@octocodeai/octocode-engine 16.5.0

package/dist/security/contentSanitizer.js

@@ -0,0 +1,181 @@
+import { nativeSanitizeContent } from './native.js';
+import { securityRegistry } from './registry.js';
+const MAX_STRING_LENGTH = 10_000;
+const MAX_STRING_LENGTH_DISPLAY = '10,000';
+const MAX_ARRAY_LENGTH = 100;
+const MAX_DEPTH = 20;
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+function shouldApplyExtraPattern(fileContext, filePath) {
+    if (!fileContext)
+        return true;
+    if (!filePath)
+        return false;
+    fileContext.lastIndex = 0;
+    const applies = fileContext.test(filePath);
+    fileContext.lastIndex = 0;
+    return applies;
+}
+function detectWithExtraPatterns(content, filePath, extraPatterns) {
+    let sanitized = content;
+    const secrets = [];
+    for (const pattern of extraPatterns) {
+        if (!shouldApplyExtraPattern(pattern.fileContext, filePath)) {
+            continue;
+        }
+        pattern.regex.lastIndex = 0;
+        if (pattern.regex.test(sanitized)) {
+            secrets.push(pattern.name);
+            pattern.regex.lastIndex = 0;
+            sanitized = sanitized.replace(pattern.regex, `[REDACTED-${pattern.name.toUpperCase()}]`);
+        }
+        pattern.regex.lastIndex = 0;
+    }
+    return { sanitized, secrets };
+}
+export const ContentSanitizer = {
+    sanitizeContent(content, filePath) {
+        if (content == null || typeof content !== 'string') {
+            return {
+                content: content == null ? '' : String(content),
+                hasSecrets: false,
+                secretsDetected: [],
+                warnings: [],
+            };
+        }
+        const rustResult = nativeSanitizeContent(content, filePath ?? null);
+        const extraPatterns = securityRegistry.extraSecretPatterns;
+        if (extraPatterns.length > 0) {
+            const { sanitized: finalContent, secrets: extraSecrets } = detectWithExtraPatterns(rustResult.content, filePath, extraPatterns);
+            const allSecrets = [...rustResult.secretsDetected, ...extraSecrets];
+            const hasSecrets = allSecrets.length > 0;
+            return {
+                content: finalContent,
+                hasSecrets,
+                secretsDetected: allSecrets,
+                warnings: hasSecrets ? [`${allSecrets.length} secret(s) redacted`] : [],
+            };
+        }
+        return {
+            content: rustResult.content,
+            hasSecrets: rustResult.hasSecrets,
+            secretsDetected: rustResult.secretsDetected,
+            warnings: rustResult.warnings,
+        };
+    },
+    validateInputParameters(params) {
+        return validateRecursive(params, 0, new WeakSet());
+    },
+};
+function validateRecursive(params, depth, ancestorStack) {
+    if (!params || typeof params !== 'object') {
+        return {
+            sanitizedParams: {},
+            isValid: false,
+            hasSecrets: false,
+            warnings: ['Invalid parameters: must be an object'],
+        };
+    }
+    if (depth > MAX_DEPTH) {
+        return {
+            sanitizedParams: {},
+            isValid: false,
+            hasSecrets: false,
+            warnings: ['Maximum nesting depth exceeded'],
+        };
+    }
+    if (ancestorStack.has(params)) {
+        return {
+            sanitizedParams: {},
+            isValid: false,
+            hasSecrets: false,
+            warnings: ['Circular reference detected'],
+        };
+    }
+    ancestorStack.add(params);
