@compr/opscontext-mcp 2.9.0 → 2.9.1

package/CHANGELOG.md

@@ -6,6 +6,24 @@ All notable changes to OpsContext for AI Agents (previously ContextEngine — MC
 
 ## [Unreleased]
 
+## [2.9.1] 2026-09-25: a staged file name is data, never shell
+
+### Security
+
+- **A staged file name is data, never shell** (`src/hooks.ts`, LOCK
+  `[STAGED-PATH-IS-AN-ARGUMENT-NEVER-A-SHELL-STRING]`). The pre-commit checkers ran
+  `git diff --cached -- "<name>"` and `git show :"<name>"` through a shell, escaping only the
+  double quote. Proven on 2026-09-25: a staged file named `note$(touch PROOF).md` ran `touch`
+  while `contextengine hook secret-scan` listed the staged files, so a cloned repo or a pull
+  request could run a command on the committer's machine. Names now reach git as arguments,
+  listed with `-z` and matched with a `:(literal)` pathspec; the rule-parity index read, whose
+  names come from `policy.json`, takes the same path.
+- **Every staged file is scanned, whatever its name.** The same line dropped every non-ASCII
+  name (git prints `caf\303\251.md` quoted, the lookup failed, the file was skipped unscanned)
+  and a name containing `*` matched other files too. A planted key in `café.md` passed the
+  scanner before; it is caught now. A diff above 1 MB was skipped silently as well; the buffer
+  is 32 MB.
+
 ## [2.9.0] 2026-09-25: credentials and prompt words stay out of the audit log
 
 ### Security

package/dist/hooks.js

@@ -43,7 +43,7 @@
 //      project gets its own `.contextengine/policy.json`. This rule only
 //      applies to the repo it lives in. Cross-repo enforcement is a
 //      separate concern (org-policy distribution via `extends:`).
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { existsSync, readFileSync } from "fs";
 import { createHash } from "crypto";
 import { join } from "path";
@@ -107,25 +107,36 @@ export function matchesAnyGlob(path, globs) {
  * Errors from git (not a repo, no staged changes, etc.) are RE-THROWN, not
  * swallowed. The caller decides whether "no staged changes" is fatal.
  */
+// [LOCKED] [STAGED-PATH-IS-AN-ARGUMENT-NEVER-A-SHELL-STRING] - 2026-09-25
+// [NEVER] build a shell command string from a staged path, a policy path, or any other value a
+//         repository controls. Pass it as one argv element to execFileSync, list names with -z,
+//         and address the file with a `:(literal)` pathspec (here) or a `:path` blob spec
+//         (contentAfterCommit below).
+// WHY: until 2.9.0 this ran `git diff --cached -- "<name>"` through a shell, escaping only the
+//      double quote. Proven in a scratch repo on 2026-09-25: a staged file named
+//      `note$(touch PROOF).md` ran `touch` while the pre-commit scanner parsed the staged list,
+//      so a cloned repo or a pull request could run a command on the committer's machine. The
+//      same line also lost every non-ASCII name: `--name-only` prints `caf\303\251.md` C-quoted,
+//      the shell lookup found no such file, the catch skipped it, and a planted key in `café.md`
+//      was never scanned. A plain pathspec is a glob too: `a*.md` also matched `ab.md`.
+// FIX: execFileSync("git", [...]) with the name as its own argument (no shell exists to expand
+//      it), `-z` so git prints raw names, `:(literal)` so a name matches only itself, and a
+//      32 MB buffer so a large file is not skipped silently. tests/hooks.test.ts and
+//      tests/rule-parity.test.ts stage those exact names.
 export function getStagedFiles(repoRoot) {
-    const nameOutput = execSync("git diff --cached --name-only --diff-filter=ACMR", {
-        cwd: repoRoot,
-        encoding: "utf-8",
-    }).trim();
-    if (!nameOutput)
+    const nameOutput = execFileSync("git", ["diff", "--cached", "--name-only", "-z", "--diff-filter=ACMR"], { cwd: repoRoot, encoding: "utf-8" });
+    const fileNames = nameOutput.split("\0").filter((f) => f.length > 0);
+    if (fileNames.length === 0)
         return [];
-    const fileNames = nameOutput.split("\n");
     const result = [];
     for (const file of fileNames) {
         let diff;
         try {
-            diff = execSync(`git diff --cached --unified=0 -- "${file.replace(/"/g, '\\"')}"`, {
-                cwd: repoRoot,
-                encoding: "utf-8",
-            });
+            diff = execFileSync("git", ["diff", "--cached", "--unified=0", "--", `:(literal)${file}`], { cwd: repoRoot, encoding: "utf-8", maxBuffer: 32 * 1024 * 1024 });
         }
         catch {
-            // Binary file, deleted, or path that doesn't roundtrip — skip safely.
+            // git could not diff this path (index and worktree disagree in a way git refuses to
+            // print, or the diff exceeds the buffer): nothing to parse, skip it.
             continue;
         }
         const addedLines = [];
@@ -586,7 +597,9 @@ export function formatDocCoverageViolationsJson(violations) {
 function contentAfterCommit(repoRoot, rel, stagedSet, useWorktree) {
     if (!useWorktree && stagedSet.has(rel)) {
         try {
-            return execSync(`git show :"${rel}"`, {
+            // [LOCK] [STAGED-PATH-IS-AN-ARGUMENT-NEVER-A-SHELL-STRING]: `rel` comes from policy.json,
+            // which a cloned repo controls; it is an argv element, never part of a shell string.
+            return execFileSync("git", ["show", `:${rel}`], {
                 cwd: repoRoot,
                 encoding: "utf-8",
                 maxBuffer: 32 * 1024 * 1024,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@compr/opscontext-mcp",
-  "version": "2.9.0",
+  "version": "2.9.1",
   "description": "OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.",
   "type": "module",
   "main": "dist/index.js",