@blogic-cz/agent-tools 1.5.7 → 1.5.9

package/src/shared/content-security.ts

@@ -0,0 +1,91 @@
+import { findSecretMatches } from "./credential-patterns";
+
+const SENSITIVE_ENV_NAME =
+  /(?:KEY|TOKEN|SECRET|PASS(?:WORD)?|PWD|CREDENTIAL|AUTH|COOKIE|SESSION|PSK)/i;
+const isSensitiveEnvironmentName = (name: string) =>
+  name !== "PWD" &&
+  name !== "OLDPWD" &&
+  name !== "CODEX_SESSION_ID" &&
+  SENSITIVE_ENV_NAME.test(name);
+
+const sensitiveEnvironmentValues = (environment: Record<string, string | undefined>) =>
+  Object.entries(environment)
+    .flatMap(([name, value]) =>
+      isSensitiveEnvironmentName(name) && value && value.length >= 8 ? [value] : [],
+    )
+    .toSorted((left, right) => right.length - left.length);
+
+export function unsafeOutboundTextReason(
+  text: string,
+  environment: Record<string, string | undefined> = process.env,
+): string | null {
+  if (findSecretMatches(text).length > 0) return "a credential pattern";
+  if (sensitiveEnvironmentValues(environment).some((value) => text.includes(value))) {
+    return "a credential from the process environment";
+  }
+
+  const assignments = text.match(/^[A-Za-z_][A-Za-z0-9_]*=.*$/gm) ?? [];
+  if (
+    assignments.length >= 5 &&
+    assignments.some((line) => isSensitiveEnvironmentName(line.split("=", 1)[0] ?? ""))
+  ) {
+    return "an environment dump";
+  }
+  return null;
+}
+
+/** Remove recognized secret spans and known sensitive process-environment values. */
+export function redactSensitiveText(
+  text: string,
+  environment: Record<string, string | undefined> = process.env,
+): string {
+  const spans = findSecretMatches(text).map(({ start, end }) => ({ start, end }));
+  for (const value of sensitiveEnvironmentValues(environment)) {
+    let start = text.indexOf(value);
+    while (start !== -1) {
+      spans.push({ start, end: start + value.length });
+      start = text.indexOf(value, start + 1);
+    }
+  }
+  if (spans.length === 0) return text;
+
+  spans.sort((left, right) => left.start - right.start || right.end - left.end);
+  let result = "";
+  let offset = 0;
+  for (const span of spans) {
+    if (span.start < offset) {
+      offset = Math.max(offset, span.end);
+      continue;
+    }
+    result += text.slice(offset, span.start) + "[REDACTED]";
+    offset = span.end;
+  }
+  return result + text.slice(offset);
+}
+
+/** Sanitize values before serialization so JSON and TOON retain their structure. */
+export function redactSensitiveValue<T>(
+  value: T,
+  environment: Record<string, string | undefined> = process.env,
+): T {
+  if (typeof value === "string") return redactSensitiveText(value, environment) as T;
+  if (Array.isArray(value))
+    return value.map((item) => redactSensitiveValue(item, environment)) as T;
+  if (value === null || typeof value !== "object") return value;
+  if (value instanceof Date) return redactSensitiveText(value.toISOString(), environment) as T;
+
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => {
+      const serialized = JSON.stringify(item) ?? "undefined";
+      const pair = `${JSON.stringify(key)}: ${serialized}`;
+      const valueStart = pair.length - serialized.length;
+      const contextualSecret =
+        typeof item === "string" &&
+        findSecretMatches(pair).some((match) => match.start < valueStart && match.end > valueStart);
+      return [
+        redactSensitiveText(key, environment),
+        contextualSecret ? "[REDACTED]" : redactSensitiveValue(item, environment),
+      ];
+    }),
+  ) as T;
+}