+    const sanitizedParams = {};
+    const warnings = new Set();
+    let hasSecrets = false;
+    let hasValidationErrors = false;
+    for (const [key, value] of Object.entries(params)) {
+        if (typeof key !== 'string' || key.trim() === '') {
+            warnings.add(`Invalid parameter key: ${key}`);
+            hasValidationErrors = true;
+            continue;
+        }
+        if (DANGEROUS_KEYS.has(key)) {
+            warnings.add(`Dangerous parameter key blocked: ${key}`);
+            hasValidationErrors = true;
+            continue;
+        }
+        if (typeof value === 'string') {
+            let v = value;
+            if (v.length > MAX_STRING_LENGTH) {
+                warnings.add(`Parameter ${key} exceeds maximum length (${MAX_STRING_LENGTH_DISPLAY} characters)`);
+                v = v.substring(0, MAX_STRING_LENGTH);
+            }
+            const r = ContentSanitizer.sanitizeContent(v, undefined);
+            if (r.hasSecrets) {
+                hasSecrets = true;
+                r.secretsDetected.forEach((s) => warnings.add(`Secrets detected in ${key}: ${s}`));
+            }
+            sanitizedParams[key] = r.content;
+        }
+        else if (Array.isArray(value)) {
+            const truncated = value.length > MAX_ARRAY_LENGTH
+                ? (() => {
+                    warnings.add(`Parameter ${key} array exceeds maximum length (${MAX_ARRAY_LENGTH} items)`);
+                    return value.slice(0, MAX_ARRAY_LENGTH);
+                })()
+                : value;
+            let arrHasSecrets = false;
+            let arrHasErrors = false;
+            const sanitizedArr = truncated.map(item => {
+                if (typeof item === 'string') {
+                    const r = ContentSanitizer.sanitizeContent(item, undefined);
+                    if (r.hasSecrets) {
+                        arrHasSecrets = true;
+                    }
+                    return r.content;
+                }
+                if (item !== null && typeof item === 'object' && !Array.isArray(item)) {
+                    const r = validateRecursive(item, depth + 1, ancestorStack);
+                    if (r.hasSecrets)
+                        arrHasSecrets = true;
+                    if (!r.isValid) {
+                        arrHasErrors = true;
+                        r.warnings.forEach(w => warnings.add(`${key}[]: ${w}`));
+                    }
+                    return r.sanitizedParams;
+                }
+                return item;
+            });
+            if (arrHasSecrets)
+                hasSecrets = true;
+            if (arrHasErrors)
+                hasValidationErrors = true;
+            sanitizedParams[key] = sanitizedArr;
+        }
+        else if (value !== null && typeof value === 'object') {
+            const r = validateRecursive(value, depth + 1, ancestorStack);
+            if (r.hasSecrets)
+                hasSecrets = true;
+            if (!r.isValid) {
+                hasValidationErrors = true;
+                r.warnings.forEach(w => warnings.add(`Invalid nested object in parameter ${key}: ${w}`));
+            }
+            else {
+                sanitizedParams[key] = r.sanitizedParams;
+            }
+        }
+        else {
+            sanitizedParams[key] = value;
+        }
+    }
+    ancestorStack.delete(params);
+    return {
+        sanitizedParams,
+        isValid: !hasValidationErrors,
+        hasSecrets,
+        warnings: Array.from(warnings),
+    };
+}

