@programinglive/dev-workflow-mcp-server 1.12.1 → 1.13.0

package/security/audit.js

@@ -0,0 +1,86 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { scanSecrets } from './scanner.js';
+import { classify,securityMode } from './policy.js';
+import { sanitize } from './sanitizer.js';
+import { isProtectedFile,protectedFileMetadata } from './files.js';
+import { databaseConnectionUrl } from './config.js';
+
+export async function auditDatabase({root,userId,projectPath=root,env=process.env}) {
+  const type=env.DEV_WORKFLOW_DB_TYPE || 'sqlite';
+  const issues=[]; let close=async()=>{}; let query;
+  try {
+    if(type==='sqlite') {
+      const dbPath=env.DEV_WORKFLOW_DB_PATH || path.join(root,'.state','dev-workflow.db');
+      try {await fs.access(dbPath);} catch{return {status:'not_present',issues:[]};}
+      const {default:Database}=await import('better-sqlite3');
+      const db=new Database(dbPath,{readonly:true,fileMustExist:true});
+      close=async()=>db.close();
+      query=async(table)=>db.prepare(`SELECT * FROM ${table} WHERE user_id = ? AND project_path = ? LIMIT 1001`).all(userId,projectPath);
+    } else if(['postgres','postgresql'].includes(type)) {
+      const {default:pg}=await import('pg');
+      const pool=new pg.Pool({connectionString:databaseConnectionUrl(env),connectionTimeoutMillis:3000});
+      close=()=>pool.end();
+      const {PostgresAdapter}=await import('../db/adapters/postgres.js');
+      const numericId=new PostgresAdapter().getNumericUserId(userId);
+      query=async(table)=>(await pool.query(`SELECT * FROM ${table} WHERE user_id = $1 AND project_path = $2 LIMIT 1001`,[numericId,projectPath])).rows;
+    } else if(type==='mysql') {
+      const {default:mysql}=await import('mysql2/promise');
+      const connection=await mysql.createConnection(databaseConnectionUrl(env));
+      close=()=>connection.end();
+      query=async(table)=>(await connection.execute(`SELECT * FROM ${table} WHERE user_id = ? AND project_path = ? LIMIT 1001`,[userId,projectPath]))[0];
+    } else return {status:'unsupported',issues:[]};
+    let rows_scanned=0,truncated=false;
+    const unavailable_tables=[];
+    for(const table of ['workflow_history','workflow_state','project_summary']) {
+      try {
+        const rows=await query(table); truncated ||= rows.length>1000;
+        for(const [index,row] of rows.slice(0,1000).entries()) {
+          rows_scanned++;
+          const findings=scanSecrets(row);
+          if(findings.length || classify(row)==='SECRET') issues.push({table,row_number:index+1,findings,detected_sensitivity:'SECRET'});
+        }
+      } catch {unavailable_tables.push(table);}
+    }
+    return {status:unavailable_tables.length?'partial':'scanned',rows_scanned,truncated,unavailable_tables,scope:'current user and project only',issues};
+  } catch {return {status:'unavailable',issues,remediation:'Verify database configuration and read permissions in a trusted operator session.'};}
+  finally {await close().catch(()=>{});}
+}
+
+export async function securityAudit({root,state={},stateFile,userId='default',env=process.env}) {
+  const report={mode:securityMode(env),status:'review_required',protected_files:[],potential_exposures:[],configuration:[],scan:{files_scanned:0,truncated:false,unreadable:0}};
+  const inspect=(source,value)=>{
+    const findings=scanSecrets(value);
+    if(findings.length || classify(value)==='SECRET') report.potential_exposures.push({source,findings,detected_sensitivity:'SECRET'});
+  };
+  inspect('in-memory knowledge',state);
+  // Scan only the current user's state artifacts; never enumerate other users' state.
+  if(stateFile) for(const file of [stateFile,path.join(path.dirname(stateFile),'project-summary.json')]) {
+    try {inspect('current-user knowledge artifact',JSON.parse(await fs.readFile(file,'utf8')));}catch {report.scan.unreadable++;}
+  }
+  const skip=new Set(['.git','node_modules','.state','dist','build','out','.next','.worktrees','.superpowers']);
+  async function walk(dir,depth=0) {
+    if(depth>12 || report.scan.files_scanned>=500) {report.scan.truncated=true;return;}
+    let entries;try{entries=await fs.readdir(dir,{withFileTypes:true});}catch{report.scan.unreadable++;return;}
+    for(const entry of entries) {
+      const file=path.join(dir,entry.name);
+      if(entry.isSymbolicLink()) continue;
+      if(entry.isDirectory()) {if(!skip.has(entry.name)) await walk(file,depth+1);continue;}
+      if(isProtectedFile(file)) {try{report.protected_files.push(await protectedFileMetadata(file));}catch{report.scan.unreadable++;}continue;}
+      if(!/\.(?:md|json|[cm]?js|tsx?|ya?ml|sh|ps1|toml)$/i.test(file)||entry.name.endsWith('lock.json'))continue;
+      if(report.scan.files_scanned>=500){report.scan.truncated=true;break;}
+      try {
+        const stat=await fs.stat(file);
+        if(stat.size>1024*1024){report.scan.truncated=true;continue;}
+        report.scan.files_scanned++;
+        inspect(path.relative(root,file),await fs.readFile(file,'utf8'));
+      }catch{report.scan.unreadable++;}
+    }
+  }
+  await walk(root);
+  if(env.DEV_WORKFLOW_DB_URL) report.configuration.push({issue:'legacy_database_configuration',remediation:'Use DEV_WORKFLOW_DB_URL_ENV and provision its target outside client JSON.'});
+  for(const name of ['JWT_SECRET','SESSION_SECRET']) if(!env[name]) report.configuration.push({issue:'signing_secret_not_configured',variable:name,scope:'required only when running the corresponding web authentication server'});
+  report.database=await auditDatabase({root,userId,env});
+  report.recommendations=['Review candidates in a trusted session; no detected values are returned.','Rotate exposed credentials before reviewing historical Git cleanup.','Replace raw credentials with SecretReference; protect backups and external logs.'];
+  return sanitize(report);
+}

