@blogic-cz/agent-tools 1.6.20 → 1.7.1

package/src/api-tool/transport.ts

@@ -0,0 +1,167 @@
+import { lookup } from "node:dns/promises";
+import { request as httpsRequest } from "node:https";
+import { request as httpRequest } from "node:http";
+import type { SecureContextOptions } from "node:tls";
+import { isIP } from "node:net";
+import { ApiError, apiError } from "./errors";
+
+export type TransportRequest = {
+  url: URL;
+  method: string;
+  headers: Readonly<Record<string, string>>;
+  body: string;
+  maxBytes: number;
+  signal: AbortSignal;
+  allowedPrivateAddresses: readonly string[];
+  developmentLoopback?: boolean;
+};
+export type TransportResult = { status: number; body: string };
+export type Transport = (request: TransportRequest) => Promise<TransportResult>;
+export type Resolver = (host: string) => Promise<readonly { address: string; family: number }[]>;
+
+export function beforeAbort<T>(operation: Promise<T>, signal: AbortSignal): Promise<T> {
+  if (signal.aborted) {
+    void operation.catch(() => undefined);
+    return Promise.reject(apiError("DEADLINE_EXCEEDED"));
+  }
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(apiError("DEADLINE_EXCEEDED"));
+    signal.addEventListener("abort", abort, { once: true });
+    operation.then(
+      (value) => {
+        signal.removeEventListener("abort", abort);
+        return resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", abort);
+        return reject(error);
+      },
+    );
+  });
+}
+
+export function allowedAddress(
+  address: string,
+  privateAllow: readonly string[],
+  developmentLoopback = false,
+): boolean {
+  if (developmentLoopback && address === "127.0.0.1") return true;
+  const family = isIP(address);
+  if (!family) return false;
+  if (family === 6) {
+    const normalized = new URL(`http://[${address}]`).hostname.slice(1, -1);
+    const first = Number.parseInt(normalized.split(":")[0] || "0", 16);
+    if (
+      normalized.startsWith("::ffff:") ||
+      (first & 0xffc0) === 0xfe80 ||
+      normalized === "fd00:ec2::254"
+    )
+      return false;
+    if (privateAllow.includes(normalized)) return true;
+    const second = Number.parseInt(normalized.split(":")[1] || "0", 16);
+    return (
+      /^[23][0-9a-f]{3}:/.test(normalized) &&
+      !(normalized.startsWith("2001:") && (second <= 0x1ff || second === 0xdb8)) &&
+      !normalized.startsWith("2002:") &&
+      !(normalized.startsWith("3fff:") && second <= 0xfff)
+    );
+  }
+  const parts = address.split(".").map(Number);
+  const [a = 0, b = 0] = parts;
+  if ((a === 169 && b === 254) || address === "168.63.129.16" || a === 0 || a >= 224) return false;
+  if (privateAllow.includes(address)) return true;
+  return !(
+    a === 10 ||
+    a === 127 ||
+    (a === 172 && b >= 16 && b <= 31) ||
+    (a === 192 && (b === 168 || b === 0 || b === 2)) ||
+    (a === 198 && (b === 18 || b === 19 || b === 51)) ||
+    (a === 203 && b === 0) ||
+    (a === 100 && b >= 64 && b <= 127)
+  );
+}
+
+export const MAX_PENDING_DNS_LOOKUPS = 64;
+export function makePinnedTransport(
+  resolve: Resolver = (host) => lookup(host, { all: true, verbatim: true }),
+  trust: Pick<SecureContextOptions, "ca"> = {},
+): Transport {
+  let pendingLookups = 0;
+  return async (input) => {
+    const host = input.url.hostname.replace(/^\[|\]$/g, "");
+    if (
+      input.url.protocol !== "https:" &&
+      !(input.developmentLoopback && input.url.protocol === "http:" && host === "127.0.0.1")
+    )
+      throw apiError("DESTINATION_DENIED");
+    if (input.signal.aborted) throw apiError("DEADLINE_EXCEEDED");
+    let addresses: Awaited<ReturnType<Resolver>>;
+    try {
+      if (isIP(host)) addresses = [{ address: host, family: isIP(host) }];
+      else {
+        if (pendingLookups >= MAX_PENDING_DNS_LOOKUPS) throw apiError("BUDGET_EXHAUSTED");
+        pendingLookups++;
+        const operation = Promise.resolve()
+          .then(() => resolve(host))
+          .finally(() => {
+            pendingLookups--;
+          });
+        addresses = await beforeAbort(operation, input.signal);
+      }
+    } catch (error) {
+      if (error instanceof ApiError && error.code === "BUDGET_EXHAUSTED") throw error;
+      throw apiError(input.signal.aborted ? "DEADLINE_EXCEEDED" : "DESTINATION_DENIED");
+    }
+    if (input.signal.aborted) throw apiError("DEADLINE_EXCEEDED");
+    const pinned = addresses[0];
+    if (
+      !pinned ||
+      addresses.some(
+        (item) =>
+          !allowedAddress(item.address, input.allowedPrivateAddresses, input.developmentLoopback),
+      )
+    )
+      throw apiError("DESTINATION_DENIED");
+    return new Promise((resolveResult, reject) => {
+      const request = (input.url.protocol === "https:" ? httpsRequest : httpRequest)(
+        input.url,
+        {
+          method: input.method,
+          headers: input.headers,
+          signal: input.signal,
+          agent: false,
+          family: pinned.family,
+          ca: trust.ca,
+          rejectUnauthorized: true,
+          lookup: (_hostname, _options, callback) => callback(null, pinned.address, pinned.family),
+        },
+        (response) => {
+          const status = response.statusCode ?? 0;
+          if (status >= 300 && status < 400) {
+            response.destroy();
+            reject(apiError("DESTINATION_DENIED"));
+            return;
+          }
+          const chunks: Buffer[] = [];
+          let bytes = 0;
+          response.on("data", (chunk: Buffer) => {
+            bytes += chunk.length;
+            if (bytes > input.maxBytes) {
+              response.destroy();
+              reject(apiError("LIMIT_EXCEEDED"));
+            } else chunks.push(chunk);
+          });
+          response.on("error", () => reject(apiError("UPSTREAM_FAILED")));
+          response.on("end", () =>
+            resolveResult({ status, body: Buffer.concat(chunks).toString("utf8") }),
+          );
+        },
+      );
+      request.on("error", () =>
+        reject(apiError(input.signal.aborted ? "DEADLINE_EXCEEDED" : "UPSTREAM_FAILED")),
+      );
+      request.end(input.body);
+    });
+  };
+}
+export const pinnedTransport = makePinnedTransport();

