@blogic-cz/agent-tools 1.5.6 → 1.5.8

package/src/observability-tool/main.ts

@@ -1,20 +1,18 @@
 #!/usr/bin/env bun
 
 import { BunRuntime, BunServices } from "@effect/platform-bun";
-import { Console, Effect, Layer } from "effect";
-import type { Cause } from "effect";
+import { Effect, Layer } from "effect";
 import { Command } from "effect/unstable/cli";
 
 import { ConfigServiceLayer } from "#config";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
-import { makeSchemaCommand, VERSION } from "#shared";
+import { withRedactedOutput } from "#shared/output-boundary";
+import { makeSchemaCommand, renderCauseToStderr, VERSION } from "#shared";
 
 import { metricsCommand } from "./metrics";
 import { logsCommand } from "./logs";
 import { traceCommand } from "./trace";
 
-const renderCauseToStderr = (cause: Cause.Cause<unknown>) => Console.error(cause.toString());
-
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
 const mainCommand = Command.make("observability-tool", {}).pipe(
@@ -24,11 +22,11 @@ const mainCommand = Command.make("observability-tool", {}).pipe(
   Command.withSubcommands([traceCommand, metricsCommand, logsCommand, commandsCommand]),
 );
 
-const cli = Command.run(mainCommand, { version: VERSION });
+const cli = Command.run(mainCommand, { version: VERSION, renderErrors: false });
 
 const MainLayer = Layer.mergeAll(BunServices.layer, ConfigServiceLayer, AuditServiceLayer);
 
-const program = withAudit("observability", cli).pipe(
+const program = withRedactedOutput(withAudit("observability", cli)).pipe(
   Effect.provide(MainLayer),
   Effect.tapCause(renderCauseToStderr),
 );

package/src/observability-tool/shared.ts

@@ -5,6 +5,7 @@ import { ConfigService, getToolConfig } from "#config";
 import type { ObservabilityConfig } from "#config";
 
 import { ObservabilityToolError } from "./errors";
+import { unsafeOutboundTextReason } from "#shared/content-security";
 import type {
   DsQueryOpts,
   DsQueryResponse,
@@ -200,6 +201,45 @@ export function observabilityFetch<T>(
   path: string,
   init?: RequestInit,
 ): Effect.Effect<T, ObservabilityToolError> {
+  const rawBody = typeof init?.body === "string" ? init.body : "";
+  const url = `${config.url}${path}`;
+  let decodedUrl: string;
+  try {
+    decodedUrl = decodeURIComponent(url);
+  } catch {
+    return Effect.fail(
+      new ObservabilityToolError({
+        cause: new Error("Refusing malformed observability URL encoding."),
+      }),
+    );
+  }
+  const bodyText = [rawBody];
+  const appendJsonText = (value: unknown): void => {
+    if (typeof value === "string") {
+      bodyText.push(value);
+    } else if (Array.isArray(value)) {
+      value.forEach(appendJsonText);
+    } else if (typeof value === "object" && value !== null) {
+      for (const [key, nested] of Object.entries(value)) {
+        bodyText.push(key);
+        appendJsonText(nested);
+      }
+    }
+  };
+  try {
+    appendJsonText(JSON.parse(rawBody) as unknown);
+  } catch {
+    // Non-JSON request bodies are still checked as supplied above.
+  }
+  const unsafeReason = unsafeOutboundTextReason([url, decodedUrl, ...bodyText].join("\n"));
+  if (unsafeReason !== null) {
+    return Effect.fail(
+      new ObservabilityToolError({
+        cause: new Error(`Refusing to send observability request containing ${unsafeReason}.`),
+      }),
+    );
+  }
+
   return Effect.tryPromise({
     try: async () => {
       const headers = buildHeaders(config.token);
@@ -210,7 +250,7 @@ export function observabilityFetch<T>(
         });
       }
 
-      const response = await fetch(`${config.url}${path}`, {
+      const response = await fetch(url, {
         ...init,
         headers,
       });

package/src/session-tool/main.ts

@@ -15,8 +15,16 @@ import type { MessageSummary, SessionResult, SessionSource } from "./types";
 
 import { ALL_SESSION_SOURCES } from "./types";
 