package/security/commands.js

@@ -0,0 +1,10 @@
+export function assertSafeToolCommand(name,args) {
+  const command=name==='perform_release'?args.command:name==='run_full_workflow'?args.releaseCommand:undefined;
+  if(command && !/^(?:(?:major|minor|patch)|npm(?:\.cmd)? run release(?::(?:major|minor|patch))?(?: -- (?:--release-as (?:major|minor|patch)|--first-release))?)$/.test(command.trim())) {
+    const error=new Error('Strict mode permits npm run release[:major|minor|patch] only. Arbitrary shell commands and file reads are denied. Run custom release actions in a trusted operator session.');
+    error.code='UNSAFE_COMMAND_DENIED'; throw error;
+  }
+  if(args.branch && !/^[A-Za-z0-9][A-Za-z0-9._\/-]*$/.test(args.branch)) {
+    const error=new Error('Unsafe branch syntax denied');error.code='UNSAFE_COMMAND_DENIED';throw error;
+  }
+}

package/security/config.js

@@ -0,0 +1,24 @@
+import { safeLog } from './sanitizer.js';
+import { securityMode } from './policy.js';
+import { registerRuntimeSecret } from './runtime-secrets.js';
+
+export function databaseConnectionUrl(env=process.env) {
+  securityMode(env);
+  const variable=env.DEV_WORKFLOW_DB_URL_ENV;
+  if(variable) {
+    if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(variable)) throw new Error('DEV_WORKFLOW_DB_URL_ENV must name an environment variable');
+    if(!env[variable]) throw new Error('Referenced database environment variable is missing');
+    registerRuntimeSecret(env[variable]);
+    return env[variable];
+  }
+  if(env.DEV_WORKFLOW_DB_URL) safeLog('warn','DEV_WORKFLOW_DB_URL is deprecated; configure DEV_WORKFLOW_DB_URL_ENV outside client configuration.');
+  registerRuntimeSecret(env.DEV_WORKFLOW_DB_URL);
+  return env.DEV_WORKFLOW_DB_URL;
+}
+
+export function requireSigningSecret(name,env=process.env) {
+  const value=env[name];
+  if(!value || value.length<32 || /change[-_ ]?(?:me|in|this|production)|dev-workflow.*secret/i.test(value)) throw new Error('Configure a strong authentication signing secret outside the knowledge system');
+  registerRuntimeSecret(value);
+  return value;
+}

