@intutic/shared-types 1.10.0 → 2.0.0

package/dist/scriptScan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scriptScan.js","sourceRoot":"","sources":["../src/scriptScan.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;;;AAoIH,oDAaC;AAyOD,8CAeC;AAvYD,iDAAgH;AAiEhH;;;;;;;;;;;;;;;GAeG;AACU,QAAA,mBAAmB,GAAG,CAAC,CAAA;AACvB,QAAA,mBAAmB,GAAG,EAAE,CAAA;AACrC,eAAe;AACF,QAAA,qBAAqB,GAAG,OAAO,CAAA;AAE5C,6EAA6E;AAC7E,MAAM,kBAAkB,GAA6C;IACnE,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,OAAO;IACb,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,OAAO;IACZ,EAAE,EAAE,QAAQ;IACZ,GAAG,EAAE,QAAQ;IACb,EAAE,EAAE,YAAY;IAChB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,YAAY;IAChB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,MAAM;IACV,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,MAAM;CACX,CAAA;AAED,yEAAyE;AACzE,MAAM,gBAAgB,GAAgE;IACpF,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACxC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;IACrC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACpC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACpC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACpC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;IACpC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC1C,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;IAChD,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;CACrC,CAAA;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAAC,IAAY,EAAE,SAAkB;IACnE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAA;IACxC,IAAI,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;IAElE,IAAI,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,CAAA;QACvC,KAAK,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,CAAC;YACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,QAAQ,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAiC;IAChE;QACE,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,gBAAgB;QAC1B,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,oCAAoC;QACpC,MAAM,EAAE,mEAAmE;QAC3E,WAAW,EACT,uFAAuF;YACvF,iFAAiF;QACnF,OAAO,EAAE;YACP,+CAA+C;YAC/C,gDAAgD;SACjD;QACD,UAAU,EAAE;YACV,4CAA4C;YAC5C,0CAA0C;YAC1C,mDAAmD;SACpD;KACF;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,gBAAgB;QAC1B,uEAAuE;QACvE,qDAAqD;QACrD,uEAAuE;QACvE,MAAM,EAAE,2DAA2D;QACnE,WAAW,EACT,0FAA0F;YAC1F,wDAAwD;QAC1D,OAAO,EAAE,CAAC,kCAAkC,EAAE,wCAAwC,CAAC;QACvF,UAAU,EAAE;YACV,qCAAqC;YACrC,0CAA0C;YAC1C,oCAAoC;SACrC;KACF;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,QAAQ,EAAE,mBAAmB;QAC7B,gEAAgE;QAChE,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,4CAA4C;QAC5C,MAAM,EACJ,yEAAyE;YACzE,sEAAsE;QACxE,WAAW,EAAE,sFAAsF;QACnG,OAAO,EAAE,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACrD,UAAU,EAAE,CAAC,eAAe,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,0BAA0B,CAAC;KAChH;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,mBAAmB;QAC7B,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM;QACJ,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,+BAA+B;QAC/B,oFAAoF;YACpF,gDAAgD;QAClD,WAAW,EACT,wFAAwF;YACxF,uCAAuC;QACzC,OAAO,EAAE;YACP,oEAAoE;YACpE,sEAAsE;SACvE;QACD,UAAU,EAAE;YACV,qCAAqC;YACrC,4CAA4C;YAC5C,qCAAqC;SACtC;KACF;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,QAAQ,EAAE,gBAAgB;QAC1B,6DAA6D;QAC7D,qEAAqE;QACrE,yEAAyE;QACzE,4CAA4C;QAC5C,MAAM,EAAE,kHAAkH;QAC1H,WAAW,EACT,4FAA4F;YAC5F,uEAAuE;QACzE,OAAO,EAAE;YACP,8EAA8E;YAC9E,mCAAmC;SACpC;QACD,UAAU,EAAE,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,wCAAwC,CAAC;KACtG;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,QAAQ,EAAE,gBAAgB;QAC1B,uEAAuE;QACvE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,EAAE,qHAAqH;QAC7H,WAAW,EACT,gGAAgG;YAChG,oBAAoB;QACtB,OAAO,EAAE;YACP,+CAA+C;YAC/C,2DAA2D;SAC5D;QACD,UAAU,EAAE;YACV,+BAA+B;YAC/B,yBAAyB;YACzB,mDAAmD;SACpD;QACD,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,QAAQ,EAAE,gBAAgB;QAC1B,2DAA2D;QAC3D,kEAAkE;QAClE,oBAAoB;QACpB,MAAM,EAAE,wFAAwF;QAChG,WAAW,EACT,8FAA8F;YAC9F,wFAAwF;QAC1F,OAAO,EAAE;YACP,4CAA4C;YAC5C,0CAA0C;SAC3C;QACD,UAAU,EAAE;YACV,kBAAkB;YAClB,gCAAgC;YAChC,mCAAmC;SACpC;QACD,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;CACF,CAAA;AAED,mFAAmF;AACnF,MAAM,QAAQ,GAA8D,4BAAoB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjH,OAAO;IACP,EAAE,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;CACpC,CAAC,CAAC,CAAA;AAEH;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,QAAsC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAClF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAEd,IAAI,EAAU,CAAA;QACd,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACnG,CAAC;QAED,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,gEAAgE;gBACvF,2FAA2F,CAC9F,CAAA;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;oBACtF,4DAA4D,CAC/D,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,mEAAmE;gBAC1F,yDAAyD,CAC5D,CAAA;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,mBAAmB;oBACnF,yEAAyE,CAC5E,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,yBAAyB,CAAC,4BAAoB,CAAC,CAAA;AAE/C;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,iBAAiB,CAAC,OAAe,EAAE,QAAwB;IACzE,MAAM,QAAQ,GAAwB,EAAE,CAAA;IACxC,KAAK,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAQ;QACxE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,IAAI,CAAC,EAAE,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,IAAA,yBAAU,EAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAClD,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;AACxF,CAAC"}

package/dist/secretPatterns.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Credential-VALUE patterns, declared once.
+ *
+ * Three consumers, three engines, one source:
+ *   - the hook gate's static floor (`protectedPaths.ts` → emitted JS gates and
+ *     bash gates via `grep -E`) — refuses a Write/Edit whose CONTENT carries a
+ *     credential-shaped string, before the file exists;
+ *   - the pre-commit scan (`tools/cli/src/lib/gitHooks.ts`, `grep -E` over the
+ *     staged diff) — the last line before a secret enters git history;
+ *   - tests in both packages.
+ *
+ * Hand-copying these between the gate and the git hook is how the two would
+ * drift into enforcing different notions of "credential" — the exact
+ * two-copies failure the WASM host-import list had. So the dialect here is
+ * the gate table's portable subset (see `assertPortableEre`): JS `RegExp` ∩
+ * POSIX ERE, with no `\b`, no lookaround, no `\d`/`\s` — and no interval
+ * quantifiers, which that checker forbids because `{n}` behaviour differs
+ * across greps. Repetition is therefore EXPANDED (`[A-Z2-7]` sixteen times),
+ * built by `.repeat()` below so the count is stated once, not typed sixteen
+ * times wrongly.
+ *
+ * Only HIGH-PRECISION shapes belong here: every pattern gates at `block`, and
+ * a false positive teaches the developer to disable the hook — the bypass the
+ * rest of the gate exists to stop. Prefixed formats (AKIA…, sk-ant-…, gh?_…,
+ * PEM armor) essentially never occur in benign prose in real format; the
+ * generic shapes (high-entropy hex, bare base64 runs) deliberately stay out,
+ * in the proxy's DLP where redaction — not refusal — is the response.
