@blogic-cz/agent-tools 1.11.1 → 1.13.0

package/src/credential-guard/passive-sed.ts

@@ -0,0 +1,78 @@
+export function isPassiveSedProgram(text: string): boolean {
+  let position = 0;
+  let commands = 0;
+  let groups = 0;
+  const spaces = (): void => {
+    while (position < text.length && /[ \t\r]/.test(text[position] ?? "")) position++;
+  };
+  const delimited = (delimiter: string): boolean => {
+    while (position < text.length) {
+      const ch = text[position++];
+      if (ch === "\\") {
+        if (position >= text.length || text[position] === "\n") return false;
+        position++;
+      } else if (ch === delimiter) return true;
+      else if (ch === "\n") return false;
+    }
+    return false;
+  };
+  const address = (): boolean => {
+    const number = /^[0-9]+/.exec(text.slice(position));
+    if (number) {
+      position += number[0].length;
+      return true;
+    }
+    if (text[position] === "$") {
+      position++;
+      return true;
+    }
+    if (text[position] !== "/") return false;
+    position++;
+    return delimited("/");
+  };
+  while (position < text.length) {
+    spaces();
+    if (text[position] === ";" || text[position] === "\n") {
+      position++;
+      continue;
+    }
+    if (text[position] === "}") {
+      if (groups === 0) return false;
+      groups--;
+      position++;
+      continue;
+    }
+    if (position === text.length) break;
+    if (/[0-9$/]/.test(text[position] ?? "")) {
+      if (!address()) return false;
+      spaces();
+      if (text[position] === ",") {
+        position++;
+        spaces();
+        const relative = /^\+[0-9]+/.exec(text.slice(position));
+        if (relative) position += relative[0].length;
+        else if (!address()) return false;
+        spaces();
+      }
+    }
+    if (text[position] === "!") {
+      position++;
+      spaces();
+    }
+    const command = text[position++];
+    if (command === "{") {
+      groups++;
+      continue;
+    }
+    if (command === "s") {
+      const delimiter = text[position++];
+      if (!delimiter || /[\\\n\r]/.test(delimiter)) return false;
+      if (!delimited(delimiter) || !delimited(delimiter)) return false;
+      while (position < text.length && /[gp0-9iImM]/.test(text[position] ?? "")) position++;
+    } else if (!command || !"pPdDnNgGhHx=".includes(command)) return false;
+    commands++;
+    spaces();
+    if (position < text.length && ![";", "\n", "}"].includes(text[position] ?? "")) return false;
+  }
+  return commands > 0 && groups === 0;
+}

package/src/credential-guard/passive.test.ts

@@ -0,0 +1,141 @@
+import { describe, expect, it } from "vitest";
+import { createCredentialGuard } from "#guard";
+import { isPassiveJqFilter } from "./passive-jq";
+
+describe("passive jq independent parser limits", () => {
+  it("enforces the byte limit", () => {
+    expect(isPassiveJqFilter("." + " ".repeat(65_535))).toBe(true);
+    expect(isPassiveJqFilter("." + " ".repeat(65_536))).toBe(false);
+    expect(isPassiveJqFilter('"' + "é".repeat(32_767) + '"')).toBe(true);
+    expect(isPassiveJqFilter('"' + "é".repeat(32_768) + '"')).toBe(false);
+  });
+  it("enforces the token limit without shallow-chain recursion", () => {