package/security/files.js

@@ -0,0 +1,27 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertSafeKnowledge } from './policy.js';
+import { sanitize } from './sanitizer.js';
+
+export function isProtectedFile(file) {
+  const normalized=String(file).replaceAll('\\','/').toLowerCase();
+  const name=normalized.split('/').at(-1);
+  return /^\.env(?:\.|$)/.test(name) || /^(?:credentials|service[-_]account).*\.json$/.test(name) ||
+    /^(?:id_rsa|id_ed25519|id_dsa|id_ecdsa)(?:\.|$)/.test(name) || /\.(?:pem|key|p12|pfx)$/.test(name) ||
+    /^(?:\.npmrc|\.git-credentials|\.netrc|_netrc|application_default_credentials\.json)$/.test(name) || normalized.includes('/.docker/') || normalized.includes('/.ssh/') || normalized.includes('/.aws/') || normalized.includes('/.kube/') || normalized.includes('/gcloud/');
+}
+export async function protectedFileMetadata(file) {
+  const resolved=await fs.realpath(file);
+  const stat=await fs.stat(resolved);
+  return sanitize({path:file,protected:isProtectedFile(file)||isProtectedFile(resolved),size_bytes:stat.size,kind:stat.isFile()?'file':'directory',content:'[OMITTED]'});
+}
+export async function readKnowledgeFile(file) {
+  const metadata=await protectedFileMetadata(file);
+  if(metadata.protected) return metadata;
+  // Refuse links entirely: do not race a link replacement between check and read.
+  const stat=await fs.lstat(file);
+  if(stat.isSymbolicLink() || !stat.isFile() || stat.size>1024*1024) throw new Error('Knowledge file is not an eligible regular file');
+  const content=await fs.readFile(file,'utf8');
+  assertSafeKnowledge({path:file,content});
+  return {path:file,classification:'INTERNAL',content};
+}

package/security/http.js

@@ -0,0 +1,26 @@
+import { securityOutputFilter } from './sanitizer.js';
+import { assertSafeKnowledge } from './policy.js';
+
+export function securityJsonMiddleware(req,res,next) {
+  const json=res.json.bind(res);
+  res.json=value=>json(securityOutputFilter(value));
+  next();
+}
+export function knowledgeInputMiddleware(req,res,next) {
+  try {assertSafeKnowledge(req.body);next();}
+  catch(error) {
+    res.status(422).json({error:'Knowledge input rejected; use SecretReference.',findings:error.findings || []});
+  }
+}
+
+// Authentication is a runtime boundary, separate from knowledge responses.
+export const AUTH_COOKIE='dev_workflow_auth';
+export function authenticationToken(req) {
+  const header=req.headers.authorization;
+  if(typeof header==='string' && header.startsWith('Bearer ')) return header.slice(7);
+  const cookie=String(req.headers.cookie || '').split(';').map(v=>v.trim()).find(v=>v.startsWith(AUTH_COOKIE+'='));
+  try{return cookie ? decodeURIComponent(cookie.slice(AUTH_COOKIE.length+1)) : null;}catch{return null;}
+}
+export function authCookieOptions(production=true) {
+  return {httpOnly:true,secure:production,sameSite:production?'none':'lax',path:'/',maxAge:30*24*60*60*1000};
+}

package/security/log-bridge.cjs

@@ -0,0 +1,17 @@
+// Node 20-compatible CommonJS bridge to the single ESM security implementation.
+const pending=new Set();
+let security;
+const ready=Promise.all([import('./sanitizer.js'),import('./policy.js')]).then(([logging,policy])=>{security={...logging,...policy};});
+function safeLog(level,...values) {
+  const operation=ready.then(()=>security.safeLog(level,...values)).catch(()=>process.stderr.write('[REDACTED: logging unavailable]\n'));
+  pending.add(operation); operation.finally(()=>pending.delete(operation));
+}
+async function flushLogs(){await Promise.all([...pending]);}
+function assertSafeKnowledge(value){if(!security)throw new Error('Security initialization required; await log-bridge.ready');return security.assertSafeKnowledge(value);}
+function spawnLogged(command,args,options={}) {
+  const result=require('node:child_process').spawnSync(command,args,{...options,stdio:'pipe',encoding:'utf8',maxBuffer:16*1024*1024});
+  if(result.stdout)safeLog('info',result.stdout);
+  if(result.stderr)safeLog('error',result.stderr);
+  return result;
+}
+module.exports={ready,safeLog,flushLogs,assertSafeKnowledge,spawnLogged};

