@hegemonart/get-design-done 1.33.0 → 1.33.5

package/scripts/lib/peer-cli/sanitize-env.cjs

@@ -0,0 +1,198 @@
+// scripts/lib/peer-cli/sanitize-env.cjs
+//
+// Plan 33.5-04 — peer-CLI environment sandbox (SC#4; CONTEXT D-03).
+//
+// ============================================================================
+// WHY THIS EXISTS
+// ============================================================================
+//
+// The two peer-CLI clients (acp-client.cjs / asp-client.cjs) spawn external
+// peer binaries (Gemini / Cursor / Copilot / Qwen / Codex) over stdio. Before
+// this module, both clients defaulted the child's environment to the FULL
+// `process.env` whenever the caller did not supply `opts.env` (acp line ~102,
+// asp line ~122). That leaks GDD's own secrets — ANTHROPIC_API_KEY, GH_TOKEN,
+// any GDD_* var — into every spawned peer, even though peers authenticate with
+// their OWN logged-in credentials and have no need for GDD's keys.
+//
+// D-03 (locked) makes the sandbox ALLOWLIST-FORWARD / DEFAULT-DENY: the child
+// env is built from (a) an OS-essential baseline (just enough for a binary to
+// launch on Windows + macOS + Linux) PLUS (b) an explicit caller allowlist read
+// from `.design/config.json#peer_cli.env_allowlist`. Everything else is dropped.
+// GDD secrets and any secret-shaped var are NEVER forwarded unless the operator
+// explicitly allowlists them — a one-line escape hatch for the rare peer that
+// genuinely needs an inherited provider key.
+//
+// No new runtime dependency (D-12): plain JS + a defensive config read that
+// mirrors registry.cjs's `readEnabledPeers` idiom.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// ── OS-essential baseline ────────────────────────────────────────────────────
+//
+// Exact variable names a child process generally needs to *launch* and behave
+// correctly across Windows + POSIX. Kept deliberately pragmatic: anything not
+// here (and not explicitly allowlisted) is dropped. The test only pins that
+// PATH + HOME survive, so this set can evolve without breaking the contract.
+
+const BASELINE = Object.freeze([
+  // PATH resolution (Windows uses `Path`; PATHEXT picks executable suffixes).
+  'PATH',
+  'Path',
+  'PATHEXT',
+  // Home / profile (POSIX HOME; Windows USERPROFILE + HOMEDRIVE/HOMEPATH).
+  'HOME',
+  'USERPROFILE',
+  'HOMEDRIVE',
+  'HOMEPATH',
+  // System roots (Windows).
+  'SystemRoot',
+  'windir',
+  'SystemDrive',
+  // Temp dirs (cross-platform variants).
+  'TEMP',
+  'TMP',
+  'TMPDIR',
+  // Locale / shell.
+  'LANG',
+  'SHELL',
+  // Windows command interpreter + platform descriptors.
+  'COMSPEC',
+  'OS',
+  'NUMBER_OF_PROCESSORS',
+  'PROCESSOR_ARCHITECTURE',
+]);
+
+// Documented baseline PREFIXES — any var whose name starts with one of these is
+// treated as baseline (locale family + Node runtime knobs like NODE_OPTIONS).
+const BASELINE_PREFIXES = Object.freeze(['LC_', 'NODE_']);
+
+// ── Secret matchers (extra guard on the baseline) ─────────────────────────────
+//
+// SECRET_NAME — exact GDD-held secret variable names that must never leak.
+// SECRET_PREFIX — any GDD_* var is GDD-internal and never forwarded.
+// SECRET_SHAPE — generic secret-shaped suffixes; catches third-party keys a
+//   future baseline addition might otherwise let through.
+//
+// All three are overridden ONLY by an explicit entry in opts.allowlist
+// (explicit allowlist WINS — see sanitizeEnv below).
+
+const SECRET_NAME = Object.freeze([
+  'ANTHROPIC_API_KEY',
