@impeccable/reviews 0.1.5 → 0.1.7

package/dist/scan.js

@@ -36,6 +36,95 @@ function valueAt(text, from) {
 }
 /** A name that says its value is a secret, anywhere in it; `author` is not `auth`. */
 const SECRET_NAME = /secret|token|passw(?:or)?d|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?key|authoriz|auth(?!or)|credential/i;
+/**
+ * How far the last text read for curlCommand was read, and what it said there: whether the command going on is curl's, the quote open, and
+ * where the last argument curlArgument read ends, since a `-u` inside an argument is not an option.
+ */
+let command;
+/**
+ * The command going on at `at`, as the shell reads it: whether it is curl's, and the quote open there. A `;`, `&`, `|` or a line's end starts
+ * another command (`curl … && docker run -u node:node`), except inside quotes or after a backslash, which continues the line. curl counts inside
+ * quotes too, as in `sh -c "curl …"` or a command the debug log or the transcript writes as a JSON string. The text is read once from its start
+ * however far apart curl and its arguments are: each call goes on from where the last one on the same text stopped.
+ */
+function curlCommand(text, at) {
+    let state = command;
+    // Within one search the matches only move on, so one at or before the last starts a new search, which reads the text afresh.
+    if (!state || state.text !== text || at <= state.at)
+        state = command = { text, at: 0, curl: false, quote: '', argumentEnd: 0 };
+    let { at: i, curl, quote } = state;
+    for (; i < at; i++) {
+        const c = text[i];
+        // A backslash escapes a quote, a separator, a line's end or another backslash; before a letter it changes nothing, so `\curl` is still curl.
+        if (c === '\\' && quote !== "'" && /["';&|\n\\]/.test(text[i + 1] ?? ''))
+            i++;
+        else if (quote)
+            quote = c === quote ? '' : quote;
+        else if (c === '"' || c === "'")
+            quote = c;
+        else if (';&|\n'.includes(c))
+            curl = false;
+        if (c === 'c' && text.startsWith('curl', i) && !/[\w.-]/.test(text[i - 1] ?? ' ') && !/[\w.-]/.test(text[i + 4] ?? ' '))
+            curl = true;
+    }
+    Object.assign(state, { at: i, curl, quote });
+    return state;
+}
+/**
+ * The word that starts at `from`, as the shell reads it, inside the quote `outer` open there: where it ends, and the password after its first
+ * colon (what it stands for, and where it starts and ends in the text), or no password when it has no colon. Quotes and backslashes are read as
+ * the shell reads them; inside an outer double quote (`sh -c "…"`, a JSON string) `\"` quotes for the command within. A word is read once.
+ */
+function curlArgument(text, from, outer) {
+    let quote = '';
+    let colon = false;
+    let value = '';
+    let start = -1;
+    let to = from;
+    let i = from;
+    while (i < text.length) {
+        const c = text[i];
+        // The character the text stands for here, none for a quote's mark, and how many characters of the text it takes.
+        let stands = c;
+        let width = 1;
+        if (quote) {
+            if (quote === '\\"' ? text.startsWith('\\"', i) : c === quote)
+                [stands, width, quote] = ['', quote.length, ''];
+            else if (c === outer)
+                break;
+            // Inside an outer double quote its backslashes come first, in a single-quoted word too: `'a:b\"c'` in a JSON string is `a:b"c`.
