook trust (sh-security-review)
Resolves findings from the Phase 2 security review (detector fan-out +
proof-or-kill verifier). The unsigned Jira Automation webhook body was
trusted for identity, comment content, repo routing, and issue
existence; a JIRA_WEBHOOK_SECRET holder could forge those fields.
- Corroborate against the real Jira record: the webhook body is now only
a pointer (issue_key + required comment_id). The triggering comment's
author and text are re-fetched server-side via get_comment/fetch_jira_
comment, and identity, the @openswe check, prompt text, and project
key are derived from that authoritative record — never payload author/
body fields. An uncorroborated comment is rejected. (closes the
account-id impersonation, unsigned-body prompt injection, and
fabricated-issue findings)
- Validate issue_key against the Jira key format and percent-encode all
untrusted path segments (_seg) so a crafted key can't traverse to a
different Jira REST endpoint or inject query params. (closes the path-
traversal / query-injection findings)
- Route source=="jira" through the bot-token-default / author_prs_as_
user opt-in path in resolve_github_token, matching Linear, instead of
unconditionally resolving a per-user OAuth token from a payload email.
- Gate attribution on an active user mapping (is_login_mapped) so a
pending/unconfirmed mapping can't drive PR authorship.
Adds regression tests: server-corroboration wins over payload, malformed
issue_key rejected, uncorroborated comment rejected, path-segment
encoding, project-key derivation, active-mapping gate.
Remaining (non-blocking, deployment/hardening): set ALLOWED_GITHUB_ORGS/
REPOS so the shared allowlist isn't fail-open; consider HMAC-over-body +
timestamp on the Automation payload to close the residual replay gap.
* harden(open-swe): opt-in Jira webhook replay/IP + fail-closed allowlist
Folds the two deployment-hardening items from the Phase 2 security review
into code (all opt-in / default-off, so existing and upstream deployments
are unaffected):
- JIRA_WEBHOOK_REQUIRE_SIGNATURE: when set, the Automation payload must
carry X-Openswe-Signature (hex HMAC-SHA256 of the raw body keyed by
JIRA_WEBHOOK_SECRET) plus a fresh timestamp, verified by
verify_jira_signature / _jira_timestamp_is_fresh (mirrors the Linear
HMAC+freshness model). Closes the static-token model's replay/forgery
gap when enabled.
- JIRA_WEBHOOK_IP_ALLOWLIST: optional CIDR allowlist on the webhook's
direct client IP (verify_jira_source_ip). Documented as direct-peer
only; behind a proxy/LB, allowlist Atlassian's ranges at that layer.
- REQUIRE_REPO_ALLOWLIST: makes an empty ALLOWED_GITHUB_ORGS/REPOS fail
CLOSED instead of the back-compat allow-all, plus a startup fail-open
warning. Applies to all channels for consistency.
Documents all new vars (and a Jira section) in .env.example. Adds tests
for signature on/off + valid/missing/wrong/stale, IP allow/deny/off, and
the fail-closed allowlist.
* feat(open-swe): Confluence Atlassian Connect trigger (Phase 4)
Adds the @openswe-on-a-Confluence-comment trigger via a private Atlassian
Connect app. Designed and adversarially verified with the ultracode
workflow (3 divergent Opus designs + judge; 3 proof-or-kill Opus
skeptics on the implemented crypto).
- utils/atlassian_connect.py: hand-rolled qsh (pinned to Atlassian's
official test vector), PyJWT HS256 webhook verifier with alg-pinning,
issuer binding, and qsh-verified-last ordering; RS256 signed-install
lifecycle verifier against Atlassian's published keys; installation
store keyed by clientKey with the sharedSecret encrypted at rest
(TOKEN_ENCRYPTION_KEY / Fernet). No new dependency (PyJWT already pinned).
- webhooks/confluence.py: install/uninstall lifecycle + comment handler.
The JWT-signed webhook body is only a pointer; the comment's real
author/text/container are re-fetched server-side via the Basic-auth
service account (Phase-2 corroboration lesson), with active-only login
attribution and the repo allowlist.
- utils/confluence.py: get_comment / get_user_email (path-encoded).