-import { makeSchemaCommand, formatOption, formatOutput, logText, VERSION } from "#shared";
+import {
+  makeSchemaCommand,
+  formatOption,
+  formatOutput,
+  logText,
+  renderCauseToStderr,
+  VERSION,
+} from "#shared";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { withRedactedOutput } from "#shared/output-boundary";
 import { ResolvedPaths, ResolvedPathsLayer } from "./config";
 import { SessionStorageNotFoundError } from "./errors";
 import { formatDate, SessionService, SessionServiceLayer } from "./service";
@@ -321,18 +329,25 @@ const mainCommand = Command.make("session-tool", {}).pipe(
 
 const cli = Command.run(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
 
-export const run = Command.runWith(mainCommand, {
+const runWithErrorsDisabled = Command.runWith(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
+export const run = (args: ReadonlyArray<string>) =>
+  withRedactedOutput(runWithErrorsDisabled(args)).pipe(Effect.tapCause(renderCauseToStderr));
 
 const MainLayer = AppLayer.pipe(
   Layer.provideMerge(BunServices.layer),
   Layer.provideMerge(AuditServiceLayer),
 );
 
-const program = withAudit("session", cli).pipe(Effect.provide(MainLayer));
+const program = withRedactedOutput(withAudit("session", cli)).pipe(
+  Effect.provide(MainLayer),
+  Effect.tapCause(renderCauseToStderr),
+);
 
 BunRuntime.runMain(program, {
   disableErrorReporting: true,

package/src/shared/audit.ts

@@ -6,6 +6,7 @@ import { basename, dirname, join } from "node:path";
 import { Cause, Context, Effect, Layer } from "effect";
 
 import { loadConfig } from "#config";
+import { redactSensitiveText } from "./content-security";
 
 const DEFAULT_AUDIT_RETENTION_DAYS = 90;
 const IN_MEMORY_DB_PATH = ":memory:";
@@ -80,12 +81,12 @@ const isInMemoryDatabase = (dbPath: string): boolean =>
 const toAuditEntry = (row: AuditRow): AuditLogEntry => ({
   id: row.id,
   ts: row.ts,
-  tool: row.tool,
-  project: row.project,
-  args: row.args,
+  tool: redactSensitiveText(row.tool),
+  project: redactSensitiveText(row.project),
+  args: redactSensitiveText(row.args),
   duration: row.duration,
   success: row.success === 1,
-  error: row.error,
+  error: row.error === null ? null : redactSensitiveText(row.error),
   exitCode: row.exit_code,
 });
 
@@ -246,12 +247,12 @@ const createAuditService = (dbPath: string, db: Database | null): AuditServiceSh
           db.run(
             "INSERT INTO audit_log (tool, project, args, duration, success, error, exit_code) VALUES (?, ?, ?, ?, ?, ?, ?)",
             [
-              safeToolName(entry.tool),
-              entry.project,
-              entry.args,
+              redactSensitiveText(safeToolName(entry.tool)),
+              redactSensitiveText(entry.project),
+              redactSensitiveText(entry.args),
               entry.duration,
               entry.success ? 1 : 0,
-              entry.error ?? null,
+              entry.error === undefined ? null : redactSensitiveText(entry.error),
               entry.exitCode ?? null,
             ],
           );
@@ -317,7 +318,7 @@ export const withAudit = <A, E, R>(
   Effect.suspend(() => {
     const startedAt = Date.now();
     const project = process.cwd();
-    const args = process.argv.slice(2).join(" ");
+    const args = redactSensitiveText(process.argv.slice(2).join(" "));
     const tool = safeToolName(toolName || deriveToolNameFromArgv());
 
     return Effect.matchCauseEffect(program, {
@@ -332,7 +333,7 @@ export const withAudit = <A, E, R>(
             args,
             duration: Date.now() - startedAt,
             success: pureHelp,
-            error: pureHelp ? undefined : formatCause(cause),
+            error: pureHelp ? undefined : redactSensitiveText(formatCause(cause)),
             exitCode: pureHelp ? 0 : extractExitCode(cause),
           }),
           () => Effect.failCause(cause),