package/security/policy.js

@@ -0,0 +1,37 @@
+import { scanSecrets } from './scanner.js';
+
+export const CLASSIFICATIONS=Object.freeze(['PUBLIC','INTERNAL','CONFIDENTIAL','SECRET']);
+export function securityMode(env=process.env) {
+  const mode=env.DEV_WORKFLOW_SECURITY_MODE || 'strict';
+  if(mode!=='strict') throw new Error('Only strict DEV_WORKFLOW_SECURITY_MODE is supported');
+  return mode;
+}
+export function classify(value) {
+  if(scanSecrets(value).length) return 'SECRET';
+  let rank=value && typeof value==='object' && (value.classification || value.sensitivity) ? 0 : 1; const seen=new WeakSet();
+  function visit(item) {
+    if(typeof item==='string' && /^[\s]*[\[{]/.test(item)) {try{visit(JSON.parse(item));}catch{} return;}
+    if(!item||typeof item!=='object'||seen.has(item)) return; seen.add(item);
+    for(const key of ['classification','sensitivity']) {
+      if(item[key]!==undefined) {
+        const index=CLASSIFICATIONS.indexOf(String(item[key]).toUpperCase());
+        if(index<0) throw new Error('Unknown knowledge classification');
+        rank=Math.max(rank,index);
+      }
+    }
+    for(const child of Object.values(item)) visit(child);
+  }
+  visit(value); return CLASSIFICATIONS[rank];
+}
+export class SecretContentError extends Error {
+  constructor(findings=[]) {
+    super('Secret content denied. Replace credential material with a SecretReference.');
+    this.code='SECRET_CONTENT_DENIED'; this.findings=findings;
+  }
+}
+export function assertSafeKnowledge(value) {
+  securityMode();
+  const findings=scanSecrets(value);
+  if(findings.length || classify(value)==='SECRET') throw new SecretContentError(findings);
+  return value;
+}

package/security/references.js

@@ -0,0 +1,21 @@
+const PROVIDERS = new Set(['env','op','vault','aws-secrets','gcp-secret','bitwarden']);
+
+export class SecretReference {
+  constructor(uri) {
+    if (typeof uri !== 'string' || uri.length > 512) throw new Error('Invalid SecretReference');
+    const match = /^([a-z-]+):\/\/([A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*)$/.exec(uri);
+    if (!match || !PROVIDERS.has(match[1]) || (match[1] === 'env' && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(match[2])) || match[2].split('/').some(p=>p==='.'||p==='..')) {
+      throw new Error('Invalid SecretReference; use a supported provider URI without credentials');
+    }
+    this.uri = uri;
+    this.provider = match[1];
+    Object.freeze(this);
+  }
+}
+
+export function isSecretReference(value) {
+  try { new SecretReference(value); return true; } catch { return false; }
+}
+
+// Metadata only. Deliberately no resolve(), fetch(), or provider credential API.
+export const secretProviders = Object.freeze([...PROVIDERS]);

package/security/runtime-secrets.js

@@ -0,0 +1,42 @@
+// Runtime-only redaction memory. Never serialize this set or expose a resolver.
+const material=new Set();
+let scanValues=null;
+export function registerRuntimeSecret(value) {
+  if(typeof value==='string' && value.length>0) {
+    material.add(value);
+    scanValues=null;
+    try{const url=new URL(value);if(url.password){material.add(url.password);material.add(decodeURIComponent(url.password));}}catch{}
+  }
+}
+export function prepareRuntimeSecretScan() {
+  // Environment is inspected locally, never returned/logged/stored. This also
+  // covers opaque credential formats not recognized by provider patterns.
+  const values=[...material];
+  for(const [name,value] of Object.entries(process.env)) {
+    if(/(?:PASSWORD|PASSWD|TOKEN|SECRET|API[_-]?KEY|PRIVATE[_-]?KEY|DATABASE_URL|DEV_WORKFLOW_DB_URL$)/i.test(name) && !/(?:_ENV|_MODE|_REF)$/.test(name) && value && !/^(?:env|op|vault|aws-secrets|gcp-secret|bitwarden):\/\//.test(value)) values.push(value);
+  }
+  scanValues=[...new Set(values)].sort((a,b)=>b.length-a.length);
+}
+export function runtimeSecretSpans(text) {
+  const spans=[];
+  if(!scanValues)prepareRuntimeSecretScan();
+  for(const value of scanValues) if(value) {
+    let offset=0,index;
+    while((index=text.indexOf(value,offset))>=0) {
+      const before=text[index-1]||'',after=text[index+value.length]||'';
+      if(value.length>=8 || (!/[A-Za-z0-9_]/.test(before) && !/[A-Za-z0-9_]/.test(after))) spans.push({start:index,end:index+value.length,type:'known_runtime_credential',severity:'high'});
+      offset=index+value.length;
+    }
+  }
+  return spans;
+}
+export function redactRuntimeSecrets(text) {
+  let out='',cursor=0;
+  for(const span of runtimeSecretSpans(text).sort((a,b)=>a.start-b.start || b.end-a.end)) {
+    if(span.end<=cursor)continue;
+    if(span.start<cursor){cursor=span.end;continue;}
+    out+=text.slice(cursor,span.start)+'[REDACTED]';cursor=span.end;
+  }
+  out+=text.slice(cursor);
+  return out;
+}

