@haposoft/cafekit 0.16.0-rc.1 → 0.16.0-rc.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haposoft/cafekit",
-  "version": "0.16.0-rc.1",
+  "version": "0.16.0-rc.2",
   "description": "Native spec-driven workflows for Claude Code, Codex CLI, and OpenCode. Bundles CafeKit skills, runtime hooks, agents, and installer scaffolding.",
   "author": "Haposoft <nghialt@haposoft.com>",
   "license": "MIT",

package/src/claude/agents/code-auditor.md

@@ -44,12 +44,17 @@ Before reading any specific logic, you MUST run a Dependency Scope Check (Blast
 
 | # | Pillar | Example Issues |
 |---|--------|----------------|
-| 1 | **Security** | XSS, SQL injection, hardcoded secrets, missing auth checks |
+| 1 | **Security** | XSS, SQL injection, hardcoded secrets, missing auth checks, over-broad log redaction corrupting safe identifiers/public URLs, quote/delimiter-unsafe authorization redaction, non-idempotent redaction, filesystem write escaping via traversal/symlink/sibling-prefix, non-canonical return path, non-atomic write or leaked temp file |
 | 2 | **Logic Correctness** | Race conditions, null references, off-by-one, unawait-ed async |
 | 3 | **Architecture** | Cross-module coupling, layer separation violations, circular dependencies |
 | 4 | **Principles (YAGNI/KISS/DRY)** | Code duplication, over-engineering, features outside scope |
 | 5 | **Convention & Style** | Non-standard naming, missing type annotations, formatting issues |
 
+### Critical-only invariants (enforce only when the diff touches these surfaces)
+
+- **Logging redaction:** exact token-boundary matching (safe suffixes `_file`/`_path`/`_hint`/`_label` and `tokenizer` must not be redacted), public URLs unchanged unless they carry a credential, `Bearer`/`Basic` redaction preserves surrounding quotes and trailing `,`/`;`/whitespace outside the value, never drops the closing quote, and `redact(redact(x)) === redact(x)`.
+- **Filesystem write boundary:** existing real directory root, reject empty/whitespace-only/URI/absolute/traversal/sibling-prefix before mutation, dual containment (lexical `path.resolve` **and** `realpath` of deepest existing parent), never follow or overwrite final symlink, never create parents outside root, atomic same-directory temp + `rename` with cleanup, return canonical `realpath` on success.
+
 ## Review Process
 
 Assume the code may be AI-generated. Do not trust polished structure, confident comments, or happy-path tests — verify behavior from evidence.
@@ -144,6 +149,8 @@ When called from `develop` Step 4 (Quality Gate Auto-Fix):
 - Cross-service behavior "proven" only by process-local memory, fake adapters, or other non-shared placeholders
 - Files or features from later tasks delivered early without explicit scope-escape justification
 - Task marked complete while required commands/evidence are still FAIL / UNVERIFIED
+- Logging redaction that over-redacts safe identifiers/public URLs, drops closing quotes, consumes `,`/`;` delimiters, or is not idempotent when the diff touches redaction/sanitization
+- Filesystem write that returns a lexical path instead of canonical `realpath`, skips `realpath` parent containment, follows or overwrites a final symlink, creates or mutates anything outside the root on rejection, or leaks a temp file / misses atomic same-directory `rename`
 
