mirror of
https://github.com/stablyai/orca.git
synced 2026-09-22 16:02:32 +00:00
OrcaWinandOrca Worker
2c4989ea94
* docs(windows): document the EDR signal surface Six Microsoft Defender for Endpoint incidents fired against Orca 1.4.192 in eight days on one enterprise Windows 11 / Intune tenant. All six were behavioural process-tree scoring, not signature hits; two escalated to multi-stage incidents mapped to ATT&CK Execution and Collection. Add a reference doc mapping each attack-technique-shaped behaviour to the code that produces it and to why it exists: the renamed daemon image (T1036), the per-process PEB read, encoded policy-bypassed PowerShell (T1049), caret-escaped cmd.exe lines, and computer-use screen capture plus runtime-compiled MSIL (T1113). Records that signing is not the gate -- reputation is signer plus hash-keyed prevalence -- and carries the two evidence gaps the report noted. Adds an engineer checklist, deployment guidance for admins (AV path exclusions do not suppress EDR behavioural alerts; an MDE alert suppression rule does), and an explicit pre-deployment warning about computer use. * docs(windows): correct the PowerShell flag inventory and admin paths Review corrections to the EDR posture doc. The "encoded, policy-bypassing PowerShell" list conflated three different shapes and was incomplete. Split it into the three tiers an EDR actually scores differently -- bypass plus encoding, encoding alone, and bypass alone -- and add the sites it missed, including windows-mobile-firewall.ts, which encodes a script and launches it elevated through Start-Process -Verb RunAs. system-fonts.ts (-Command) and desktop-script-provider-bridge.ts (-File) were listed as encoded and are not. Notes that a raw grep under-reports, because the hook sites reach -EncodedCommand through wrapWindowsPowerShellEncodedCommand. Attribute the in-payload Set-ExecutionPolicy move to #16576 rather than to #16003's measurement, which keyed on -WindowStyle Hidden + -EncodedCommand, and record that the launcher's own tradeoff is unverified on a real box. Admin guidance was missing two ways a suppression rule pinned to one full path misses real activity: the .staging-<hex> sibling that exists mid-update, which is when the update-cluster incidents fire, and the userData fallback when LOCALAPPDATA is unset. Also: state the measurement conditions on the process-table timings, note that Hermes has surface even though we have no telemetry for it, note that the uninstaller names are electron-builder-generated and in no repo file, drop a volatile line count, and mark the per-operation computer-use shape as being addressed by an unmerged change. Drops the duplicated AGENTS.md section, keeping the indexed bullet. * docs(windows): reconcile the EDR posture doc with the shipped remediation Three claims in this doc became false once the rest of the Windows EDR set landed, and two told engineers the opposite of what the release does. The process-table section still described one shared snapshot taken with `Memory | CommandLine | CreationTime`, argued that splitting the cache per field set "would restore exactly the fan-out it exists to prevent", and concluded the shape was unfixable because "the information is only in the PEB". The split shipped (identity opens no handle at all), `Memory` is retired, and the command line now comes from the kernel through `ProcessCommandLineInformation` -- `ReadProcessMemory` is absent from the compiled addon and a ratchet asserts it against the import table. An engineer reading the old text would have concluded both fixes were dead ends. The PowerShell site inventories were stale in three of four lists: the port scan went native, every `-ExecutionPolicy Bypass` + `-EncodedCommand` pair was dropped as a measured no-op, and of the unencoded-bypass list only `wsl-cli-scripts.ts` survives. Regenerated against the merged tree, including the sites that reach the flag through `wrapWindowsPowerShellEncodedCommand` and never spell it, which a raw `rg` misses. Incident-evidence sections are left alone: they record what the tenant observed on 1.4.192, not what the code does now. --------- Co-authored-by: Orca Worker <orca-worker@localhost>