+  'GH_TOKEN',
+  'GITHUB_TOKEN',
+]);
+
+const SECRET_PREFIX = Object.freeze(['GDD_']);
+
+const SECRET_SHAPE = /(_KEY|_TOKEN|_SECRET|_PASSWORD|_AUTH)$/i;
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+function isBaseline(key) {
+  if (BASELINE.includes(key)) return true;
+  for (const pfx of BASELINE_PREFIXES) {
+    if (key.startsWith(pfx)) return true;
+  }
+  return false;
+}
+
+function isSecret(key) {
+  if (SECRET_NAME.includes(key)) return true;
+  for (const pfx of SECRET_PREFIX) {
+    if (key.startsWith(pfx)) return true;
+  }
+  return SECRET_SHAPE.test(key);
+}
+
+/**
+ * Defensively read `<cwd>/.design/config.json` and extract
+ * `peer_cli.env_allowlist` (a string[]). Returns [] on ANY failure path
+ * (file missing, unparsable, wrong shape) — never throws. Mirrors
+ * registry.cjs's `readEnabledPeers` idiom so both share a defensive reader.
+ *
+ * @param {string} [cwd] defaults to process.cwd()
+ * @returns {string[]} allowlisted env var names (deduped); empty by default
+ */
+function readPeerCliAllowlist(cwd) {
+  const root = typeof cwd === 'string' && cwd.length > 0 ? cwd : process.cwd();
+  const cfgPath = path.join(root, '.design', 'config.json');
+  let raw;
+  try {
+    raw = fs.readFileSync(cfgPath, 'utf8');
+  } catch {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const peerCli = parsed && typeof parsed === 'object' ? parsed.peer_cli : null;
+  const list = peerCli && Array.isArray(peerCli.env_allowlist) ? peerCli.env_allowlist : [];
+  const out = [];
+  const seen = new Set();
+  for (const item of list) {
+    if (typeof item !== 'string' || item.length === 0) continue;
+    if (seen.has(item)) continue;
+    seen.add(item);
+    out.push(item);
+  }
+  return out;
+}
+
+// ── sanitizeEnv ─────────────────────────────────────────────────────────────--
+
+/**
+ * Build a sanitized child environment (allowlist-forward / default-deny).
+ *
+ * For each KEY in sourceEnv, forward it iff:
+ *   - KEY is explicitly in opts.allowlist (explicit allowlist WINS — even over
+ *     the secret filters), OR
+ *   - KEY is in the OS-essential BASELINE (exact name or a documented prefix)
+ *     AND KEY is NOT a GDD secret / secret-shaped var.
+ *
+ * Everything else is dropped. Pure: never mutates the input.
+ *
+ * @param {Record<string,string>} [sourceEnv=process.env]
+ * @param {{ allowlist?: string[] }} [opts]
+ * @returns {Record<string,string>}
+ */
+function sanitizeEnv(sourceEnv, opts) {
+  const src = sourceEnv && typeof sourceEnv === 'object' ? sourceEnv : process.env;
+  const o = opts && typeof opts === 'object' ? opts : {};
+  const allowlist = Array.isArray(o.allowlist) ? new Set(o.allowlist) : new Set();
+
+  const result = {};
+  for (const key of Object.keys(src)) {
+    const value = src[key];
+    // A value that is not a string (e.g. inherited prototype noise) is skipped;
+    // child env entries must be strings.
+    if (typeof value !== 'string') continue;
+
+    // Explicit allowlist wins over everything, including the secret filters.
+    if (allowlist.has(key)) {
+      result[key] = value;
+      continue;
+    }
+    // Otherwise the key must be baseline AND not secret-shaped.
+    if (isBaseline(key) && !isSecret(key)) {
+      result[key] = value;
+    }
+    // Default-deny: anything else is dropped.
+  }
+  return result;
+}
+
+module.exports = {
+  sanitizeEnv,
+  readPeerCliAllowlist,
+  BASELINE,
+  BASELINE_PREFIXES,
+  SECRET_NAME,
+  SECRET_PREFIX,
+  SECRET_SHAPE,
+};

