@erichll/pi-auto-review 0.3.4 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.4.0 - 2026-08-19
+
+- **Credential-exfiltration hardening.** Expand deterministic terminal denies to cover
+  `.env` variants, common credential files, additional file readers and encoders,
+  shell substitutions, staged variables, redirects, and multi-stage pipelines that
+  upload credentials to network sinks. Template files such as `.env.example` and
+  `.env.sample` remain reviewable.
+- **Reviewer refresh safety.** Re-resolve reviewer model/provider metadata for each
+  review, reacquire authentication for each attempt, and bind the reviewer session
+  identity to the endpoint and authentication fingerprint so provider or OAuth
+  refreshes cannot reuse a stale connection.
+- **Compatibility.** Require Pi 0.84.1+ and permission-system 25.1.0+ to match the
+  current reviewer and forwarded-permission contracts.
+
+## 0.3.5 - 2026-08-13
+
+- Raise the default model-review `timeoutMs` from 45s to 90s and the default
+  `retries` from 1 to 2. Approval now tolerates real-world model latency better
+  while keeping the same bounded transcript surface.
+
 ## 0.3.4 - 2026-08-08
 
 - Normalize direct and permission-system v24 forwarded evidence before policy

package/README.md

@@ -106,9 +106,9 @@ Package-shipped defaults live in `src/config.json`:
 {
   "model": "codex-auto-review",
   "reasoning": "low",
-  "timeoutMs": 45000,
+  "timeoutMs": 90000,
   "maxTokens": 1600,
-  "retries": 1,
+  "retries": 2,
   "maxUserTranscriptTokens": 1200,
   "maxToolTranscriptTokens": 1200,
   "maxRelevantResultTokens": 800,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.3.4",
+  "version": "0.4.0",
   "description": "Model-backed boundary approval broker for Pi",
   "type": "module",
   "license": "MIT",
@@ -47,15 +47,15 @@
     "test": "node --disable-warning=ExperimentalWarning --experimental-loader ./test/typescript-loader.mjs --test test/*.test.ts"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.82.1",
-    "@earendil-works/pi-coding-agent": ">=0.82.1",
-    "@gotgenes/pi-permission-system": ">=23.0.0"
+    "@earendil-works/pi-ai": "^0.84.1",
+    "@earendil-works/pi-coding-agent": "^0.84.1",
+    "@gotgenes/pi-permission-system": "^25.1.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.83.0",
-    "@earendil-works/pi-coding-agent": "0.83.0",
-    "@gotgenes/pi-permission-system": "24.0.0",
-    "@types/node": "^22.15.3",
+    "@earendil-works/pi-ai": "^0.84.1",
+    "@earendil-works/pi-coding-agent": "^0.84.1",
+    "@gotgenes/pi-permission-system": "^25.1.0",
+    "@types/node": "^26.2.0",
     "typescript": "^6.0.3"
   }
 }

package/src/config.json

@@ -1,9 +1,9 @@
 {
   "model": "codex-auto-review",
   "reasoning": "low",
-  "timeoutMs": 45000,
+  "timeoutMs": 90000,
   "maxTokens": 1600,
-  "retries": 1,
+  "retries": 2,
   "maxUserTranscriptTokens": 1200,
   "maxToolTranscriptTokens": 1200,
   "maxRelevantResultTokens": 800,

package/src/index.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { appendFileSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
@@ -93,13 +94,24 @@ type ReviewerRuntime = {
   model: Parameters<typeof completeSimple>[0];
   auth: {
     apiKey?: string;
-    headers?: Record<string, string>;
+    // ProviderHeaders allows null values (e.g. "clear" directives) in 0.84.x.
+    headers?: Record<string, string | null>;
     env?: Record<string, string>;
   };
   streamSimple?: ApiStreamSimpleFunction;
   sessionId: string;
 };
 
