@oracle-agent/oracle 0.14.0 → 0.14.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oracle-agent/oracle",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Oracle: standalone prepare-only multichain agent control plane with optional Hermes integration. Policy-bounded intents for a user-signed wallet; the public package never takes your key.",
   "license": "BUSL-1.1",
   "type": "module",

package/scripts/secret-scan.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 // Pre-publication secret scan. Fails CLOSED: any hit is an error.
 //
-// Checks the working tree AND every blob in git history, because a secret
-// removed in a later commit is still public the moment the repo is.
+// Checks the working tree and every blob reachable from HEAD. Set
+// ORACLE_SCAN_ALL_REFS=1 for an explicit audit of every fetched ref.
 
 import { execFileSync } from "node:child_process";
 import { validateMnemonic } from "@scure/bip39";
@@ -64,6 +64,7 @@ const ALLOWED_VALUES = [
 
 const PUBLIC_EMAIL_RE = /^(?:[0-9]+\+)?[a-z0-9_.-]+\[?bot\]?@users\.noreply\.github\.com$|^oracle@users\.noreply\.github\.com$|^noreply@github\.com$/i;
 const PRIVATE_EMAIL_RE = /@(gmail|icloud|me|yahoo|outlook|hotmail|protonmail)\.com$|@(local|gmk)$|^fleet@|^agent@/i;
+const HISTORY_SCOPE = process.env.ORACLE_SCAN_ALL_REFS === "1" ? "--all" : "HEAD";
 
 function sh(cmd, args) {
   return execFileSync(cmd, args, { cwd: ROOT, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
@@ -99,7 +100,7 @@ function parseEmail(identity) {
 }
 
 function scanIdentities(findings) {
-  const identities = new Set(sh("git", ["log", "--all", "--format=%an <%ae>|%cn <%ce>"]).split(/[\n|]/).filter(Boolean));
+  const identities = new Set(sh("git", ["log", HISTORY_SCOPE, "--format=%an <%ae>|%cn <%ce>"]).split(/[\n|]/).filter(Boolean));
   for (const identity of identities) {
     const email = parseEmail(identity);
     if (!email) continue;
@@ -128,7 +129,7 @@ for (const rel of tracked) {
 }
 
 // --- 2. every blob in history ---
-const revs = sh("git", ["rev-list", "--all"]).split("\n").filter(Boolean);
+const revs = sh("git", ["rev-list", HISTORY_SCOPE]).split("\n").filter(Boolean);
 const seen = new Set();
 let historyBlobs = 0;
 for (const rev of revs) {

package/src/cli/commands/plugins.mjs

@@ -20,6 +20,8 @@ import { spawnSync } from "node:child_process";
 import { oracleConfigDir } from "../paths.mjs";
 import { loadPlugin, scanInstalledPlugins, SCHEMA_ID } from "../../plugins/agent-plugin-loader.mjs";
 
+const INSTALLED_PLUGIN_NAME_RE = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;
+
 function pluginsDir() {
   const dir = path.join(oracleConfigDir(), "plugins");
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
@@ -124,12 +126,44 @@ function cmdRemove(name) {
     return 1;
   }
 
-  const dest = path.join(pluginsDir(), name);
+  if (!INSTALLED_PLUGIN_NAME_RE.test(name) || path.basename(name) !== name || path.isAbsolute(name)) {
+    process.stderr.write(`invalid plugin name "${name}"\n`);
+    return 1;
+  }
+
+  const root = pluginsDir();
+  const rootStat = fs.lstatSync(root);
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    process.stderr.write("refusing to remove plugin: plugin root is not a regular directory\n");
+    return 1;
+  }
+
+  const dest = path.resolve(root, name);
+  const relative = path.relative(root, dest);
+  if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    process.stderr.write(`invalid plugin name "${name}"\n`);
+    return 1;
+  }
+
   if (!fs.existsSync(dest)) {
     process.stderr.write(`plugin "${name}" not found\n`);
     return 1;
   }
 
