@mutmutco/cursor-plugin 4.2.7 → 4.3.1

package/scripts/secret-echo-lint.mjs

@@ -1,177 +0,0 @@
-// Secret-echo PreToolUse lint (#2611): zero-LLM guard against printing secrets-inserted env
-// vars to the transcript. Runs before every Bash / PowerShell tool use (PreToolUse hook).
-// Flags echo/printf/printenv of env vars whose name matches the secret-name pattern, and
-// whole-environment dumps (bare env, printenv, set, Get-ChildItem env:). Never crashes a
-// turn — every failure path exits 0 and allows the call.
-//
-// MODE: advisory by default (warn on stderr, exit 0). MMI_SECRET_ECHO_LINT=block flips to
-// emit the PreToolUse deny JSON. Ship: advisory.
-const MODE = process.env.MMI_SECRET_ECHO_LINT ?? 'advisory';
-
-import { readHookInput } from './hook-io.mjs';
-import { appendHookActivity } from './hook-trace.mjs';
-
-// ---------------------------------------------------------------------------
-// Pure detection logic — exported for tests (no IO here).
-// ---------------------------------------------------------------------------
-
-/**
- * Secret-name pattern reused from scripts/sensitive-value-mask.mjs secret-assignment matcher.
- */
-const SECRET_NAME_RE = /(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PASSPHRASE|PRIVATE[_-]?KEY|CLIENT[_-]?SECRET|ACCESS[_-]?KEY|CREDENTIALS?)/i;
-
-function isSecretName(name) {
-  return SECRET_NAME_RE.test(name);
-}
-
-// Whole-environment dump patterns (per-segment anchors)
-const BARE_ENV = /^\s*env\s*$/;
-const BARE_PRINTENV = /^\s*printenv\s*$/;
-const BARE_SET = /^\s*set\s*$/;
-const PS_ENV_DUMP = /\b(?:Get-ChildItem|gci|ls|dir)\s+env:/i;
-
-/**
- * Inspect a shell command for secret-named env var print or whole-environment dumps.
- * Returns null (clean) or { block: true, reason }.
- *
- * @param {string} command
- * @returns {{ block: boolean, reason: string } | null}
- */
-export function analyze(command) {
-  if (!command || typeof command !== 'string') return null;
-  const trimmed = command.trim();
-  if (!trimmed) return null;
-
-  // Split first so `secrets use` exemptions and dump checks are per-segment
-  // (closes compound bypass + newline-separated dump miss; lone-CR line breaks split too).
-  const segments = trimmed.split(/[;&|]|[\r\n]+/);
-  for (const raw of segments) {
-    const seg = raw.trim();
-    if (!seg) continue;
-    if (/^secrets\s+use\b/.test(seg)) continue;
-    if (/^(?:export|local|declare|typeset)\s/.test(seg)) continue;
-
-    if (BARE_ENV.test(seg)) {
-      return { block: true, reason: 'bare `env` dumps all environment variables including secrets-sealed values' };
-    }
-    if (BARE_PRINTENV.test(seg)) {
-      return { block: true, reason: 'bare `printenv` dumps all environment variables including secrets-sealed values' };
-    }
-    if (BARE_SET.test(seg)) {
-      return { block: true, reason: 'bare `set` dumps all environment variables including secrets-sealed values' };
-    }
-    if (PS_ENV_DUMP.test(seg)) {
-      return { block: true, reason: '`Get-ChildItem env:` dumps all environment variables including secrets-sealed values' };
-    }
-
-    const hit = checkBashPrint(seg) || checkPsPrint(seg);
-    if (hit) return hit;
-  }
-
-  return null;
-}
-
-function checkBashPrint(segment) {
-  // printenv SECRET_NAME
-  const peMatch = segment.match(/(?:^|\s)printenv\s+(\w+)(?:\s|$)/);
-  if (peMatch && isSecretName(peMatch[1])) {
-    return { block: true, reason: `printenv of $${peMatch[1]} prints a secret-named env var` };
-  }
-
-  // echo/printf with $SECRET_VAR
-  if (/\b(?:echo|printf)\b/.test(segment)) {
-    for (const m of segment.matchAll(/\$[\{]?(\w+)/g)) {
-      if (isSecretName(m[1])) {
-        return { block: true, reason: `echo/printf of $${m[1]} prints a secret-named env var` };
-      }
-    }
-  }
-
-  return null;
-}
-
-function checkPsPrint(segment) {
-  // PowerShell accepts both $env:SECRET_VAR and ${env:SECRET_VAR}; keep one matcher so the braced form
-  // cannot bypass the same output checks as the ordinary form.