+// Model/stream metadata is re-resolved for every review instead of being
+// cached for the session: pi can refresh models.json or re-register a
+// provider while a session is live, and the resolved model's baseUrl, api
+// or streamSimple may have changed, so a per-session cache could keep
+// calling a stale endpoint. Authentication is also deliberately excluded
+// because pi resolves models.json auth and headers dynamically on every
+// request (including OAuth refresh); it is reacquired per model call in
+// complete().
+type ReviewerMeta = Omit<ReviewerRuntime, "auth" | "sessionId">;
+
 type ReviewResult = {
   decision: ModelDecision;
   attempts: number;
@@ -125,9 +137,9 @@ const BOUNDED_SURFACES = new Set(["path", "external_directory"]);
 const DEFAULT_CONFIG: Config = {
   model: "codex-auto-review",
   reasoning: "low",
-  timeoutMs: 45_000,
+  timeoutMs: 90_000,
   maxTokens: 1_600,
-  retries: 1,
+  retries: 2,
   maxUserTranscriptTokens: 1_200,
   maxToolTranscriptTokens: 1_200,
   maxRelevantResultTokens: 800,
@@ -644,10 +656,50 @@ function parseModelRef(modelRef: string): {
   return { provider, modelId: idParts.join("/") };
 }
 
-async function resolveReviewer(
+function reviewerSessionId(
+  ctx: ExtensionContext,
+  config: Config,
+  model: ReviewerMeta["model"],
+  auth: ReviewerRuntime["auth"],
+): string {
+  // pi-ai reuses Codex WebSockets by session/account without comparing the
+  // socket URL or handshake headers. Bind the cache identity to endpoint and
+  // authentication metadata so a live provider/auth refresh cannot reuse the
+  // old connection. Sensitive values only feed the hash below.
+  // Hash the complete identity and keep the result below pi-ai's 64-character
+  // prompt-cache-key limit, which would otherwise be able to truncate away a
+  // distinguishing suffix on long session IDs or base URLs.
+  const identity = JSON.stringify({
+    sessionId: ctx.sessionManager.getSessionId(),
+    modelRef: config.model,
+    provider: model.provider,
+    modelId: model.id,
+    api: model.api,
+    baseUrl: model.baseUrl,
+    modelHeaders: Object.entries(model.headers ?? {}).sort(([a], [b]) =>
+      a.localeCompare(b),
+    ),
+    auth: {
+      apiKey: auth.apiKey,
+      headers: Object.entries(auth.headers ?? {}).sort(([a], [b]) =>
+        a.localeCompare(b),
+      ),
+      env: Object.entries(auth.env ?? {}).sort(([a], [b]) =>
+        a.localeCompare(b),
+      ),
+    },
+  });
+  const fingerprint = createHash("sha256")
+    .update(identity)
+    .digest("hex")
+    .slice(0, 48);
+  return `pi-auto-review-${fingerprint}`;
+}
+
+async function resolveReviewerMeta(
   ctx: ExtensionContext,
   config: Config,
-): Promise<ReviewerRuntime> {
+): Promise<ReviewerMeta> {
   const { provider, modelId } = parseModelRef(config.model);
   const available = ctx.modelRegistry.getAvailable();
   const registeredModel = provider
@@ -671,8 +723,6 @@ async function resolveReviewer(
         : `model ${config.model} is unavailable`,
     );
   }
-  const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
-  if (!auth.ok) throw new Error(`model authentication failed: ${auth.error}`);
 
   const registered = (
     ctx.modelRegistry as ExtensionContext["modelRegistry"] & {
@@ -689,13 +739,24 @@ async function resolveReviewer(
 
   return {
     model,
-    auth,
     streamSimple:
       registered?.api === model.api ? registered.streamSimple : undefined,
-    sessionId: `${ctx.sessionManager.getSessionId()}-codex-auto-review`,
   };
 }
 