+ */
+export interface SecretValuePattern {
+    /** Stable id, `secrets.*` family. Appears in block messages and audit lines. */
+    id: string;
+    /** JS RegExp ∩ POSIX ERE source, portable-subset clean. */
+    source: string;
+    /** Shown to the developer the moment they are blocked. */
+    description: string;
+}
+export declare const SECRET_VALUE_PATTERNS: readonly SecretValuePattern[];
+/**
+ * The alternation of every pattern, for consumers that make one pass —
+ * the pre-commit hook's single `grep -E` over the staged diff.
+ */
+export declare function secretPatternAlternation(): string;
+//# sourceMappingURL=secretPatterns.d.ts.map

package/dist/secretPatterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAA;IACV,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAA;CACpB;AAKD,eAAO,MAAM,qBAAqB,EAAE,SAAS,kBAAkB,EA0D9D,CAAA;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD"}

package/dist/secretPatterns.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_VALUE_PATTERNS = void 0;
+exports.secretPatternAlternation = secretPatternAlternation;
+/** `cls` repeated `n` times — interval quantifiers are not in the portable subset. */
+const rep = (cls, n) => cls.repeat(n);
+exports.SECRET_VALUE_PATTERNS = [
+    {
+        id: 'secrets.aws_access_key',
+        // AKIA long-lived, ASIA temporary, ABIA/ACCA/A3T* other classes; base32
+        // alphabet [A-Z2-7] per gitleaks — 0,1,8,9 never appear. Same shape the
+        // Rust proxy's dlp.rs and the MCP proxy's scanner pin.
+        source: '(A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)' + rep('[A-Z2-7]', 16),
+        description: 'AWS access key ID',
+    },
+    {
+        id: 'secrets.anthropic_api_key',
+        // 20 required tail characters, then any more — the portable spelling of {20,}.
+        source: 'sk-ant-' + rep('[A-Za-z0-9_-]', 20) + '[A-Za-z0-9_-]*',
+        description: 'Anthropic API key',
+    },
+    {
+        id: 'secrets.github_token',
+        // All five classic prefixes: PAT (ghp), OAuth (gho), App-user (ghu),
+        // App-server (ghs), refresh (ghr).
+        source: 'gh[pousr]_' + rep('[A-Za-z0-9]', 36),
+        description: 'GitHub token',
+    },
+    {
+        id: 'secrets.private_key_pem',
+        source: '-----BEGIN [A-Z ]*PRIVATE KEY-----',
+        description: 'PEM private key material',
+    },
+    {
+        id: 'secrets.openrouter_api_key',
+        // sk-or-v1- + a long hex tail. The default workhorse alias
+        // (infra/kubernetes/base/litellm/config.yaml) routes through this key —
+        // the one credential a default, non-BYOK Intutic deployment actually
+        // depends on, and it was absent from this table.
+        source: 'sk-or-v1-' + rep('[A-Za-z0-9]', 20) + '[A-Za-z0-9]*',
+        description: 'OpenRouter API key',
+    },
+    {
+        id: 'secrets.intutic_virtual_key',
+        // `vk_${randomBytes(16).toString('hex')}_${workspaceId}` —
+        // apiKeyService.ts's createApiKey. Exactly 32 lowercase hex chars after
+        // the prefix; the trailing `_<workspaceId>` is left unanchored since its
+        // own prefix is a plain implementation detail, not part of the secret.
+        source: 'vk_' + rep('[a-f0-9]', 32),
+        description: 'Intutic virtual key',
+    },
+    {
+        id: 'secrets.intutic_gateway_token',
+        // `gwk_${randomBytes(32).toString('hex')}` — routes/gateways.ts. Exactly
+        // 64 lowercase hex chars; this is the cell/gateway registration
+        // credential, gatewayAuth.ts's sole accepted token shape.
+        source: 'gwk_' + rep('[a-f0-9]', 64),
+        description: 'Intutic gateway token',
+    },
+    {
+        id: 'secrets.stripe_secret_key',
+        source: 'sk_live_' + rep('[A-Za-z0-9]', 24),
+        description: 'Stripe live secret key',
+    },
+];
+/**
+ * The alternation of every pattern, for consumers that make one pass —
+ * the pre-commit hook's single `grep -E` over the staged diff.
