@kaydash9999/banker-plugins 0.14.0 → 0.15.1

package/skills/ralph-qa/references/gemini-read-only.toml

@@ -0,0 +1,9 @@
+# ralph-qa gemini seat: an admin-tier policy (gemini --admin-policy) that denies every tool. The
+# payload comes on stdin, so the seat needs no tool, and a read tool would also read the folders
+# the settings add to the workspace. The admin tier outranks the user's policies, settings
+# `tools.allowed`, trusted MCP servers and the approval mode (gemini-cli 0.62.0).
+# gemini-seat.mjs check refuses to start the seat when the rules below are changed.
+[[rule]]
+toolName = "*"
+decision = "deny"
+priority = 100

package/skills/ralph-qa/references/gemini-seat.mjs

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+/**
+ * gemini-seat: what ralph-qa checks before a gemini seat runs and removes after it ran.
+ *
+ *   node gemini-seat.mjs check <seat folder>   prints the read-only policy's path (exit 0), or
+ *                                               says why the seat must not run (exit 1)
+ *   node gemini-seat.mjs clean <seat folder>   removes gemini's record of that folder's sessions
+ *   node gemini-seat.mjs sweep <base folder>   removes the records of seat folders under it that
+ *                                               are gone (a run cut short before its clean)
+ *
+ * check: the admin policy next to this script must be the shipped deny-all one, as gemini reads
+ * a missing or changed policy file without a word and opens its tools (0.62.0). And no folder
+ * above the seat folder, outside the home, may hold `.gemini/.env` or `.env`: gemini reads the
+ * first one it finds walking up to the root, and a GOOGLE_GEMINI_BASE_URL there sends the
+ * payload elsewhere. On Windows any account may create such a folder under C:\.
+ * clean: gemini 0.62.0 records every headless session, payload and answer, under
+ * <home>/.gemini/tmp/<id>/chats, kept 30 days by default, and no setting stops it. The folders
+ * whose `.project_root` names the seat folder go: tmp/<id> and history/<id>, and the same under
+ * <home>/.cache/.gemini, where gemini keeps them in its macOS sandbox. A seat still running
+ * when its run cleaned up writes its session again into a folder without `.project_root`;
+ * projects.json, which maps the seat folder's path to that folder's name, then ties it to the
+ * seat, and its entry (a path, no payload) stays. <home> is $GEMINI_CLI_HOME when set, as gemini
+ * reads it. The seat folder may be gone already (a run cut short): clean matches its path as
+ * written and as resolved through the nearest folder that still exists, and sweep finds every
+ * <base>/ralph-qa.<id>/gemini record whose folder is gone. A run still going keeps its folder, so
+ * sweep leaves its records. On Windows the paths are compared by their long names (TEMP may be
+ * spelt with an 8.3 short one).
+ * Exit 2 on a usage error, or for check, a seat folder that does not exist.
+ */
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const POLICY = fileURLToPath(new URL("./gemini-read-only.toml", import.meta.url));
+
+// The policy's rules as gemini reads them, comments and blank lines aside: one rule, every tool
+// denied. Any other rule could open a tool to the seat.
+const POLICY_LINES = ["[[rule]]", 'toolName = "*"', 'decision = "deny"', "priority = 100"];
+
+// ASCII only, and only spaces and tabs around a rule: gemini's TOML parser drops a file with a
+// BOM or a no-break space, and then opens every tool, while trim() would let one through.
+export function policyIntact(text) {
+  if (typeof text !== "string" || /[^\t\r\n\x20-\x7e]/.test(text)) return false;
+  const lines = text.split(/\r?\n/).map((l) => l.replace(/#.*/, "").replace(/^[ \t]+|[ \t\r]+$/g, "")).filter(Boolean);
+  return lines.length === POLICY_LINES.length && lines.every((l, i) => l === POLICY_LINES[i]);
+}
+
+// realpath as the OS gives it: on Windows that spells an 8.3 short name (C:\Users\RUNNER~1) long,
+// as a home folder is. A path that does not exist is resolved through its nearest folder that
+// does, so a seat folder that is gone still matches what gemini recorded under a link above it.