+// pi resolves models.json auth and headers dynamically on every request;
+// reacquire authentication per model call instead of pinning it for the
+// session (rotating OAuth tokens would otherwise go stale and fail closed
+// until session restart).
+async function resolveApiKeyAndHeaders(
+  ctx: ExtensionContext,
+  model: ReviewerMeta["model"],
+): Promise<ReviewerRuntime["auth"]> {
+  const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+  if (!auth.ok) throw new Error(`model authentication failed: ${auth.error}`);
+  return auth;
+}
+
 async function modelCall(
   runtime: ReviewerRuntime,
   config: Config,
@@ -745,11 +806,17 @@ async function modelCall(
   return text;
 }
 
+type ReviewerResolver = (
+  ctx: ExtensionContext,
+  config: Config,
+) => Promise<ReviewerMeta>;
+
 async function complete(
   ctx: ExtensionContext,
   config: Config,
   request: BoundaryRequest,
   reviewerContext?: BoundaryReviewerContext,
+  resolve: ReviewerResolver = resolveReviewerMeta,
 ): Promise<ReviewResult> {
   const started = Date.now();
   const transcript = buildClassifierTranscript(
@@ -772,11 +839,17 @@ async function complete(
     if (controller.signal.aborted) {
       throw new Error("review aborted before model resolution");
     }
-    const runtime = await resolveReviewer(ctx, config);
+    const meta = await resolve(ctx, config);
     let lastError: unknown;
     const retryErrors: string[] = [];
     for (let attempt = 1; attempt <= config.retries + 1; attempt++) {
       try {
+        const auth = await resolveApiKeyAndHeaders(ctx, meta.model);
+        const runtime: ReviewerRuntime = {
+          ...meta,
+          auth,
+          sessionId: reviewerSessionId(ctx, config, meta.model, auth),
+        };
         const decision = parseDecision(
           await modelCall(
             runtime,
@@ -885,6 +958,9 @@ export function createPiAutoReviewExtension(
   let disposeBrokerService: (() => void) | undefined;
   const reviewResults = new Map<string, ReviewResult>();
   let broker: BoundaryApprovalBroker | undefined;
+  // Reviewer metadata is re-resolved per review (see ReviewerMeta above),
+  // so a models.json or provider refresh mid-session is observed on the
+  // next review instead of reusing a stale model/stream binding.
   const uiAutoConfirmer = new PermissionUiAutoConfirmer(
     () => config.autoConfirmBoundedAllows,
   );
@@ -898,6 +974,7 @@ export function createPiAutoReviewExtension(
           config,
           request,
           reviewerContext,
+          resolveReviewerMeta,
         );
         if (request.source === "permission-system") {
           reviewResults.set(request.id, result);