package/src/shared/credential-patterns.ts

@@ -0,0 +1,62 @@
+/** Patterns used by the credential guard and shared output redaction. */
+export const SECRET_PATTERNS = [
+  { name: "AWS Access Key", pattern: /(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}/ },
+  { name: "GitHub Token", pattern: /gh[ps]_[A-Za-z0-9]{36}/ },
+  { name: "GitHub PAT", pattern: /github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}/ },
+  { name: "OpenAI Key", pattern: /sk-[A-Za-z0-9]{48}/ },
+  {
+    name: "Generic API Key",
+    pattern: /(?:api[_-]?key|apikey)["\s:=]+["']?([A-Za-z0-9_-]{20,})["']?/i,
+  },
+  {
+    name: "Generic Secret",
+    pattern:
+      /(?:secret|token|password|passwd|pwd)["  \t:=]+["']?(?!\$\{|process\.env|z\.|generate|create|read|get|fetch|import|export|const|function|return|Schema)[^\s"']{32,}["']?/i,
+  },
+  {
+    // eslint-disable-next-line eslint/no-useless-concat -- intentionally split to avoid credential guard self-detection
+    name: "Priv" + "ate Key",
+    pattern: new RegExp("-----BEGIN.*PRIVATE KEY-----"),
+  },
+  {
+    name: "JWT Token",
+    pattern: /(?:["'=:\s]|^)eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
+  },
+  { name: "Azure SAS Token", pattern: /[?&]sig=[A-Za-z0-9%+/=]{20,}/ },
+  { name: "GCP Service Account Key", pattern: /"type"\s*:\s*"service_account"/ },
+  {
+    name: "Slack Webhook URL",
+    pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/,
+  },
+  {
+    name: "Discord Webhook URL",
+    pattern: /https:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/,
+  },
+  {
+    name: "Database URL",
+    pattern: /(?:postgres(?:ql)?|mysql|mongodb):\/\/(?!\$\{)[^:]+:(?!\$\{)[^@]+@/,
+  },
+];
+
+export function findSecretMatches(
+  content: string,
+): Array<{ name: string; start: number; end: number }> {
+  const matches: Array<{ name: string; start: number; end: number }> = [];
+  for (const { name, pattern } of SECRET_PATTERNS) {
+    const scanner = new RegExp(
+      pattern.source,
+      pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`,
+    );
+    for (const match of content.matchAll(scanner)) {
+      const start = match.index;
+      let end = start + match[0].length;
+      if (name === "Private Key") {
+        const remainder = content.slice(end);
+        const closing = /^\r?\n?[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/.exec(remainder);
+        end += closing?.[0].length ?? remainder.length;
+      }
+      matches.push({ name, start, end });
+    }
+  }
+  return matches;
+}

package/src/shared/effect-version.ts

@@ -1,4 +1,5 @@
 import { fileURLToPath } from "node:url";
+import { redactSensitiveText } from "./content-security";
 
 // eslint-disable-next-line import/no-relative-parent-imports -- package.json lives at project root, outside src/
 import pkg from "../../package.json" with { type: "json" };
@@ -27,6 +28,6 @@ export const checkEffectVersion = async (): Promise<boolean> => {
 
   const error = effectVersionError(version);
   if (error === undefined) return true;
-  console.error(error);
+  console.error(redactSensitiveText(error));
   return false;
 };

package/src/shared/error-renderer.ts

@@ -1,6 +1,7 @@
 import type { Effect } from "effect";
 
 import { Cause, Console } from "effect";
+import { redactSensitiveText } from "./content-security";
 
 const formatError = (error: unknown): string => {
   if (
@@ -42,7 +43,19 @@ const formatError = (error: unknown): string => {
 
 const formatCause = (cause: Cause.Cause<unknown>): string => {
   const firstFailure = cause.reasons.find(Cause.isFailReason);
-  if (firstFailure !== undefined) return formatError(firstFailure.error);
+  if (firstFailure !== undefined) {
+    if (
+      typeof firstFailure.error === "object" &&
+      firstFailure.error !== null &&
+      Reflect.get(firstFailure.error, "_tag") === "ShowHelp"
+    ) {
+      const errors = Reflect.get(firstFailure.error, "errors");
+      return Array.isArray(errors) && errors.length > 0
+        ? errors.map(formatError).join("; ")
+        : "Help requested";
+    }
+    return formatError(firstFailure.error);
+  }
 
   const firstDefect = cause.reasons.find(Cause.isDieReason);
   if (firstDefect !== undefined) {
@@ -56,4 +69,4 @@ const formatCause = (cause: Cause.Cause<unknown>): string => {
 };
 
 export const renderCauseToStderr = (cause: Cause.Cause<unknown>): Effect.Effect<void> =>
-  Console.error(formatCause(cause));
+  Console.error(redactSensitiveText(formatCause(cause)));

package/src/shared/format.ts

@@ -1,7 +1,8 @@
 import { Flag } from "effect/unstable/cli";
-import { encode as encodeToon } from "@toon-format/toon";
+import { decode as decodeToon, encode as encodeToon } from "@toon-format/toon";
 import { Effect } from "effect";
 