package/security/sanitizer.js

@@ -0,0 +1,42 @@
+import { REDACTED, redactText, isSensitiveKey, isSafeValue, isWorkflowSessionField } from './scanner.js';
+import { redactRuntimeSecrets,prepareRuntimeSecretScan } from './runtime-secrets.js';
+
+export function sanitize(value) {
+  prepareRuntimeSecretScan();
+  const seen=new WeakSet();
+  function clean(item,depth=0) {
+    if(depth>64) return '[OMITTED]';
+    if(typeof item==='string') {
+      const trimmed=item.trim();
+      if(trimmed.startsWith('{')||trimmed.startsWith('[')) {
+        try { return JSON.stringify(clean(JSON.parse(item),depth+1)); } catch { /* text */ }
+      }
+      return redactRuntimeSecrets(redactText(item));
+    }
+    if(typeof item==='bigint') return String(item);
+    if(typeof item==='function'||typeof item==='symbol') return '[OMITTED]';
+    if(item===null||typeof item!=='object') return item;
+    if(seen.has(item)) return '[CIRCULAR]'; seen.add(item);
+    if(item instanceof Date) return Date.prototype.toISOString.call(item);
+    if(Buffer.isBuffer(item)||ArrayBuffer.isView(item)) return '[BINARY OMITTED]';
+    if([item.classification,item.sensitivity].some(label=>label!==undefined && !['PUBLIC','INTERNAL','CONFIDENTIAL'].includes(String(label).toUpperCase()))) return {classification:'SECRET',content:REDACTED};
+    if(item instanceof Error) return {name:'Error',message:clean(item.message,depth+1)};
+    const out=Array.isArray(item)?[]:{};
+    for(const [key,descriptor] of Object.entries(Object.getOwnPropertyDescriptors(item))) {
+      if(key==='length' && Array.isArray(item)) continue;
+      const safeKey=redactRuntimeSecrets(redactText(key));
+      const child='value' in descriptor ? descriptor.value : REDACTED;
+      Object.defineProperty(out,safeKey,{value:isSensitiveKey(key)&&!isSafeValue(child)&&!isWorkflowSessionField(key,child)?REDACTED:clean(child,depth+1),enumerable:true,writable:true,configurable:true});
+    }
+    return out;
+  }
+  try {return clean(value);} catch {return '[REDACTED: inspection failed]';}
+}
+
+export const securityOutputFilter = sanitize;
+
+export function safeLog(level,...values) {
+  const last=values.at(-1);
+  const sink=last && typeof last.write==='function' ? values.pop() : process.stderr;
+  try {sink.write(JSON.stringify(sanitize({level,values}))+'\n');} catch {sink.write('[REDACTED: logging failed]\n');}
+}