+const OS_REALPATH = process.platform === "win32" ? realpathSync.native : realpathSync;
+const realWith = (realpath) => (p) => {
+  const rest = [];
+  for (let dir = resolve(p); ; dir = dirname(dir)) {
+    try {
+      return join(realpath(dir), ...rest);
+    } catch {
+      if (dirname(dir) === dir) return resolve(p);
+      rest.unshift(basename(dir));
+    }
+  }
+};
+const real = realWith(OS_REALPATH);
+const norm = (p, platform) => (platform === "win32" ? resolve(p).toLowerCase() : resolve(p));
+const geminiHome = (env) => env.GEMINI_CLI_HOME || homedir();
+
+function inside(dir, root, platform) {
+  const d = norm(dir, platform);
+  const r = norm(root, platform);
+  return d === r || d.startsWith(r.endsWith(sep) ? r : r + sep);
+}
+
+// The .env files gemini could read for a run in `seat` that sit in folders above it outside the
+// home ($GEMINI_CLI_HOME and the account's home both count as the home).
+export function strayEnvFiles(seat, { env = process.env, platform = process.platform, exists = existsSync, realpath = OS_REALPATH } = {}) {
+  const longName = realWith(realpath);
+  const homes = [geminiHome(env), homedir()].map(longName);
+  const found = [];
+  for (let dir = longName(seat); ; dir = dirname(dir)) {
+    if (!homes.some((h) => inside(dir, h, platform))) {
+      found.push(...[join(dir, ".gemini", ".env"), join(dir, ".env")].filter((f) => exists(f)));
+    }
+    if (dirname(dir) === dir) return found;
+  }
+}
+
+const listDir = (dir) => {
+  try {
+    return readdirSync(dir);
+  } catch {
+    return [];
+  }
+};
+
+// The folder a session folder's .project_root names; null for a link or a file, undefined for a
+// folder without the marker.
+function projectRoot(dir) {
+  try {
+    if (!lstatSync(dir).isDirectory()) return null;
+  } catch {
+    return null;
+  }
+  try {
+    return readFileSync(join(dir, ".project_root"), "utf8").trim();
+  } catch {
+    return undefined;
+  }
+}
+
+// <g>/projects.json, gemini's map from a project folder to its folder name under tmp/ and
+// history/, read the other way round: folder name to project folder.
+function registered(g) {
+  try {
+    const { projects } = JSON.parse(readFileSync(join(g, "projects.json"), "utf8"));
+    if (!projects || typeof projects !== "object" || Array.isArray(projects)) return new Map();
+    return new Map(Object.entries(projects).filter(([, name]) => typeof name === "string").map(([owner, name]) => [name, owner]));
+  } catch {
+    return new Map();
+  }
+}
+
+// Each folder gemini keeps under tmp/ or history/, here and under .cache/.gemini, with the
+// folder its .project_root names. A folder without the marker (a seat that wrote its session
+// again after its run cleaned up) gets the project projects.json gives its name. Only folders
+// read from tmp/ and history/ are looked up, so no name there reaches another folder.
+function projectFolders(env) {
+  const home = geminiHome(env);
+  return [join(home, ".gemini"), join(home, ".cache", ".gemini")].flatMap((g) => {
+    const names = registered(g);
+    return ["tmp", "history"].flatMap((kind) => listDir(join(g, kind)).map((name) => {
+      const dir = join(g, kind, name);
+      const root = projectRoot(dir);
+      return { dir, owner: root === undefined ? names.get(name) : root };
+    }));
+  }).filter((p) => p.owner);
+}
+
+// The folders gemini keeps for sessions run in `seat`, matched by the path as written and as
+// resolved; the seat folder may be gone already.
+export function sessionFolders(seat, { env = process.env, platform = process.platform } = {}) {
+  const want = new Set([norm(seat, platform), norm(real(seat), platform)]);
+  return projectFolders(env).filter((p) => want.has(norm(p.owner, platform))).map((p) => p.dir);
+}
+
+// The session folders of seat folders under `base` that are gone: .project_root names
+// <base>/ralph-qa.<id>/gemini and that folder no longer exists (a run cut short before its clean).
+// A run still going has its seat folder, so its records stay.
