@desplega.ai/agent-swarm 1.164.1 → 1.166.0

package/src/utils/pr-body-leaks.ts

@@ -21,6 +21,13 @@
  *     label and a commit SHA. Only "swarm run", "workflow run" or "run id"
  *     followed by a hex id counts. Cost: "run <id>" alone passes.
  * Every other category is checked everywhere, fences included.
+ *
+ * Swarm provenance: a `## Swarm provenance` section may carry the auth-gated
+ * links a maintainer uses to backtrack (task and session links, durable
+ * agent-fs paths, the Slack permalink of the ask). Inside that section only,
+ * `PROVENANCE_ALLOWED` categories pass, and a Slack permalink's embedded
+ * channel id and ts do not count. Bare Slack ids, ts values and private-chat
+ * quotes stay blocked there too.
  */
 
 export type LeakCategory =
@@ -144,27 +151,159 @@ const PLACEHOLDER_UUIDS = new RegExp(
   "gi",
 );
 
-/** Fenced code blocks (``` or ~~~). An unclosed fence runs to the end, as in CommonMark. */
-const FENCED_CODE = /^[ \t]*(`{3,}|~{3,})[^\n]*\n[\s\S]*?(?:^[ \t]*\1[`~]*[ \t]*$|$(?![\s\S]))/gm;
+/** The section heading under which auth-gated provenance links are allowed. */
+export const PROVENANCE_HEADING = "Swarm provenance";
 