package/src/api-tool/types.ts

@@ -0,0 +1,202 @@
+import { isIP } from "node:net";
+import { allowedAddress } from "./transport";
+import { Schema } from "effect";
+import { apiError } from "./errors";
+
+export const Method = Schema.Literals(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+const Auth = Schema.Union([
+  Schema.Struct({ kind: Schema.Literal("bearer"), secretRef: Schema.String }),
+  Schema.Struct({
+    kind: Schema.Literal("apiKey"),
+    header: Schema.String,
+    secretRef: Schema.String,
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("basic"),
+    usernameRef: Schema.String,
+    passwordRef: Schema.String,
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("login"),
+    path: Schema.String,
+    fields: Schema.Record(Schema.String, Schema.String),
+    tokenField: Schema.String,
+  }),
+]);
+export const ProfileSchema = Schema.Struct({
+  origin: Schema.String,
+  auth: Auth,
+  methods: Schema.optionalKey(Schema.Array(Method)),
+  pathPrefixes: Schema.Array(Schema.String),
+  deniedPathPrefixes: Schema.Array(Schema.String),
+  allowedPrivateAddresses: Schema.Array(Schema.String),
+  disclosure: Schema.Union([
+    Schema.Struct({ kind: Schema.Literal("raw") }),
+    Schema.Struct({ kind: Schema.Literal("fields"), fields: Schema.Array(Schema.String) }),
+  ]),
+  maxRequestBytes: Schema.Number,
+  maxResponseBytes: Schema.Number,
+  timeoutMs: Schema.Number,
+});
+const GrantSchema = Schema.Struct({
+  digest: Schema.String,
+  expiresAt: Schema.Number,
+  revoked: Schema.Boolean,
+  profiles: Schema.Array(Schema.String),
+  maxRequests: Schema.Number,
+  maxBytes: Schema.Number,
+  maxConcurrent: Schema.Number,
+  lifetimeMs: Schema.Number,
+});
+export const OperatorSchema = Schema.Struct({
+  listen: Schema.Union([
+    Schema.Struct({
+      kind: Schema.Literal("tls"),
+      host: Schema.String,
+      port: Schema.Number,
+      certFile: Schema.String,
+      keyFile: Schema.String,
+      separateIdentityAcknowledged: Schema.Literal(true),
+    }),
+    Schema.Struct({
+      kind: Schema.Literal("developmentLoopback"),
+      host: Schema.Literal("127.0.0.1"),
+      port: Schema.Number,
+    }),
+  ]),
+  secretsFile: Schema.String,
+  grantUseDirectory: Schema.String,
+  profiles: Schema.Record(Schema.String, ProfileSchema),
+  grants: Schema.Array(GrantSchema),
+  maxConcurrent: Schema.Number,
+});
+export const ClientSchema = Schema.Struct({
+  proxyOrigin: Schema.String,
+  capability: Schema.String,
+  developmentLoopback: Schema.optionalKey(Schema.Boolean),
+});
+export const RequestSchema = Schema.Struct({
+  profile: Schema.String,
+  method: Method,
+  path: Schema.String,
+  query: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+  body: Schema.optionalKey(Schema.Json),
+});
+export const ResultSchema = Schema.Struct({ status: Schema.Number, data: Schema.Json });
+export type OperatorConfig = typeof OperatorSchema.Type;
+export type ClientConfig = typeof ClientSchema.Type;
+export type ApiRequest = typeof RequestSchema.Type;
+export type ApiResult = typeof ResultSchema.Type;
+export type Profile = typeof ProfileSchema.Type;
+export type Grant = typeof GrantSchema.Type;
+
+export function decode<S extends Schema.ConstraintDecoder<unknown>>(
+  schema: S,
+  value: unknown,
+): S["Type"] {
+  try {
+    return Schema.decodeUnknownSync(schema, { onExcessProperty: "error" })(value);
+  } catch {
+    throw apiError("CONFIG_INVALID");
+  }
+}
+export const MAX_PATH_BYTES = 16_384;
+export const MAX_RESULT_ENVELOPE_BYTES = 10_000_000;