+const SEAT_PARENT = /^ralph-qa\.[A-Za-z0-9]+$/;
+export function staleSessionFolders(base, { env = process.env, platform = process.platform, exists = existsSync } = {}) {
+  const roots = new Set([norm(base, platform), norm(real(base), platform)]);
+  const stale = ({ owner }) => {
+    const o = norm(owner, platform);
+    return basename(o) === "gemini" && SEAT_PARENT.test(basename(dirname(o))) && roots.has(dirname(dirname(o))) && !exists(owner);
+  };
+  return projectFolders(env).filter(stale).map((p) => p.dir);
+}
+
+function check(seat) {
+  let text = null;
+  try {
+    text = readFileSync(POLICY, "utf8");
+  } catch {
+    // reported as not intact below
+  }
+  if (!policyIntact(text)) {
+    process.stderr.write(`gemini-seat: ${POLICY} is missing or is not the shipped deny-all policy; the seat would run with its tools open\n`);
+    return 1;
+  }
+  const stray = strayEnvFiles(seat);
+  if (stray.length) {
+    process.stderr.write(`gemini-seat: gemini would read ${stray.join(", ")} (above the seat folder, outside the home); remove it or make the seat folder elsewhere\n`);
+    return 1;
+  }
+  process.stdout.write(POLICY + "\n");
+  return 0;
+}
+
+function remove(dirs) {
+  for (const dir of dirs) rmSync(dir, { recursive: true, force: true });
+  process.stdout.write(JSON.stringify({ removed: dirs }) + "\n");
+  return 0;
+}
+
+function main(argv) {
+  const [cmd, folder, ...rest] = argv;
+  if (!["check", "clean", "sweep"].includes(cmd) || !folder || rest.length) {
+    process.stderr.write("usage: node gemini-seat.mjs check|clean <seat folder> | sweep <base folder>\n");
+    return 2;
+  }
+  if (cmd === "check" && !existsSync(folder)) {
+    process.stderr.write(`gemini-seat: no such folder: ${folder}\n`);
+    return 2;
+  }
+  if (cmd === "check") return check(folder);
+  return remove(cmd === "clean" ? sessionFolders(folder) : staleSessionFolders(folder));
+}
+
+const invokedDirectly = () => {
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+};
+
+if (invokedDirectly()) process.exitCode = main(process.argv.slice(2));

package/skills/ralph-qa/references/payload-scan.mjs

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+/**
+ * payload-scan: secret-like strings in a file that is about to go to an external CLI seat.
+ *
+ *   node payload-scan.mjs <file>
+ *
+ * Prints {"file", "count", "hits": [{"line", "kind"}]} and exits 0 when nothing was found,
+ * 1 when something was, 2 when the file cannot be read or scanned or the arguments are not one
+ * file. A private key hit also carries `end`, the line of its END marker (null when there is
+ * none): the whole block is the secret, not just the BEGIN line. The matched text itself is never
+ * printed, so the report cannot become the leak. The patterns cover common key and token
+ * formats, private key blocks (PGP too), secret assignments (quoted, or unquoted with letters
+ * and digits), passwords (quoted, with a symbol, alone on a config or env-file line, or after a
+ * Dockerfile `ENV KEY value`), secrets given as command-line flags, curl's user and password flag,
+ * hex keys, Basic and Bearer credentials, credentials in URLs and
+ * long high-entropy strings (a lockfile's sha512- integrity hash and a Go or Terraform h1: hash
+ * aside); they do not prove a payload clean. A Docker secret file's path after a *_FILE key is
+ * not read as the password it points to. Every repeat and lookahead is bounded (a run longer than
+ * 65536 characters is read in pieces) or anchored, so a long line takes linear time and cannot
+ * overflow the regex stack.
+ */
+import { readFileSync, realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const SECRET_KEY = String.raw`(?:api[_-]?key|secret|token|passw(?:or)?d|pwd|access[_-]?key|credential|비밀번호|패스워드)[\w-]{0,64}["']?\s*[:=]\s*`;
+// `pass` and `passphrase` count only as a word of their own (DB_PASS, "pass"), not inside bypass.
+const PASS_WORD = String.raw`(?:passw(?:or)?d|pwd|passcode|(?<![a-z])pass(?:phrase)?(?![a-z]))`;
+const PASSWORD_KEY = String.raw`(?:${PASS_WORD}|비밀번호|패스워드)[\w-]{0,64}["']?\s*[:=]\s*`;
+// An unquoted value that is not code: none of the characters an expression or a reference
+// holds, and at least one symbol (an identifier has none).
