@ictechgy/context-guard 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes for the ContextGuard plugin are documented here.
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-08-24
+
+- Hardened three context-guard-kit security surfaces: `run_guarded_git()` now
+  resolves `git` through the fixed-path approved-runtime-executable resolver
+  instead of a PATH lookup, `FallbackLineSanitizer` gained PEM private-key
+  block and Cookie header redaction plus a corrected userinfo-credential
+  regex, and adjacent wrapper scripts are opened with `O_NOFOLLOW` before use
+  to reject a pre-planted symlink.
+- Corrected `sanitize_output.py`'s docstring to accurately describe that
+  `anonymize_paths_for_context()` is a deliberate no-op for `unknown_text`/
+  `source_code` contexts (behavior unchanged).
+
 ## [0.7.0] - 2026-08-22
 
 - Added a zero-provider-context advisory mode for WeightClass-style routing.

package/README.ko.md

@@ -230,7 +230,7 @@ plugin 배치에서는 기존 Bash trim 동작을 유지하고 setup이 referenc
 사용할 수 없다고 알립니다.
 
 ```bash
-npm install --save-exact @ictechgy/context-guard@0.7.0
+npm install --save-exact @ictechgy/context-guard@0.7.1
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --plan
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --yes
 ```

package/README.md

@@ -243,7 +243,7 @@ keeps the existing Bash trim behavior and setup reports the reference route as
 unavailable.
 
 ```bash
-npm install --save-exact @ictechgy/context-guard@0.7.0
+npm install --save-exact @ictechgy/context-guard@0.7.1
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --plan
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --yes
 ```

package/docs/distribution.md

@@ -31,14 +31,14 @@ Project scope is the default. `context-guard doctor` and `context-guard setup --
 
