@ipul-labs/forge 1.16.6 → 1.16.7

package/bin/cli/sessionStore.js

@@ -48,17 +48,14 @@ export function sessionDir(repo, iid) {
 }
 
 async function ensureDir(dir) {
-	await fs.mkdir(dir, { recursive: true });
+	await fs.mkdir(dir, { recursive: true, mode: 0o700 });
 }
 
 export async function writeAnalysis(repo, iid, analysis) {
 	const dir = sessionDir(repo, iid);
 	await ensureDir(dir);
-	await fs.writeFile(
-		path.join(dir, "analysis.json"),
-		JSON.stringify(analysis, null, 2),
-		"utf8",
-	);
+	const file = path.join(dir, "analysis.json");
+	await fs.writeFile(file, JSON.stringify(analysis, null, 2), { encoding: "utf8", mode: 0o600 });
 }
 
 export async function readAnalysis(repo, iid) {
@@ -84,7 +81,7 @@ export async function updateState(repo, iid, partial) {
 		createdAt: now,
 	};
 	const next = { ...prev, ...partial, updatedAt: now };
-	await fs.writeFile(file, JSON.stringify(next, null, 2), "utf8");
+	await fs.writeFile(file, JSON.stringify(next, null, 2), { encoding: "utf8", mode: 0o600 });
 	return next;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ipul-labs/forge",
-  "version": "1.16.6",
+  "version": "1.16.7",
   "description": "AI-powered code change & deploy control panel — connects Claude, GitLab, and Kubernetes",
   "readmeFilename": "README.md",
   "type": "module",

package/server/forge/core/localRepo.js

@@ -55,9 +55,21 @@ function sanitizeRepo(repo) {
 }
 
 function gitlabCloneUrl(project) {
+	return `https://gitlab.com/${project}.git`;
+}
+
+function gitEnvWithToken() {
 	const { token } = getConnection("gitlab");
 	if (!token) throw new Error("GitLab token is required to clone the repo locally. Set it in Settings → Connections or via GITLAB_TOKEN env var.");
-	return `https://oauth2:${token}@gitlab.com/${project}.git`;
+	return {
+		GIT_ASKPASS: "echo",
+		GIT_TERMINAL_PROMPT: "0",
+		GIT_CONFIG_COUNT: "2",
+		GIT_CONFIG_KEY_0: "credential.helper",
+		GIT_CONFIG_VALUE_0: "",
+		GIT_CONFIG_KEY_1: "http.extraHeader",
+		GIT_CONFIG_VALUE_1: `Authorization: Bearer ${token}`,
+	};
 }
 
 function resolveCloneUrl(repoInput) {
@@ -90,16 +102,18 @@ export async function ensureWorkingTree(repo, branchName, onLog) {
 	const hasRepo = await exists(path.join(dir, ".git"));
 	const log = (m) => onLog?.(m);
 
+	const gitEnv = gitEnvWithToken();
+	const envOpts = { env: { ...process.env, ...gitEnv } };
 	if (!hasRepo) {
 		log(`Cloning ${repo} → ${dir}`);
 		await fs.mkdir(dir, { recursive: true });
-		const clone = await runGit(["clone", "--depth=1", resolveCloneUrl(repo), dir], {}, onLog);
+		const clone = await runGit(["clone", "--depth=1", resolveCloneUrl(repo), dir], envOpts, onLog);
 		if (clone.code !== 0) throw new Error(`git clone failed (code ${clone.code})`);
 	} else {
 		log(`Reusing clone at ${dir}`);
 	}
 
-	const fetch = await runGit(["fetch", "--depth=1", "origin", "main"], { cwd: dir }, onLog);
+	const fetch = await runGit(["fetch", "--depth=1", "origin", "main"], { cwd: dir, ...envOpts }, onLog);
 	if (fetch.code !== 0) throw new Error(`git fetch failed (code ${fetch.code})`);
 
 	const reset = await runGit(["reset", "--hard", "origin/main"], { cwd: dir }, onLog);
@@ -121,9 +135,10 @@ export async function ensureWorkingTree(repo, branchName, onLog) {
  * @param {(msg: string) => void} [onLog]
  */
 export async function overlayChanges(dir, changes, onLog) {
+	const realBase = await fs.realpath(dir);
 	for (const c of changes) {
-		const full = path.join(dir, c.file);
-		if (!full.startsWith(dir + path.sep) && full !== dir) {
+		const full = path.resolve(dir, c.file);
+		if (!full.startsWith(realBase + path.sep) && full !== realBase) {
 			throw new Error(`Refusing to write outside clone dir: ${c.file}`);
 		}
 		if (c.action === "delete") {