-  const envReference = /\$(?:\{env:(\w+)\}|env:(\w+))/gi;
-  const envName = (match) => match[1] ?? match[2];
-
-  // Write-Output / Write-Host / echo with $env:SECRET_VAR
-  if (/\b(?:Write-Output|Write-Host|echo)\b/i.test(segment)) {
-    for (const m of segment.matchAll(envReference)) {
-      const name = envName(m);
-      if (isSecretName(name)) {
-        return { block: true, reason: `Write/echo of $env:${name} prints a secret-named env var` };
-      }
-    }
-  }
-
-  // $env:SECRET_VAR in output position (start of command or after pipe, not assignment LHS)
-  for (const m of segment.matchAll(new RegExp(`(?:^|[;&|]\\s*)${envReference.source}`, 'gi'))) {
-    const name = envName(m);
-    const after = segment.slice(m.index + m[0].length);
-    if (/^\s*=(?!=)/.test(after)) continue; // assignment LHS, not output
-    if (isSecretName(name)) {
-      return { block: true, reason: `$env:${name} in output position prints a secret-named env var` };
-    }
-  }
-
-  return null;
-}
-
-// ---------------------------------------------------------------------------
-// IO + main — only runs when this file is the entry point.
-// ---------------------------------------------------------------------------
-
-function preToolUseDeny(reason) {
-  return JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: 'deny',
-      permissionDecisionReason: reason,
-    },
-  });
-}
-
-async function main() {
-  let input;
-  try {
-    input = await readHookInput();
-  } catch {
-    appendHookActivity({
-      event: 'PreToolUse',
-      script: 'secret-echo-lint',
-      outcome: 'failed',
-      action: 'could not read hook input',
-    });
-    process.exit(0);
-  }
-
-  const result = analyze(input?.tool_input?.command);
-
-  appendHookActivity({
-    event: 'PreToolUse',
-    script: 'secret-echo-lint',
-    outcome: result?.block ? (MODE === 'block' ? 'deny' : 'observe') : 'ran',
-    action: result?.block ? result.reason : 'clean',
-    tool: input?.tool_name,
-  });
-
-  if (result?.block) {
-    if (MODE === 'block') {
-      process.stdout.write(preToolUseDeny(result.reason) + '\n');
-    } else {
-      process.stderr.write(`[mmi-secret-echo-lint] would-block: ${result.reason}\n`);
-    }
-  }
-
-  process.exit(0);
-}
-
-if (
-  process.argv[1] &&
-  (process.argv[1].endsWith('secret-echo-lint.mjs') ||
-    process.argv[1].replace(/\\/g, '/').endsWith('scripts/secret-echo-lint.mjs'))
-) {
-  main().catch(() => process.exit(0));
-}

package/scripts/test-command-policy-core.mjs

@@ -1,294 +0,0 @@
-// test-command-policy-core.mjs — shared verdict for "may this diff run tests?" (#5519), and the
-// ONE `Test-Policy-Override` reader both surfaces share (#5804).
-//
-// `mmi-cli tests policy` and the PreToolUse test-command gate both answer that question. Before
-// #5519 they answered it separately: the CLI summary printed the repository's CONFIGURED mandatory
-// glob count on an OK line, while the gate independently matched the task diff against those globs
-// and refused a focused test when none hit. Agents read "8 mandatory glob(s)" as permission, then
-// hit TEST-POLICY TEST COMMAND REFUSED on the next line. Delegated workers and the parent hook also
-// diverged when they did not share an evaluator.
-//
-// #5804 reopened the same divergence along the waiver axis: the CLI honoured a valid override
-// trailer on the findings layer and printed OK, while the gate — fed the same diff without the
-// waiver — refused the matching focused test on the next line. So the reader lives HERE, next to
-// the verdict it feeds, and both surfaces pass the SAME honoured waiver into `evaluateTestCommandPolicy`.
-// The reader is the only git-IO in this module, and it is git's own trailer parser plus the exact
-// guards #3628/#3637 established — the hook must never grow a second, looser trailer parser.