172 lines
4.3 KiB
Plaintext
172 lines
4.3 KiB
Plaintext
# Build artifacts
|
|
tsconfig.*.tsbuildinfo
|
|
|
|
# TypeScript emit artifacts next to sources (tsc produced these accidentally;
|
|
# real source lives in .ts/.tsx). Hand-authored declaration files are
|
|
# re-included below.
|
|
src/**/*.js
|
|
src/**/*.d.ts
|
|
/electron.vite.config.js
|
|
/electron.vite.config.d.ts
|
|
!src/main/types/hosted-git-info.d.ts
|
|
!src/preload/api-types.d.ts
|
|
!src/preload/index.d.ts
|
|
!src/renderer/src/env.d.ts
|
|
!src/renderer/src/mermaid.d.ts
|
|
!src/types/build-constants.d.ts
|
|
|
|
# Dependencies
|
|
node_modules/
|
|
# Why: the trailing-slash form matches directories only, so a node_modules SYMLINK (how agent
|
|
# worktrees share an install) slipped past a bulk `git add` and got committed — twice.
|
|
node_modules
|
|
|
|
# Build output
|
|
dist/
|
|
dist-electron/
|
|
out/
|
|
/build/
|
|
release/
|
|
native/**/.build/
|
|
|
|
# pnpm
|
|
.pnpm-store/
|
|
package-lock.json
|
|
|
|
# Environment
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
|
|
# IDE
|
|
.vscode/
|
|
.idea/
|
|
.serena/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# OS
|
|
# Keep these in step with isOsMetadataSkillEntryName (skill-package-identity.ts): both disk
|
|
# walkers skip a plain file with one of these names, the git-tree producer does not, and
|
|
# ignoring them here is what keeps `git add -A` from committing a stray one.
|
|
*.stackdump
|
|
.DS_Store
|
|
._*
|
|
Thumbs.db
|
|
ehthumbs.db
|
|
desktop.ini
|
|
|
|
# Lint/cache
|
|
.oxlintcache
|
|
|
|
# Logs
|
|
*.log
|
|
*.log.*
|
|
npm-debug.log*
|
|
pnpm-debug.log*
|
|
|
|
# Coverage
|
|
coverage/
|
|
|
|
# Prod release scan output (accidental adds)
|
|
prod-release-scan-*.md
|
|
|
|
# Benchmark run output
|
|
/tests/tools/benchmarks/results/*.json
|
|
/.bench-fixtures/
|
|
|
|
# Temp
|
|
tmp/
|
|
.tmp/
|
|
design-docs/
|
|
.context/
|
|
.atl/
|
|
|
|
# Machine-local agent hook endpoint files may contain auth tokens.
|
|
/agent-hooks/
|
|
|
|
# Local-only design/planning docs (not checked in), including most of docs/reference/.
|
|
# Durable docs that should be tracked must live in one of the allow-listed
|
|
# locations below (assets, readme, STYLEGUIDE, mobile terminal shortcut bar,
|
|
# and the tracked reference docs linked from AGENTS.md / README.md).
|
|
docs/**
|
|
!docs/
|
|
# The deployable docs app is source, not local engineering notes.
|
|
!docs/site/
|
|
!docs/site/**
|
|
!docs/assets/
|
|
!docs/assets/**
|
|
!docs/readme/
|
|
!docs/readme/**
|
|
!docs/STYLEGUIDE.md
|
|
!docs/agent-skill-sharing-implementation-checklist.md
|
|
!docs/mobile-terminal-shortcut-bar.md
|
|
!docs/reference/
|
|
!docs/reference/git-compatibility.md
|
|
!docs/reference/headless-linux-server.md
|
|
!docs/reference/ime-regression-checklist.md
|
|
!docs/reference/linux-glibc-compatibility.md
|
|
!docs/reference/macos-press-and-hold.md
|
|
!docs/reference/orcad-operations.md
|
|
!docs/reference/relay-grace-time-reconfiguration.md
|
|
!docs/reference/windows-edr-posture.md
|
|
!docs/reference/windows-process-enumeration.md
|
|
!docs/reference/wsl-runner-verification.md
|
|
!docs/reference/remote-wire-compatibility.md
|
|
!docs/reference/renderer-agent-status-performance.md
|
|
!docs/reference/ssh-execution-boundary.md
|
|
!docs/reference/ssh-host-key-verification.md
|
|
!docs/reference/ssh-reconnect-source-recovery.md
|
|
!docs/reference/windows-setup-shell.md
|
|
!docs/reference/worktree-scan-fingerprint.md
|
|
!docs/reference/wsl-command-execution.md
|
|
!docs/reference/wsl-probe-failure-semantics.md
|
|
!docs/reference/xterm-patch-regeneration.md
|
|
|
|
# Stably CLI (only docs/ are tracked)
|
|
.stably/*
|
|
!.stably/docs/
|
|
.playwright-cli
|
|
.validate-ui-screenshots/
|
|
validation-screenshots/
|
|
.stably-browser
|
|
|
|
# Local scratch notes and PR evidence screenshots (not part of the product).
|
|
/notes/
|
|
/pr-evidence/
|
|
|
|
# Playwright
|
|
test-results/
|
|
playwright-report/
|
|
|
|
# Agent skill installations (machine-local, populated by agent tooling)
|
|
/.claude/skills/
|
|
/.agents/skills/
|
|
/skills-lock.json
|
|
|
|
# Generated Clawpatch state includes machine-local paths and review records.
|
|
/.clawpatch/
|
|
/mobile/.clawpatch/
|
|
|
|
# Agent hook runtime endpoints (machine-local secrets)
|
|
/agent-hooks/
|
|
validation-screenshots/
|
|
|
|
# Localization bootstrap cache (regenerated by bootstrap:*-catalog)
|
|
src/renderer/src/i18n/locales/.zh-catalog-cache.json
|
|
src/renderer/src/i18n/locales/.ko-catalog-cache.json
|
|
src/renderer/src/i18n/locales/.ja-catalog-cache.json
|
|
src/renderer/src/i18n/locales/.es-catalog-cache.json
|
|
|
|
# Bench result JSONs are working artifacts
|
|
tests/tools/benchmarks/results/terminal-pipeline-*.json
|
|
|
|
# Old release trees the cross-version wire harness extracts on demand
|
|
tests/e2e/.cross-version-checkouts/
|
|
|
|
# Bundler's install path for the mobile release toolchain (mobile/Gemfile.lock
|
|
# IS committed). Also keeps oxfmt/oxlint, which honor this file, from walking
|
|
# vendored gems.
|
|
/mobile/vendor/
|