package/src/policy.ts

@@ -298,15 +298,139 @@ export function deterministicHardDeny(
     };
   }
 
-  const credentialSource =
-    /(?:\/|~\/|\$HOME\/|\$\{HOME\}\/)(?:\.ssh\/(?:id_[A-Za-z0-9_-]+|authorized_keys)|\.aws\/credentials|\.kube\/config|\.docker\/config\.json|\.npmrc|\.netrc|\.pi\/agent\/auth\.json)|(?:^|[\/@\s])\.env(?:\s|$)/i;
-  const networkUpload =
-    /\b(?:curl\b[^;\n]*(?:--data(?:-binary|-raw|-urlencode)?|-d|--form|-F|--upload-file|-T)|wget\b[^;\n]*(?:--post-file|--post-data)|(?:nc|ncat|socat)\b)/i;
-  const credentialPipe =
-    /(?:cat|sed|awk|base64|openssl)\b[^|;\n]*(?:\.ssh|\.aws|\.kube|\.docker|\.npmrc|\.netrc|\.env|auth\.json)[^|;\n]*\|[^;\n]*\b(?:curl|wget|nc|ncat|socat)\b/i;
+  // Secret path text is only evidence when it occurs as the operand of an
+  // operation that reads a file. In particular, a slash-delimited `.env` in
+  // a URL or literal request payload is not itself a credential source.
+  const envFileName =
+    String.raw`\.env(?:\.(?!example\b|sample\b)[A-Za-z0-9_-]*)*`;
+  const envFile =
+    envFileName + String.raw`(?=[\s"'/@<>=|;&)\`]|$)`;
+  const envPath =
+    String.raw`(?:[^\s"'@<>=|;&()]+\/)*` + envFile;
+  const credentialDirectoryPath =
+    String.raw`(?:~\/|\$HOME\/|\$\{HOME\}\/|\/|\.\.?\/)?` +
+    String.raw`(?:[^\s"'@<>=|;&()\/]+\/)*` +
+    String.raw`(?:\.ssh\/(?:id_[A-Za-z0-9_-]+|authorized_keys)|\.aws\/credentials|\.kube\/config|\.docker\/config\.json|\.npmrc|\.netrc|\.pi\/agent\/auth\.json)`;
+  const credentialPath =
+    String.raw`(?:` +
+    credentialDirectoryPath +
+    String.raw`|` + envPath + String.raw`)`;
+  const directCredentialUpload = new RegExp(
+    String.raw`\b(?:curl|wget)\b[^;\n]*(?:` +
+      String.raw`(?:--data(?:-binary|-urlencode)?|-d|--form|-F)(?:=|\s+)[^;\n\s]*@\s*["']?` + credentialPath +
+      String.raw`|(?:--upload-file|--post-file)(?:=|\s+)["']?` + credentialPath +
+      String.raw`|-T(?:\s*|=)["']?` + credentialPath +
+      String.raw`)["']?`,
+    "i",
+  );
+  const redirectedCredentialUpload = new RegExp(
+    String.raw`\b(?:` +
+      String.raw`(?:curl|wget)\b[^;\n]*(?:--data(?:-binary|-raw|-urlencode)?|-d|--form|-F|--upload-file|-T|--post-file|--post-data)[^;\n]*` +
+      String.raw`|(?:nc|ncat|socat)\b[^;\n]*` +
+      String.raw`)<\s*["']?` +
+      credentialPath,
+    "i",
+  );
+  // The pipe matcher covers any content-emitting reader that names a secret
+  // file (a bare filename such as `head .env`, `dd if=.env`, or a path like
+  // ~/.aws/credentials) and feeds a network sink. The producer set is
+  // enumerated rather than derived from directCredentialUpload because a bare
+  // filename argument carries no path/@/redirect evidence; keeping the list
+  // broad is fail-closed and cheap, since a match also requires a secret-file
+  // token before the pipe and a network sink after it. This is best-effort
+  // hardening, not a completeness guarantee: readers not on the list still
+  // fall through to the contextual matchers below or the dynamic reviewer.
+  // The leading lookbehind keeps the producers from
+  // matching mid-word (star, code) so the terms stay real tool tokens.
+  const credentialPipe = new RegExp(
+    String.raw`(?<![A-Za-z0-9_])(?:cat|sed|awk|base64|openssl|head|tail|grep|dd|sort|cut|strings|rev|uniq|fold|od|xxd|hexdump|base32|uuencode|gzip|bzip2|xz|zstd|tar|zip)\b[^|;\n]*(?:\.ssh|\.aws|\.kube|\.docker|\.npmrc|\.netrc|` +
+      String.raw`(?:^|[\s"'=/@])` +
+      envFile +
+      String.raw`|auth\.json)[^|;\n]*\|[^;\n]*\b(?:curl|wget|nc|ncat|socat)\b`,
