@sema-agent/core 7.33.2 → 7.33.3

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 7.33.3 — 2026-09-26
+
+### Security fix — a credential written into a URL is read as a MODEL could read it: `user:secret/part@host` trips the git-family userinfo screen on KEY and VALUE (#1140; 7.33.2 follow-up; behavior; +0 exports, +0 wire keys) (@server)
+
+- **Before.** 7.33.2's userinfo screen read the authority the way git and curl do — it ends at the first `/`, `?` or `#` — so `url.https://alice:secret/part@git.example/.insteadOf` (a password with an unescaped separator) had no userinfo: the KEY cleared its exemption screen, the VALUE row did not fire, and the whole git group reached the host subprocess (server 7.103.0 merge review). 7.32.1 had withheld the group because every KEY fell to the shape rule — a regression relative to the shipped chain.
+- **Now.** One single-pass scanner shared by the KEY exemption and the VALUE credential row: after any `://` (any slash run) the segment up to the first `@` is a userinfo when it has no `/` `?` `#` (RFC reading; a user alone counts, KL-1129b) OR it has a `:` before its first `/` `?` `#` (`user:secret/…@`). A path `@` with no colon before it (`https://git.example/@scope/pkg`) still clears; a URL nested in a path is read on its own; scp forms (`host:/repo@v2.git`, `git@host:path`) never trip. No regex, no backtracking: linear on `://`, `:` and `/` runs.
+- **Who is hurt / compensation.** `https://host:8443/api/@scope/pkg` (a port and a path `@`) is over-dropped and breaks its git group — fail-closed on purpose, KL-1129b; write such a URL without the port or through the repository's config.
+- Pins: `test/backlog1129-git-config-key-family.test.ts` (7.33.3 block: the host-reported KEY / VALUE / `%2F` forms, path-`@`, port over-drop, query colon, nested and second URL, empty userinfo, 4 × 256 KiB linearity).
+
 # Changelog
 
 ## 7.33.2 — 2026-09-26

package/dist/core/secret-env.js

@@ -15,7 +15,61 @@ const NON_SECRET_ENV_EXACT_NAMES = new Set([
     "MAX_BATCH_PREFILL_TOKENS", "MAX_WAITING_TOKENS", "MAX_TOP_N_TOKENS", "RATE_LIMIT_TOKENS",
     "PROMPT_TOKENS", "CONTEXT_TOKENS",
 ]);
-const URL_USERINFO_RE = /:(?<=[a-z][a-z0-9+.-]*:)\/{2,}[^/?#@]+@/i;
+function carriesUrlUserinfo(value) {
+    let open = -1;
+    let colon = -1;
+    let sep = -1;
+    let bracket = false;
+    let armed = false;
+    const isSchemeChar = (ch) => (ch >= 0x61 && ch <= 0x7a) || (ch >= 0x41 && ch <= 0x5a) || (ch >= 0x30 && ch <= 0x39) || ch === 0x2b || ch === 0x2e || ch === 0x2d;
+    const qualifies = (at) => open !== -1 && at > open && (sep === -1 || (colon !== -1 && colon < sep));
+    for (let i = 0; i < value.length; i++) {
+        const c = value.charCodeAt(i);
+        if (c === 0x3a && value.charCodeAt(i + 1) === 0x2f && value.charCodeAt(i + 2) === 0x2f && i > 0 && isSchemeChar(value.charCodeAt(i - 1))) {
+            if (open !== -1) {
+                if (colon === -1 && !bracket)
+                    colon = i;
+                if (sep === -1)
+                    sep = i + 1;
+                if (colon !== -1 && colon < sep)
+                    armed = true;
+            }
+            i += 2;
+            while (value.charCodeAt(i + 1) === 0x2f)
+                i++;
+            open = i + 1;
+            colon = -1;
+            sep = -1;
+            bracket = value.charCodeAt(open) === 0x5b;
+            continue;
+        }
+        if (open === -1)
+            continue;
+        if (c === 0x40) {
+            if (armed || qualifies(i))
+                return true;
+            open = -1;
+            armed = false;
+            bracket = false;
+            continue;
+        }
+        if (bracket) {
+            if (c === 0x5d)
+                bracket = false;
+            else if (c === 0x2f || c === 0x3f || c === 0x23) {
+                bracket = false;
+                if (sep === -1)
+                    sep = i;
+            }
+            continue;
+        }
+        if (colon === -1 && c === 0x3a)
+            colon = i;
+        if (sep === -1 && (c === 0x2f || c === 0x3f || c === 0x23))
+            sep = i;
+    }
+    return false;
+}
 const HEADER_LINE_BREAK_RE = /\r\n|\r|\n/;
 const AUTHORIZATION_HEADER_NAME_RE = /^[ \t]*(?:(?:proxy-)?authorization|cookie)[ \t]*:/i;
 const HEADER_CONTENT_RE = /[^ \t\f\v]/;
@@ -36,13 +90,13 @@ function carriesAuthorizationHeader(value) {
 const GIT_PROXY_CONFIG_KEY_RE = /^(?:http(?:\..+)?|remote\..+)\.proxy$/is;
 const PROXY_AUTHORITY_USERINFO_RE = /^(?:[a-z][a-z0-9+.-]*:\/*)?[^/?#@]+@/i;
 const NON_SECRET_ENV_INDEXED_FAMILIES = [
-    { stem: "GIT_CONFIG_KEY", valueClears: (value) => !URL_USERINFO_RE.test(value) },
+    { stem: "GIT_CONFIG_KEY", valueClears: (value) => !carriesUrlUserinfo(value) },
 ];
 const SECRET_ENV_INDEXED_FAMILIES = [
     {
         stem: "GIT_CONFIG_VALUE",
         credentialWhen: (value, group) => {
-            if (carriesAuthorizationHeader(value) || URL_USERINFO_RE.test(value))
+            if (carriesAuthorizationHeader(value) || carriesUrlUserinfo(value))
                 return true;
             const key = group.sibling("GIT_CONFIG_KEY");
             return key !== undefined && GIT_PROXY_CONFIG_KEY_RE.test(key) && PROXY_AUTHORITY_USERINFO_RE.test(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.33.2",
+  "version": "7.33.3",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.33.3.json

@@ -0,0 +1,43 @@
+{
+  "repo": "core",
+  "version": "7.33.3",
+  "from": "aa8e4a621a350bcadeff763fdec25d97ae96370f",
+  "to": "v7.33.3",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 217,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.key",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@bac45dd2 sdk@4031f42 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "c5da6d6b48d9ad047bb04fea9b494aaa1f87ec2d"
+}