+  const stat = fs.lstatSync(dest);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    process.stderr.write(`refusing to remove plugin "${name}": path is not a regular plugin directory\n`);
+    return 1;
+  }
+
+  const rootReal = fs.realpathSync(root);
+  const destReal = fs.realpathSync(dest);
+  const realRelative = path.relative(rootReal, destReal);
+  if (!realRelative || realRelative === ".." || realRelative.startsWith(`..${path.sep}`) || path.isAbsolute(realRelative)) {
+    process.stderr.write(`refusing to remove plugin "${name}": path escapes the plugin directory\n`);
+    return 1;
+  }
+
   fs.rmSync(dest, { recursive: true, force: true });
   process.stdout.write(`removed plugin "${name}"\n`);
   return 0;

package/src/cli/operator-dispatch.mjs

@@ -38,25 +38,6 @@ export const OPERATOR_NOT_INSTALLED_MESSAGE = `oracle: signing is unavailable in
 export const SIGN_HINT =
   "hint: run 'oracle sign init' to provision keys, or 'oracle sign doctor --json' for detail.";
 
-function whichOnPath(binName) {
-  const pathEnv = process.env.PATH || "";
-  const parts = pathEnv.split(path.delimiter).filter(Boolean);
-  const exts = process.platform === "win32" ? ["", ".cmd", ".exe", ".bat"] : [""];
-  for (const dir of parts) {
-    for (const ext of exts) {
-      const candidate = path.join(dir, binName + ext);
-      try {
-        if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) {
-          return candidate;
-        }
-      } catch {
-        // ignore
-      }
-    }
-  }
-  return null;
-}
-
 function binsFromDir(binDir) {
   const bins = {};
   for (const name of OPERATOR_BIN_NAMES) {
@@ -132,47 +113,6 @@ function tryResolvePackage(fromPaths) {
   return null;
 }
 
-function tryCapsOnPath() {
-  const capsBin = whichOnPath("oracle-operator-caps");
-  if (!capsBin) return null;
-  const r = spawnSync(capsBin, [], {
-    encoding: "utf8",
-    timeout: 5000,
-    env: process.env,
-  });
-  if (r.status !== 0 || !r.stdout) return null;
-  try {
-    const report = JSON.parse(r.stdout);
-    if (!report || typeof report !== "object" || !report.bins) return null;
-    return {
-      ok: true,
-      binDir: path.dirname(Object.values(report.bins)[0] || capsBin),
-      version: report.version || "unknown",
-      bins: report.bins,
-      source: "caps-path",
-      controlMcp: report.controlMcp,
-    };
-  } catch {
-    return null;
-  }
-}
-
-function tryPathProbe() {
-  const bins = {};
-  for (const name of OPERATOR_BIN_NAMES) {
-    const hit = whichOnPath(name);
-    if (hit) bins[name] = hit;
-  }
-  if (!Object.keys(bins).length) return null;
-  return {
-    ok: true,
-    binDir: path.dirname(Object.values(bins)[0]),
-    version: "unknown",
-    bins,
-    source: "path-probe",
-  };
-}
-
 export function resolveOperator() {
   if (process.env.ORACLE_PUBLIC_DESKTOP === "1") return { ok: false, source: "public-desktop" };
   const envDir = process.env.ORACLE_OPERATOR_BIN_DIR;
@@ -193,10 +133,7 @@ export function resolveOperator() {
     return { ok: true, binDir: abs, version, bins, source: "env:ORACLE_OPERATOR_BIN_DIR" };
   }
 
-  const fromPkg =
-    tryResolvePackage([process.cwd(), PACKAGE_ROOT]) ||
-    tryCapsOnPath() ||
-    tryPathProbe();
+  const fromPkg = tryResolvePackage([process.cwd(), PACKAGE_ROOT]);
   return fromPkg || { ok: false };
 }