package/dist/security/filePatterns.d.ts

@@ -0,0 +1 @@
+export declare const IGNORED_FILE_PATTERNS: RegExp[];

package/dist/security/filePatterns.js

@@ -0,0 +1,209 @@
+export const IGNORED_FILE_PATTERNS = [
+    /\.env$/,
+    /\.env\..+$/,
+    /^\.npmrc$/,
+    /^\.pypirc$/,
+    /^\.netrc$/,
+    /^\.dockercfg$/,
+    /^\.docker\/config\.json$/,
+    /^credentials$/,
+    /^\.credentials$/,
+    /^\.aws\/credentials$/,
+    /^\.aws\/config$/,
+    /^\.ssh\/.*$/,
+    /^id_rsa$/,
+    /^id_dsa$/,
+    /^id_ecdsa$/,
+    /^id_ed25519$/,
+    /^id_rsa\.pub$/,
+    /^id_dsa\.pub$/,
+    /^id_ecdsa\.pub$/,
+    /^id_ed25519\.pub$/,
+    /^known_hosts$/,
+    /^authorized_keys$/,
+    /.*_rsa$/,
+    /.*_dsa$/,
+    /.*_ecdsa$/,
+    /.*_ed25519$/,
+    /^private.*\.key$/,
+    /^private.*\.pem$/,
+    /^.*[-_]private[-_].*\.key$/,
+    /^.*[-_]private[-_].*\.pem$/,
+    /[-_]private\.key$/,
+    /[-_]private\.pem$/,
+    /^.*\.private\.key$/,
+    /^.*\.private\.pem$/,
+    /\.pem$/,
+    /\.key$/,
+    /\.crt$/,
+    /\.cer$/,
+    /\.keystore$/,
+    /\.p12$/,
+    /\.pfx$/,
+    /\.jks$/,
+    /\.ppk$/,
+    /^service[-_]account.*\.json$/,
+    /^.*-service[-_]account.*\.json$/,
+    /^application[-_]default[-_]credentials\.json$/,
+    /^gcloud[-_]credentials\.json$/,
+    /^kubeconfig$/,
+    /^\.kube\/config$/,
+    /^k8s[-_]config$/,
+    /^terraform\.tfstate$/,
+    /^terraform\.tfstate\.backup$/,
+    /^terraform\.tfvars$/,
+    /^\.terraform\.lock\.hcl$/,
+    /^\.pgpass$/,
+    /^\.my\.cnf$/,
+    /^\.psqlrc$/,
+    /^secrets\.yml$/,
+    /^master\.key$/,
+    /^config\/master\.key$/,
+    /^wp-config\.php$/,
+    /^google-services\.json$/,
+    /^GoogleService-Info\.plist$/,
+    /^keystore\.properties$/,
+    /\.mobileprovision$/,
+    /\.provisionprofile$/,
+    /^\.token$/,
+    /^token\.txt$/,
+    /^access_token$/,
+    /^refresh_token$/,
+    /^bearer_token$/,
+    /^auth_token$/,
+    /^client_secret.*\.json$/,
+    /^oauth2.*\.json$/,
+    /^\.password$/,
+    /^password\.txt$/,
+    /^passwords\.txt$/,
+    /^\.secret$/,
+    /^secret\.txt$/,
+    /^secrets\.txt$/,
+    /^apikey\.txt$/,
+    /^api_key\.txt$/,
+    /^api-key\.txt$/,
+    /^\.git-credentials$/,
+    /^git-credentials$/,
+    /^\.htpasswd$/,
+    /^auth\.json$/,
+    /^\.ftpconfig$/,
+    /^ftpconfig\.json$/,
+    /^_netrc$/,
+    /^\.bash_history$/,
+    /^\.zsh_history$/,
+    /^\.sh_history$/,
+    /^\.history$/,
+    /^\.mysql_history$/,
+    /^\.psql_history$/,
+    /^\.sqlite_history$/,
+    /^\.pip\/pip\.conf$/,
+    /^credentials\.xml$/,
+    /^secrets\/.*\.xml$/,
+    /^shadow$/,
+    /^shadow\.bak$/,
+    /^gshadow$/,