+    expect(isPassiveJqFilter(Array(2048).fill(".").join("|"))).toBe(true);
+    expect(isPassiveJqFilter(Array(2048).fill(".").join("|") + "?")).toBe(true);
+    expect(isPassiveJqFilter(Array(2049).fill(".").join("|"))).toBe(false);
+  });
+  it("enforces the depth limit", () => {
+    expect(isPassiveJqFilter("(".repeat(64) + "." + ")".repeat(64))).toBe(true);
+    expect(isPassiveJqFilter("(".repeat(65) + "." + ")".repeat(65))).toBe(false);
+  });
+  it.each([
+    ". |",
+    "{a:}",
+    "{a",
+    "map(.) trailing",
+    '"unterminated',
+    '"\\(env)"',
+    "unknown_filter",
+    ".[]? | env",
+    ".[env]",
+    "map(env)",
+    'include "helper"; .',
+  ])("refuses incomplete and unsupported syntax: %s", (filter) => {
+    expect(isPassiveJqFilter(filter)).toBe(false);
+    expect(createCredentialGuard().isDangerousBashCommand(`jq '${filter}' sample.json`)).toBe(true);
+  });
+});
+
+describe("credential guard file tools", () => {
+  it("keeps content scanning on Write and Edit", () => {
+    const content = "ghp_" + "A".repeat(36);
+    for (const tool of ["Write", "Edit"]) {
+      expect(() =>
+        createCredentialGuard().handleToolExecuteBefore(
+          { tool },
+          { args: { filePath: "docs/example.md", content } },
+        ),
+      ).toThrow("Secret detected");
+    }
+  });
+  it("protects kubeconfig artifacts without matching unrelated path words", () => {
+    const guard = createCredentialGuard();
+    for (const path of [
+      "config/kubeconfig",
+      "config/kubeconfig-prod.yaml",
+      "config/cluster.kubeconfig",
+      "config/team-kubeconfig-prod.yaml",
+      "config/prod-kubeconfig-test.json",
+      "config/TEAM-KUBECONFIG-PROD.YAML",
+      "config/team-kubeconfig.backup",
+      "config/kubeconfig.md",
+      "config/kubeconfig/cluster.json",
+      "prod-kubeconfig/admin.conf",
+      "/tmp/team_kubeconfig/config",
+      "mykubeconfig",
+      "kubeconfig2",
+      "config/MYKUBECONFIG2.backup",
+      "prod-kubeconfig",
+      "/tmp/team_kubeconfig/",
+      "docs/kubeconfig-notes/readme.md",
+      "docs/team-kubeconfig-prod/readme.md",
+      "/tmp/team_kubeconfig/nested/check-kubeconfig-topology.md",
+      "docs/cluster-kubeconfig-notes.md/readme.md",
+      "config/kubeconfig2.MD",
+      "docs/check-kubeconfig.md\n",
+      "docs/check-kubeconfig.md\r\n",
+    ])
+      expect(guard.isPathBlocked(path)).toBe(true);
+    for (const path of [
+      "docs/check-kubeconfig-topology.md",
+      "docs/team-kubeconfig-prod.md",
+      "docs/TEAM-KUBECONFIG-PROD.MD",
+      "docs/cluster-kubeconfig-notes.md",
+    ])
+      expect(guard.isPathBlocked(path)).toBe(false);
+  });
+  it.each([
+    ["prod-kubeconfig/admin.conf", true],
+    ["/tmp/team_kubeconfig/config", true],
+    ["mykubeconfig", true],
+    ["kubeconfig2", true],
+    ["docs/kubeconfig-notes/readme.md", true],
+    ["/tmp/team_kubeconfig/check-kubeconfig-topology.md", true],
+    ["docs/cluster-kubeconfig-notes.md/readme.md", true],
+    ["config/kubeconfig.md", true],
+    ["docs/check-kubeconfig-topology.md", false],
+    ["docs/cluster-kubeconfig-notes.md", false],
+    ["docs/TEAM-KUBECONFIG-PROD.MD", false],
+    ["docs/cluster-topology.md", false],
+    ["docs/check-kubeconfig.md\n", true],
