@link-assistant/hive-mind 2.12.3 → 2.12.4

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @link-assistant/hive-mind
 
+## 2.12.4
+
+### Patch Changes
+
+- 5659a7d: Sanitize credentials that only appear encoded. A GitHub token leaked through a published log because GHCR's token endpoint echoes the supplied credential back base64-encoded inside a JSON body, and every sanitization layer compared surface bytes: the base64 spelling shares no substring with the token, contains no `gho_`, and the structured-assignment rules that would have masked it on the key alone could not read through the backslash-escaped quotes that agent tool results wrap stdout in. Bounded base64 (at all three byte alignments), base64url, hex, percent, byte-escape and HTML-entity runs are now decoded, sanitized with the existing rules, and re-encoded with the round trip verified before substitution — so the `abc…xyz` mask survives the encoding and a run that cannot be rebuilt exactly is redacted whole. Line-wrapped blobs are scanned as groups of base64-only lines, since every common wrapper folds at 76 or 64 columns and leaves no single-line run to match, and the stream sanitizer holds such a group back rather than releasing byte-misaligned slices — together with the line the blob starts on, which is not base64-only and so joins no group, and which released on its own would leave a credential straddling the first fold in neither half. That line is recognised by whether its trailing base64 run decodes to text rather than by its length, so a URL, a commit SHA or a content digest still passes through without delay. Secretlint now runs over the decoded payloads too, sharing the same decoder walk as the synchronous core, which is the redundancy that actually helps: measured against the incident log, its recommended preset finds nothing at all in the surface text. Also fixes the `SENSITIVE_KEY` affixes, whose unbounded backtracking turned a 553 KB base64 blob into a hang at a fail-closed publication boundary, and `postKillRecoveryNotice()`, the one publication path that never sanitized — together with the `require-sanitized-output` rule's blindness to argv-array `gh` invocations that let it stay that way.
+
 ## 2.12.3
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.12.3",
+  "version": "2.12.4",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/credential-sanitization-core.lib.mjs

@@ -7,6 +7,7 @@
  */
 
 import { StringDecoder } from 'node:string_decoder';
+import { sanitizeEncodedCredentials, wrappedBase64HoldStart } from './encoded-credential-detection.lib.mjs';
 
 export const CREDENTIAL_SANITIZATION_ERROR_CODE = 'ERR_CREDENTIAL_SANITIZATION';
 export const CREDENTIAL_SANITIZATION_FAILURE_MESSAGE = 'Credential sanitization failed; publication was blocked.';
@@ -70,7 +71,17 @@ const VENDOR_PATTERNS = Object.freeze([
   /\b(?:[A-Z0-9]+[_-])+(?:TOKEN|SECRET|PASSWORD|CREDENTIAL|API[_-]?KEY)(?:[_-][A-Z0-9]+)+\b/g,
 ]);
 
-const SENSITIVE_KEY = String.raw`(?:[A-Za-z0-9_.-]*(?:api[-_]?key|account[-_]?key|client[-_]?secret|consumer[-_]?secret|webhook[-_]?secret|access[-_]?token|refresh[-_]?token|auth[-_]?token|password|passwd|pwd|private[-_]?key|secret|token|session[-_]?key|session[-_]?token|cookie|docker[-_]?auth|registry[-_]?auth|shared[-_]?access[-_]?signature|sas[-_]?token)[A-Za-z0-9_.-]*|auth|authorization)`;
+// The affixes around the sensitive word are bounded rather than `*`. Unbounded
+// they made every assignment rule quadratic: at each of the N starting offsets
+// in a long identifier-shaped run the engine consumed to the end and then
+// backtracked one character at a time looking for the sensitive word. A single
+// 64 KB base64 blob — routine in a published log — took 19 s per rule and a
+// 256 KB one never finished, which turns the fail-closed publication path into
+// a hang. Bounding costs nothing in coverage: a key whose affix is longer than
+// this simply matches from a later offset, and the affix is preserved text
+// rather than masked content, so the sanitized output is identical.
+const MAX_KEY_AFFIX = 64;
+const SENSITIVE_KEY = String.raw`(?:[A-Za-z0-9_.-]{0,${MAX_KEY_AFFIX}}(?:api[-_]?key|account[-_]?key|client[-_]?secret|consumer[-_]?secret|webhook[-_]?secret|access[-_]?token|refresh[-_]?token|auth[-_]?token|password|passwd|pwd|private[-_]?key|secret|token|session[-_]?key|session[-_]?token|cookie|docker[-_]?auth|registry[-_]?auth|shared[-_]?access[-_]?signature|sas[-_]?token)[A-Za-z0-9_.-]{0,${MAX_KEY_AFFIX}}|auth|authorization)`;
 