+    /^\.muttrc$/,
+    /^\.mailrc$/,
+    /^\.ircrc$/,
+    /^\.s3cfg$/,
+    /^s3cfg$/,
+    /^\.slack-token$/,
+    /^slack[-_]token$/,
+    /^\.github[-_]token$/,
+    /^github[-_]token$/,
+    /^\.netrc\.heroku$/,
+    /^\.circleci\/local[-_]config\.yml$/,
+    /^vault[-_]pass.*\.txt$/,
+    /^\.vault[-_]pass.*$/,
+    /^\.npm[-_]token$/,
+    /^settings\.xml$/,
+    /^\.m2\/settings\.xml$/,
+    /^gradle\.properties$/,
+    /^\.gradle\/gradle\.properties$/,
+    /^\.subversion\/auth\/.*$/,
+    /^Login Data$/,
+    /^Cookies$/,
+    /\/Login Data$/,
+    /\/Cookies$/,
+    /\/logins\.json$/,
+    /\/key[34]\.db$/,
+    /\.mozilla\/firefox\/.*\/logins\.json$/,
+    /\.mozilla\/firefox\/.*\/key[34]\.db$/,
+    /\.config\/chromium\/.*\/Login Data$/,
+    /\.config\/google-chrome\/.*\/Login Data$/,
+    /\.kdbx$/,
+    /\.kdb$/,
+    /^1Password\.sqlite$/,
+    /^1Password.*\.sqlite$/,
+    /\.agilekeychain\//,
+    /\.opvault\//,
+    /^password-store$/,
+    /^passwords\.kdbx$/,
+    /^keepass\.kdbx$/,
+    /^wallet\.dat$/,
+    /^default_wallet$/,
+    /^\.bitcoin\/wallet\.dat$/,
+    /^\.ethereum\/keystore\/.*$/,
+    /^\.electrum\/wallets\/.*$/,
+    /\/keystore\/UTC--.*$/,
+    /^dump\.rdb$/,
+    /^mongodb\.dump$/,
+    /\.bson$/,
+    /\.dump$/,
+    /^\.idea\/dataSources\.xml$/,
+    /^\.idea\/webServers\.xml$/,
+    /^\.idea\/deployment\.xml$/,
+    /^\.vagrant\/machines\/.*\/private_key$/,
+    /^\.vagrant\.d\/insecure_private_key$/,
+    /^cookies\.txt$/,
+    /^\.cookies$/,
+    /^session$/,
+    /^sessionid$/,
+    /^\.wget-hsts$/,
+    /^core\.\d+$/,
+    /\.core$/,
+    /\.dmp$/,
+    /\.mdmp$/,
+    /^Credentials$/,
+    /^NTUSER\.DAT$/,
+    /^SAM$/,
+    /\.keychain$/,
+    /\.keychain-db$/,
+    /\.csr$/,
+    /^oauth[-_]token.*$/,
+    /^bearer[-_]token.*$/,
+    /^jwt[-_]token.*$/,
+    /^\.token\..*$/,
+    /^api[-_]keys?\..*$/,
+    /^\.redis_history$/,
+    /^\.mongo_history$/,
+    /^\.dbshell$/,
+    /^docker-compose\.override\.yml$/,
+    /^docker-compose\..*\.yml$/,
+    /^\.gcp[-_]credentials\.json$/,
+    /^\.azure[-_]credentials$/,
+    /^\.do[-_]token$/,
+    /^\.linode[-_]token$/,
+    /^\.msmtprc$/,
+    /^\.fetchmailrc$/,
+    /^wireguard\.conf$/,
+    /^wg[0-9]+\.conf$/,
+    /\.ovpn$/,
+    /^PASSWORDS\.md$/,
+    /^SECRETS\.md$/,
+    /^CREDENTIALS\.md$/,
+    /^ACCESS\.md$/,
+    /\.asc$/,
+    /\.gpg$/,
+    /^\.ssh\/config$/,
+    /\.rdp$/,
+    /^credentials\.db$/,
+    /^credentials\.sqlite$/,
+    /\.postman_environment\.json$/,
+    /^\.ruby-env$/,
+    /^\.rbenv-vars$/,
+    /^\.python-env$/,
+    /^\.node-env$/,
+    /^\.rsync[-_]password$/,
+    /^rsync[-_]password$/,
+];

