@sema-agent/core 7.33.1 → 7.33.2

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 7.33.2 — 2026-09-26
+
+### Security fix — git's config VALUES are judged by their value: `GIT_CONFIG_VALUE_<i>` carrying an `Authorization:` header or a userinfo URL is dropped (#1129 follow-up; behavior; `SecretEnvFindingKind` +`family-rule`; +0 exports, +0 wire keys) (@server)
+
+- **Before.** 7.33.1 exempted `GIT_CONFIG_KEY_<i>` from the shape rule with a value screen on the KEY (URL userinfo). The VALUE member has no credential word in its name, so the scrub never judged it — `GIT_CONFIG_COUNT=1 / GIT_CONFIG_KEY_0=http.extraHeader / GIT_CONFIG_VALUE_0="Authorization: Bearer <token>"` passed whole. A host that withholds the group only when core withholds a member (the server's all-or-nothing rule) therefore handed the token to the task's shell; 7.32.1 had withheld the whole group because the KEY fell to the shape rule. A regression relative to the shipped chain (server 7.102.0), found by the server's codex back-review.
+- **Now.** The credential side of the exact-name arm reads a named family too: `GIT_CONFIG_VALUE_<i>` whose value is an HTTP credential header (`Authorization:` / `Proxy-Authorization:` / `Cookie:`, any case, leading whitespace allowed) or a URL with a userinfo (`<scheme>:/+<user>[:<secret>]@…`) is a credential and drops, reported as `kind: "family-rule"` (confidence high — the value was read). The KEY screen reads a slash run (`https:///u:t@host`, which curl accepts, dropped like `https://`). A KEY whose value fails its screen is now reported as `family-rule` too (it was `suffix-rule`; KL-1129d closed). The screen reads the authority as git and curl do — it ends at the first `/`, `?` or `#`, so an `@` in a query or fragment is not a userinfo — and an `Authorization:` header with nothing after the colon (curl's spelling for "send no such header") is not a credential: both stay and their group runs; a header on the value's SECOND line (git hands `http.extraHeader` to libcurl verbatim, a line break carries another header — real git 2.54 / libcurl 8.7.1 put it on the wire) is read like the first. A proxy VALUE with a userinfo and no scheme (`u:<secret>@host:port` — libcurl assumes http, git prompts for a missing password) drops when its paired KEY (`GIT_CONFIG_KEY_<i>`, same index) names a proxy (`http.proxy` / `http.<url>.proxy` / `remote.<name>.proxy`): the screen reads the group, which `scrubSecretEnv` always has; `isSecretEnvKey(key, value?, env?)` gains an optional third parameter for callers that classify one entry (without it the proxy screen is silent — `a@b.example` is also an e-mail address). A folded header (`Authorization:` + a continuation line beginning with SP / HTAB) is a header with content; a Unicode line separator is not a line break to HTTP and does not split headers. On a proxy key the userinfo may hold any byte but `/` and `@` (curl accepts U+00A0 in a password), the scheme is optional with any slash count (`https:/…` folds), and the key's subsection may hold any character git accepts. Each screen reads as its consumer does: git-URL (`://` or more slashes — a single slash is git's scp-like `host:path`, so `example.invalid:/repo@v2.git` and `git@github.com:org/repo.git` stay, `ssh://git@github.com/…` drops as a URL userinfo), curl-header, curl-proxy. A family stem is asserted `[A-Z0-9_]+` at load (KL-1129c closed). The URL screen is anchored on the `:` and reads the scheme backward, linear in the value's length (the scheme-first form was quadratic: ~1 s for an 8 KiB header-shaped value, on the host's event loop at every spawn — a codex falsification round measured it). No value-shape screen outside the git family: a header-looking value on any other name is untouched (#1134 records the policy question).
+- **Who needs it.** Deployments whose host passes git config through the environment and relies on the group rule to keep an `http.extraHeader` token out of tool subprocesses.
+- **Who is hurt / compensation.** A git group whose VALUE is a URL with a user name and no secret (`remote.<name>.url = ssh://git@github.com/org/repo.git`, `https://jane@host/…`) is treated like the KEY side already was in 7.33.1 (KL-1129b: a bare user can itself be a token) and breaks — write such remotes in the repository's config or in scp form (`git@github.com:org/repo.git` stays). A git group whose VALUE carries a credential no longer reaches the child (git exits 128 `missing config value` on the broken group — fail-closed; the host's group rule withholds the rest); the `SecretEnvFindingKind` word set gains `family-rule` (metrics labels pass it through; exhaustive switches over the four words must add an arm). Compensation: credentials to git children go through a credential helper, not the environment.
+- Pins: `test/backlog1129-git-config-key-family.test.ts` (7.33.2 block: header spellings, userinfo URLs, path-`@` and plain values kept, slash run, family verdict kinds; ② block re-pinned to `family-rule`).
+
 ## 7.33.1 — 2026-09-26
 