package/security/scanner.js

@@ -0,0 +1,108 @@
+import { isSecretReference, SecretReference } from './references.js';
+import { runtimeSecretSpans,prepareRuntimeSecretScan } from './runtime-secrets.js';
+
+export const REDACTED = '[REDACTED]';
+const sensitiveName = /(?:^|[_\-.])(?:password|passwd|pwd|secret|token|api[_-]?key|authorization|cookie|session|credential|private[_-]?key|connection[_-]?string)(?:$|[_\-.])/i;
+export function isSensitiveKey(key) {
+  if(/^(?:secret_type|secret_provider|provider|token_count)$/i.test(key)) return false;
+  const normalized=String(key).replace(/([a-z])([A-Z])/g,'$1_$2');
+  return sensitiveName.test(normalized) || /^(?:AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|DATABASE_URL|DEV_WORKFLOW_DB_URL|accessToken|refreshToken|clientSecret|passwordHash|set-cookie)$/i.test(key);
+}
+export function isSafeValue(value) {
+  if(value && typeof value==='object' && typeof value.uri==='string' && Object.keys(value).every(k=>['uri','provider'].includes(k)) && isSecretReference(value.uri) && (!value.provider||value.provider===value.uri.split('://')[0])) return true;
+  return value instanceof SecretReference || value === '' || value == null || typeof value === 'boolean' ||
+    (typeof value === 'string' && (isSecretReference(value) || /^(?:\[REDACTED\]|\*{3,}|<[^<>\r\n]+>|\$\{[A-Z_][A-Z0-9_]*\})$/.test(value)));
+}
+
+export function isWorkflowSessionField(key,value) {
+  return key==='session' && value && typeof value==='object' &&
+    ['active','review','blocked','paused','completed','ended'].includes(value.state);
+}
+
+const patterns = [
+  ['private_key', /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[\s\S]*?(?:-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----|$)/g],
+  ['ssh_key', /\b(?:ssh-rsa|ssh-ed25519|ecdsa-sha2-\S+)\s+[A-Za-z0-9+/=]{40,}(?:[^\r\n]*)/g],
+  ['github_token', /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g],
+  ['aws_access_key', /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g],
+  ['api_key', /\b(?:sk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}|[sr]k_(?:live|test)_[A-Za-z0-9]{16,}|AIza[A-Za-z0-9_-]{30,}|xox[baprs]-[A-Za-z0-9-]{16,}|v1\.0-[A-Za-z0-9_-]{30,})\b/g],
+  ['oauth_token', /\b(?:ya29\.[A-Za-z0-9_-]{20,}|glpat-[A-Za-z0-9_-]{20,})\b/g],
+  ['jwt', /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{8,}\b/g],
+  ['connection_credentials', /\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:([^\s@/]+)@/gid, 1],
+  ['authorization', /\b(?:authorization|proxy-authorization)\s*["']?\s*[:=]\s*["']?((?:(?:Bearer|Basic|Token)\s+)?[^\r\n,"'}]+)/gid, 1],
+  ['bearer_token', /\bBearer\s+([A-Za-z0-9_.~+\/-]+=*)/gid, 1],
+  ['cookie', /\b(?:set-cookie|cookie)\s*["']?\s*[:=]\s*["']?([^\r\n"'}]+)/gid, 1],
+  ['sensitive_assignment', /\b([A-Za-z_][\w.-]*(?:PASSWORD|PASSWD|PWD|TOKEN|SECRET|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIAL|DATABASE_URL|SESSION)[\w.-]*|password|passwd|pwd|token|secret|api[_-]?key|authorization|cookie|access_token|refresh_token|session(?:_id)?)\s*["']?\s*[:=]\s*(?:"([^"\r\n]*)"|'([^'\r\n]*)'|([^\s,;<>}]+))/gid, 'assignment'],
+];
+
+export function entropy(value) {
+  const counts={}; for(const c of value) counts[c]=(counts[c]||0)+1;
+  return Object.values(counts).reduce((sum,n)=>sum-(n/value.length)*Math.log2(n/value.length),0);
+}
+
+export function secretSpans(text) {
+  if(isSecretReference(text)) return [];
+  const references=[...text.matchAll(/\b[a-z-]+:\/\/[^\s,"'<>]+/g)].filter(m=>isSecretReference(m[0])).map(m=>[m.index,m.index+m[0].length]);