 ## Operating Guidelines
 

package/src/claude/skills/backend-development/references/backend-security.md

@@ -257,6 +257,58 @@ const dbPassword = process.env.DB_PASSWORD;
 if (!dbPassword) throw new Error('DB_PASSWORD not set');
 ```
 
+## Critical Security Invariants (apply only when the task touches these surfaces)
+
+These invariants are lane-aware: enforce them for Critical tasks that touch the
+named surface; for Direct/Standard tasks that happen to touch it, apply the same
+checks with proportional evidence (targeted unit test + diff self-check for Direct,
+bounded suite for Standard). Do not impose a fixed heavy ceremony on every task.
+
+### Logging & Secret Redaction
+
+- Match secret names by exact token boundaries, not broad substrings. Never redact
+  by substring inside safe identifiers — e.g. names ending in `_file`, `_path`,
+  `_hint`, `_label` or containing `tokenizer` must stay intact. Preserve the
+  field/key name, replace only the value with `[REDACTED]` (use `[REDACTED-PEM]`
+  for PEM blocks, keeping the surrounding structure).
+- Leave public URLs and credential-free strings untouched. URL redaction applies
+  only when a credential is present in the URL (e.g. `user:pass@host`).
+- Authorization redaction is quote-aware and delimiter-safe: match schemes
+  `Bearer`/`Basic` case-insensitively, redact only the credential that follows,
+  preserve surrounding quotes and trailing delimiters (`,`, `;`, whitespace) outside
+  the redacted value, and never drop the closing quote.
+- Idempotence: `redact(redact(x)) === redact(x)`. The markers `[REDACTED]` /
+  `[REDACTED-PEM]` are stable and not re-wrapped or corrupted.
+- Verification guidance: cover true-positive credential cases, false-positive
+  safe-identifier and public-URL cases, quoted `Bearer`/`Basic` with trailing
+  delimiters, multi-line/PEM cases when relevant, and an idempotence round-trip.
+  Assert that no secret appears in error messages or completion reports and that
+  safe values are byte-identical after redaction.
+
+### Filesystem Write Boundary
+
+- Require an existing real directory as root. Reject before any mutation when
+  `targetPath` is empty or whitespace-only, contains a URI scheme, is absolute,
+  escapes via `..` segments, or escapes via sibling-prefix (`root` vs
+  `root-evil`).
+- Containment needs two checks: lexical containment of the resolved path
+  (`path.resolve(root, target)` inside root) **and** `realpath` containment of
+  the deepest existing parent directory. This blocks symlink-pointing-outside
+  and traversal that lexical check alone would miss. Never follow or overwrite a
+  symlink at the final target; never create parent directories outside root.
+- Perform atomic same-directory write: create a temporary file in the target
+  directory, write fully, then `rename` into place. Remove the temp file on any
+  error. Rejections must happen before creating or modifying anything outside root.
+- Return the canonical `realpath` of the target on success (e.g. macOS
+  `/var` → `/private/var` alias must resolve). Keep the public API otherwise
+  unchanged.
+- Verification guidance: nested success, traversal / absolute / URI / sibling-prefix
+  rejection, parent-symlink rejection, final-symlink rejection (do not follow or
+  overwrite), no-outside-mutation assertion (filesystem outside root unchanged on
+  failure), atomic temp cleanup, and canonical return-path equality. Critical runs
+  the full project suite; Direct/Standard use proportional lane evidence (targeted
+  unit test + diff self-check for Direct, bounded suite for Standard).
+
 ## API Security Checklist
 
 - [ ] Use HTTPS/TLS 1.3 only

package/src/claude/skills/develop/references/quality-gate.md

@@ -45,6 +45,26 @@ Stage A applies same spec compliance review checklist for every tier: scope, req
 - Scope fidelity is mandatory: missing scoped behavior, extra unapproved behavior, or task output that exists only as orphaned/unreachable code is a review failure even when build/tests pass.
 - Runtime-facing artifacts must be reachable from the real entrypoint/caller named by the task or the task-aware scout report.
 
+### Critical security verification (apply only when the task touches these surfaces)
+
+No fixed ceremony for every task — apply the checklist below only when the
+touched files, risk signals, or task description include logging/redaction or
+filesystem write boundaries. Direct uses targeted unit test + diff self-check,
+Standard a bounded suite, Critical strict evidence (inspector/test-runner/
+code-auditor per lane policy).
+
+- **Logging / secret redaction:** assert broad matchers did not corrupt safe
+  identifiers or public URLs; quoted `Bearer`/`Basic` redaction keeps surrounding
+  quotes and leaves trailing `,`/`;`/whitespace outside the replacement; redaction
+  is idempotent (`redact(redact(x)) === redact(x)`); no secret appears in test
+  failures or the verification receipt.
+- **Filesystem write boundary:** assert lexical `path.resolve` **and** `realpath` of
+  the deepest existing parent both stay inside the canonical root; parent-symlink
+  and final-symlink targets are rejected without following/overwriting; no file
+  outside root is created or mutated on rejection; write goes via same-directory
+  temp file + atomic `rename` with cleanup on error; success returns canonical
+  `realpath` (platform aliases resolved).
+
 ## Flash Gate (`--flash`)
 
 Use this only when `/hapo:develop ... --flash` is present.