+ */
+function secretPatternAlternation() {
+    return exports.SECRET_VALUE_PATTERNS.map((p) => `(${p.source})`).join('|');
+}
+//# sourceMappingURL=secretPatterns.js.map

package/dist/secretPatterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":";;;AAwGA,4DAEC;AArED,sFAAsF;AACtF,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAEhD,QAAA,qBAAqB,GAAkC;IAClE;QACE,EAAE,EAAE,wBAAwB;QAC5B,wEAAwE;QACxE,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,EAAE,mCAAmC,GAAG,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;QACjE,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,+EAA+E;QAC/E,MAAM,EAAE,SAAS,GAAG,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,GAAG,gBAAgB;QAC/D,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,qEAAqE;QACrE,mCAAmC;QACnC,MAAM,EAAE,YAAY,GAAG,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC;QAC7C,WAAW,EAAE,cAAc;KAC5B;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,MAAM,EAAE,oCAAoC;QAC5C,WAAW,EAAE,0BAA0B;KACxC;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,2DAA2D;QAC3D,wEAAwE;QACxE,qEAAqE;QACrE,iDAAiD;QACjD,MAAM,EAAE,WAAW,GAAG,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,cAAc;QAC7D,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,2DAA2D;QAC3D,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,EAAE,KAAK,GAAG,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;QACnC,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,yEAAyE;QACzE,gEAAgE;QAChE,0DAA0D;QAC1D,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;QACpC,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,MAAM,EAAE,UAAU,GAAG,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC;QAC3C,WAAW,EAAE,wBAAwB;KACtC;CACF,CAAA;AAED;;;GAGG;AACH,SAAgB,wBAAwB;IACtC,OAAO,6BAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACpE,CAAC"}

package/dist/skillScan.d.ts

@@ -0,0 +1,166 @@
+/**
+ * Skill-content scanning — pattern table and scan function for AGENT SKILL
+ * markdown (`SKILL.md`), not tool descriptions.
+ *
+ * # Where these patterns came from, and what changed in the port
+ *
+ * No component in this codebase read skill content before this file. The
+ * closest existing detector is `packages/proxy/src/tool_poison.rs`, which
+ * scans TOOL DESCRIPTIONS for the same threat genre — prose an agent treats
+ * as authoritative instruction, published by a party the user never
+ * reviewed. Its own module doc comment records the reason that detector
+ * exists rather than reusing `injection.rs`: `injection.rs`'s five
+ * conversational-jailbreak patterns ("ignore previous instructions", "you
+ * are now", "DAN mode") were tested against the same poisoning corpus this
+ * module's seed patterns were validated on and matched **zero** payloads.
+ * A poisoned instruction document does not read like a jailbreak; it reads
+ * like documentation. Skill markdown is that same genre — prose the agent
+ * loads and treats as authoritative, not a conversational turn — so this
+ * module ports `tool_poison.rs`'s seven patterns' underlying INTENT (read
+ * the Rust source for the reasoning behind each one; this file adapts the
+ * detection logic to markdown/skill-file context, not JSON tool-description
+ * context — "tool" becomes "tool or skill" throughout, since a skill's prose
+ * can just as easily try to redirect which tool or which skill the agent
+ * uses), plus three additions for markdown's own attack surface: hidden HTML
+ * comments, markdown-link/image exfiltration, and an obfuscated
+ * decode-then-execute instruction shape that has no equivalent in a tool
+ * description (a tool description is not somewhere an agent expects to find
+ * executable-code instructions; a skill file is exactly that).