-
-import { execFileSync } from 'node:child_process';
-
-/** Command class the PreToolUse gate regulates. Non-test verification is never refused here. */
-export const TEST_COMMAND_CLASS = 'test';
-
-/** The commit trailer that carries a waiver. Live here so the reader and every message built from
- *  it spell the key identically. */
-export const TRAILER_KEY = 'Test-Policy-Override';
-/** NOT the authority on what is honoured — {@link readOverride} asks git for that. This is the
- *  DISAGREEMENT detector: a line shaped like the trailer that git's parser does not report is the
- *  defect worth surfacing, because it waives the gate while leaving the audit trail empty. */
-const OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
-/** Record and field separators for the one `git log` call that reads sha, trailer and body at once. */
-const REC = '\u001e';
-const FLD = '\u001f';
-
-/** The kinds a `Test-Policy-Override` trailer may waive — the diff rules and nothing else. The
- *  three refusal kinds (unresolvable-base, untrusted-range, malformed-override-trailer) are
- *  deliberately absent: a waiver read out of a range the gate cannot trust would be the original
- *  defect wearing the fix's clothes. */
-export const WAIVABLE_KINDS = [
-  'mandatory-zone-untested',
-  'unrequested-test-file',
-  'protected-removed',
-  'stale-protected-entry',
-  'stale-satisfied-by',
-];
-
-/** The one waivable kind whose finding is a VERDICT ON OUT-OF-ZONE TEST WORK ITSELF (#5804). Rule 1
- *  always co-occurs with a matched glob (test commands already allowed there), and the deletion and
- *  staleness kinds speak to policy hygiene, not to running tests — waiving them buys the deletion,
- *  never the command class. `unrequested-test-file` is different: its finding says exactly what the
- *  command gate refuses, "this test work was never asked for". A waiver over it IS the human's
- *  "this test is requested" decision, so it — and only it — authorizes the `test` class. */
-const TEST_WORK_KIND = 'unrequested-test-file';
-
-/** What counts as a test FILE. Lives here with the verdict that reads it, and is re-imported by
- *  cli/src/test-policy-core.ts, for the reason the module header gives: two copies of a predicate
- *  both surfaces answer with is how #5519 and #5804 each started. */
-export const TEST_FILE_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
-export const PY_TEST_FILE_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
-
-/** Is this path a test file by name? JS/TS and Python, because the guard regulates both estates. */
-export function isTestPath(path) {
-  return typeof path === 'string' && (TEST_FILE_RE.test(path) || PY_TEST_FILE_RE.test(path));
-}
-
-/** Does this diff EDIT a test file that already existed at the base? (#5842)
- *
- *  A zone outside the mandatory globs means no test is REQUIRED there. It never meant no test may be
- *  RUN. Those read the same to a guard that only looks at globs, and the difference is what the
- *  refusal cost: a repo whose policy deliberately leaves `scripts/**` unmandated still runs
- *  `scripts/*.test.mjs` in its REQUIRED gate, so a fix to one of those tests could go red in CI while
- *  every local attempt to run that exact file was denied — a three-minute round trip per attempt,
- *  with the file's own fixtures unverifiable any other way.
- *
- *  ADDED test files are deliberately excluded, and that exclusion is the whole reason this is not
- *  simply "is a test file in the diff". An out-of-zone test the diff CREATES is precisely what
- *  `unrequested-test-file` refuses and what a `Test-Policy-Override` waiver exists to authorize
- *  (#5804). If writing one also bought permission to run it, the waiver would authorize nothing that
- *  was not already free, and "tests are opt-in" would be enforced only at PR time. Editing a test
- *  that is already in the tree asserts nothing about whether new test work was requested — the file
- *  is there, the required gate already runs it, and the only question left is whether the author may
- *  watch it pass. A rename counts as added: the new name did not exist at the base either. */
-export function editsExistingTest(paths, addedPaths = []) {
-  const added = new Set(Array.isArray(addedPaths) ? addedPaths : []);
-  const list = Array.isArray(paths) ? paths : [];
-  return list.some((path) => isTestPath(path) && !added.has(path));
-}
-
-/**
- * Glob body → regex body. Supports `**`, `*`, and `{a,b}` (including wildcards inside braces).
- * Kept byte-compatible with {@link globToRegExp} in cli/src/test-policy-core.ts so rule matching
- * and the command guard cannot drift on the same policy file.