 // Issue #2119: token *accounting* is not a credential. Every AI provider SDK
 // spells usage telemetry with the plural "tokens" (`tokens`, `inputTokens`,
@@ -90,14 +101,38 @@ const normalizeAssignmentKey = prefix =>
     .toLowerCase();
 
 const isTokenCounterAssignment = (prefix, value) => NUMERIC_VALUE.test(String(value ?? '').trim()) && TOKEN_COUNTER_KEY.test(normalizeAssignmentKey(prefix));
+
+// Issue #2156: `SENSITIVE_KEY` matches any key *containing* `secret`, `token`
+// or `auth`, which includes real npm package names — `secretlint`,
+// `@secretlint/secretlint-rule-preset-recommend`, `next-auth`. Their manifest
+// values are version ranges, and masking those rewrote dependency versions to
+// `[REDACTED]` in every published `package.json` excerpt. A credential is
+// never a bare semver range, so exempting that exact value shape costs no
+// protection. The guard is on the value alone; `token: "1.2.3"` in a real
+// credential field would be a 5-character value that `maskToken` reduces to
+// `[REDACTED]` anyway.
+// One comparator (`^1.2.3`, `>=4.0.0`, `v2.1`), optionally repeated as a range
+// joined by whitespace, `-` or `||` — the full npm/semver range grammar.
+const VERSION_COMPARATOR = String.raw`(?:\^|~|[><]=?|=)?\s*v?\d+(?:\.\d+){1,2}(?:[-+][0-9A-Za-z.-]+)?`;
+const VERSION_RANGE_VALUE = new RegExp(`^${VERSION_COMPARATOR}(?:(?:\\s*(?:\\|\\||-)\\s*|\\s+)${VERSION_COMPARATOR})*$`);
+const isVersionRangeAssignment = value => VERSION_RANGE_VALUE.test(String(value ?? '').trim());
 const SENSITIVE_ENV_NAME = /(?:API_?KEY|ACCOUNT_?KEY|CLIENT_?SECRET|CONSUMER_?SECRET|WEBHOOK_?SECRET|ACCESS_?TOKEN|REFRESH_?TOKEN|AUTH_?TOKEN|PASSWORD|PASSWD|PRIVATE_?KEY|SECRET|TOKEN|COOKIE|AUTH)$/i;
-const QUOTED_ASSIGNMENT = new RegExp(`((?:["']?${SENSITIVE_KEY}["']?)\\s*(?:=>|[:=])\\s*)(["'])([^"'\\r\\n]*)(\\2)`, 'gi');
+// Issue #2156: structured output is routinely nested inside another JSON
+// document — an agent tool result embeds the command's stdout as a JSON
+// *string*, so a response body reaches the log as `{\"token\":\"...\"}` with
+// every quote backslash-escaped. Anchoring on a bare `"` missed all of those,
+// which meant the generic `token` / `password` / `api_key` rules silently did
+// nothing for the single most common shape in our own logs. A quote delimiter
+// is therefore any run of backslashes followed by a quote character, and the
+// value is matched lazily so it stops at the escape rather than swallowing it.
+const QUOTE = String.raw`\\*["']`;
+const QUOTED_ASSIGNMENT = new RegExp(`((?:${QUOTE})?${SENSITIVE_KEY}(?:${QUOTE})?\\s*(?:=>|[:=])\\s*)(${QUOTE})([^"'\\r\\n]*?)(${QUOTE})`, 'gi');
 // Issue #2119: a value that *opens* a JSON/JS structure is punctuation, not a
 // secret. Without this guard `"tokens": {` was rewritten to `"tokens": [REDACTED]`,
 // which silently truncated the object and made the whole record unparseable.
 // The guard only rejects a structural character in first position, so a
 // credential that merely contains a brace (`password=ab{cd`) is still masked whole.
-const UNQUOTED_ASSIGNMENT = new RegExp(`((?:["']?${SENSITIVE_KEY}["']?)\\s*(?:=>|[:=])\\s*)(?!["']|[{[]|(?:Bearer|Basic|SharedAccessSignature)\\s)([^\\s,;}&'"\\r\\n]+)`, 'gi');
+const UNQUOTED_ASSIGNMENT = new RegExp(`((?:${QUOTE})?${SENSITIVE_KEY}(?:${QUOTE})?\\s*(?:=>|[:=])\\s*)(?!${QUOTE}|[{[]|(?:Bearer|Basic|SharedAccessSignature)\\s)([^\\s,;}&'"\\r\\n]+)`, 'gi');
 const XML_CREDENTIAL = new RegExp(`(<(${SENSITIVE_KEY})\\b[^>]*>)([\\s\\S]*?)(<\\/\\2\\s*>)`, 'gi');
 const CLI_CREDENTIAL_QUOTED = new RegExp(`(--${SENSITIVE_KEY}(?:\\s+|=))(["'])([^"'\\r\\n]*)(\\2)`, 'gi');
 const CLI_CREDENTIAL = new RegExp(`(--${SENSITIVE_KEY}(?:\\s+|=))(?!["'])([^\\s"'\\r\\n]+)`, 'gi');
@@ -121,9 +156,13 @@ const replaceCookieHeader = (_match, prefix, cookieText) => {
 