+  const found=runtimeSecretSpans(text);
+  for (const [type,re,group] of patterns) {
+    re.lastIndex=0;
+    for(const match of text.matchAll(re)) {
+      const index=group==='assignment' ? [2,3,4].find(i=>match[i]!==undefined) : group;
+      let start=index ? match.indices[index][0] : match.index;
+      let end=index ? match.indices[index][1] : match.index+match[0].length;
+      if(references.some(([a,b])=>match.index>=a && end<=b)) continue;
+      const value=text.slice(start,end);
+      if(type==='authorization' && /^(?:Bearer|Basic|Token)\s+\[REDACTED\]$/i.test(value)) continue;
+      if(type==='sensitive_assignment' && /^(?:authorization|cookie)$/i.test(match[1])) continue;
+      if (isSafeValue(value)) continue;
+      if(type==='authorization' && /^(Bearer|Basic|Token)\s+/i.test(value)) start+=value.match(/^\S+\s+/)[0].length;
+      found.push({start,end,type,severity:type==='private_key'?'critical':'high'});
+    }
+  }
+  // Context-only entropy: avoid flagging commit hashes, IDs, URLs and arbitrary prose.
+  for (const m of text.matchAll(/\b(?:key|credential)\s*[:=]\s*([A-Za-z0-9_+\/-]{24,})/gid)) {
+    if(!isSafeValue(m[1]) && entropy(m[1])>=3.5) found.push({start:m.indices[1][0],end:m.indices[1][1],type:'high_entropy_credential',severity:'high'});
+  }
+  return found;
+}
+
+export function redactText(text) {
+  const spans=secretSpans(text).sort((a,b)=>a.start-b.start || b.end-a.end);
+  let out='',cursor=0;
+  for(const span of spans) {
+    if(span.end<=cursor) continue;
+    if(span.start<cursor) {cursor=span.end; continue;}
+    out+=text.slice(cursor,span.start)+REDACTED; cursor=span.end;
+  }
+  return out+text.slice(cursor);
+}
+
+export function scanSecrets(value) {
+  prepareRuntimeSecretScan();
+  const findings=[],seen=new WeakSet();
+  const add=(type,location,severity='high')=>findings.push({type,location:redactText(location),severity,sanitized_preview:REDACTED,suggested_secret_ref:'env://REQUIRED_CREDENTIAL'});
+  function visit(item,location='$',depth=0) {
+    if(depth>64) { add('inspection_limit',location); return; }
+    if(typeof item==='function' || typeof item==='symbol') {add('executable_knowledge',location);return;}
+    if(typeof item==='string') {
+      const trimmed=item.trim();
+      if(trimmed.startsWith('{')||trimmed.startsWith('[')) {
+        try {visit(JSON.parse(item),location,depth+1);return;} catch { /* scan text */ }
+      }
+      for(const span of secretSpans(item)) add(span.type,`${location}:line ${item.slice(0,span.start).split('\n').length}`,span.severity);
+    } else if(item && typeof item==='object') {
+      if(seen.has(item)) return; seen.add(item);
+      const prototype=Object.getPrototypeOf(item);
+      if(![Object.prototype,Array.prototype,Date.prototype,Error.prototype,SecretReference.prototype,null].includes(prototype)) add('unsupported_knowledge_type',location);
+      if(item instanceof Error) visit(item.message,`${location}.message`,depth+1);
+      for(const [key,descriptor] of Object.entries(Object.getOwnPropertyDescriptors(item))) {
+        const childLocation=`${location}.${redactText(key)}`;
+        visit(key,`${location}.[key]`,depth+1);
+        if(!('value' in descriptor)) {add('uninspectable_property',childLocation);continue;}
+        const child=descriptor.value;
+        if(isSensitiveKey(key) && !isSafeValue(child) && !isWorkflowSessionField(key,child)) add('sensitive_field',childLocation);
+        visit(child,childLocation,depth+1);
+      }
+    }
+  }
+  visit(value); return findings;
+}