- webapp.py: GET /connect/atlassian-connect.json (served dynamically),
POST /connect/{installed,uninstalled,webhook/comment-created}, the
space->repo resolver, thread-id, and fetch helpers.
- completion.py: source=="confluence" failure-reply branch.
Security: the sh-security-review verify pass confirmed one HIGH — the
symmetric signed-install=false first-install was trust-on-first-use gated
only by the public Confluence hostname (webhook-auth bypass). Fixed by
switching to signed-install=true + RS256 verification of lifecycle
callbacks, which cryptographically authenticates the first install. All
other attack lenses (forgery/replay/alg-confusion/overwrite/uninstall
DoS/corroboration/injection) were defeated; residuals are deployment
config (REQUIRE_REPO_ALLOWLIST) or accepted-by-design (qsh cannot cover
bodies; comment-trigger prompt injection, shared with all sources).
New env (documented in .env.example): CONFLUENCE_BASE_URL/EMAIL/API_TOKEN,
CONNECT_BASE_URL, CONNECT_EXPECTED_BASE_URL (optional). Install secrets
require the durable Postgres LangGraph store in prod.
Outstanding before push: /sh-security-review on the real diff and the
GPT-4.1 cross-family review (auth boundary); README/CLAUDE.md + memory.
* docs(open-swe): Phase 5 — Confluence prompt guidance + architecture docs
- prompt.py: Confluence-triggered runs notify via confluence_comment on
the triggering page; add Confluence to the shared-base source list.
- CLAUDE.md: document the Jira + Confluence tool planes and the Atlassian
triggers (Jira Automation shared-secret webhook; Confluence Connect app
with HS256 webhook + qsh and RS256 signed-install lifecycle), plus the
server-side corroboration + encrypted install store.
Phase 5 also verified the trigger surface end-to-end against a running
uvicorn app (descriptor served; /connect/* and /webhooks/jira fail closed
without valid auth) and recorded the integration in project memory.
* fix(open-swe): resolve /sh-security-review findings on the Atlassian surface
Formal sh-security-review (detector fan-out + verifier) over the Phase-4
Connect surface (esp. the new RS256 signed-install code, unseen by the
earlier adversarial verify) and the Phase-2 opt-in hardening.
CRITICAL — cross-tenant install (origin validation, CWE-346): signed-
install proves the caller is *an* Atlassian tenant, not *ours*, and the
descriptor is served publicly, so any attacker could install the app on
their own Confluence site and drive agent runs against our allowlisted
repos. The baseUrl body field is attacker-controlled and cannot bind the
tenant; only the signature-verified clientKey (JWT iss) can. Added a
MANDATORY, fail-closed CONNECT_EXPECTED_CLIENT_KEYS allowlist checked in
process_install after signature+iss verification.
HIGH — cross-tenant thread-id collision (CWE-330/863): Confluence comment
ids are per-instance, so generate_thread_id_from_confluence_comment now
salts the hash with the verified clientKey (plumbed from the webhook JWT
iss) to prevent thread hijack across tenants.
HIGH/MEDIUM — path/query injection (CWE-22/88): get_page and update_page
interpolated page_id into the REST path unencoded (update_page on a
mutating PUT with no params= backstop). Now _seg()-encoded, matching the
rest of the module.
MEDIUM — self-trigger loop (CWE-405): process_confluence_comment had no
bot-authorship early-out. Added an optional CONFLUENCE_BOT_ACCOUNT_ID
guard mirroring the Linear botActor / Jira comment_author_is_bot checks.
LOW — corrected the CONNECT_EXPECTED_BASE_URL comment to document it as
opt-in defense-in-depth (the clientKey allowlist is the real gate).
Verified clean by the detectors: RS256/HS256 alg-pinning, aud/iss/exp,
kid-fetch SSRF (host-pinned + quote-encoded), at-rest secret encryption,
constant-time comparisons, and the Phase-2 hardening. New regression
tests for each fix; full suite green (1602).
* harden(open-swe): GPT-4.1 cross-family review follow-ups
Cross-family review (GPT-4.1 via orchestrator cross_reviewer) found no
critical/high issues and confirmed the auth boundary is fail-closed and
correct. Two low-cost defense-in-depth items applied:
- Validate the signed-install JWT 'kid' against a strict charset before
the public-key fetch, so a malformed kid fails fast with no network
call (on top of the existing fixed host + percent-encoding).