-/** Returns the distinct leak categories found in `body`, in rule order. Empty means clean. */
-export function findPrBodyLeaks(body: string): LeakCategory[] {
-  const text = body
-    .replace(/\r\n/g, "\n")
+/** Categories allowed inside the provenance section. Everything else stays blocked there too. */
+export const PROVENANCE_ALLOWED: ReadonlySet<LeakCategory> = new Set<LeakCategory>([
+  "slack-link",
+  "swarm-dashboard-link",
+  "agent-fs-link",
+  "swarm-task-ref",
+  "agent-fs-path",
+]);
+
+/** A whole Slack permalink, query string included (`?thread_ts=...`). */
+const SLACK_URL = /https?:\/\/[^\s)"'<>]*slack\.com\/(?:archives|client)\/[^\s)"'<>]*/gi;
+
+// CommonMark 0.31.2 §4.5: a fence line starts at most 3 columns in, and a tab
+// expands to the next multiple of 4, so a line with a leading tab is too deep.
+// Only ASCII space and tab count as whitespace here (§2.1); JS `\s` and
+// `trim()` also match U+00A0 and other Unicode spaces, which GitHub treats as text.
+const HEADING = /^#{1,2}[ \t]+(.+?)(?:[ \t]+#+)?[ \t]*$/;
+const FENCE_LINE = /^( {0,3})(`{3,}|~{3,})(.*)$/;
+const COMMENT_OPEN = /^[ \t]*<!--/;
+const BLANK = /^[ \t]*$/;
+
+export type MarkdownLine = {
+  line: string;
+  /** Text of the level-1/level-2 heading this line starts, else null. */
+  heading: string | null;
+  /** True for a fence line or a line inside a fenced code block. */
+  code: boolean;
+  /**
+   * True once a fence closed on a line less indented than its opener. The
+   * opener may sit in a list item, where that line ends the item and opens a
+   * new fence instead, so GitHub can read the rest of the body differently.
+   */
+  ambiguous: boolean;
+};
+
+/**
+ * Each line of `markdown`, read the way GitHub renders it at the top level.
+ * Headings inside fenced code blocks and HTML comment blocks do not count.
+ * A fence opens or closes only on a line indented at most 3 columns; it closes
+ * on the same character, at least as long as the opener, with no info string.
+ * An unclosed fence runs to the end. Inside an ambiguous span no line counts
+ * as code, so prose checks still see it.
+ * Shared with `scripts/check-pr-body.ts` so both read sections the same way.
+ */
+export function markdownHeadings(markdown: string): MarkdownLine[] {
+  const out: MarkdownLine[] = [];
+  let fence: { char: string; length: number; indent: number } | null = null;
+  let inComment = false;
+  let ambiguous = false;
+  for (const line of markdown.replace(/\r\n/g, "\n").split("\n")) {
+    const fenceLine = FENCE_LINE.exec(line);
+    const indent = fenceLine?.[1]?.length ?? 0;
+    const run = fenceLine?.[2] ?? "";
+    const info = fenceLine?.[3] ?? "";
+    let heading: string | null = null;
+    let code = false;
+    if (fence) {
+      code = true;
+      if (run[0] === fence.char && run.length >= fence.length && BLANK.test(info)) {
+        if (indent < fence.indent) ambiguous = true;
+        fence = null;
+      }
+    } else if (inComment) {
+      if (line.includes("-->")) inComment = false;
+    } else if (fenceLine && !(run[0] === "`" && info.includes("`"))) {
+      fence = { char: run[0] ?? "`", length: run.length, indent };
+      code = true;
+    } else if (COMMENT_OPEN.test(line)) {
+      inComment = !line.slice(line.indexOf("<!--") + 4).includes("-->");
+    } else {
+      heading = HEADING.exec(line)?.[1] ?? null;
+    }
+    out.push({ line, heading, code: code && !ambiguous, ambiguous });
+  }
+  return out;
+}
+
+/** `markdown` with every fenced code block collapsed to one placeholder line. */
+export function stripFencedCode(markdown: string, placeholder = "<code-block>"): string {
+  const out: string[] = [];
+  let wasCode = false;
+  for (const { line, code } of markdownHeadings(markdown)) {
+    if (!code) out.push(line);
+    else if (!wasCode && placeholder) out.push(placeholder);
+    wasCode = code;
+  }
+  return out.join("\n");
+}
+
+const isProvenanceHeading = (raw: string) =>
+  raw
+    .replace(/<!--[\s\S]*?-->/g, "")
+    .replace(/^[ \t]+|[ \t]+$/g, "")
+    .replace(/[ \t]+/g, " ")
+    .toLowerCase() === PROVENANCE_HEADING.toLowerCase();
+
+/**
+ * A line GitHub might render as a level-1/level-2 heading in some context: an
+ * ATX heading at any indent or behind list or quote markers, or a setext
+ * underline. Fence and comment state are ignored on purpose.
+ */
+const MAYBE_HEADING =
+  /^[ \t]*(?:(?:[-*+>]|\d{1,9}[.)])[ \t]*)*(?:#{1,2}(?:[ \t]|$)|(?:=+|-+)[ \t]*$)/;
+
+/**
+ * Split a body into the `## Swarm provenance` section(s) and everything else.
+ * Fails closed both ways. A section opens only on a heading `markdownHeadings`
+ * reads at the top level, outside an ambiguous span. It ends on any line that
+ * might render as a level-1/level-2 heading, even one the parser reads as
+ * fenced or commented out.
+ */
+export function splitProvenance(body: string): { outside: string; provenance: string } {
+  const outside: string[] = [];
+  const provenance: string[] = [];
+  let inProvenance = false;
+  for (const { line, heading, ambiguous } of markdownHeadings(body)) {
+    if (heading !== null && !ambiguous && isProvenanceHeading(heading)) inProvenance = true;
+    else if (heading !== null || MAYBE_HEADING.test(line)) inProvenance = false;
+    (inProvenance ? provenance : outside).push(line);
+  }
+  return { outside: outside.join("\n"), provenance: provenance.join("\n") };
+}
+
+function scan(text: string, skip: ReadonlySet<LeakCategory>, found: LeakCategory[]) {
+  const clean = text
     .replace(PRESIGNED_URL, "<presigned-url>")
     .replace(PLACEHOLDER_UUIDS, "<placeholder-uuid>");
-  const prose = text.replace(FENCED_CODE, "<code-block>");
-  const found: LeakCategory[] = [];
+  const prose = stripFencedCode(clean);
   for (const rule of LEAK_RULES) {
     if (
       rule.enabled &&
+      !skip.has(rule.category) &&
       !found.includes(rule.category) &&
-      rule.pattern.test(rule.proseOnly ? prose : text)
+      rule.pattern.test(rule.proseOnly ? prose : clean)
     ) {
       found.push(rule.category);
     }
   }
-  return found;
+}
+
+/** Returns the distinct leak categories found in `body`, in rule order. Empty means clean. */
+export function findPrBodyLeaks(body: string): LeakCategory[] {
+  const { outside, provenance } = splitProvenance(body);
+  const found: LeakCategory[] = [];
+  scan(outside, new Set(), found);
+  // A permalink carries a channel id and a message ts; allowed here, so drop it whole.
+  scan(provenance.replace(SLACK_URL, "<slack-permalink>"), PROVENANCE_ALLOWED, found);
+  return LEAK_RULES.map((r) => r.category).filter(
+    (c, i, all) => found.includes(c) && all.indexOf(c) === i,
+  );
 }
 
 /** GitHub logins whose PR bodies get the leak check in CI. */

package/src/utils/request-auth-context.ts

@@ -5,6 +5,8 @@ import type { User } from "../types";
 export type HttpRequestAuth = (
   | { kind: "operator"; fingerprint: string }
   | { kind: "user"; userId: string; user: User }
+  /** Password-page viewer with no user identity. Least privilege: every gate denies it. */
+  | { kind: "guest" }
   /** Ephemeral session token minted by the ACP adapter per session (aseph_ prefix). */
   | { kind: "agent"; agentId: string; taskId: string }
 ) & {