@sema-agent/core 7.33.2 → 7.33.4

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## 7.33.4 — 2026-09-27
+
+### Security fix — the git-family URL screen stops parsing the authority: any `@` after a `://` is a credential carrier, and on a proxy key any `@` is (#1146; 7.33.3 follow-up; behavior narrowing; +0 exports, +0 wire keys) (@server)
+
+- **Before.** 7.33.2 and 7.33.3 read the URL authority — where it ends, which `:` belongs to a password, whether a `[` opens an IP literal — and each reading lost to an adversarial spelling: `https://[alice:secret/part@host` (a `[` that never closes; host review), `https://[a:dead%25x%oops]/part@host`, `https://[abc:def]secret/part@host`, `https://@user:secret@host`, `ssh://token%40host/r.git`, `https:/u:secret@host` (codex), `https://token/part@host` (no colon). In each the KEY cleared its exemption screen or the VALUE row did not fire, and the git group reached the host subprocess; 7.32.1 had withheld it.
+- **Now.** One rule, no parsing: a `GIT_CONFIG_KEY_<i>` / `GIT_CONFIG_VALUE_<i>` value holding a `:/` and, anywhere after it, an `@` or its percent-encoding `%40` is a carrier (`family-rule`) — `:/` because curl reads a single slash as a URL (`https:/u:secret@host`), `%40` because git decodes it before handing the user to ssh (`ssh://token%40host/r.git`); under a proxy key (`http.proxy` / `http.<url>.proxy` / `remote.<name>.proxy`) any `@` / `%40` in the value is. Linear.
+- **Who is hurt / compensation.** Over-drops, fail-closed (KL-1129b): a path / query / fragment `@` (`https://git.example/@scope/pkg`, `https://[::1]/repo@v2.git`, `https://h/?q=a@b`), an scp absolute path with an `@` (`host:/repo@v2.git`), an empty userinfo, a proxy value with `@` in a query, an `http.extraHeader` like `Referer: https://git.example/@scope`. The git group breaks (git exits 128) and a host's group rule withholds it. Compensation: write such a URL into the repository's config, or percent-encode the `@` (`%40`). Never over-dropped: values with no `:/` (`git@host:org/repo.git`, and `git@host:/abs` where the `@` comes first) and URLs with no `@` / `%40` after the `:/`.
+- Pins: `test/backlog1129-git-config-key-family.test.ts` (7.33.4 block: the five review spellings on KEY and VALUE, scp / no-`@` controls, proxy `@`, 1 MiB linearity; the 7.33.1–7.33.3 authority pins re-pinned to the over-match reading).
+
+## 7.33.3 — 2026-09-26
+
+### Security fix — a credential written into a URL is read as a MODEL could read it: `user:secret/part@host` trips the git-family userinfo screen on KEY and VALUE (#1140; 7.33.2 follow-up; behavior; +0 exports, +0 wire keys) (@server)
+
+- **Before.** 7.33.2's userinfo screen read the authority the way git and curl do — it ends at the first `/`, `?` or `#` — so `url.https://alice:secret/part@git.example/.insteadOf` (a password with an unescaped separator) had no userinfo: the KEY cleared its exemption screen, the VALUE row did not fire, and the whole git group reached the host subprocess (server 7.103.0 merge review). 7.32.1 had withheld the group because every KEY fell to the shape rule — a regression relative to the shipped chain.
+- **Now.** One single-pass scanner shared by the KEY exemption and the VALUE credential row: after any `://` (any slash run) the segment up to the first `@` is a userinfo when it has no `/` `?` `#` (RFC reading; a user alone counts, KL-1129b) OR it has a `:` before its first `/` `?` `#` (`user:secret/…@`). A path `@` with no colon before it (`https://git.example/@scope/pkg`) still clears; a URL nested in a path is read on its own; scp forms (`host:/repo@v2.git`, `git@host:path`) never trip. No regex, no backtracking: linear on `://`, `:` and `/` runs.
+- **Who is hurt / compensation.** `https://host:8443/api/@scope/pkg` (a port and a path `@`) is over-dropped and breaks its git group — fail-closed on purpose, KL-1129b; write such a URL without the port or through the repository's config.
+- Pins: `test/backlog1129-git-config-key-family.test.ts` (7.33.3 block: the host-reported KEY / VALUE / `%2F` forms, path-`@`, port over-drop, query colon, nested and second URL, empty userinfo, 4 × 256 KiB linearity).
+
 # Changelog
 