 ### The first-byte lane's retry is a construction-time seat — `BrainTimeoutConfig.firstByteRetries?: 0 | 1` (#1128; additive; +1 optional type key; +0 exports, +0 codes) (@server)

package/dist/core/secret-env.d.ts

@@ -25,7 +25,7 @@ export interface EnvNameTable {
     has(upperName: string, value?: string): boolean;
 }
 /** Which rule classified a key as secret-shaped — the env arm's `kind` vocabulary. */
-export type SecretEnvFindingKind = "suffix-rule" | "namespace-rule" | "exact-name";
+export type SecretEnvFindingKind = "suffix-rule" | "namespace-rule" | "exact-name" | "family-rule";
 /** One env entry the `scrub` policy dropped: the key (the VALUE is never carried — this record is meant
  *  to be loggable), the rule that classified it, how strong that claim is, and the minting module. */
 export interface SecretEnvFinding {
@@ -46,7 +46,7 @@ export declare function classifyExactEnvName(key: string, credentialNames: EnvNa
 /** Is `key` a secret-pattern env var (one the fail-closed `scrub` policy drops before spawning a shell)? Pass the
  *  entry's `value` to get exactly the scrub's answer for that entry: a named-family exemption holds only for a value
  *  that clears the family's screen, so without a value such a member reads as secret (the name alone cannot clear). */
-export declare function isSecretEnvKey(key: string, value?: string): boolean;
+export declare function isSecretEnvKey(key: string, value?: string, env?: NodeJS.ProcessEnv): boolean;
 /** Drop every secret-pattern key (see {@link isSecretEnvKey}) from an env object — the fail-closed `scrub`
  *  policy. `findings` is an OPTIONAL caller-owned collector: pass an array to learn which entries were
  *  dropped and why, read it back after the call. Omitting it leaves this function byte-for-byte what it