+export function relativePath(path: string): string {
+  if (
+    path.length > MAX_PATH_BYTES ||
+    !/^\/[A-Za-z0-9_~!$&'()+,=:@./-]*$/.test(path) ||
+    path.includes("//") ||
+    path.split("/").some((segment) => segment.endsWith("."))
+  )
+    throw apiError("POLICY_DENIED");
+  return path;
+}
+export const matchesPrefix = (path: string, prefix: string): boolean => {
+  const normalized = prefix === "/" ? prefix : prefix.replace(/\/$/, "");
+  return normalized === "/" || path === normalized || path.startsWith(`${normalized}/`);
+};
+export function originUrl(origin: string, developmentLoopback = false): URL {
+  let url: URL;
+  try {
+    url = new URL(origin);
+  } catch {
+    throw apiError("CONFIG_INVALID");
+  }
+  if (
+    url.origin !== origin ||
+    url.username ||
+    url.password ||
+    (url.protocol !== "https:" &&
+      !(developmentLoopback && url.protocol === "http:" && url.hostname === "127.0.0.1"))
+  )
+    throw apiError("CONFIG_INVALID");
+  return url;
+}
+const bounded = (n: number, max: number): boolean => Number.isSafeInteger(n) && n > 0 && n <= max;
+export function validateOperator(value: unknown): OperatorConfig {
+  const config = decode(OperatorSchema, value);
+  if (
+    !(
+      bounded(config.listen.port, 65535) ||
+      (config.listen.kind === "developmentLoopback" && config.listen.port === 0)
+    ) ||
+    !bounded(config.maxConcurrent, 64) ||
+    !config.grants.length ||
+    config.grants.length > 100 ||
+    Object.keys(config.profiles).length > 100 ||
+    !Object.keys(config.profiles).length
+  )
+    throw apiError("CONFIG_INVALID");
+  const digests = new Set<string>();
+  for (const grant of config.grants) {
+    if (
+      !/^[a-f0-9]{64}$/.test(grant.digest) ||
+      digests.has(grant.digest) ||
+      !bounded(grant.expiresAt, Number.MAX_SAFE_INTEGER) ||
+      !bounded(grant.maxRequests, 10000) ||
+      !bounded(grant.maxBytes, 1_000_000_000) ||
+      !bounded(grant.maxConcurrent, 64) ||
+      !bounded(grant.lifetimeMs, 86400000) ||
+      !grant.profiles.length ||
+      grant.profiles.some((p) => !Object.hasOwn(config.profiles, p))
+    )
+      throw apiError("CONFIG_INVALID");
+    digests.add(grant.digest);
+  }
+  for (const profile of Object.values(config.profiles)) {
+    originUrl(profile.origin);
+    for (const address of profile.allowedPrivateAddresses) {
+      if (
+        !isIP(address) ||
+        !allowedAddress(address, [address]) ||
+        (isIP(address) === 6 && new URL(`http://[${address}]`).hostname.slice(1, -1) !== address)
+      )
+        throw apiError("CONFIG_INVALID");
+    }
+    if (
+      !profile.pathPrefixes.length ||
+      !bounded(profile.maxRequestBytes, 1_000_000) ||
+      !bounded(profile.maxResponseBytes, 10_000_000) ||
+      !bounded(profile.timeoutMs, 60000) ||
+      profile.methods?.length === 0
+    )
+      throw apiError("CONFIG_INVALID");
+    for (const prefix of [...profile.pathPrefixes, ...profile.deniedPathPrefixes])
+      relativePath(prefix);
+    if (profile.auth.kind === "apiKey" && !/^(?:x-[a-z0-9-]+|api-key)$/i.test(profile.auth.header))
+      throw apiError("CONFIG_INVALID");
+    if (profile.auth.kind === "login") {
+      relativePath(profile.auth.path);
+      const minimumBody = JSON.stringify(
+        Object.fromEntries(Object.keys(profile.auth.fields).map((field) => [field, ""])),
+      );
+      if (
+        Buffer.byteLength(profile.auth.path) + Buffer.byteLength(minimumBody) >
+        profile.maxRequestBytes
+      )
+        throw apiError("CONFIG_INVALID");
+    }
+  }
+  return config;
+}