- */
-export function translateGlob(glob) {
-  let out = '';
-  for (let i = 0; i < glob.length; i += 1) {
-    const char = glob[i];
-    if (char === '*') {
-      if (glob[i + 1] === '*') {
-        if (glob[i + 2] === '/') {
-          out += '(?:.*/)?';
-          i += 2;
-        } else {
-          out += '.*';
-          i += 1;
-        }
-      } else out += '[^/]*';
-    } else if (char === '{') {
-      const close = glob.indexOf('}', i);
-      if (close === -1) out += '\\{';
-      else {
-        out += `(?:${glob.slice(i + 1, close).split(',').map(translateGlob).join('|')})`;
-        i = close;
-      }
-    } else {
-      out += /[.+?^${}()|[\]\\]/.test(char) ? `\\${char}` : char;
-    }
-  }
-  return out;
-}
-
-export function globToRegExp(glob) {
-  return new RegExp(`^${translateGlob(glob)}$`);
-}
-
-function mandatoryGlobList(mandatory) {
-  if (!Array.isArray(mandatory)) return [];
-  return mandatory.map((entry) => (typeof entry === 'string' ? entry : entry?.glob)).filter((glob) => typeof glob === 'string');
-}
-
-/** Mandatory globs that match at least one path in `paths`. Order follows the policy declaration. */
-export function matchedMandatoryGlobs(paths, mandatory) {
-  const globs = mandatoryGlobList(mandatory);
-  const list = Array.isArray(paths) ? paths : [];
-  return globs.filter((glob) => {
-    const re = globToRegExp(glob);
-    return list.some((path) => re.test(path));
-  });
-}
-
-/**
- * Decide whether test commands are allowed against a path set, a mandatory zone, and the waiver the
- * caller has already read for this range (#5804).
- *
- * @param {{ paths: string[], mandatory?: unknown, regulated?: boolean,
- *            override?: { kinds?: string[] } | null }} input
- *   `regulated: false` — no test-policy.json (estate default); tests are not gated.
- *   `regulated: true` (default) — a declared policy applies; zero matched globs refuses `test`.
- *   `override` — the waiver honoured for this range, as {@link readOverride} returned it, or null.
- *   A waiver whose kinds cover {@link TEST_WORK_KIND} authorizes the `test` class even with zero
- *   matched globs: reporting and enforcement then state ONE decision, because both feed this
- *   function the same receipt.
- *   `addedPaths` — the subset of `paths` this diff CREATED. #5842: an edit to a test that already
- *   existed authorizes the class; creating one does not — see {@link editsExistingTest}.
- */
-export function evaluateTestCommandPolicy({ paths, mandatory, regulated = true, override = null, addedPaths = [] } = {}) {
-  const configuredMandatoryCount = mandatoryGlobList(mandatory).length;
-  if (!regulated) {
-    return {
-      configuredMandatoryCount: 0,
-      matchedMandatoryGlobs: [],
-      matchedMandatoryCount: 0,
-      testCommandsAllowed: true,
-      editsExistingTest: false,
-      reasonId: null,
-      commandClasses: { allowed: [TEST_COMMAND_CLASS], refused: [] },
-    };
-  }
-  const matched = matchedMandatoryGlobs(paths, mandatory);
-  const overrideAuthorizes = Array.isArray(override?.kinds) && override.kinds.includes(TEST_WORK_KIND);
-  const existingTestEdited = editsExistingTest(paths, addedPaths);
-  const testCommandsAllowed = matched.length > 0 || overrideAuthorizes || existingTestEdited;
-  return {
-    configuredMandatoryCount,
-    matchedMandatoryGlobs: matched,
-    matchedMandatoryCount: matched.length,
-    testCommandsAllowed,
-    /** #5842: true when the diff edits a test file that already existed — one of the facts that can
-     *  authorize the class, named so a refusal can say what was missing. */
-    editsExistingTest: existingTestEdited,
-    reasonId: testCommandsAllowed ? null : 'test-command-outside-mandatory-zone',
-    commandClasses: {
-      allowed: testCommandsAllowed ? [TEST_COMMAND_CLASS] : [],
-      refused: testCommandsAllowed ? [] : [TEST_COMMAND_CLASS],
-    },
-  };
-}
-
-function git(args, cwd) {
-  return execFileSync('git', args, { windowsHide: true, cwd, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
-}
-
-/** Split an optional `[kind, kind]` scope off the front of a trailer value. */
-function parseScope(value) {
-  const scoped = /^\[([^\]]*)\]\s*([\s\S]*)$/.exec(value);
-  if (!scoped) return { kinds: [...WAIVABLE_KINDS], reason: value, unknown: [] };
-  const named = scoped[1].split(',').map((k) => k.trim()).filter(Boolean);
-  return {
-    kinds: named,
-    reason: scoped[2].trim(),
-    unknown: named.filter((k) => !WAIVABLE_KINDS.includes(k)),
-  };
-}
-
-function invisibleTrailer(sha, line) {
-  return {
-    kind: 'malformed-override-trailer',
-    paths: [],
-    detail:
-      `OVERRIDE TRAILER GIT CANNOT SEE — commit ${sha.slice(0, 8)} carries\n`