package/dist/core/secret-env.js

@@ -15,11 +15,62 @@ const NON_SECRET_ENV_EXACT_NAMES = new Set([
     "MAX_BATCH_PREFILL_TOKENS", "MAX_WAITING_TOKENS", "MAX_TOP_N_TOKENS", "RATE_LIMIT_TOKENS",
     "PROMPT_TOKENS", "CONTEXT_TOKENS",
 ]);
+const URL_USERINFO_RE = /:(?<=[a-z][a-z0-9+.-]*:)\/{2,}[^/?#@]+@/i;
+const HEADER_LINE_BREAK_RE = /\r\n|\r|\n/;
+const AUTHORIZATION_HEADER_NAME_RE = /^[ \t]*(?:(?:proxy-)?authorization|cookie)[ \t]*:/i;
+const HEADER_CONTENT_RE = /[^ \t\f\v]/;
+function carriesAuthorizationHeader(value) {
+    let logical;
+    const judge = () => logical !== undefined && AUTHORIZATION_HEADER_NAME_RE.test(logical) && HEADER_CONTENT_RE.test(logical.slice(logical.indexOf(":") + 1));
+    for (const physical of value.split(HEADER_LINE_BREAK_RE)) {
+        if (logical !== undefined && (physical.startsWith(" ") || physical.startsWith("\t"))) {
+            logical += " " + physical;
+            continue;
+        }
+        if (judge())
+            return true;
+        logical = physical;
+    }
+    return judge();
+}
+const GIT_PROXY_CONFIG_KEY_RE = /^(?:http(?:\..+)?|remote\..+)\.proxy$/is;
+const PROXY_AUTHORITY_USERINFO_RE = /^(?:[a-z][a-z0-9+.-]*:\/*)?[^/?#@]+@/i;
 const NON_SECRET_ENV_INDEXED_FAMILIES = [
-    { stem: "GIT_CONFIG_KEY", valueClears: (value) => !/[a-z][a-z0-9+.-]*:\/\/[^/@]+@/i.test(value) },
+    { stem: "GIT_CONFIG_KEY", valueClears: (value) => !URL_USERINFO_RE.test(value) },
+];
+const SECRET_ENV_INDEXED_FAMILIES = [
+    {
+        stem: "GIT_CONFIG_VALUE",
+        credentialWhen: (value, group) => {
+            if (carriesAuthorizationHeader(value) || URL_USERINFO_RE.test(value))
+                return true;
+            const key = group.sibling("GIT_CONFIG_KEY");
+            return key !== undefined && GIT_PROXY_CONFIG_KEY_RE.test(key) && PROXY_AUTHORITY_USERINFO_RE.test(value);
+        },
+    },
 ];
-const indexedFamilyMember = (stem) => new RegExp(`^${stem}_(?:0|[1-9][0-9]*)$`);
+const indexedFamilyMember = (stem) => {
+    if (!/^[A-Z0-9_]+$/.test(stem))
+        throw new Error(`secret-env: indexed family stem ${JSON.stringify(stem)} must match [A-Z0-9_]+`);
+    return new RegExp(`^${stem}_(0|[1-9][0-9]*)$`);
+};
 const NON_SECRET_ENV_INDEXED_FAMILY_ROWS = NON_SECRET_ENV_INDEXED_FAMILIES.map((f) => ({ member: indexedFamilyMember(f.stem), valueClears: f.valueClears }));
+const SECRET_ENV_INDEXED_FAMILY_ROWS = SECRET_ENV_INDEXED_FAMILIES.map((f) => ({ member: indexedFamilyMember(f.stem), credentialWhen: f.credentialWhen }));
+function classifyByFamily(upperName, value, env) {
+    if (value === undefined)
+        return undefined;
+    for (const row of SECRET_ENV_INDEXED_FAMILY_ROWS) {
+        const member = row.member.exec(upperName);
+        if (member === null)
+            continue;
+        const index = member[1];
+        if (row.credentialWhen(value, { sibling: (stem) => env?.[`${stem}_${index}`] }))
+            return "credential";
+    }
+    if (NON_SECRET_ENV_INDEXED_FAMILY_ROWS.some((row) => row.member.test(upperName) && !row.valueClears(value)))
+        return "screen-failed";
+    return undefined;
+}
 const NON_SECRET_ENV_NAMES = {
     has: (upperName, value) => NON_SECRET_ENV_EXACT_NAMES.has(upperName) ||
         (value !== undefined && NON_SECRET_ENV_INDEXED_FAMILY_ROWS.some((row) => row.member.test(upperName) && row.valueClears(value))),
@@ -28,6 +79,7 @@ const SECRET_ENV_KIND_CONFIDENCE = {
     "exact-name": "high",
     "suffix-rule": "medium",
     "namespace-rule": "medium",
+    "family-rule": "high",
 };
 export function classifyExactEnvName(key, credentialNames, exemptNames, value) {
     const upper = key.toUpperCase();
@@ -37,23 +89,26 @@ export function classifyExactEnvName(key, credentialNames, exemptNames, value) {
         return "exempt";
     return "unknown";
 }
-function classifySecretEnvKey(key, value) {
+function classifySecretEnvKey(key, value, env) {
     const byExactName = classifyExactEnvName(key, SECRET_ENV_EXACT_NAMES, NON_SECRET_ENV_NAMES, value);
     if (byExactName === "credential")
         return "exact-name";
     if (byExactName === "exempt")
         return undefined;
+    const byFamily = classifyByFamily(key.toUpperCase(), value, env);
+    if (byFamily === "credential")
+        return "family-rule";
     if (SECRET_ENV_RE.test(key))
-        return "suffix-rule";
+        return byFamily === "screen-failed" ? "family-rule" : "suffix-rule";
     return SEMA_NAMESPACE_SECRET_RE.test(key) ? "namespace-rule" : undefined;
 }
-export function isSecretEnvKey(key, value) {
-    return classifySecretEnvKey(key, value) !== undefined;
+export function isSecretEnvKey(key, value, env) {
+    return classifySecretEnvKey(key, value, env) !== undefined;
 }
 export function scrubSecretEnv(env, findings) {
     const out = {};
     for (const k of Object.keys(env)) {
-        const kind = classifySecretEnvKey(k, env[k]);
+        const kind = classifySecretEnvKey(k, env[k], env);
         if (kind === undefined) {
             out[k] = env[k];
             continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.33.1",
+  "version": "7.33.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.33.2.json

@@ -0,0 +1,59 @@
+{
+  "repo": "core",
+  "version": "7.33.2",
+  "from": "869ac44b1f76fcf61f658f1652370b74b500868c",
+  "to": "v7.33.2",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [
+    {
+      "set": "SecretEnvFindingKind",
+      "at": [
+        "src/core/secret-env.ts:329"
+      ],
+      "newSet": false,
+      "added": [
+        "family-rule"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 217,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.key",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [
+      "SecretEnvFindingKind"
+    ],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@a4cd5728 sdk@4031f42 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "3eae7e3fe99b608206dc0f9d0b9fb257f012d0f1"
+}