package/src/credential-guard/index.ts

@@ -1602,6 +1602,9 @@ function hasArgumentBraceExpansion(text: string): boolean {
 }
 
 function hasCommandArgumentBraceExpansion(argv: string[]): boolean {
+  const apiData = apiRequestDataIndexes(argv);
+  if (apiData)
+    return argv.some((arg, index) => !apiData.has(index) && hasArgumentBraceExpansion(arg));
   // LogQL is data for this wrapper; its quoted label selectors are never shell-evaluated.
   if (
     argv[0]?.split("/").at(-1) === "bun" &&
@@ -1621,6 +1624,52 @@ function hasCommandArgumentBraceExpansion(argv: string[]): boolean {
     : hasArgumentBraceExpansion(argv.join(" "));
 }
 
+function apiRequestDataIndexes(argv: string[]): Set<number> | undefined {
+  const start =
+    argv[0] === "bun" && argv[1] === "run" && argv[2] === "api-tool"
+      ? 3
+      : ["api-tool", "agent-tools-api"].includes(argv[0] ?? "")
+        ? 1
+        : -1;
+  if (start < 0 || argv[start] !== "request" || argv.length > 18) return undefined;
+  const data = new Set<number>();
+  const seen = new Set<string>();
+  for (let index = start + 1; index < argv.length; index++) {
+    const [flag = "", ...attached] = (argv[index] ?? "").split("=");
+    if (
+      !["--config", "--profile", "--path", "--method", "--query", "--body"].includes(flag) ||
+      seen.has(flag)
+    )
+      return undefined;
+    seen.add(flag);
+    const value = attached.length ? attached.join("=") : argv[++index];
+    if (!value || value.startsWith("--")) return undefined;
+    if (flag === "--query" || flag === "--body") {
+      try {
+        JSON.parse(value);
+      } catch {
+        return undefined;
+      }
+      data.add(index);
+    } else if (flag === "--method") {
+      if (!["GET", "POST", "PUT", "PATCH", "DELETE"].includes(value)) return undefined;
+    } else if (flag === "--profile") {
+      if (!/^[A-Za-z0-9_-]{1,128}$/.test(value)) return undefined;
+    } else if (flag === "--config") {
+      if (!/^(?:\.?\.?\/)?[A-Za-z0-9_./-]+$/.test(value)) return undefined;
+    } else if (flag === "--path") {
+      if (
+        value.length > 16384 ||
+        !/^\/[A-Za-z0-9_~!$&'()+,=:@./-]*$/.test(value) ||
+        value.includes("//") ||
+        value.split("/").some((part) => part.endsWith("."))
+      )
+        return undefined;
+    }
+  }
+  return data;
+}
+
 function literalSqlArgumentIndex(argv: string[]): number | undefined {
   if (
     argv[0]?.split("/").at(-1) !== "bun" ||
@@ -1647,9 +1696,11 @@ function literalSqlArgumentIndex(argv: string[]): number | undefined {
   return sql;
 }
 