- Make JWT nbf verification explicit (verify_nbf) on both the RS256
lifecycle and HS256 webhook decodes.
Other suggestions triaged as already-handled (aud cross-app replay is
blocked by the per-tenant iss->secret lookup; documented static-token/IP/
baseUrl tradeoffs; qsh pinned to Atlassian's vector) or ops/infra
(Fernet rotation via MultiFernet; rate limiting at the gateway).
* docs(open-swe): document Jira + Confluence in installation & customization guides
- INSTALLATION.md §5: add Jira (Automation-rule webhook + shared secret,
service account, JIRA_PROJECT_TO_REPO) and Confluence (Atlassian Connect
app install, CONNECT_EXPECTED_CLIENT_KEYS bootstrap, durable-store note,
CONFLUENCE_SPACE_TO_REPO) trigger setup; §6: add the new env vars +
REQUIRE_REPO_ALLOWLIST.
- CUSTOMIZATION.md: jira_*/confluence_* in the tools table; repo-extraction
note covers all four sources.
- AGENTS.md: match CLAUDE.md (triggers, webhooks, tool list, auth).
- README.md: invocation section, tools table, and overview line.
153 lines
5.7 KiB
Python
153 lines
5.7 KiB
Python
import sys
|
|
from types import ModuleType
|
|
from typing import TYPE_CHECKING, Any
|
|
|
|
_TOOL_MODULES = {
|
|
"add_finding": ".add_finding",
|
|
"confluence_comment": ".confluence_comment",
|
|
"confluence_create_page": ".confluence_create_page",
|
|
"confluence_get_page": ".confluence_get_page",
|
|
"confluence_search": ".confluence_search",
|
|
"confluence_update_page": ".confluence_update_page",
|
|
"enter_plan_mode": ".enter_plan_mode",
|
|
"fetch_url": ".fetch_url",
|
|
"http_request": ".http_request",
|
|
"jira_comment": ".jira_comment",
|
|
"jira_create_issue": ".jira_create_issue",
|
|
"jira_get_issue": ".jira_get_issue",
|
|
"jira_get_issue_comments": ".jira_get_issue_comments",
|
|
"jira_list_projects": ".jira_list_projects",
|
|
"jira_update_issue": ".jira_update_issue",
|
|
"linear_comment": ".linear_comment",
|
|
"linear_create_issue": ".linear_create_issue",
|
|
"linear_delete_issue": ".linear_delete_issue",
|
|
"linear_get_issue": ".linear_get_issue",
|
|
"linear_get_issue_comments": ".linear_get_issue_comments",
|
|
"linear_list_teams": ".linear_list_teams",
|
|
"linear_update_issue": ".linear_update_issue",
|
|
"list_findings": ".list_findings",
|
|
"list_review_findings": ".list_review_findings",
|
|
"open_pull_request": ".open_pull_request",
|
|
"publish_review": ".publish_review",
|
|
"read_repo_file": ".read_repo_file",
|
|
"report_platform_issue": ".report_platform_issue",
|
|
"request_pr_review": ".request_pr_review",
|
|
"reply_to_finding_thread": ".reply_to_finding_thread",
|
|
"resolve_finding_thread": ".resolve_finding_thread",
|
|
"save_plan": ".save_plan",
|
|
"schedule_thread_wakeup": ".schedule_thread_wakeup",
|
|
"search_repo_code": ".search_repo_code",
|
|
"slack_add_reaction": ".slack_add_reaction",
|
|
"slack_read_thread_messages": ".slack_read_thread_messages",
|
|
"slack_start_new_thread": ".slack_start_new_thread",
|
|
"slack_thread_reply": ".slack_thread_reply",
|
|
"update_finding": ".update_finding",
|
|
"web_search": ".web_search",
|
|
}
|
|
|
|
__all__ = [
|
|
"add_finding",
|
|
"confluence_comment",
|
|
"confluence_create_page",
|
|
"confluence_get_page",
|
|
"confluence_search",
|
|
"confluence_update_page",
|
|
"enter_plan_mode",
|
|
"fetch_url",
|
|
"http_request",
|
|
"jira_comment",
|
|
"jira_create_issue",
|
|
"jira_get_issue",
|
|
"jira_get_issue_comments",
|
|
"jira_list_projects",
|
|
"jira_update_issue",
|
|
"linear_comment",