+const BARE = String.raw`[^\s;,"'().\[\]{}$<>]`;
+// at most 8 words before PRIVATE KEY (RSA, EC, OPENSSH, ENCRYPTED, PGP): an open nested repeat
+// overflows V8's regex stack on a key marker before millions of words
+const PRIVATE_KEY = String.raw`(?:[A-Z0-9]{1,32} ){0,8}PRIVATE KEY(?: BLOCK)?-----`;
+
+export const PATTERNS = [
+  ["aws-access-key", /(?<![A-Z0-9])(?:AKIA|ASIA)[A-Z0-9]{16}(?![A-Z0-9])/],
+  ["github-token", /(?<![A-Za-z0-9])(?:gh[pousr]_[A-Za-z0-9]{36,65536}|github_pat_[A-Za-z0-9_]{22,65536})/],
+  ["gitlab-token", /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,65536}/],
+  ["anthropic-key", /(?<![A-Za-z0-9])sk-ant-[A-Za-z0-9_-]{20,65536}/],
+  ["openai-key", /(?<![A-Za-z0-9-])sk-(?!ant-)(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,65536}/],
+  ["stripe-key", /(?<![A-Za-z0-9])[rs]k_(?:live|test)_[A-Za-z0-9]{16,65536}/],
+  ["npm-token", /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}/],
+  ["huggingface-token", /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{30,65536}/],
+  ["google-api-key", /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}/],
+  ["slack-token", /(?<![A-Za-z0-9])xox[abprs]-[A-Za-z0-9-]{10,65536}/],
+  ["slack-webhook", /hooks\.slack\.com\/services\/T[A-Za-z0-9]+\/B[A-Za-z0-9]+\/[A-Za-z0-9]+/],
+  ["private-key", new RegExp(`-----BEGIN ${PRIVATE_KEY}`)],
+  ["jwt", /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{10,65536}\.eyJ[A-Za-z0-9_-]{10,65536}\.[A-Za-z0-9_-]{10,65536}/],
+  ["bearer-token", /\bbearer\s+[A-Za-z0-9._~+/-]{20,65536}/i],
+  ["basic-auth", /\bauthorization["']?\s*[:=]\s*["']?basic\s+[A-Za-z0-9+/=]{8,65536}/i],
+  ["url-credentials", /[a-z][a-z0-9+.-]{0,31}:\/\/[^\s:@/]{0,256}:[^\s@/]{3,256}@/i],
+  // quoted: 12 characters or more, or 8 to 11 holding a digit (a word like "development" is not one)
+  ["assigned-secret", new RegExp(SECRET_KEY + String.raw`["'](?:[^"'\s]{12,256}|(?=[^"'\s]{0,10}\d)[^"'\s]{8,11})["']`, "i")],
+  ["assigned-secret-bare", new RegExp(SECRET_KEY + String.raw`(?=[^\s"']{0,256}\d)(?=[^\s"']{0,256}[A-Za-z])[^\s"'(\[{]{12,256}`, "i")],
+  ["assigned-password", new RegExp(PASSWORD_KEY + String.raw`(?:["'][^"'\s]{6,256}["']|(?=${BARE}{0,256}[^\w\s;,"'().\[\]{}$<>])${BARE}{6,256})`, "i")],
+  ["env-password", /^[+\- ]?\s*(?:export\s+)?[A-Za-z0-9_]{0,64}(?:passw(?:or)?d|pwd|passcode)[A-Za-z0-9_]{0,64}=[^\s$"'][^\s"']{5,256}/i],
+  // a password alone on a config line: YAML, compose lists, .properties, Dockerfile ENV, diff marks
+  ["config-password", new RegExp(String.raw`^[+\- ]?\s*(?:-\s+|export\s+|ENV\s+)?[\w.-]{0,64}${PASS_WORD}[\w.-]{0,64}["']?\s*[:=]\s*["']?(?![-$<{%])[^\s"',;()\[\]{}]{6,256}["']?\s*(?:#.*)?$`, "i")],
+  // a Dockerfile's legacy `ENV KEY value` form, the value alone after the space
+  ["dockerfile-env-password", new RegExp(String.raw`^[+\- ]?\s*ENV\s+[\w.-]{0,64}${PASS_WORD}[\w.-]{0,64}\s+["']?(?![-$<{%])[^\s"',;()\[\]{}=]{6,256}["']?\s*(?:#.*)?$`, "i")],
+  ["flag-secret", /--(?:password|passwd|pass|token|api-key|apikey|secret|client-secret)(?:=|\s+)(?![-$])[^\s"']{6,256}/i],
+  // curl's -u flag with a user and password pair, glued to it or not; a uid:gid (docker) that is
+  // the whole value, quoted or not, a host:/path (rsync), a date format (date -u +%H:%M) or an id
+  // substitution ($(id -u):$(id -g)) is no credential. A user:group of names is not told apart:
+  // that would let admin:admin through.