package/dist/security/ignoredPathFilter.d.ts

@@ -0,0 +1,3 @@
+export declare function shouldIgnorePath(pathToCheck: string): boolean;
+export declare function shouldIgnoreFile(fileName: string): boolean;
+export declare function shouldIgnore(fullPath: string): boolean;

package/dist/security/ignoredPathFilter.js

@@ -0,0 +1,72 @@
+import { IGNORED_PATH_PATTERNS } from './pathPatterns.js';
+import { IGNORED_FILE_PATTERNS } from './filePatterns.js';
+import { securityRegistry } from './registry.js';
+let _compiledPathRegex = null;
+let _compiledFileRegex = null;
+let _cachedVersion = -1;
+function stripNamedGroups(source) {
+    return source.replace(/\(\?<[^>]+>/g, '(?:');
+}
+function invalidateIfNeeded() {
+    const ver = securityRegistry.version;
+    if (ver !== _cachedVersion) {
+        _compiledPathRegex = null;
+        _compiledFileRegex = null;
+        _cachedVersion = ver;
+    }
+}
+function getCompiledPathRegex() {
+    invalidateIfNeeded();
+    if (!_compiledPathRegex) {
+        const extra = securityRegistry.extraIgnoredPathPatterns;
+        const all = extra.length > 0
+            ? [...IGNORED_PATH_PATTERNS, ...extra]
+            : IGNORED_PATH_PATTERNS;
+        _compiledPathRegex = new RegExp(all.map(r => stripNamedGroups(r.source)).join('|'));
+    }
+    return _compiledPathRegex;
+}
+function getCompiledFileRegex() {
+    invalidateIfNeeded();
+    if (!_compiledFileRegex) {
+        const extra = securityRegistry.extraIgnoredFilePatterns;
+        const all = extra.length > 0
+            ? [...IGNORED_FILE_PATTERNS, ...extra]
+            : IGNORED_FILE_PATTERNS;
+        _compiledFileRegex = new RegExp(all.map(r => stripNamedGroups(r.source)).join('|'));
+    }
+    return _compiledFileRegex;
+}
+export function shouldIgnorePath(pathToCheck) {
+    if (!pathToCheck || pathToCheck.trim() === '') {
+        return true;
+    }
+    const normalizedPath = normalizePathForIgnoreMatching(pathToCheck.replace(/\\/g, '/'));
+    const regex = getCompiledPathRegex();
+    const pathParts = normalizedPath.split('/');
+    for (const part of pathParts) {
+        if (regex.test(part))
+            return true;
+    }
+    return regex.test(normalizedPath);
+}
+function normalizePathForIgnoreMatching(normalizedPath) {
+    if (normalizedPath === '/private/var')
+        return '/var';
+    if (normalizedPath.startsWith('/private/var/')) {
+        return normalizedPath.slice('/private'.length);
+    }
+    return normalizedPath;
+}
+export function shouldIgnoreFile(fileName) {
+    if (!fileName || fileName.trim() === '') {
+        return true;
+    }
+    const normalizedPath = fileName.replace(/\\/g, '/');
+    const fileNameOnly = normalizedPath.split('/').pop() || '';
+    const regex = getCompiledFileRegex();
+    return regex.test(fileNameOnly) || regex.test(normalizedPath);
+}
+export function shouldIgnore(fullPath) {
+    return shouldIgnorePath(fullPath) || shouldIgnoreFile(fullPath);
+}

package/dist/security/index.d.ts

@@ -0,0 +1,16 @@
+export type { SensitiveDataPattern, SanitizationResult, ValidationResult, PathValidationResult, ToolResult, ISanitizer, } from './types.js';
+export { ContentSanitizer } from './contentSanitizer.js';
+export { maskSensitiveData } from './mask.js';
+export { PathValidator, pathValidator, resetPathValidator, } from './pathValidator.js';
+export { validateCommand } from './commandValidator.js';
+export { withSecurityValidation, withBasicSecurityValidation, configureSecurity, } from './withSecurityValidation.js';
+export type { SecurityDepsConfig } from './withSecurityValidation.js';
+export { extractResearchFields, extractRepoOwnerFromParams, } from './paramExtractors.js';
+export { shouldIgnore, shouldIgnorePath, shouldIgnoreFile, } from './ignoredPathFilter.js';
+export { redactPath } from './pathUtils.js';
+export { ALLOWED_COMMANDS, DANGEROUS_PATTERNS, PATTERN_DANGEROUS_PATTERNS, } from './securityConstants.js';
+export { IGNORED_PATH_PATTERNS } from './pathPatterns.js';
+export { IGNORED_FILE_PATTERNS } from './filePatterns.js';
+export { allRegexPatterns } from './regexes/index.js';
+export { SecurityRegistry, securityRegistry } from './registry.js';
+export type { ISecurityRegistry } from './registry.js';