+    "i",
+  );
+  const credentialReader =
+    String.raw`(?<![A-Za-z0-9_])(?:cat|sed|awk|base64|openssl|head|tail|grep|dd|sort|cut|strings|rev|uniq|fold|od|xxd|hexdump|base32|uuencode|gzip|bzip2|xz|zstd|tar|zip)\b[^|;\n]*` +
+    credentialPath;
+  const credentialShellExpansion =
+    String.raw`(?:\$\([^)]*` +
+    credentialReader +
+    String.raw`[^)]*\)|<\([^)]*` +
+    credentialReader +
+    String.raw`[^)]*\)|\`[^\`\n]*` +
+    credentialReader +
+    String.raw`[^\`\n]*\`)`;
+  const credentialExpansionUpload = new RegExp(
+    String.raw`\b(?:curl|wget)\b[^;\n]*(?:--data(?:-binary|-raw|-urlencode)?|-d|--form|-F|--upload-file|-T|--post-file|--post-data)[^;\n]*` +
+      credentialShellExpansion,
+    "i",
+  );
+  const redirectedCredentialExpansion = new RegExp(
+    String.raw`\b(?:nc|ncat|socat)\b[^;\n]*(?:<<<|<)\s*` +
+      credentialShellExpansion,
+    "i",
+  );
+  const stagedCredentialVariableRead = new RegExp(
+    String.raw`\b([A-Za-z_][A-Za-z0-9_]*)\s*=\s*` +
+      credentialShellExpansion,
+    "gi",
+  );
+  let stagedCredentialVariableUpload = false;
+  for (const match of command.matchAll(stagedCredentialVariableRead)) {
+    const variable = match[1];
+    const suffix = command.slice((match.index ?? 0) + match[0].length);
+    const escapedVariable = variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const variableUpload = new RegExp(
+      String.raw`(?:\b(?:curl|wget)\b[^;\n]*(?:--data(?:-binary|-raw|-urlencode)?|-d|--form|-F|--upload-file|-T|--post-file|--post-data)[^;\n]*|\b(?:nc|ncat|socat)\b[^;\n]*<<<\s*["']?)` +
+        String.raw`(?:\$\{` +
+        escapedVariable +
+        String.raw`\}|\$` +
+        escapedVariable +
+        String.raw`(?![A-Za-z0-9_]))`,
+      "i",
+    );
+    if (variableUpload.test(suffix)) {
+      stagedCredentialVariableUpload = true;
+      break;
+    }
+  }
+  const credentialSubstitution = new RegExp(
+    String.raw`\b(?:nc|ncat|socat)\b[^;\n]*\$\([^)]*` +
+      credentialReader +
+      String.raw`[^)]*\)`,
+    "i",
+  );
+  const stagedCredentialRead = new RegExp(
+    credentialReader + String.raw`[^|;\n]*>\s*["']?([^\s"';&|]+)["']?`,
+    "gi",
+  );
+  let stagedCredentialUpload = false;
+  for (const match of command.matchAll(stagedCredentialRead)) {
+    const target = match[1];
+    const suffix = command.slice((match.index ?? 0) + match[0].length);
+    const escapedTarget = target.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const targetUpload = new RegExp(
+      String.raw`\b(?:curl|wget)\b[^;\n]*(?:` +
+        String.raw`(?:--data(?:-binary|-urlencode)?|-d|--form|-F)(?:=|\s+)[^;\n\s]*@\s*["']?` + escapedTarget +
+        String.raw`|(?:--upload-file|--post-file)(?:=|\s+)["']?` + escapedTarget +
+        String.raw`|-T(?:\s*|=)["']?` + escapedTarget +
+        String.raw`)(?=[\s"']|$)`,
+      "i",
+    );
+    if (targetUpload.test(suffix)) {
+      stagedCredentialUpload = true;
+      break;
+    }
+  }
   if (
-    (credentialSource.test(command) && networkUpload.test(command)) ||
-    credentialPipe.test(command)
+    directCredentialUpload.test(command) ||
+    redirectedCredentialUpload.test(command) ||
+    credentialPipe.test(command) ||
+    credentialExpansionUpload.test(command) ||
+    redirectedCredentialExpansion.test(command) ||
+    credentialSubstitution.test(command) ||
+    stagedCredentialVariableUpload ||
+    stagedCredentialUpload
   ) {
     return {
       rule: "credential-exfiltration",