package/src/shared/content-security.ts

@@ -0,0 +1,91 @@
+import { findSecretMatches } from "./credential-patterns";
+
+const SENSITIVE_ENV_NAME =
+  /(?:KEY|TOKEN|SECRET|PASS(?:WORD)?|PWD|CREDENTIAL|AUTH|COOKIE|SESSION|PSK)/i;
+const isSensitiveEnvironmentName = (name: string) =>
+  name !== "PWD" &&
+  name !== "OLDPWD" &&
+  name !== "CODEX_SESSION_ID" &&
+  SENSITIVE_ENV_NAME.test(name);
+
+const sensitiveEnvironmentValues = (environment: Record<string, string | undefined>) =>
+  Object.entries(environment)
+    .flatMap(([name, value]) =>
+      isSensitiveEnvironmentName(name) && value && value.length >= 8 ? [value] : [],
+    )
+    .toSorted((left, right) => right.length - left.length);
+
+export function unsafeOutboundTextReason(
+  text: string,
+  environment: Record<string, string | undefined> = process.env,
+): string | null {
+  if (findSecretMatches(text).length > 0) return "a credential pattern";
+  if (sensitiveEnvironmentValues(environment).some((value) => text.includes(value))) {
+    return "a credential from the process environment";
+  }
+
+  const assignments = text.match(/^[A-Za-z_][A-Za-z0-9_]*=.*$/gm) ?? [];
+  if (
+    assignments.length >= 5 &&
+    assignments.some((line) => isSensitiveEnvironmentName(line.split("=", 1)[0] ?? ""))
+  ) {
+    return "an environment dump";
+  }
+  return null;
+}
+
+/** Remove recognized secret spans and known sensitive process-environment values. */
+export function redactSensitiveText(
+  text: string,
+  environment: Record<string, string | undefined> = process.env,
+): string {
+  const spans = findSecretMatches(text).map(({ start, end }) => ({ start, end }));
+  for (const value of sensitiveEnvironmentValues(environment)) {
+    let start = text.indexOf(value);
+    while (start !== -1) {
+      spans.push({ start, end: start + value.length });
+      start = text.indexOf(value, start + 1);
+    }
+  }
+  if (spans.length === 0) return text;
+
+  spans.sort((left, right) => left.start - right.start || right.end - left.end);
+  let result = "";
+  let offset = 0;
+  for (const span of spans) {
+    if (span.start < offset) {
+      offset = Math.max(offset, span.end);
+      continue;
+    }
+    result += text.slice(offset, span.start) + "[REDACTED]";
+    offset = span.end;
+  }
+  return result + text.slice(offset);
+}
+
+/** Sanitize values before serialization so JSON and TOON retain their structure. */
+export function redactSensitiveValue<T>(
+  value: T,
+  environment: Record<string, string | undefined> = process.env,
+): T {
+  if (typeof value === "string") return redactSensitiveText(value, environment) as T;
+  if (Array.isArray(value))
+    return value.map((item) => redactSensitiveValue(item, environment)) as T;
+  if (value === null || typeof value !== "object") return value;
+  if (value instanceof Date) return redactSensitiveText(value.toISOString(), environment) as T;
+
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => {
+      const serialized = JSON.stringify(item) ?? "undefined";
+      const pair = `${JSON.stringify(key)}: ${serialized}`;
+      const valueStart = pair.length - serialized.length;
+      const contextualSecret =
+        typeof item === "string" &&
+        findSecretMatches(pair).some((match) => match.start < valueStart && match.end > valueStart);
+      return [
+        redactSensitiveText(key, environment),
+        contextualSecret ? "[REDACTED]" : redactSensitiveValue(item, environment),
+      ];
+    }),
+  ) as T;
+}