 /**
  * Synchronously sanitize known vendor credentials and credential-like
- * structured values. The operation is deterministic and idempotent.
+ * structured values in their plaintext representation.
+ *
+ * Encoded representations are handled by {@link sanitizeCredentialText}, which
+ * wraps this function; keeping the plaintext rules separate is what lets the
+ * encoded layer call back into them without recursing forever.
  */
-export const sanitizeCredentialText = (input, options = {}) => {
+const sanitizePlaintextCredentials = (input, options = {}) => {
   let output = String(input ?? '');
 
   // Known active credentials are the strongest signal and are replaced before
@@ -160,8 +199,11 @@ export const sanitizeCredentialText = (input, options = {}) => {
 
   // XML and JSON/YAML/TOML/INI/shell-style assignments.
   output = output.replace(XML_CREDENTIAL, (_match, start, _key, value, end) => `${start}${maskValue(value.trim())}${end}`);
-  output = output.replace(QUOTED_ASSIGNMENT, (match, prefix, quote, value) => (isTokenCounterAssignment(prefix, value) ? match : `${prefix}${quote}${maskValue(value)}${quote}`));
-  output = output.replace(UNQUOTED_ASSIGNMENT, (match, prefix, value) => (isTokenCounterAssignment(prefix, value) ? match : `${prefix}${maskValue(value)}`));
+  // The opening and closing delimiters are captured independently because an
+  // escaped payload may not balance them symmetrically; each is preserved as
+  // written so the surrounding document stays byte-for-byte parseable.
+  output = output.replace(QUOTED_ASSIGNMENT, (match, prefix, openQuote, value, closeQuote) => (isTokenCounterAssignment(prefix, value) || isVersionRangeAssignment(value) ? match : `${prefix}${openQuote}${maskValue(value)}${closeQuote}`));
+  output = output.replace(UNQUOTED_ASSIGNMENT, (match, prefix, value) => (isTokenCounterAssignment(prefix, value) || isVersionRangeAssignment(value) ? match : `${prefix}${maskValue(value)}`));
 
