@i4ctime/q-ring 0.13.1 → 0.14.0

package/dist/mcp.js

@@ -39,7 +39,7 @@ import {
   tunnelList,
   tunnelRead,
   verifyAuditChain
-} from "./chunk-Q3UCKJAJ.js";
+} from "./chunk-NNIEXAW5.js";
 
 // src/mcp.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -710,6 +710,15 @@ function registerSecretTools(server2) {
         params.sourceProjectPath
       );
       if (toolBlock) return toolBlock;
+      for (const key of [params.sourceKey, params.targetKey]) {
+        const decision = checkKeyReadPolicy(key, void 0, params.sourceProjectPath);
+        if (!decision.allowed) {
+          return text(
+            `Policy Denied: ${decision.reason} (source: ${decision.policySource})`,
+            true
+          );
+        }
+      }
       entangleSecrets(
         params.sourceKey,
         {
@@ -2038,12 +2047,39 @@ function runHealthScan(config = {}) {
 
 // src/core/exec.ts
 import { spawn } from "child_process";
+import { StringDecoder } from "string_decoder";
 import { Transform } from "stream";
 var BUILTIN_PROFILES = {
   unrestricted: { name: "unrestricted" },
   restricted: {
     name: "restricted",
-    denyCommands: ["curl", "wget", "ssh", "scp", "nc", "netcat", "ncat"],
+    denyCommands: [
+      // Network tools.
+      "curl",
+      "wget",
+      "ssh",
+      "scp",
+      "nc",
+      "netcat",
+      "ncat",
+      // Interpreters and shells: given the secret env vars, `python -c`,
+      // `node -e`, `bash -c`, etc. can perform arbitrary network I/O and
+      // exfiltrate them, defeating allowNetwork. Denied by default in
+      // `restricted`; to run them with secrets use a custom profile in
+      // .q-ring.json, or the `ci` / `unrestricted` profile.
+      "python",
+      "python2",
+      "python3",
+      "node",
+      "deno",
+      "bun",
+      "perl",
+      "ruby",
+      "php",
+      "sh",
+      "bash",
+      "zsh"
+    ],
     maxRuntimeSeconds: 30,
     allowNetwork: false,
     stripEnvVars: ["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY"]
@@ -2063,6 +2099,11 @@ var RedactionTransform = class extends Transform {
   patterns = [];
   tail = "";
   maxLen = 0;
+  // Decodes UTF-8 across chunk boundaries: a multi-byte character split between
+  // two Buffer chunks would otherwise be corrupted to U+FFFD by chunk.toString()
+  // BEFORE matching runs, letting a multi-byte secret slip through unredacted.
+  // StringDecoder buffers the incomplete trailing bytes until the rest arrives.
+  decoder = new StringDecoder("utf8");
   constructor(secretsToRedact) {
     super();
     const validSecrets = secretsToRedact.filter((s) => s.length > 5);
@@ -2080,7 +2121,8 @@ var RedactionTransform = class extends Transform {
       this.push(chunk);
       return callback();
     }
-    const text2 = this.tail + chunk.toString();
+    const decoded = typeof chunk === "string" ? chunk : this.decoder.write(chunk);
+    const text2 = this.tail + decoded;
     let redacted = text2;
     for (const { value, replacement } of this.patterns) {
       redacted = redacted.split(value).join(replacement);
@@ -2096,8 +2138,8 @@ var RedactionTransform = class extends Transform {
     callback();
   }
   _flush(callback) {
-    if (this.tail) {
-      let final = this.tail;
+    let final = this.tail + this.decoder.end();
+    if (final) {
       for (const { value, replacement } of this.patterns) {
         final = final.split(value).join(replacement);
       }
@@ -2491,7 +2533,7 @@ function registerToolingTools(server2) {
         "Inject only secrets carrying at least one of these tags. Combinable with `keys` as an AND filter."
       ),
       profile: z9.enum(["unrestricted", "restricted", "ci"]).optional().default("restricted").describe(
-        "Exec sandbox profile. 'restricted' (default) denies a fixed list of network-tool binaries (curl, wget, ssh, scp, nc, netcat, ncat), strips proxy env vars, and caps runtime at 30s \u2014 it is NOT a real sandbox: it does not restrict PATH, and interpreters invoked directly (python, node, perl, etc.) can still make network requests and read the injected secret env vars. 'ci' allows network with a 300s cap and blocks a few destructive commands; 'unrestricted' inherits the full server environment. For untrusted commands use OS-level isolation (containers, network namespaces), not this profile."
+        "Exec sandbox profile. 'restricted' (default) denies network-tool binaries (curl, wget, ssh, scp, nc, netcat, ncat) AND common interpreters/shells (python, node, deno, bun, perl, ruby, php, sh, bash, zsh) \u2014 since those could otherwise egress the injected secrets \u2014 strips proxy env vars, and caps runtime at 30s. It still is NOT a real OS sandbox (it does not restrict PATH, and some allowed binary could in principle make network calls); for genuinely untrusted commands use OS-level isolation (containers, network namespaces). 'ci' allows network and interpreters with a 300s cap and blocks a few destructive commands; 'unrestricted' inherits the full server environment. Define a custom profile in .q-ring.json to allow specific interpreters with secrets."
       ),
       scope: scope6,
       projectPath: projectPath6,
@@ -2658,7 +2700,7 @@ ${result.stderr}`);
           `Dashboard already running at ${dashboardInstance.url}`
         );
       }
-      const { startDashboardServer } = await import("./dashboard-2UDYGGTT.js");
+      const { startDashboardServer } = await import("./dashboard-KAUEPLXO.js");
       dashboardInstance = startDashboardServer({ port: params.port });
       return text(
         `Dashboard started at ${dashboardInstance.url}