package/server/forge/core/validator/clone.js

@@ -26,11 +26,23 @@ function sanitizeRepo(repo) {
 }
 
 function gitlabCloneUrl(project) {
+	return `https://gitlab.com/${project}.git`;
+}
+
+function gitEnvWithToken() {
 	const { token } = getConnection("gitlab");
 	if (!token) {
 		throw new Error("GitLab token is required to clone the repo for validation. Set it in Settings → Connections or via GITLAB_TOKEN env var.");
 	}
-	return `https://oauth2:${token}@gitlab.com/${project}.git`;
+	return {
+		GIT_ASKPASS: "echo",
+		GIT_TERMINAL_PROMPT: "0",
+		GIT_CONFIG_COUNT: "2",
+		GIT_CONFIG_KEY_0: "credential.helper",
+		GIT_CONFIG_VALUE_0: "",
+		GIT_CONFIG_KEY_1: "http.extraHeader",
+		GIT_CONFIG_VALUE_1: `Authorization: Bearer ${token}`,
+	};
 }
 
 function resolveCloneUrl(repoInput) {
@@ -54,11 +66,12 @@ export async function ensureClone(repo, branchName, emit) {
 	emit({ type: "progress", step: "clone", status: "running" });
 	emit({ type: "log", step: "clone", message: hasRepo ? `Reusing clone at ${dir}` : `Cloning ${repo} → ${dir}` });
 
+	const gitEnv = gitEnvWithToken();
 	if (!hasRepo) {
 		await fs.mkdir(dir, { recursive: true });
 		const clone = await runCmd(
 			"git", ["clone", "--depth=1", resolveCloneUrl(repo), dir],
-			{},
+			{ env: { ...process.env, ...gitEnv } },
 			(l) => emit({ type: "log", step: "clone", message: l }),
 		);
 		if (clone.code !== 0) throw new Error(`git clone failed (code ${clone.code})`);
@@ -66,7 +79,7 @@ export async function ensureClone(repo, branchName, emit) {
 
 	const fetch = await runCmd(
 		"git", ["fetch", "--depth=1", "origin", "main"],
-		{ cwd: dir },
+		{ cwd: dir, env: { ...process.env, ...gitEnv } },
 		(l) => emit({ type: "log", step: "clone", message: l }),
 	);
 	if (fetch.code !== 0) throw new Error(`git fetch failed (code ${fetch.code})`);

package/server/forge/core/validator/overlay.js

@@ -8,10 +8,10 @@ import path from "node:path";
 
 export async function overlayChanges(dir, changes, emit) {
 	emit({ type: "progress", step: "overlay", status: "running" });
+	const realBase = await fs.realpath(dir);
 	for (const c of changes) {
-		const full = path.join(dir, c.file);
-		// Defensive: refuse to escape the clone dir.
-		if (!full.startsWith(dir + path.sep) && full !== dir) {
+		const full = path.resolve(dir, c.file);
+		if (!full.startsWith(realBase + path.sep) && full !== realBase) {
 			throw new Error(`Refusing to write outside clone dir: ${c.file}`);
 		}
 		if (c.action === "delete") {

package/server/forge/routes.js

@@ -21,6 +21,7 @@ import { Router } from "express";
 import * as configStore from "./core/configStore.js";
 import { listDeployments } from "./core/k8s.js";
 import { ForgeAgent } from "./core/ForgeAgent.js";
+import crypto from "node:crypto";
 import { probeQuota } from "./core/quotaClient.js";
 import { validate as runValidation } from "./core/validator.js";
 import { createProvider } from "./core/providers/index.js";
@@ -45,7 +46,9 @@ function requireAuth(req, res, next) {
 		return res.status(401).json({ error: "Missing Authorization header." });
 	}
 
-	if (auth.slice(7) !== token) {
+	const provided = Buffer.from(auth.slice(7));
+	const expected = Buffer.from(token);
+	if (provided.length !== expected.length || !crypto.timingSafeEqual(provided, expected)) {
 		return res.status(403).json({ error: "Invalid token." });
 	}
 
@@ -54,12 +57,20 @@ function requireAuth(req, res, next) {
 
 // ─── Error handler ────────────────────────────────────────────────────────────
 
+function redactSecrets(text) {
+	return text
+		.replace(/(?:token|key|secret|password|bearer)[=:\s]+\S+/gi, (m) => m.slice(0, m.indexOf(m.match(/[=:\s]/)[0]) + 1) + "***")
+		.replace(/oauth2:[^@]+@/gi, "oauth2:***@")
+		.replace(/ghp_\w+/g, "ghp_***")
+		.replace(/glpat-\w+/g, "glpat-***");
+}
+
 function handleError(res, error, operation) {
 	const msg = error?.message ?? "Unknown error";
-	console.error(`[forge] ${operation} failed:`, msg);
+	console.error(`[forge] ${operation} failed:`, redactSecrets(msg));
 	const upstream = /^(?:GitLab|GitHub) (\d{3}) on /.exec(msg);
 	const status = error?.status ?? (upstream ? Number(upstream[1]) : 500);
-	res.status(status).json({ error: msg, operation });
+	res.status(status).json({ error: redactSecrets(msg), operation });
 }
 
 // ─── Repo helpers ─────────────────────────────────────────────────────────────