   // CLI arguments and sensitive query parameters.
   output = output.replace(CLI_CREDENTIAL_QUOTED, (_match, prefix, quote, value) => `${prefix}${quote}${maskValue(value)}${quote}`);
@@ -176,6 +218,50 @@ export const sanitizeCredentialText = (input, options = {}) => {
   return output;
 };
 
+/**
+ * How many nested encoding layers to peel. A credential wrapped in base64 of
+ * base64 is still a credential; beyond three layers the payload is no longer
+ * something any real service produces.
+ */
+const MAX_ENCODED_SANITIZATION_DEPTH = 3;
+
+const collectKnownTokenValues = options => {
+  const environmentTokens =
+    options.includeEnvironmentCredentials === false
+      ? []
+      : Object.entries(process.env)
+          .filter(([name, value]) => SENSITIVE_ENV_NAME.test(name) && typeof value === 'string' && value.length > 0)
+          .map(([, value]) => value);
+  const explicit = (options.knownTokens || []).map(token => (typeof token === 'string' ? token : token?.value)).filter(Boolean);
+  return [...environmentTokens, ...explicit];
+};
+
+/**
+ * Synchronously sanitize known vendor credentials and credential-like
+ * structured values, in both plaintext **and encoded** representations. The
+ * operation is deterministic and idempotent.
+ *
+ * Issue #2156: a credential that reaches a log only as base64 (or hex, percent,
+ * escape or entity encoding) has no plaintext substring for the rules above to
+ * match, yet remains fully recoverable — and GitHub's secret scanning does
+ * recover it. Encoded runs are therefore decoded, sanitized with the same
+ * rules, and re-encoded in place.
+ */
+export const sanitizeCredentialText = (input, options = {}) => {
+  const knownTokens = collectKnownTokenValues(options);
+
+  const sanitizeAtDepth = (text, depth) => {
+    const plain = sanitizePlaintextCredentials(text, options);
+    if (depth >= MAX_ENCODED_SANITIZATION_DEPTH || options.skipEncodedCredentials === true) return plain;
+    return sanitizeEncodedCredentials(plain, {
+      knownTokens,
+      sanitizePlaintext: nested => sanitizeAtDepth(nested, depth + 1),
+    });
+  };
+
+  return sanitizeAtDepth(String(input ?? ''), 0);
+};
+
 /**
  * Return a non-sensitive indication that another sanitizer pass would change
  * the text. Callers never receive the matching value.
@@ -232,8 +318,17 @@ export const createCredentialStreamSanitizer = options => {
 
       const boundary = Math.max(pending.lastIndexOf('\n'), pending.lastIndexOf('\r'));
       if (boundary < 0) break;
-      output += sanitizeCredentialText(pending.slice(0, boundary + 1), options);
-      pending = pending.slice(boundary + 1);
+
+      // Issue #2156: a base64 blob wrapped across lines is one credential
+      // carrier spread over many records. Releasing those records one at a time
+      // hands the sanitizer a byte-misaligned slice that decodes to noise, so
+      // hold a trailing group of base64-only lines back until a line that
+      // cannot belong to the blob arrives (or `flush` forces the issue), the
+      // same way an unterminated PEM block is held above.
+      const releaseEnd = wrappedBase64HoldStart(pending, boundary + 1) ?? boundary + 1;
+      if (releaseEnd <= 0) break;
+      output += sanitizeCredentialText(pending.slice(0, releaseEnd), options);
+      pending = pending.slice(releaseEnd);
     }
 
     return output;