 `bash_reference_v1` is a narrower distribution than the ordinary CLI/plugin.
 It accepts only an exact project-local npm topology: root
-`@ictechgy/context-guard@0.7.0` declares
+`@ictechgy/context-guard@0.7.1` declares
 `@ictechgy/context-guard-receipt: 0.2.1`, and the installed Receipt inventory
 must match the SHA-256 trust anchor embedded in the root policy. Hoisted and
 nested npm dependency layouts are supported; global npm, `npx`, Homebrew,
 source-checkout, arbitrary `PATH`, and marketplace-plugin layouts are refused.
 
 ```bash
-npm install --save-exact @ictechgy/context-guard@0.7.0
+npm install --save-exact @ictechgy/context-guard@0.7.1
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --plan
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --yes
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ictechgy/context-guard",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "ContextGuard CLI helpers for keeping AI coding agent context focused and local-first.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ictechgy/context-guard#readme",

package/plugins/context-guard/.claude-plugin/plugin.json

@@ -37,5 +37,5 @@
     "gated-experiments",
     "future-roadmap"
   ],
-  "version": "0.7.0"
+  "version": "0.7.1"
 }

package/plugins/context-guard/README.ko.md

@@ -48,7 +48,7 @@ npx @ictechgy/context-guard --version
 
 짧은 `bash_reference_v1` Bash 출력 경로는 이 marketplace plugin/소스 배치에서
 의도적으로 활성화되지 않습니다. 정확한 프로젝트 로컬
-`@ictechgy/context-guard@0.7.0` npm 설치와
+`@ictechgy/context-guard@0.7.1` npm 설치와
 `@ictechgy/context-guard-receipt@0.2.1` 의존성이 필요하며, 그 뒤
 `setup --agent claude --scope project --bash-reference-v1`로 명시적으로
 활성화해야 합니다. Plugin setup은 동작하지 않는 reference flag를 설치하지 않고

package/plugins/context-guard/README.md

@@ -48,7 +48,7 @@ npx @ictechgy/context-guard --version
 
 The compact `bash_reference_v1` Bash-output route is intentionally not
 available from this marketplace-plugin/source layout. It requires an exact
-project-local npm installation of `@ictechgy/context-guard@0.7.0` and its
+project-local npm installation of `@ictechgy/context-guard@0.7.1` and its
 `@ictechgy/context-guard-receipt@0.2.1` dependency, then explicit
 `setup --agent claude --scope project --bash-reference-v1`. Plugin setup keeps
 legacy trimming and warns instead of installing a no-op reference flag. See the

package/plugins/context-guard/bin/context-guard-rewrite-bash

@@ -13,6 +13,7 @@ import json
 import os
 import re
 import shutil
+import stat
 import subprocess
 import sys
 
@@ -174,7 +175,35 @@ def _runtime_shell_argv() -> tuple[str, ...]:
     )
 
 
+class UnsafeAdjacentWrapperError(RuntimeError):
+    """Adjacent wrapper is not a regular file opened without symlink following."""
+
+
 def _isolated_wrapper_prefix(wrapper: str) -> list[str]:
+    # O_NOFOLLOW+fstat rejects a symlink planted before this call; it cannot
+    # close the gap between this check and the later, separate process that
+    # actually execs the returned path (the shell string this hook emits is
+    # run by the harness, not by a child of this process, so the validated
+    # fd cannot be carried across that boundary). A post-check swap of the
+    # wrapper still requires write/rename authority over the install
+    # directory itself - the same authority needed to replace the CLI - so
+    # this is accepted as a residual risk outside this hook's threat model.
+    if not hasattr(os, "O_NOFOLLOW"):
+        raise UnsafeAdjacentWrapperError("O_NOFOLLOW is required for adjacent wrappers")
+    flags = os.O_RDONLY | os.O_NOFOLLOW
+    if hasattr(os, "O_CLOEXEC"):
+        flags |= os.O_CLOEXEC
+    try:
+        fd = os.open(wrapper, flags)
+    except OSError as exc:
+        raise UnsafeAdjacentWrapperError(
+            f"wrapper could not be opened without following symlinks: {exc}"
+        ) from exc
+    try:
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            raise UnsafeAdjacentWrapperError("wrapper is not a regular file")