package/src/shared/credential-patterns.ts

@@ -0,0 +1,62 @@
+/** Patterns used by the credential guard and shared output redaction. */
+export const SECRET_PATTERNS = [
+  { name: "AWS Access Key", pattern: /(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}/ },
+  { name: "GitHub Token", pattern: /gh[ps]_[A-Za-z0-9]{36}/ },
+  { name: "GitHub PAT", pattern: /github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}/ },
+  { name: "OpenAI Key", pattern: /sk-[A-Za-z0-9]{48}/ },
+  {
+    name: "Generic API Key",
+    pattern: /(?:api[_-]?key|apikey)["\s:=]+["']?([A-Za-z0-9_-]{20,})["']?/i,
+  },
+  {
+    name: "Generic Secret",
+    pattern:
+      /(?:secret|token|password|passwd|pwd)["  \t:=]+["']?(?!\$\{|process\.env|z\.|generate|create|read|get|fetch|import|export|const|function|return|Schema)[^\s"']{32,}["']?/i,
+  },
+  {
+    // eslint-disable-next-line eslint/no-useless-concat -- intentionally split to avoid credential guard self-detection
+    name: "Priv" + "ate Key",
+    pattern: new RegExp("-----BEGIN.*PRIVATE KEY-----"),
+  },
+  {
+    name: "JWT Token",
+    pattern: /(?:["'=:\s]|^)eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
+  },
+  { name: "Azure SAS Token", pattern: /[?&]sig=[A-Za-z0-9%+/=]{20,}/ },
+  { name: "GCP Service Account Key", pattern: /"type"\s*:\s*"service_account"/ },
+  {
+    name: "Slack Webhook URL",
+    pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/,
+  },
+  {
+    name: "Discord Webhook URL",
+    pattern: /https:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/,
+  },
+  {
+    name: "Database URL",
+    pattern: /(?:postgres(?:ql)?|mysql|mongodb):\/\/(?!\$\{)[^:]+:(?!\$\{)[^@]+@/,
+  },
+];
+
+export function findSecretMatches(
+  content: string,
+): Array<{ name: string; start: number; end: number }> {
+  const matches: Array<{ name: string; start: number; end: number }> = [];
+  for (const { name, pattern } of SECRET_PATTERNS) {
+    const scanner = new RegExp(
+      pattern.source,
+      pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`,
+    );
+    for (const match of content.matchAll(scanner)) {
+      const start = match.index;
+      let end = start + match[0].length;
+      if (name === "Private Key") {
+        const remainder = content.slice(end);
+        const closing = /^\r?\n?[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/.exec(remainder);
+        end += closing?.[0].length ?? remainder.length;
+      }
+      matches.push({ name, start, end });
+    }
+  }
+  return matches;
+}

package/src/shared/effect-version.ts

@@ -1,4 +1,5 @@
 import { fileURLToPath } from "node:url";
+import { redactSensitiveText } from "./content-security";
 
 // eslint-disable-next-line import/no-relative-parent-imports -- package.json lives at project root, outside src/
 import pkg from "../../package.json" with { type: "json" };
@@ -27,6 +28,6 @@ export const checkEffectVersion = async (): Promise<boolean> => {
 
   const error = effectVersionError(version);
   if (error === undefined) return true;
-  console.error(error);
+  console.error(redactSensitiveText(error));
   return false;
 };

package/src/shared/error-renderer.ts

@@ -1,6 +1,7 @@
 import type { Effect } from "effect";
 
 import { Cause, Console } from "effect";
+import { redactSensitiveText } from "./content-security";
 
 const formatError = (error: unknown): string => {
   if (
@@ -42,7 +43,19 @@ const formatError = (error: unknown): string => {
 
 const formatCause = (cause: Cause.Cause<unknown>): string => {
   const firstFailure = cause.reasons.find(Cause.isFailReason);
-  if (firstFailure !== undefined) return formatError(firstFailure.error);
+  if (firstFailure !== undefined) {
+    if (
+      typeof firstFailure.error === "object" &&
+      firstFailure.error !== null &&
+      Reflect.get(firstFailure.error, "_tag") === "ShowHelp"
+    ) {
+      const errors = Reflect.get(firstFailure.error, "errors");
+      return Array.isArray(errors) && errors.length > 0
+        ? errors.map(formatError).join("; ")
+        : "Help requested";
+    }
+    return formatError(firstFailure.error);
+  }
 
   const firstDefect = cause.reasons.find(Cause.isDieReason);
   if (firstDefect !== undefined) {
@@ -56,4 +69,4 @@ const formatCause = (cause: Cause.Cause<unknown>): string => {
 };
 
 export const renderCauseToStderr = (cause: Cause.Cause<unknown>): Effect.Effect<void> =>
-  Console.error(formatCause(cause));
+  Console.error(redactSensitiveText(formatCause(cause)));

package/src/shared/format.ts

@@ -1,7 +1,8 @@
 import { Flag } from "effect/unstable/cli";
-import { encode as encodeToon } from "@toon-format/toon";
+import { decode as decodeToon, encode as encodeToon } from "@toon-format/toon";
 import { Effect } from "effect";
 