+    ["docs/check-kubeconfig.md\r\n", true],
+    ["prod-kubeconfig/.env.example", false],
+  ])("preserves kubeconfig segment policy across file tools: %s", (path, blocked) => {
+    for (const guard of [
+      createCredentialGuard(),
+      createCredentialGuard({ additionalBlockedPaths: ["ordinary-private\\.md$"] }),
+    ]) {
+      expect(guard.isPathBlocked(path)).toBe(blocked);
+      for (const tool of ["Read", "Write", "Edit"]) {
+        const invoke = () =>
+          guard.handleToolExecuteBefore({ tool }, { args: { filePath: path, content: "Notes." } });
+        if (blocked) expect(invoke).toThrow("Access blocked");
+        else expect(invoke).not.toThrow();
+      }
+    }
+  });
+  it("retains configured protection for ordinary kubeconfig Markdown basenames", () => {
+    const path = "docs/cluster-kubeconfig-notes.md";
+    const guard = createCredentialGuard({
+      additionalBlockedPaths: ["cluster-kubeconfig-notes\\.md$"],
+    });
+    expect(guard.isPathBlocked(path)).toBe(true);
+    for (const tool of ["Read", "Write", "Edit"])
+      expect(() =>
+        guard.handleToolExecuteBefore({ tool }, { args: { file_path: path, content: "Notes." } }),
+      ).toThrow("Access blocked");
+  });
+  it("preserves existing explicit allowed-path precedence for kubeconfig segments", () => {
+    const path = "prod-kubeconfig/admin.conf";
+    const guard = createCredentialGuard({
+      additionalAllowedPaths: ["^prod-kubeconfig/admin\\.conf$"],
+      additionalBlockedPaths: ["admin\\.conf$"],
+    });
+    expect(guard.isPathBlocked(path)).toBe(false);
+    for (const tool of ["Read", "Write", "Edit"])
+      expect(() =>
+        guard.handleToolExecuteBefore({ tool }, { args: { file_path: path, content: "Notes." } }),
+      ).not.toThrow();
+    expect(guard.isDangerousBashCommand(`cat ${path}`)).toBe(false);
+  });
+});

package/src/credential-guard/paths.ts

@@ -0,0 +1,108 @@
+import { posix } from "node:path";
+
+export const CODE_OR_PROSE_EXTENSION =
+  /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs|vue|cs|py|go|rs|java|kt|rb|php|sh|md|mdx)$/i;
+
+export const DEFAULT_BLOCKED_PATH_PATTERNS: RegExp[] = [
+  /(?:^|\/)id_(?:rsa|dsa|ecdsa|ed25519)(?:_sk)?(?![^/]*\.pub$)(?:[-_.][^/]*|~)?$/i,
+  /(?:^|\/)\.htpasswd(?:~|\.bak|\.orig)?$/i,
+  /(?:^|\/)service-account[^/]*\.json$/i,
+  /\.env$/,
+  /\.env\.[^./]+$/,
+  /(?:^|\/)\.env(?!\.(?:example|sample|template))[^/]*(?:\/|$)/i,
+  /(?:^|\/)(?:\.netrc|_netrc|\.npmrc|\.pypirc|\.pgpass|\.my\.cnf|\.vault-token|\.sentryclirc)(?:~|\.bak|\.orig)?$/i,
+  /(?:^|\/)\.docker\/config\.json(?:~|\.bak|\.orig)?$/i,
+  /(?:^|\/)\.config\/(?:gh\/hosts\.yml|hub)(?:~|\.bak|\.orig)?$/i,
+  /(?:^|\/)\.m2\/settings\.xml(?:~|\.bak|\.orig)?$/i,
+  /(?:^|\/)\.composer\/auth\.json(?:~|\.bak|\.orig)?$/i,
+  /\.(?:pem|key|p12|pfx)(?:~|\.bak|\.orig)?$/i,
+  /(?:^|\/)(?:secrets?|credentials?)(?:\/|$)/i,
+  /(?:^|\/)\.(?:aws|ssh|kube|gnupg|azure)(?:\/|$)/i,
+  /(?:^|\/)(?:kubeconfig[^/]*|(?![^/]+\.md(?![\s\S]))[^/]*kubeconfig[^/]*)(?:\/|$)/i,
+];
+
+export const DEFAULT_ALLOWED_PATH_PATTERNS: RegExp[] = [
+  /\.env\.(?:example|template|sample)[^/]*$/i,
+];
+
+const PROCESS_ENVIRONMENT_PATH =
+  /^(?:\/|(?:\.\.\/)*)proc\/(?:self|thread-self|[0-9]+|\$\$|\$\{\$\})(?:\/task\/(?:[0-9]+|\$\$|\$\{\$\}))?\/environ$/;