package/dist/security/index.js

@@ -0,0 +1,13 @@
+export { ContentSanitizer } from './contentSanitizer.js';
+export { maskSensitiveData } from './mask.js';
+export { PathValidator, pathValidator, resetPathValidator, } from './pathValidator.js';
+export { validateCommand } from './commandValidator.js';
+export { withSecurityValidation, withBasicSecurityValidation, configureSecurity, } from './withSecurityValidation.js';
+export { extractResearchFields, extractRepoOwnerFromParams, } from './paramExtractors.js';
+export { shouldIgnore, shouldIgnorePath, shouldIgnoreFile, } from './ignoredPathFilter.js';
+export { redactPath } from './pathUtils.js';
+export { ALLOWED_COMMANDS, DANGEROUS_PATTERNS, PATTERN_DANGEROUS_PATTERNS, } from './securityConstants.js';
+export { IGNORED_PATH_PATTERNS } from './pathPatterns.js';
+export { IGNORED_FILE_PATTERNS } from './filePatterns.js';
+export { allRegexPatterns } from './regexes/index.js';
+export { SecurityRegistry, securityRegistry } from './registry.js';

package/dist/security/mask.d.ts

@@ -0,0 +1 @@
+export declare function maskSensitiveData(text: string): string;

package/dist/security/mask.js

@@ -0,0 +1,49 @@
+import { nativeMaskSensitiveData } from './native.js';
+import { securityRegistry } from './registry.js';
+import { maskEveryOtherChar } from './maskUtils.js';
+function applyJsMask(text, patterns) {
+    const applicable = patterns.filter(p => !p.fileContext);
+    if (applicable.length === 0)
+        return text;
+    const matches = [];
+    for (const p of applicable) {
+        p.regex.lastIndex = 0;
+        let m;
+        const re = new RegExp(p.regex.source, p.regex.flags.replace('g', '') + 'g');
+        while ((m = re.exec(text)) !== null) {
+            matches.push({ start: m.index, end: m.index + m[0].length });
+            if (m[0].length === 0)
+                re.lastIndex++;
+        }
+    }
+    if (matches.length === 0)
+        return text;
+    matches.sort((a, b) => a.start - b.start);
+    const deduped = [];
+    let lastEnd = 0;
+    for (const m of matches) {
+        if (m.start >= lastEnd) {
+            deduped.push(m);
+            lastEnd = m.end;
+        }
+    }
+    let result = text;
+    for (let i = deduped.length - 1; i >= 0; i--) {
+        const { start, end } = deduped[i];
+        result =
+            result.slice(0, start) +
+                maskEveryOtherChar(text.slice(start, end)) +
+                result.slice(end);
+    }
+    return result;
+}
+export function maskSensitiveData(text) {
+    if (!text)
+        return text;
+    let result = nativeMaskSensitiveData(text);
+    const extra = securityRegistry.extraSecretPatterns;
+    if (extra.length > 0) {
+        result = applyJsMask(result, extra);
+    }
+    return result;
+}

package/dist/security/maskUtils.d.ts

@@ -0,0 +1 @@
+export declare function maskEveryOtherChar(text: string): string;

package/dist/security/maskUtils.js

@@ -0,0 +1,7 @@
+export function maskEveryOtherChar(text) {
+    let result = '';
+    for (let i = 0; i < text.length; i++) {
+        result += i % 2 === 0 ? '*' : text[i];
+    }
+    return result;
+}

package/dist/security/native.d.ts

@@ -0,0 +1,9 @@
+export interface NativeSanitizationResult {
+    content: string;
+    hasSecrets: boolean;
+    secretsDetected: string[];
+    warnings: string[];
+}
+export declare const nativeSanitizeContent: (content: string, filePath: string | null) => NativeSanitizationResult;
+export declare const nativeMaskSensitiveData: (text: string) => string;
+export declare const nativePatternCount: () => number;