|
|
"linear_create_issue",
|
|
"linear_delete_issue",
|
|
"linear_get_issue",
|
|
"linear_get_issue_comments",
|
|
"linear_list_teams",
|
|
"linear_update_issue",
|
|
"list_findings",
|
|
"list_review_findings",
|
|
"open_pull_request",
|
|
"publish_review",
|
|
"read_repo_file",
|
|
"report_platform_issue",
|
|
"request_pr_review",
|
|
"reply_to_finding_thread",
|
|
"resolve_finding_thread",
|
|
"save_plan",
|
|
"schedule_thread_wakeup",
|
|
"search_repo_code",
|
|
"slack_add_reaction",
|
|
"slack_read_thread_messages",
|
|
"slack_start_new_thread",
|
|
"slack_thread_reply",
|
|
"update_finding",
|
|
"web_search",
|
|
]
|
|
|
|
if TYPE_CHECKING:
|
|
from .add_finding import add_finding
|
|
from .confluence_comment import confluence_comment
|
|
from .confluence_create_page import confluence_create_page
|
|
from .confluence_get_page import confluence_get_page
|
|
from .confluence_search import confluence_search
|
|
from .confluence_update_page import confluence_update_page
|
|
from .enter_plan_mode import enter_plan_mode
|
|
from .fetch_url import fetch_url
|
|
from .http_request import http_request
|
|
from .jira_comment import jira_comment
|
|
from .jira_create_issue import jira_create_issue
|
|
from .jira_get_issue import jira_get_issue
|
|
from .jira_get_issue_comments import jira_get_issue_comments
|
|
from .jira_list_projects import jira_list_projects
|
|
from .jira_update_issue import jira_update_issue
|
|
from .linear_comment import linear_comment
|
|
from .linear_create_issue import linear_create_issue
|
|
from .linear_delete_issue import linear_delete_issue
|
|
from .linear_get_issue import linear_get_issue
|
|
from .linear_get_issue_comments import linear_get_issue_comments
|
|
from .linear_list_teams import linear_list_teams
|
|
from .linear_update_issue import linear_update_issue
|
|
from .list_findings import list_findings
|
|
from .list_review_findings import list_review_findings
|
|
from .open_pull_request import open_pull_request
|
|
from .publish_review import publish_review
|
|
from .read_repo_file import read_repo_file
|
|
from .reply_to_finding_thread import reply_to_finding_thread
|
|
from .report_platform_issue import report_platform_issue
|
|
from .request_pr_review import request_pr_review
|
|
from .resolve_finding_thread import resolve_finding_thread
|
|
from .save_plan import save_plan
|
|
from .schedule_thread_wakeup import schedule_thread_wakeup
|
|
from .search_repo_code import search_repo_code
|
|
from .slack_add_reaction import slack_add_reaction
|
|
from .slack_read_thread_messages import slack_read_thread_messages
|
|
from .slack_start_new_thread import slack_start_new_thread
|
|
from .slack_thread_reply import slack_thread_reply
|
|
from .update_finding import update_finding
|
|
from .web_search import web_search
|
|
|
|
|
|
def _load_tool(name: str) -> Any:
|
|
module_name = _TOOL_MODULES.get(name)
|
|
if module_name is None:
|
|
raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
|
|
from importlib import import_module
|
|
|
|
value = getattr(import_module(module_name, __name__), name)
|
|
globals()[name] = value
|
|
return value
|
|
|
|
|
|
class _LazyToolsModule(ModuleType):
|
|
def __getattribute__(self, name: str) -> Any:
|
|
tool_map = ModuleType.__getattribute__(self, "__dict__").get("_TOOL_MODULES", {})
|
|
if name in tool_map:
|
|
return _load_tool(name)
|
|
return ModuleType.__getattribute__(self, name)
|
|
|
|
|
|
sys.modules[__name__].__class__ = _LazyToolsModule
|