package/scripts/lib/redact.cjs

@@ -45,11 +45,30 @@ const PATTERNS = [
     type: 'slack',
     re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
   },
-  // GitHub personal access token.
+  // GitHub personal access token (classic).
   {
     type: 'github_pat',
     re: /\bghp_[A-Za-z0-9]{36,}\b/g,
   },
+  // Google / Gemini / GCP API key (AIza…). Distinct shape — no collision
+  // with any existing pattern; placed with the specific patterns (D-07, 33.5-05).
+  {
+    type: 'gemini',
+    re: /\bAIza[0-9A-Za-z_\-]{35}\b/g,
+  },
+  // GitHub fine-grained PAT (github_pat_…). Distinct prefix from classic
+  // `ghp_` — both coexist (D-07, 33.5-05).
+  {
+    type: 'github_pat_fine_grained',
+    re: /\bgithub_pat_[0-9A-Za-z_]{22,}\b/g,
+  },
+  // GitHub server/oauth/user/refresh tokens (ghs_/gho_/ghu_/ghr_). The
+  // `[sour]` class excludes `p`, so this never collides with `ghp_` above
+  // (D-07, 33.5-05).
+  {
+    type: 'github_token',
+    re: /\bgh[sour]_[A-Za-z0-9]{36,}\b/g,
+  },
   // AWS access key ID.
   {
     type: 'aws',

package/scripts/lib/transports/ws.cjs

@@ -24,7 +24,9 @@
 'use strict';
 
 const http = require('node:http');
+const crypto = require('node:crypto');
 const { readFileSync, existsSync } = require('node:fs');
+const path = require('node:path');
 const { probeOptional } = require('../probe-optional.cjs');
 
 const ws = probeOptional('ws');
@@ -56,16 +58,62 @@ function* readEventsSync(path) {
   }
 }
 
+/**
+ * Defensively read `.design/config.json`. Returns the parsed object or `{}`
+ * on ANY failure (missing file, bad JSON, read error) — NEVER throws. The
+ * transport must still start when no config is present, so this mirrors the
+ * house defensive-fs idiom.
+ *
+ * @returns {Record<string, any>}
+ */
+function readDesignConfig() {
+  try {
+    const cfgPath = path.join(process.cwd(), '.design', 'config.json');
+    if (!existsSync(cfgPath)) return {};
+    const parsed = JSON.parse(readFileSync(cfgPath, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Resolve the bind host once, before listen (D-04). Order:
+ *   opts.host → env GDD_WS_BIND_HOST → .design/config.json#event_stream.bind_host → '127.0.0.1'
+ * The DEFAULT (no opt, no env, no config) is loopback only — remote bind is
+ * an explicit operator opt-in.
+ *
+ * @param {{ host?: unknown }} opts
+ * @returns {string}
+ */
+function resolveBindHost(opts) {
+  if (typeof opts.host === 'string' && opts.host.trim()) {
+    return opts.host.trim();
+  }
+  const envHost = process.env['GDD_WS_BIND_HOST'];
+  if (typeof envHost === 'string' && envHost.trim()) {
+    return envHost.trim();
+  }
+  const cfg = readDesignConfig();
+  const cfgHost =
+    cfg && cfg.event_stream && typeof cfg.event_stream.bind_host === 'string'
+      ? cfg.event_stream.bind_host.trim()
+      : '';
+  if (cfgHost) return cfgHost;
+  return '127.0.0.1';
+}
+
 /**
  * Start the WebSocket server. Returns a handle with `close()`.
  *
  * @param {{
  *   port: number,
  *   token: string,
+ *   host?: string,
  *   tailFrom?: string,
  *   subscribe?: (handler: (ev: unknown) => void) => () => void,
  * }} opts
- * @returns {Promise<{close: () => void, port: number}>}
+ * @returns {Promise<{close: () => void, port: number, host: string}>}
  */
 async function startServer(opts) {
   if (typeof opts.port !== 'number' || !Number.isFinite(opts.port)) {
@@ -75,6 +123,9 @@ async function startServer(opts) {
     throw new TypeError('startServer: token (string, ≥8 chars) required');
   }
 