-      + `    ${line}\n`
-      + `  but \`git log --format='%(trailers:key=${TRAILER_KEY})'\` reports nothing for it, so the waiver would\n`
-      + '  exist only to the regex that granted it. The trailer was chosen over a flag because it can be\n'
-      + '  AUDITED, and a reason the auditor cannot see is not a reason this gate accepts (#3628).\n'
-      + '  Git reads trailers from the LAST paragraph only, and every line of that paragraph must be a\n'
-      + '  trailer or an indented continuation — one bare line such as `Closes #123` disqualifies the whole\n'
-      + '  block. Indent the continuation lines, and leave nothing but trailers in that paragraph.\n'
-      + '  This is fixable forward: push a LATER commit on this branch carrying a well-formed trailer.\n'
-      + '  The nearest waiver wins, and it supersedes this one — no force-push, no re-filed branch.',
-  };
-}
-
-function unknownScope(sha, unknown) {
-  return {
-    kind: 'malformed-override-trailer',
-    paths: [],
-    detail:
-      `UNKNOWN OVERRIDE SCOPE — commit ${sha.slice(0, 8)} scopes its waiver to ${unknown.join(', ')}, which this\n`
-      + '  gate cannot report.\n'
-      + `  Waivable kinds: ${WAIVABLE_KINDS.join(', ')}.\n`
-      + '  Refused rather than widened: treating a typo as "waive everything" is how a scoped waiver turns\n'
-      + '  into a blanket exemption without anyone deciding it should.',
-  };
-}
-
-/**
- * Whether this clone's history is grafted. Anything other than a plain `false` — including a git that
- * cannot answer — counts as shallow: the question being asked is "may I trust a commit range", and
- * "I could not tell" is not a yes.
- */
-export function isShallowRepository(cwd) {
-  try {
-    return git(['rev-parse', '--is-shallow-repository'], cwd).trim() !== 'false';
-  } catch {
-    return true;
-  }
-}
-
-/**
- * Read the waiver out of `base..HEAD` with GIT's own trailer parser, and refuse the disagreements.
- *
- * The regex is kept, but demoted to a cross-check: what it sees and what git sees must be the same
- * set, and where they differ the difference IS the finding. On Jerv-PowerTools@e3d4b8ba the regex
- * granted a waiver git reported no trailer for, and stored the first line of it — `"src/commands/
- * grind.ts is outside test-policy.json's"` — as the justification, argument discarded.
- *
- * Moved here from cli/src/test-policy-core.ts (#5804) so the PreToolUse gate reads the SAME waiver
- * the CLI reports — git's parser, the folded-whole value, the sha, the `[kind]` scoping, and the
- * nearest-waiver-wins precedence — rather than a parallel line regex that would reintroduce the
- * #3628 class on the execution side.
- *
- * @param {string} base merge-base of the change set; the waiver is read from `base..HEAD` only
- * @param {string} cwd repository root the git commands run in
- * @returns {{ override: { sha: string, reason: string, kinds: string[] } | null,
- *             refusals: Array<{ kind: string, detail: string, paths: string[] }> }}
- *   A non-empty `refusals` lists override-shaped problems from commits NEWER than the winning
- *   waiver; the caller must treat the run as refused, never honour `override` past them.
- */
-export function readOverride(base, cwd) {
-  const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
-  const refusals = [];
-  let override = null;
-  for (const record of git(['log', `${base}..HEAD`, `--format=${format}`], cwd).split(REC)) {
-    const [sha, trailer, body] = record.replace(/^\s+/, '').split(FLD);
-    if (!sha) continue;
-    // git log is newest-first, so the nearest waiver wins — as it always did — and once one is held
-    // every remaining record is OLDER than it and cannot change the answer. Stopping here is what
-    // gives a malformed trailer a forward-only remedy (#3637): the disagreement check below used to
-    // sit above this line, so an unparseable trailer refused the PR forever while the honoured waiver
-    // came from a commit after it. Rewriting that commit needs a force-push this estate does not do,
-    // which left re-filing the whole branch as the only exit. Precedence already applied to values;
-    // it now applies to the refusals read out of the same range.
-    if (override) break;
-    const value = (trailer ?? '').trim();
-    if (!value) {
-      const shaped = OVERRIDE_RE.exec(body ?? '');
-      if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
-      continue;
-    }
-    const { kinds, reason, unknown } = parseScope(value);
-    if (unknown.length > 0) refusals.push(unknownScope(sha, unknown));
-    else override = { sha, reason, kinds };
-  }
-  return { override, refusals };
-}