+  ["curl-user", /(?<!\S)(?:-u\s*|--user(?:\s+|=))(?!(["']?)\d{1,10}:\d{1,10}\1(?=["'`\s;|&)]|$))(?!["']?\+%|\))[^\s:=]{1,256}:(?!\/)\S{3,256}/],
+  ["assigned-hex", /(?:key|auth|token|secret)[\w-]{0,64}["']?\s*[:=]\s*["']?[0-9a-f]{32,65536}(?![0-9a-z])/i],
+];
+
+// Long runs of base64-like characters whose Shannon entropy is that of random data, as
+// lineage's redaction measures them (32 characters or more, 4.5 bits per character or more).
+const LONG_RUN = /[A-Za-z0-9+/=]{32,65536}/g;
+const ENTROPY_FLOOR = 4.5;
+
+export function entropy(s) {
+  const counts = new Map();
+  for (const c of s) counts.set(c, (counts.get(c) ?? 0) + 1);
+  let bits = 0;
+  for (const n of counts.values()) bits -= (n / s.length) * Math.log2(n / s.length);
+  return bits;
+}
+
+// A subresource-integrity hash (`sha512-<base64>`, as lockfiles hold) and a Go module or
+// Terraform lock hash (`h1:` and 43 base64 characters and `=`, as go.sum and .terraform.lock.hcl
+// hold) are public checksums.
+const SRI_PREFIX = /sha(?:256|384|512)-$/;
+const H1_PREFIX = /(?:^|[^A-Za-z0-9+/=])h1:$/;
+const publicHash = (line, m) => SRI_PREFIX.test(line.slice(Math.max(0, m.index - 7), m.index))
+  || (/^[A-Za-z0-9+/]{43}=$/.test(m[0]) && H1_PREFIX.test(line.slice(Math.max(0, m.index - 4), m.index)));
+const highEntropy = (line) => [...line.matchAll(LONG_RUN)].some((m) => !publicHash(line, m) && entropy(m[0]) >= ENTROPY_FLOOR);
+
+// A *_FILE key's absolute path, the Docker secret file official images take a password from, is
+// not that password: the kinds that read a value after a key name see a `-` there instead. The
+// other kinds still read the line as it is, so a key's own format shows wherever it sits.
+const SECRET_FILE_PATH = /(?<![\w.-])([\w.-]{0,128}_FILE["']?(?:[ \t]*[:=][ \t]*|[ \t]+)["']?)\/[\w.@-]{1,128}(?:\/[\w.@-]{1,128}){0,32}(?=["']?(?:[\s,;#]|$))/gi;
+const KEYED = new Set(["assigned-secret", "assigned-secret-bare", "assigned-password", "env-password", "config-password",
+  "dockerfile-env-password"]);
+
+const KEY_END = new RegExp(`-----END ${PRIVATE_KEY}`);
+
+// Each line's secret-like kinds, once per kind and line. A private key closes at the first END
+// marker at or after its line: the END lines are found once and walked with the lines, so many
+// BEGIN lines without an END still take linear time.
+export function scan(text) {
+  const hits = [];
+  const lines = String(text).split(/\r?\n/);
+  const ends = lines.flatMap((l, i) => (KEY_END.test(l) ? [i + 1] : []));
+  let next = 0;
+  lines.forEach((line, i) => {
+    while (next < ends.length && ends[next] < i + 1) next += 1;
+    const keyed = line.replace(SECRET_FILE_PATH, "$1-");
+    for (const [kind, re] of PATTERNS) {
+      if (!re.test(KEYED.has(kind) ? keyed : line)) continue;
+      hits.push(kind === "private-key" ? { line: i + 1, kind, end: ends[next] ?? null } : { line: i + 1, kind });
+    }
+    if (highEntropy(line)) hits.push({ line: i + 1, kind: "high-entropy" });
+  });
+  return { count: hits.length, hits };
+}
+
+function main(argv) {
+  if (argv.length !== 1) {
+    process.stderr.write("usage: node payload-scan.mjs <file>  (exactly one file)\n");
+    return 2;
+  }
+  const file = argv[0];
+  let text;
+  try {
+    text = readFileSync(file, "utf8");
+  } catch (e) {
+    process.stderr.write(`payload-scan: cannot read ${file}: ${e.code ?? e.message}\n`);
+    return 2;
+  }
+  let result;
+  try {
+    result = scan(text);
+  } catch (e) {
+    process.stderr.write(`payload-scan: cannot scan ${file}: ${e.message}\n`);
+    return 2;
+  }
+  process.stdout.write(JSON.stringify({ file, ...result }, null, 2) + "\n");
+  return result.count === 0 ? 0 : 1;
+}
+
+const invokedDirectly = () => {
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+};
+
+if (invokedDirectly()) process.exitCode = main(process.argv.slice(2));