+            else if (c === '\\' && (quote !== "'" || outer === '"'))
+                [stands, width] = [text[i + 1] ?? '', 2];
+        }
+        else if (outer === '"' && text.startsWith('\\"', i)) {
+            [stands, width, quote] = ['', 2, '\\"'];
+        }
+        else if (c === '\\' && outer !== "'") {
+            [stands, width] = [text[i + 1] === '\n' ? '' : (text[i + 1] ?? ''), 2];
+        }
+        else if (c === outer || /\s/.test(c) || ';&|'.includes(c)) {
+            break;
+        }
+        else if (c === '"' || c === "'") {
+            [stands, quote] = ['', c];
+        }
+        if (stands && colon) {
+            if (start < 0)
+                start = i;
+            value += stands;
+            to = i + width;
+        }
+        else if (stands === ':') {
+            colon = true;
+        }
+        i += width;
+    }
+    return { end: i, ...(value ? { password: { value, from: start, to } } : {}) };
+}
+/** The password of each `-u` match curl-password took, for its `secret`. */
+const curlPasswords = new WeakMap();
+/** A password that only names one: a variable (`$DB_PASSWORD`, `${DB_PASSWORD}`) or a placeholder (`<password>`, `{password}`). */
+const PLACEHOLDER = /^(?:\$[A-Z_][A-Z0-9_]*|\$\{[^}]*\}|<[^>]*>|\{\{?[^}]*\}?\})$/;
 /** A package.json or a workflow, by its path, or as git names it in a commit (`HEAD:package.json`). */
 const PACKAGE_OR_WORKFLOW = /(?:^|[/:])package\.json$|(?:^|[/:])\.github\/workflows\/[^/]+\.ya?ml$/;
 const NETWORK = String.raw `\b(?:curl|wget|nc|ncat|netcat)\b`;
@@ -54,6 +143,51 @@ const PATTERNS = [
         shape: /(?<![A-Za-z0-9_-])(?:(?!\beyJ)[A-Za-z0-9_-])*(\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})/,
         secret: (m) => [m.index + m[0].length - m[1].length, m.index + m[0].length],
     },
+    { name: 'google-api-key', context: 'output', severity: 'high', description: 'a Google API key', shape: /(?<![A-Za-z0-9_-])AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])/ },
+    { name: 'sendgrid-key', context: 'output', severity: 'high', description: 'a SendGrid key', shape: /(?<![A-Za-z0-9_-])SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])/ },
+    { name: 'slack-webhook', context: 'output', severity: 'high', description: "a Slack webhook's address", shape: /\bhooks\.slack\.com\/(?:services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{16,}|(?:workflows|triggers)\/[A-Za-z0-9_/-]{16,})/ },
+    {
+        name: 'url-password', context: 'output', severity: 'high', description: 'a password in an address',
+        // The fence's shape for a URL's password (shellEnvironment), through its last `@` and never across a quote, so in JSON a port and the text after it up
+        // to an email address are not one.
+        shape: /:\/\/[^/@\s:"'`]*:([^/@\s"'`]+(?:@[^/@\s"'`]+)*)@/,
+        check: (m) => !PLACEHOLDER.test(m[1]),
+        secret: (m) => [m.index + m[0].length - m[1].length - 1, m.index + m[0].length - 1],
+    },
+    {
+        name: 'curl-password', context: 'output', severity: 'high', description: 'a password on a curl command line',
+        // Each `-u` or `--user` of curl's own command (curlCommand), with the whole word after it (curlArgument): `-uadmin:pw`, `--user=admin:pw`.
+        shape: /\s(?:-u|--user(?=[\s=]))/,
+        check: (m) => {
+            const [text, at] = [m.input, m.index];
+            const state = curlCommand(text, at);
+            if (!state.curl || at < state.argumentEnd)
+                return false;
+            let from = at + m[0].length;
+            if (text[from] === '=')
+                from++;
+            // Blanks and line continuations come before the word: `curl -u \` with `  admin:pw` on the next line, `\\\n` in a JSON string.
+            else {
+                for (;;) {
+                    if (text[from] === ' ' || text[from] === '\t')
+                        from++;
+                    else if (text.startsWith('\\\n', from))
+                        from += 2;
+                    else if (state.quote === '"' && text.startsWith('\\\\\\n', from))
+                        from += 4;
+                    else
+                        break;
+                }
+            }
+            const word = curlArgument(text, from, state.quote);
+            state.argumentEnd = word.end;
+            if (!word.password || PLACEHOLDER.test(word.password.value))
+                return false;
+            curlPasswords.set(m, [word.password.from, word.password.to]);
+            return true;
+        },
+        secret: (m) => curlPasswords.get(m),
+    },
     { name: 'impeccable-token', context: 'output', severity: 'high', description: "one of Impeccable's tokens", shape: /\b(?:pst|phr)_[A-Za-z0-9._~+/=-]{16,}/ },
     { name: 'secret-reference', context: 'output', severity: 'high', description: 'a reference to a password the person typed', shape: /\bsecret:[0-9a-f]{12}\b/, kept: true },
     {

package/dist/sync.js

@@ -1,4 +1,6 @@
 import { hostQuestion, TOOL_SHOWN } from './host-questions.js';
+import { redactShapes, scan } from './scan.js';
+import { plainText } from './ui/sensitive.js';