+    finally:
+        os.close(fd)
     return [_approved_python_runtime(), "-I", os.path.realpath(wrapper)]
 
 # kubectl/docker/podman/oc 글로벌 옵션 중 다음 토큰을 value로 소비하는 형태.
@@ -2395,6 +2424,51 @@ def _is_explicit_noop_command(argv: tuple[str, ...]) -> bool:
     )
 
 
+def _wclass_advisory_is_safe(argv: tuple[str, ...]) -> bool:
+    # 토큰 형태(known flag/value pairing)만 검증한다 — `--repo`/`--task-file`
+    # 필수 여부나 `--vendor`의 허용값 같은 CLI 자체의 필수 옵션·enum 검증은
+    # 의도적으로 위임한다(다운스트림 argparse가 이미 거부함). 이 predicate가
+    # 막는 건 "인식 못 하는 트레일링 토큰이 조용히 통과하는 것"이지 CLI
+    # 문법 전체가 아니다.
+    if len(argv) < 2:
+        return False
+    if argv[1] == "review":
+        return len(argv) == 2
+    if argv[1] != "run":
+        return False
+
+    value_flags = {"--repo", "--task-file", "--vendor", "--workflow"}
+    confirm_seen = False
+    index = 2
+    while index < len(argv):
+        token = argv[index]
+        if token == "--confirm-task-egress":
+            confirm_seen = True
+            index += 1
+            continue
+        if "=" in token:
+            flag, value = token.split("=", 1)
+            if flag not in value_flags or not value or value.startswith("-"):
+                return False
+            index += 1
+            continue
+        if token not in value_flags or index + 1 >= len(argv):
+            return False
+        value = argv[index + 1]
+        if not value or value.startswith("-"):
+            return False
+        index += 2
+    return confirm_seen
+
+
+# 심사된 정확 이름 확장 레지스트리 — 글롭/접두사 금지(R-12의 TERM*→TERMINFO
+# 실패 재현 방지). 각 값은 서브커맨드 토큰 하나만이 아니라 argv 전체 모양을
+# 검증하는 predicate여야 한다.
+CGW_EXACT_NAME_EXTENSIONS = {
+    "wclass-advisory": _wclass_advisory_is_safe,
+}
+
+
 def command_search_diff(
     argv: tuple[str, ...],
     *,
@@ -2530,6 +2604,8 @@ def command_search_diff(
             route = "trim"
         else:
             route = "noop"
+    elif first in CGW_EXACT_NAME_EXTENSIONS:
+        route = "noop" if CGW_EXACT_NAME_EXTENSIONS[first](argv) else "deny"
     elif first in {"pytest", "tox", "jest", "vitest"}:
         route = "trim"
     elif first in {"find", "tree", "fd"}:
@@ -2834,7 +2910,7 @@ def _clear_git_command_scope_config(environment: dict[str, str]) -> None:
             environment.pop(name, None)
 
 
-def _discover_git_filter_config_keys() -> tuple[str, ...]:
+def _discover_git_filter_config_keys(git_executable: str) -> tuple[str, ...]:
     discovery_env = os.environ.copy()
     _clear_git_command_scope_config(discovery_env)
     discovery_env.update(
@@ -2846,7 +2922,7 @@ def _discover_git_filter_config_keys() -> tuple[str, ...]:
     )
     result = subprocess.run(
         [
-            "git",
+            git_executable,
             "config",
             "--null",
             "--name-only",
@@ -2903,13 +2979,14 @@ def run_guarded_git(argv: tuple[str, ...]) -> int:
         print("ContextGuard denied an invalid guarded Git invocation.", file=sys.stderr)
         return 126
     try:
-        filter_keys = _discover_git_filter_config_keys()
+        git_executable = _approved_runtime_executable("git")
+        filter_keys = _discover_git_filter_config_keys(git_executable)
         environment = _guarded_git_environment(filter_keys)
-        os.execvpe(guarded_argv[0], list(guarded_argv), environment)
+        os.execve(git_executable, list(guarded_argv), environment)
     except (OSError, RuntimeError, subprocess.SubprocessError):
         print("ContextGuard could not neutralize Git execution configuration.", file=sys.stderr)
         return 126
-    raise AssertionError("os.execvpe returned unexpectedly")
+    raise AssertionError("os.execve returned unexpectedly")
 
 
 def neutralize_git_config_execution(command: str, parsed: MiniShellParse) -> str:

package/plugins/context-guard/bin/context-guard-sanitize-output

@@ -2,8 +2,13 @@
 """Sanitize grep/diff/log output before it enters Claude context.
 