+
+export type PathContext = {
+  readonly home: string;
+  readonly cwd: string;
+  readonly contentRead?: boolean;
+  readonly additionalBlockedPaths?: readonly RegExp[];
+  readonly additionalAllowedPaths?: readonly RegExp[];
+};
+export function normalizePath(path: string, home = "~", cwd = "."): string {
+  let value = path.replace(/\\/g, "/").replace(/^file:\/\//i, "");
+  value = value.replace(
+    /^(?:~(?=\/|$)|%USERPROFILE%|%HOME%|\$HOME|\$\{HOME\}|\$env:USERPROFILE)/i,
+    home.replace(/\\/g, "/"),
+  );
+  if (/^(?:env:|(?:microsoft\.powershell\.core\/)?environment::)/i.test(value))
+    return value.toLowerCase();
+  value = value
+    .split("/")
+    .map((segment, index) => {
+      if (segment === "." || segment === ".." || (index === 0 && /^[A-Za-z]:$/.test(segment)))
+        return segment;
+      return segment.split(":")[0]?.replace(/[. ]+$/, "") ?? "";
+    })
+    .join("/");
+  if (!value.startsWith("/") && !/^[A-Za-z]:\//.test(value))
+    value = `${cwd.replace(/\\/g, "/")}/${value}`;
+  return posix.normalize(value).toLowerCase();
+}
+function matches(pattern: RegExp, value: string): boolean {
+  return new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, "")).test(value);
+}
+export function isSensitivePath(path: string, context: PathContext): boolean {
+  const normalized = normalizePath(path, context.home, context.cwd);
+  if (
+    /^(?:env:|(?:microsoft\.powershell\.core\/)?environment::)/i.test(normalized) ||
+    PROCESS_ENVIRONMENT_PATH.test(normalized) ||
+    PROCESS_ENVIRONMENT_PATH.test(
+      path
+        .replace(/\\/g, "/")
+        .replace(/^(?:\.\/)+/, "")
+        .toLowerCase(),
+    )
+  )
+    return true;
+  const allowed = [...DEFAULT_ALLOWED_PATH_PATTERNS, ...(context.additionalAllowedPaths ?? [])];
+  const raw = path.replace(/\\/g, "/");
+  if (allowed.some((pattern) => matches(pattern, normalized) || matches(pattern, raw)))
+    return false;
+  const basename = raw.split("/").at(-1) ?? "";
+  if (
+    context.contentRead !== false &&
+    /secret|credential|token|password|passwd|api[-_]?key|private[-_]key/i.test(basename) &&
+    !CODE_OR_PROSE_EXTENSION.test(basename)
+  )
+    return true;
+  return [...DEFAULT_BLOCKED_PATH_PATTERNS, ...(context.additionalBlockedPaths ?? [])].some(
+    (pattern) => matches(pattern, normalized) || matches(pattern, raw),
+  );
+}
+
+export function expandGlobAlternatives(pattern: string): readonly string[] | null {
+  if (/[[]/.test(pattern)) return null;
+  let variants = [""];
+  let rest = pattern;
+  while (rest.includes("{")) {
+    const start = rest.indexOf("{");
+    const end = rest.indexOf("}", start);
+    if (end < 0) return null;
+    const inner = rest.slice(start + 1, end);
+    if (inner.includes("{") || !inner.includes(",")) return null;
+    const choices = inner.split(",");
+    if (variants.length * choices.length > 64) return null;
+    const prefix = rest.slice(0, start);
+    variants = variants.flatMap((value) => choices.map((choice) => value + prefix + choice));
+    rest = rest.slice(end + 1);
+  }
+  const result = variants.map((value) => value + rest);
+  return result.some((value) => /[{}[]/.test(value)) ? null : result;
+}