 export const TASK_STATUSES = ['pending', 'in_progress', 'completed', 'skipped', 'failed'];
 /** A PUT worth sending again: the network failed or the server did. A 4xx will not change by trying again. */
 const retryable = (res) => Boolean(res && !res.ok && (res.status === 0 || res.status >= 500));
@@ -58,15 +60,49 @@ export function createSessionSync(send, intervalMs = 1000) {
         },
     };
 }
-/** The text an assistant message starts with: the `[STATUS]` line the playbook asks for, when there is one. */
-export function statusLine(message) {
+/** The most a status line holds; longer text belongs in the report. */
+export const STATUS_MAX = 70;
+const STATUS_RULE = `Status lines are in the product voice: a present-tense verb phrase of at most ${STATUS_MAX} characters that says what is happening, such as "Running the build" or "Opening the setup pull request". No "I'm", "I am", "Let me", "I'll" or "trying to"; detail goes in the report. Nothing was saved: call impeccable_progress again with the status rephrased.`;
+/** Why a status line breaks the voice, with the rule to rephrase it by; null when it keeps it. The line is never rewritten here. */
+export function statusVoiceError(line) {
+    const text = line.trim();
+    const why = /^(i['’]m|i am|let me|i['’]ll)\b/i.test(text) || /\btrying to\b/i.test(text) ? 'it narrates like an assistant'
+        : text.length > STATUS_MAX ? `it is ${text.length} characters long`
+            : plainText(text) !== text ? 'it holds a control character or an escape sequence' : null;
+    return why ? `Refused: "${text}" does not fit the status line, because ${why}. ${STATUS_RULE}` : null;
+}
+/**
+ * The text an assistant message starts with: the `[STATUS]` line the playbook asks for, when there is one that impeccable_progress
+ * would take, so the web page and the screen never show what the tool refuses: a line out of the voice or over its length, or one
+ * holding text shaped like a secret (which the fence refuses the tool). `scans` takes that refusal as the fence's own: the check and where, never the text.
+ */
+export function statusLine(message, scans) {
     if (message.role !== 'assistant' || !Array.isArray(message.content))
         return null;
     const first = message.content.find((c) => c.type === 'text');
     const text = first?.text?.trimStart() ?? '';
     if (!text.startsWith('[STATUS]'))
         return null;
-    return text.slice('[STATUS]'.length).split('\n')[0].trim() || null;
+    const line = text.slice('[STATUS]'.length).split('\n')[0].trim();
+    if (!line)
+        return null;
+    // Read before the voice, as the fence reads impeccable_progress before the tool does, so a refusal is recorded whatever else is wrong with the line.
+    const hit = scan('output', `status: ${line}`)[0];
+    if (hit)
+        scans?.record({ pattern: hit.name, severity: hit.severity, sink: '[STATUS] line', tool: 'message', action: 'block' });
+    return hit || statusVoiceError(line) ? null : line;
+}
+/** The longest status the Worker takes: a longer one makes it refuse the whole update, and the web page stops following the run. */
+const PAGE_STATUS_MAX = 500;
+/** A status the command words itself around the gateway's or the model's words, such as why the run stopped: nothing in it shaped like a secret or a terminal acts on, and no longer than the Worker takes. */
+export function pageStatus(text) {
+    // Controls come out first: one inside a token would hide it from the scan, and their removal would join it again.
+    const plain = redactShapes(plainText(text));
+    return plain.length > PAGE_STATUS_MAX ? `${plain.slice(0, PAGE_STATUS_MAX - 1)}…` : plain;
+}
+/** The report as the terminal prints it when the web page missed it: plain text, then redacted, for the reason pageStatus gives. */
+export function plainReport(markdown) {
+    return redactShapes(plainText(markdown.trim()));
 }
 /** A model error in plain words: the `error.message` of an API error body when there is one. */
 export function plainError(text) {
@@ -83,10 +119,11 @@ export function plainError(text) {
 }
 /**
  * Session sync: session start posts "running" with no tasks, each `[STATUS]`
- * line becomes the status, a question from impeccable_ask shows the run as
- * waiting until it is answered, and a quit hands over to the command's finish.
+ * line becomes the status (one refused for a secret's shape goes to `scans`),
+ * a question from impeccable_ask shows the run as waiting until it is
+ * answered, and a quit hands over to the command's finish.
  */
-export function syncExtension(sync, hooks) {
+export function syncExtension(sync, hooks, scans) {
     return (pi) => {
         let last;
         /** Questions asked and not yet answered, by tool call, in the order asked: the terminal shows the first, so the web page does too, and never an answer. */
@@ -124,7 +161,7 @@ export function syncExtension(sync, hooks) {
             if (message.role !== 'assistant')
                 return;
             last = message;
-            const status = statusLine(message);
+            const status = statusLine(message, scans);
             if (status)
                 sync.update({ status });
         });