 The helper can wrap a command while preserving its exit code, or sanitize stdin.
-It redacts common credential patterns, anonymizes absolute paths by default, and
-keeps only bounded head/anchor/tail context when output is too large.
+It redacts common credential patterns unconditionally and keeps only bounded
+head/anchor/tail context when output is too large. Absolute-path anonymization
+is scoped, not default: `anonymize_paths_for_context()` only rewrites paths it
+can structurally prove are private (e.g. `filesystem_listing` matches under a
+declared private root) - the `unknown_text`/`source_code` contexts used for
+ordinary command output leave paths untouched by design, to avoid redacting
+public/unrelated paths incorrectly.
 """
 from __future__ import annotations
 

package/plugins/context-guard/bin/context-guard-trim-output

@@ -109,13 +109,22 @@ FALLBACK_INLINE_PATTERNS: tuple[tuple[re.Pattern[str], str], ...] = (
     (re.compile(r"(?i)\bAIza[0-9A-Za-z_\-]{20,}\b"), "[REDACTED]"),
     (re.compile(r"\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b"), "[REDACTED]"),
     (re.compile(r"\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b"), "[REDACTED]"),
-    (re.compile(r"([a-z][a-z0-9+.-]*://)[^/\s:@]+:[^/\s@]+@", re.IGNORECASE), r"\1[REDACTED]@"),
+    (re.compile(r"([a-z][a-z0-9+.-]*://)[^/\s:@]+(?::[^/\s@]+)?@", re.IGNORECASE), r"\1[REDACTED]@"),
     (re.compile(rf"(?i)([?&#;](?:{SECRET_KEY})=)[^\s&#;]+"), r"\1[REDACTED]"),
     (re.compile(rf"(?i)(\b(?:{SECRET_KEY})\s*[:=]\s*)[^\s]+"), r"\1[REDACTED]"),
 )
 FALLBACK_AUTH_HEADER_RE = re.compile(
     r"(?i)^(?P<prefix>\s*(?:(?:[^:\n]+):\d+(?::\d+)?:)?\s*(?:[+-]\s*)?(?:Proxy-)?Authorization\s*:\s*).+$"
 )
+PRIVATE_KEY_BEGIN_RE = re.compile(
+    r"-----BEGIN (?:[A-Z0-9 ]*PRIVATE KEY|OPENSSH PRIVATE KEY|PGP PRIVATE KEY BLOCK)-----"
+)
+PRIVATE_KEY_END_RE = re.compile(
+    r"-----END (?:[A-Z0-9 ]*PRIVATE KEY|OPENSSH PRIVATE KEY|PGP PRIVATE KEY BLOCK)-----"
+)
+COOKIE_HEADER_RE = re.compile(
+    r"(?i)^(?P<prefix>\s*(?:(?:[^:\n]+):\d+(?::\d+)?:)?\s*(?:[+-]\s*)?(?:Set-)?Cookie\s*:\s*).+$"
+)
 ERROR_RE = re.compile(
     r"(FAIL|FAILED|ERROR|Error:|Exception|Traceback|AssertionError|panic:|fatal:|"
     r"segmentation fault|not ok|\bE\s+assert|\[ERROR\]|✗|✖)",
@@ -171,6 +180,7 @@ class FallbackLineSanitizer:
         self.diagnostic = diagnostic
         self.diagnostic_emitted = False
         self.redactions = 0
+        self.in_private_key_block = False
 
     def sanitize(self, raw_line: str) -> tuple[str, bool]:
         if self.diagnostic and not self.diagnostic_emitted:
@@ -178,12 +188,22 @@ class FallbackLineSanitizer:
             self.diagnostic_emitted = True
         line = strip_ansi(raw_line)
         original = line
-        auth_match = FALLBACK_AUTH_HEADER_RE.match(line)
-        if auth_match:
-            line = auth_match.group("prefix") + "[REDACTED]\n"
+        if self.in_private_key_block or PRIVATE_KEY_BEGIN_RE.search(line) or PRIVATE_KEY_END_RE.search(line):
+            line = "[REDACTED PRIVATE KEY BLOCK]\n"
+            if PRIVATE_KEY_END_RE.search(original):
+                self.in_private_key_block = False
+            elif PRIVATE_KEY_BEGIN_RE.search(original):
+                self.in_private_key_block = True
         else:
-            for pattern, repl in FALLBACK_INLINE_PATTERNS:
-                line = pattern.sub(repl, line)
+            auth_match = FALLBACK_AUTH_HEADER_RE.match(line)
+            cookie_match = COOKIE_HEADER_RE.match(line)
+            if auth_match:
+                line = auth_match.group("prefix") + "[REDACTED]\n"
+            elif cookie_match:
+                line = cookie_match.group("prefix") + "[REDACTED]\n"
+            else:
+                for pattern, repl in FALLBACK_INLINE_PATTERNS:
+                    line = pattern.sub(repl, line)
         redacted = line != original
         if redacted:
             self.redactions += 1