+ *
+ * # CRITICAL: what the 0-false-positive figure does and does NOT cover
+ *
+ * `tool_poison.rs`'s patterns are measured at 0 false positives on 10,753
+ * real tool and parameter descriptions (`packages/proxy/tests/corpus/tooldesc/`,
+ * BFCL v3). That figure is about TOOL DESCRIPTIONS. It says nothing about
+ * this file. Skill markdown is longer, more discursive, written for a human
+ * reader as much as an agent, and routinely contains the exact imperative
+ * security language ("block any call that…", "never embed secrets", "do
+ * not allow…") that a tool description never does — precisely the shape
+ * this module's patterns key on. The false-positive rate of THESE patterns
+ * on a corpus of REAL, BENIGN skill files is UNMEASURED. One known-benign
+ * fixture is checked here (see the sync-daemon test referenced below), but
+ * one fixture is not a corpus, and a corpus of skill markdown comparable in
+ * size and provenance to `tooldesc.jsonl` does not exist yet.
+ *
+ * Because of that gap, this phase is deliberately REPORT-ONLY. Nothing in
+ * this codebase blocks, refuses, or auto-deletes a skill on the strength of
+ * a finding from this module. `enableLocalSkillAuditDelete` (the existing
+ * workspace setting `tools/cli/src/commands/skill.ts` already consumes for
+ * the legacy rule-file audit) is extended to cover these findings too, but
+ * that is an explicit opt-in a workspace operator chooses, not a default —
+ * see the CLI command for the exact gate. Building enforcement on top of
+ * these patterns is follow-up work, gated on first measuring the
+ * false-positive rate against a real benign-skill corpus the way
+ * `tool_poison.rs` was. See `docs/TECH_DEBT.md` for the tracking entries.
+ *
+ * # Fixture discipline
+ *
+ * Every pattern below carries a `matches` array of at least one string that
+ * MUST trigger it, and a `notMatches` array of at least three strings that
+ * MUST NOT — the same discipline `services/sync-daemon/src/harness/protectedPaths.ts`
+ * enforces for its `GuardPattern` table (`assertGuardTableSane`), for the
+ * same reason: a pattern with no false-positive contract is a pattern nobody
+ * has thought about failing, and a pattern that has never been checked to
+ * fire at all can pass every other check while matching nothing. Both are
+ * asserted at import time (`assertSkillScanTableSane`, below), not from a
+ * test someone could skip — a broken pattern breaks the import for every
+ * consumer immediately.
+ *
+ * The single most load-bearing fixture in this codebase for this module is
+ * NOT here, deliberately: `services/sync-daemon/src/skillWriter.ts`'s
+ * `RULE_AUTHOR_SKILL` constant is full of the exact imperative security
+ * prose ("block any agent call that…", "Never embed secrets…") most likely
+ * to trip an overzealous pattern, and it is a real skill this codebase
+ * already ships. Asserting `scanSkillContent(RULE_AUTHOR_SKILL).clean` is
+ * done in `services/sync-daemon/__tests__/skillWriter.test.ts` rather than
+ * in this package's own test suite, because `packages/shared-types` is a
+ * leaf package `sync-daemon` depends on — importing sync-daemon's source
+ * from here would invert that dependency. The assertion still exists; it
+ * just lives at the one point in the dependency graph where both pieces are
+ * available without a layering violation.
+ *
+ * @module
+ */
+/** The three threat categories this module scans for, borrowed from Cisco's
+ *  open-source `skill-scanner` taxonomy (not its implementation — see the
+ *  module doc comment for why this is a native TypeScript port instead). */
+export type SkillScanCategory = 'prompt_injection' | 'data_exfiltration' | 'malicious_code';
+/**
+ * Which engine produced a finding. `'native'` is this module's own regex
+ * scanner (and `scriptScan.ts`'s, which reuses this union);
+ * `'cisco-skill-scanner'` is the separate, opt-in Cisco `skill-scanner`
+ * integration (Phase S3, `tools/cli/src/lib/ciscoScanner.ts`) — the
+ * genuinely deeper AST/dataflow analysis TD-356 named as the eventual
+ * follow-up to this phase's pattern matching. Optional, not required: a
+ * finding from before this field existed has no engine tag, which is fine —
+ * absence has always meant "this codebase's own scanner," now made explicit.