+import { redactSensitiveText, redactSensitiveValue } from "./content-security";
 import type { BaseResult, OutputFormat } from "./types";
 
 export const formatOption = Flag.Literals("format", ["toon", "json"]).pipe(
@@ -11,18 +12,44 @@ export const formatOption = Flag.Literals("format", ["toon", "json"]).pipe(
 
 export function formatOutput<T extends BaseResult>(result: T, format: OutputFormat): string {
   if (format === "toon") {
-    return encodeToon(result);
+    return encodeToon(redactSensitiveValue(result));
   }
-  return JSON.stringify(result, null, 2);
+  return JSON.stringify(redactSensitiveValue(result), null, 2);
 }
 
 export function formatAny<T>(data: T, format: OutputFormat): string {
   if (format === "toon") {
-    return encodeToon(data);
+    return encodeToon(redactSensitiveValue(data));
   }
-  return JSON.stringify(data, null, 2);
+  return JSON.stringify(redactSensitiveValue(data), null, 2);
 }
 
+const redactOutputText = (text: string) => {
+  let json: unknown;
+  let isJson = false;
+  try {
+    json = JSON.parse(text);
+    isJson = true;
+  } catch {
+    // Try structured TOON below before treating this as plain text.
+  }
+  if (isJson) {
+    return (
+      JSON.stringify(redactSensitiveValue(json), null, text.includes("\n") ? 2 : undefined) ??
+      "null"
+    );
+  }
+
+  let toon: unknown;
+  try {
+    toon = decodeToon(text);
+  } catch {
+    // Raw logs and status strings are not structured output.
+  }
+  if (toon !== null && typeof toon === "object") return encodeToon(redactSensitiveValue(toon));
+  return redactSensitiveText(text);
+};
+
 // `Console.log` drops bytes on a non-blocking pipe: a payload over the pipe buffer arrives
 // truncated at a page boundary, reaching the caller as invalid JSON. Awaiting the write callback
 // makes the stream retry the short write. Never replace this with `Console.log`.
@@ -30,7 +57,7 @@ export function formatAny<T>(data: T, format: OutputFormat): string {
 // instead of a silent exit 0 with partial output.
 export const logText = (text: string) =>
   Effect.callback<undefined>((resume) => {
-    process.stdout.write(`${text}\n`, (error) =>
+    process.stdout.write(`${redactOutputText(text)}\n`, (error) =>
       resume(
         error && (error as NodeJS.ErrnoException).code !== "EPIPE"
           ? Effect.die(error)

package/src/shared/index.ts

@@ -14,6 +14,11 @@ export { expandPath, runCommand } from "./bun";
 export { commonArgOptions, parseCommonArgs } from "./cli";
 
 export { renderCauseToStderr } from "./error-renderer";
+export {
+  redactSensitiveText,
+  redactSensitiveValue,
+  unsafeOutboundTextReason,
+} from "./content-security";
 
 export { dumpCommandSchema, makeSchemaCommand, type CommandSchema } from "./schema-dump";
 

package/src/shared/output-boundary.ts

@@ -0,0 +1,29 @@
+import { Console, Effect, Terminal } from "effect";
+
+import { redactSensitiveText, redactSensitiveValue } from "./content-security";
+
+const redactArgument = (value: unknown) =>
+  typeof value === "string" ? redactSensitiveText(value) : redactSensitiveValue(value);
+
+export const withRedactedOutput = <A, E, R>(program: Effect.Effect<A, E, R>) =>
+  Effect.gen(function* () {
+    const currentConsole = yield* Console.Console;
+    const currentTerminal = yield* Terminal.Terminal;
+    const redactedConsole = new Proxy(currentConsole, {
+      get(target, key) {
+        const member = Reflect.get(target, key);
+        return typeof member === "function"
+          ? (...args: ReadonlyArray<unknown>) => member.apply(target, args.map(redactArgument))
+          : member;
+      },
+    });
+    const redactedTerminal = Object.assign(Object.create(currentTerminal), {
+      display: (text: string) => currentTerminal.display(redactSensitiveText(text)),
+    });
+
+    return yield* Effect.provideService(
+      Effect.provideService(program, Console.Console, redactedConsole),
+      Terminal.Terminal,
+      redactedTerminal,
+    );
+  });