+import { redactSensitiveText, redactSensitiveValue } from "./content-security";
 import type { BaseResult, OutputFormat } from "./types";
 
 export const formatOption = Flag.Literals("format", ["toon", "json"]).pipe(
@@ -11,18 +12,44 @@ export const formatOption = Flag.Literals("format", ["toon", "json"]).pipe(
 
 export function formatOutput<T extends BaseResult>(result: T, format: OutputFormat): string {
   if (format === "toon") {
-    return encodeToon(result);
+    return encodeToon(redactSensitiveValue(result));
   }
-  return JSON.stringify(result, null, 2);
+  return JSON.stringify(redactSensitiveValue(result), null, 2);
 }
 
 export function formatAny<T>(data: T, format: OutputFormat): string {
   if (format === "toon") {
-    return encodeToon(data);
+    return encodeToon(redactSensitiveValue(data));
   }
-  return JSON.stringify(data, null, 2);
+  return JSON.stringify(redactSensitiveValue(data), null, 2);
 }
 
+const redactOutputText = (text: string) => {
+  let json: unknown;
+  let isJson = false;
+  try {
+    json = JSON.parse(text);
+    isJson = true;
+  } catch {
+    // Try structured TOON below before treating this as plain text.
+  }
+  if (isJson) {
+    return (
+      JSON.stringify(redactSensitiveValue(json), null, text.includes("\n") ? 2 : undefined) ??
+      "null"
+    );
+  }
+
+  let toon: unknown;
+  try {
+    toon = decodeToon(text);
+  } catch {
+    // Raw logs and status strings are not structured output.
+  }
+  if (toon !== null && typeof toon === "object") return encodeToon(redactSensitiveValue(toon));
+  return redactSensitiveText(text);
+};
+
 // `Console.log` drops bytes on a non-blocking pipe: a payload over the pipe buffer arrives
 // truncated at a page boundary, reaching the caller as invalid JSON. Awaiting the write callback
 // makes the stream retry the short write. Never replace this with `Console.log`.
@@ -30,7 +57,7 @@ export function formatAny<T>(data: T, format: OutputFormat): string {
 // instead of a silent exit 0 with partial output.
 export const logText = (text: string) =>
   Effect.callback<undefined>((resume) => {
-    process.stdout.write(`${text}\n`, (error) =>
+    process.stdout.write(`${redactOutputText(text)}\n`, (error) =>
       resume(
         error && (error as NodeJS.ErrnoException).code !== "EPIPE"
           ? Effect.die(error)

package/src/shared/index.ts

@@ -14,6 +14,11 @@ export { expandPath, runCommand } from "./bun";
 export { commonArgOptions, parseCommonArgs } from "./cli";
 
 export { renderCauseToStderr } from "./error-renderer";
+export {
+  redactSensitiveText,
+  redactSensitiveValue,
+  unsafeOutboundTextReason,
+} from "./content-security";
 
 export { dumpCommandSchema, makeSchemaCommand, type CommandSchema } from "./schema-dump";
 

package/src/shared/output-boundary.ts

@@ -0,0 +1,29 @@
+import { Console, Effect, Terminal } from "effect";
+
+import { redactSensitiveText, redactSensitiveValue } from "./content-security";
+
+const redactArgument = (value: unknown) =>
+  typeof value === "string" ? redactSensitiveText(value) : redactSensitiveValue(value);
+
+export const withRedactedOutput = <A, E, R>(program: Effect.Effect<A, E, R>) =>
+  Effect.gen(function* () {
+    const currentConsole = yield* Console.Console;
+    const currentTerminal = yield* Terminal.Terminal;
+    const redactedConsole = new Proxy(currentConsole, {
+      get(target, key) {
+        const member = Reflect.get(target, key);
+        return typeof member === "function"
+          ? (...args: ReadonlyArray<unknown>) => member.apply(target, args.map(redactArgument))
+          : member;
+      },
+    });
+    const redactedTerminal = Object.assign(Object.create(currentTerminal), {
+      display: (text: string) => currentTerminal.display(redactSensitiveText(text)),
+    });
+
+    return yield* Effect.provideService(
+      Effect.provideService(program, Console.Console, redactedConsole),
+      Terminal.Terminal,
+      redactedTerminal,
+    );
+  });