package/tools/definitions.js

@@ -1,5 +1,10 @@
 export function getToolList() {
   return [
+    {
+      name:'security_audit',
+      description:'Audit current project knowledge, files, runtime configuration metadata and scoped database rows. Returns sanitized findings only; does not resolve credentials or read protected file contents.',
+      inputSchema:{type:'object',properties:{},additionalProperties:false},
+    },
     {
       name: "start_task",
       description:
@@ -11,6 +16,10 @@ export function getToolList() {
             type: "string",
             description: "Clear description of what you're going to code",
           },
+          classification: {
+            type:'string',enum:['PUBLIC','INTERNAL','CONFIDENTIAL','SECRET'],
+            description:'Knowledge sensitivity. Defaults to INTERNAL. SECRET input is denied; supply a SecretReference instead.',
+          },
           type: {
             type: "string",
             enum: ["feature", "bugfix", "refactor", "other"],
@@ -397,7 +406,7 @@ export function getToolList() {
     {
       name: "create_factory_task",
       description:
-        "Create a task on the Factory board through the official write path (POST /api/factory create_task). Defaults to status 'backlog', which records the work WITHOUT starting a worker run. Only pass status 'queued' when you really want the worker to execute it - Factory rejects a queued task (409) unless 'acceptance' contains a ```run block. Use list_factory_projects first to get a real projectId.",
+        "Create a task on the Factory board through the official write path (POST /api/factory create_task). Defaults to status 'backlog', which records the work WITHOUT starting a worker run. Only pass status 'queued' when you really want the worker to execute it - Factory rejects a queued task (409) unless 'acceptance' contains a ```run block. Every task needs a 'definitionOfDone' checklist: the concrete conditions that must be true before it can be marked done. Use list_factory_projects first to get a real projectId.",
       inputSchema: {
         type: "object",
         properties: {
@@ -418,6 +427,11 @@ export function getToolList() {
             description:
               "What must be true for this task to be done. 3-3000 characters. Required by Factory.",
           },
+          definitionOfDone: {
+            type: "string",
+            description:
+              "Checklist of the concrete conditions that must be true before the task can be marked done, one per line, for example '- [ ] build lulus'. 3-3000 characters. Required by Factory, and a task cannot move to done while it is empty. Different from 'acceptance', which also carries the ```run block for the worker.",
+          },
           priority: {
             type: "string",
             enum: ["low", "normal", "high"],
@@ -430,7 +444,40 @@ export function getToolList() {
               "Defaults to backlog. 'queued' also creates a worker run and requires a ```run block in acceptance.",
           },
         },
-        required: ["projectId", "title", "acceptance"],
+        required: ["projectId", "title", "acceptance", "definitionOfDone"],
+      },
+    },
+    {
+      name: "update_factory_task",
+      description:
+        "Edit the details of an existing Factory task (title, description, acceptance, definitionOfDone). Use it to fill the definition of done of a task created before Factory required it, because a task cannot move to 'done' while that checklist is empty. It reads the task's current version and lets Factory reject a stale edit with 409 instead of overwriting someone else's change. Supply at least one field.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          recordId: {
+            type: "string",
+            description: "Factory task id (UUID) from list_factory_tasks.",
+          },
+          title: {
+            type: "string",
+            description: "New title, 3-140 characters. Omit to keep the current one.",
+          },
+          description: {
+            type: "string",
+            description: "New context text, max 4000 characters. Omit to keep the current one.",
+          },
+          acceptance: {
+            type: "string",
+            description:
+              "New acceptance text, 3-3000 characters. This is also where the ```run block for the worker lives, so keep it intact unless you mean to change what the runner executes.",
+          },
+          definitionOfDone: {
+            type: "string",
+            description:
+              "New checklist of conditions that must be true before the task can be marked done, 3-3000 characters, one condition per line, for example '- [ ] build lulus'.",
+          },
+        },
+        required: ["recordId"],
       },
     },
     {
@@ -476,7 +523,8 @@ export function getToolList() {
           },
           reason: {
             type: "string",
-            description: "Required when status is 'blocked'; used as the session summary otherwise.",
+            description:
+              "Why. Required when status is 'blocked'. Also required by Factory (min 3 characters) when status is 'done' or 'cancelled' - it becomes the closure note on the board. Otherwise used as the session summary.",
           },
           nextAction: {
             type: "string",

package/tools/handler-modules/commit-handlers.js

@@ -62,13 +62,9 @@ export async function handleCommitAndPush(args, context) {
   }
 
   try {
-    if (commitBody) {
-      await exec(
-        `git commit -m ${utils.shellEscape(generatedSummary)} -m ${utils.shellEscape(commitBody)}`
-      );
-    } else {
-      await exec(`git commit -m ${utils.shellEscape(generatedSummary)}`);
-    }
+    const commitArguments=['commit','-m',generatedSummary];
+    if(commitBody)commitArguments.push('-m',commitBody);
+    await exec('git commit',{executable:'git',arguments:commitArguments});
   } catch (error) {
     const output = error.stderr || error.stdout || error.message || "Unknown error";
     if (output.includes("nothing to commit")) {