-/** echo and printf print their arguments; grep -o, rg and git grep print matched pattern text. */
 function isLiteralTextProducer(argv: string[]): boolean {
-  return isPassiveTextCommand(argv) && argv[0]?.split("/").at(-1) !== "head";
+  return (
+    (argv[0]?.split("/").at(-1) === "git" && argv[1] === "commit") ||
+    (isPassiveTextCommand(argv) && argv[0]?.split("/").at(-1) !== "head")
+  );
 }
 
 function awkProgramIndex(argv: string[]): number | undefined {
@@ -2412,6 +2463,22 @@ function isReadonlySedPrint(argv: string[]): boolean {
   );
 }
 
+function gitCommitExecutionArguments(argv: string[]): string[] {
+  if (argv[0]?.split("/").at(-1) !== "git" || argv[1] !== "commit") return argv;
+  const executionArguments = [...argv];
+  for (let index = 2; index < argv.length && argv[index] !== "--"; index++) {
+    const argument = argv[index] ?? "";
+    if (argument === "-m" || argument === "--message") {
+      if (index + 1 < argv.length) executionArguments[++index] = "";
+    } else if (argument.startsWith("--message=")) {
+      executionArguments[index] = "--message=";
+    } else if (argument.startsWith("-m") && argument.length > 2) {
+      executionArguments[index] = "-m";
+    }
+  }
+  return executionArguments;
+}
+
 function hasStaticEnvironmentRead(
   argv: string[],
   allowedNames: Set<string>,
@@ -2468,7 +2535,7 @@ function hasStaticEnvironmentRead(
       "jq",
       "docker",
     ].includes(name ?? "") &&
-      mentionsEnvironmentRead(argv.join(" ")))
+      mentionsEnvironmentRead(gitCommitExecutionArguments(argv).join(" ")))
   );
 }
 
@@ -2551,6 +2618,15 @@ function hasEnvironmentRead(
   // ponytail: complex shell syntax stays conservative; use a shell AST if more exceptions are needed.
   const parsed = parseStaticShellCommands(command);
   if (parsed === "brace-expansion") return true;
+  if (
+    parsed &&
+    typeof parsed !== "string" &&
+    hasEnvironmentMutationPrefix(command) &&
+    parsed.pipelines
+      .flat()
+      .some((words) => apiRequestDataIndexes(unwrapStaticCommand(words)) !== undefined)
+  )
+    return true;
   if (!parsed) {
     const operands = parseStaticShellCommands(command, true);
     if (
@@ -2603,6 +2679,18 @@ function hasEnvironmentRead(
   ) {
     return true;
   }
+  if (
+    parsed.redirects.length > 0 &&
+    unwrapped.some(
+      (producer, index) =>
+        producer[0]?.split("/").at(-1) === "git" &&
+        producer[1] === "commit" &&
+        mentionsEnvironmentRead(producer.join(" ")) &&
+        unwrapped.slice(index + 1).some((consumer) => !isPassiveTextCommand(consumer)),
+    )
+  ) {
+    return true;
+  }
   if (
     parsed.redirects.length > 0 &&
     pipelines.some((pipeline) =>