 ## 7.33.2 — 2026-09-26

package/dist/core/secret-env.js

@@ -15,7 +15,12 @@ const NON_SECRET_ENV_EXACT_NAMES = new Set([
     "MAX_BATCH_PREFILL_TOKENS", "MAX_WAITING_TOKENS", "MAX_TOP_N_TOKENS", "RATE_LIMIT_TOKENS",
     "PROMPT_TOKENS", "CONTEXT_TOKENS",
 ]);
-const URL_USERINFO_RE = /:(?<=[a-z][a-z0-9+.-]*:)\/{2,}[^/?#@]+@/i;
+function carriesUrlUserinfo(value) {
+    const scheme = value.indexOf(":/");
+    if (scheme === -1)
+        return false;
+    return value.indexOf("@", scheme + 2) !== -1 || value.indexOf("%40", scheme + 2) !== -1;
+}
 const HEADER_LINE_BREAK_RE = /\r\n|\r|\n/;
 const AUTHORIZATION_HEADER_NAME_RE = /^[ \t]*(?:(?:proxy-)?authorization|cookie)[ \t]*:/i;
 const HEADER_CONTENT_RE = /[^ \t\f\v]/;
@@ -34,18 +39,18 @@ function carriesAuthorizationHeader(value) {
     return judge();
 }
 const GIT_PROXY_CONFIG_KEY_RE = /^(?:http(?:\..+)?|remote\..+)\.proxy$/is;
-const PROXY_AUTHORITY_USERINFO_RE = /^(?:[a-z][a-z0-9+.-]*:\/*)?[^/?#@]+@/i;
+const proxyValueCarriesUserinfo = (value) => value.includes("@") || value.includes("%40");
 const NON_SECRET_ENV_INDEXED_FAMILIES = [
-    { stem: "GIT_CONFIG_KEY", valueClears: (value) => !URL_USERINFO_RE.test(value) },
+    { stem: "GIT_CONFIG_KEY", valueClears: (value) => !carriesUrlUserinfo(value) },
 ];
 const SECRET_ENV_INDEXED_FAMILIES = [
     {
         stem: "GIT_CONFIG_VALUE",
         credentialWhen: (value, group) => {
-            if (carriesAuthorizationHeader(value) || URL_USERINFO_RE.test(value))
+            if (carriesAuthorizationHeader(value) || carriesUrlUserinfo(value))
                 return true;
             const key = group.sibling("GIT_CONFIG_KEY");
-            return key !== undefined && GIT_PROXY_CONFIG_KEY_RE.test(key) && PROXY_AUTHORITY_USERINFO_RE.test(value);
+            return key !== undefined && GIT_PROXY_CONFIG_KEY_RE.test(key) && proxyValueCarriesUserinfo(value);
         },
     },
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.33.2",
+  "version": "7.33.4",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.33.3.json

@@ -0,0 +1,43 @@
+{
+  "repo": "core",
+  "version": "7.33.3",
+  "from": "aa8e4a621a350bcadeff763fdec25d97ae96370f",
+  "to": "v7.33.3",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 217,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.key",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@bac45dd2 sdk@4031f42 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "c5da6d6b48d9ad047bb04fea9b494aaa1f87ec2d"
+}

package/wire-changes/core@7.33.4.json

@@ -0,0 +1,36 @@
+{
+  "repo": "core",
+  "version": "7.33.4",
+  "from": "a7409841b2648631410f123f396f5cdac7252ae1",
+  "to": "v7.33.4",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 217,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@920701d6 sdk@10cf14c — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "6c61b6a5ae287d1478e469a21bf93ef2b1f56e61"
+}