+  // Resolve the bind host once (D-04): default 127.0.0.1 (loopback only).
+  const host = resolveBindHost(opts);
+
   const httpServer = http.createServer((_req, res) => {
     res.statusCode = 426; // Upgrade Required
     res.setHeader('Content-Type', 'text/plain');
@@ -109,7 +160,16 @@ async function startServer(opts) {
 
   httpServer.on('upgrade', (req, socket, head) => {
     const auth = req.headers['authorization'];
-    if (!auth || auth !== `Bearer ${opts.token}`) {
+    const expected = `Bearer ${opts.token}`;
+    // Constant-time compare (D-04, D-12 node:crypto built-in). The length
+    // pre-check is REQUIRED — timingSafeEqual throws on a length mismatch —
+    // and is acceptable here because the secret is the TOKEN bytes, not its
+    // length. A missing/short/mismatched token still yields the 401 close.
+    const ok =
+      typeof auth === 'string' &&
+      Buffer.byteLength(auth) === Buffer.byteLength(expected) &&
+      crypto.timingSafeEqual(Buffer.from(auth), Buffer.from(expected));
+    if (!ok) {
       socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
       socket.destroy();
       return;
@@ -142,12 +202,16 @@ async function startServer(opts) {
 
   await new Promise((resolve, reject) => {
     httpServer.once('error', reject);
-    httpServer.listen(opts.port, () => resolve(undefined));
+    httpServer.listen(opts.port, host, () => resolve(undefined));
   });
 
   const addr = httpServer.address();
   return {
     port: typeof addr === 'object' && addr ? addr.port : opts.port,
+    host:
+      typeof addr === 'object' && addr && typeof addr.address === 'string'
+        ? addr.address
+        : host,
     close() {
       try {
         unsub();

package/sdk/mcp/gdd-state/schemas/add_blocker.schema.json

@@ -15,10 +15,12 @@
         "text": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 8192,
           "description": "Human-readable blocker description."
         },
         "stage": {
           "type": "string",
+          "maxLength": 64,
           "description": "Optional. Defaults to <position>.stage."
         },
         "date": {

package/sdk/mcp/gdd-state/schemas/add_decision.schema.json

@@ -15,6 +15,7 @@
         "text": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 8192,
           "description": "Human-readable decision text."
         },
         "status": {

package/sdk/mcp/gdd-state/schemas/add_must_have.schema.json

@@ -15,6 +15,7 @@
         "text": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 8192,
           "description": "Human-readable must-have criterion."
         },
         "status": {

package/sdk/mcp/gdd-state/schemas/checkpoint.schema.json

@@ -14,6 +14,7 @@
         "label": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Optional label for the timestamp entry key. When absent the key is `<stage>_checkpoint_at`."
         }
       }

package/sdk/mcp/gdd-state/schemas/frontmatter_update.schema.json

@@ -17,7 +17,7 @@
           "minProperties": 1,
           "additionalProperties": {
             "oneOf": [
-              { "type": "string" },
+              { "type": "string", "maxLength": 8192 },
               { "type": "number" },
               { "type": "boolean" }
             ]

package/sdk/mcp/gdd-state/schemas/get.schema.json

@@ -13,7 +13,8 @@
       "properties": {
         "fields": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "maxItems": 64,
+          "items": { "type": "string", "minLength": 1, "maxLength": 256 },
           "description": "Optional projection. When present, limit data.state to these top-level keys. Unknown keys are ignored (no error)."
         }
       }

package/sdk/mcp/gdd-state/schemas/probe_connections.schema.json

@@ -15,6 +15,7 @@
         "probe_results": {
           "type": "array",
           "minItems": 1,
+          "maxItems": 256,
           "items": {
             "type": "object",
             "additionalProperties": false,
@@ -23,6 +24,7 @@
               "name": {
                 "type": "string",
                 "minLength": 1,
+                "maxLength": 256,
                 "description": "Connection name (e.g. \"figma\", \"refero\")."
               },
               "status": {

package/sdk/mcp/gdd-state/schemas/resolve_blocker.schema.json

@@ -23,6 +23,7 @@
         "text": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 8192,
           "description": "Exact text match against blocker.text. First matching row is removed. Mutually exclusive with index."
         }
       }