+ */
+export type SkillScanEngine = 'native' | 'cisco-skill-scanner';
+/** One scan pattern, self-tested at import time. */
+export interface SkillScanPattern {
+    /** Stable id. Appears in findings and audit lines — never renumber one. */
+    id: string;
+    category: SkillScanCategory;
+    /** JS `RegExp` source. Matched case-insensitively; see {@link scanSkillContent}. */
+    source: string;
+    /** What this pattern catches and why — shown to whoever reviews a finding. */
+    description: string;
+    /** Strings that MUST match. At least one, checked at import time. */
+    matches: readonly string[];
+    /** Strings that MUST NOT match — the false-positive contract. At least
+     *  three, checked at import time. */
+    notMatches: readonly string[];
+}
+/** One finding from {@link scanSkillContent}. Never carries full skill
+ *  content — {@link excerptFor} bounds any excerpt to a short window around
+ *  the match, the same idea `tool_poison.rs`'s redaction placeholder serves
+ *  (replace/bound the payload, never log it whole), sized to the {0,40}–
+ *  {0,80} windows the patterns themselves already use for context. */
+export interface SkillScanFinding {
+    patternId: string;
+    category: SkillScanCategory;
+    /** Bounded context around the match. Omitted only if excerpting somehow
+     *  fails; never the full file. */
+    excerpt?: string;
+    /** Which engine produced this finding. See {@link SkillScanEngine}. */
+    engine?: SkillScanEngine;
+}
+export interface SkillScanResult {
+    /** True only when `findings` is empty. */
+    clean: boolean;
+    findings: SkillScanFinding[];
+    /** ISO-8601 timestamp of when this scan ran. */
+    scannedAt: string;
+}
+/** Longest excerpt this module will ever surface, in characters, centered on
+ *  a match. Bounded, not full-content — see the module doc comment.
+ *  Exported so `scriptScan.ts` (the bundled-script scanner, Phase S2) can
+ *  reuse the exact same bounding rather than growing a second, easily
+ *  drifting copy of "how big is too big for an excerpt". */
+export declare const EXCERPT_RADIUS = 40;
+/** Bounds a match to a short window of surrounding context. Exported for
+ *  `scriptScan.ts` to reuse verbatim — see {@link EXCERPT_RADIUS}. */
+export declare function excerptFor(content: string, index: number, length: number): string;
+/**
+ * The pattern table.
+ *
+ * Ported from `tool_poison.rs`'s seven patterns (intent preserved, "tool"
+ * generalised to "tool or skill" throughout since skill prose routinely
+ * talks about which tool to use), plus three additions for markdown's own
+ * surface: hidden HTML comments, markdown-link exfiltration, and an
+ * obfuscated decode-then-execute instruction shape.
+ */
+export declare const SKILL_SCAN_PATTERNS: readonly SkillScanPattern[];
+/**
+ * Scan skill markdown content for the patterns above.
+ *
+ * Report-only: returning findings is the entire effect of this function. It
+ * does not redact, block, or mutate `content` in any way — see the module
+ * doc comment for why enforcement is deliberately not built in this phase.
+ *
+ * Findings never carry the full skill content, only a bounded excerpt (see
+ * {@link excerptFor}) around each match, so a findings payload is safe to
+ * log or display without becoming a second copy of the skill.
+ */
+export declare function scanSkillContent(content: string): SkillScanResult;
+//# sourceMappingURL=skillScan.d.ts.map

package/dist/skillScan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skillScan.d.ts","sourceRoot":"","sources":["../src/skillScan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAEH;;4EAE4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,gBAAgB,CAAA;AAE3F;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,qBAAqB,CAAA;AAE9D,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B;yCACqC;IACrC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B;sCACkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uEAAuE;IACvE,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,gBAAgB,EAAE,CAAA;IAC5B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;4DAI4D;AAC5D,eAAO,MAAM,cAAc,KAAK,CAAA;AAEhC;sEACsE;AACtE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASjF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EA8N1D,CAAA;AA+DD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAcjE"}