@sema-agent/core 7.33.3 → 7.33.4

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 7.33.4 — 2026-09-27
+
+### Security fix — the git-family URL screen stops parsing the authority: any `@` after a `://` is a credential carrier, and on a proxy key any `@` is (#1146; 7.33.3 follow-up; behavior narrowing; +0 exports, +0 wire keys) (@server)
+
+- **Before.** 7.33.2 and 7.33.3 read the URL authority — where it ends, which `:` belongs to a password, whether a `[` opens an IP literal — and each reading lost to an adversarial spelling: `https://[alice:secret/part@host` (a `[` that never closes; host review), `https://[a:dead%25x%oops]/part@host`, `https://[abc:def]secret/part@host`, `https://@user:secret@host`, `ssh://token%40host/r.git`, `https:/u:secret@host` (codex), `https://token/part@host` (no colon). In each the KEY cleared its exemption screen or the VALUE row did not fire, and the git group reached the host subprocess; 7.32.1 had withheld it.
+- **Now.** One rule, no parsing: a `GIT_CONFIG_KEY_<i>` / `GIT_CONFIG_VALUE_<i>` value holding a `:/` and, anywhere after it, an `@` or its percent-encoding `%40` is a carrier (`family-rule`) — `:/` because curl reads a single slash as a URL (`https:/u:secret@host`), `%40` because git decodes it before handing the user to ssh (`ssh://token%40host/r.git`); under a proxy key (`http.proxy` / `http.<url>.proxy` / `remote.<name>.proxy`) any `@` / `%40` in the value is. Linear.
+- **Who is hurt / compensation.** Over-drops, fail-closed (KL-1129b): a path / query / fragment `@` (`https://git.example/@scope/pkg`, `https://[::1]/repo@v2.git`, `https://h/?q=a@b`), an scp absolute path with an `@` (`host:/repo@v2.git`), an empty userinfo, a proxy value with `@` in a query, an `http.extraHeader` like `Referer: https://git.example/@scope`. The git group breaks (git exits 128) and a host's group rule withholds it. Compensation: write such a URL into the repository's config, or percent-encode the `@` (`%40`). Never over-dropped: values with no `:/` (`git@host:org/repo.git`, and `git@host:/abs` where the `@` comes first) and URLs with no `@` / `%40` after the `:/`.
+- Pins: `test/backlog1129-git-config-key-family.test.ts` (7.33.4 block: the five review spellings on KEY and VALUE, scp / no-`@` controls, proxy `@`, 1 MiB linearity; the 7.33.1–7.33.3 authority pins re-pinned to the over-match reading).
+
 ## 7.33.3 — 2026-09-26
 
 ### Security fix — a credential written into a URL is read as a MODEL could read it: `user:secret/part@host` trips the git-family userinfo screen on KEY and VALUE (#1140; 7.33.2 follow-up; behavior; +0 exports, +0 wire keys) (@server)

package/dist/core/secret-env.js

@@ -16,59 +16,10 @@ const NON_SECRET_ENV_EXACT_NAMES = new Set([
     "PROMPT_TOKENS", "CONTEXT_TOKENS",
 ]);
 function carriesUrlUserinfo(value) {
-    let open = -1;
-    let colon = -1;
-    let sep = -1;
-    let bracket = false;
-    let armed = false;
-    const isSchemeChar = (ch) => (ch >= 0x61 && ch <= 0x7a) || (ch >= 0x41 && ch <= 0x5a) || (ch >= 0x30 && ch <= 0x39) || ch === 0x2b || ch === 0x2e || ch === 0x2d;
-    const qualifies = (at) => open !== -1 && at > open && (sep === -1 || (colon !== -1 && colon < sep));
-    for (let i = 0; i < value.length; i++) {
-        const c = value.charCodeAt(i);
-        if (c === 0x3a && value.charCodeAt(i + 1) === 0x2f && value.charCodeAt(i + 2) === 0x2f && i > 0 && isSchemeChar(value.charCodeAt(i - 1))) {
-            if (open !== -1) {
-                if (colon === -1 && !bracket)
-                    colon = i;
-                if (sep === -1)
-                    sep = i + 1;
-                if (colon !== -1 && colon < sep)
-                    armed = true;
-            }
-            i += 2;
-            while (value.charCodeAt(i + 1) === 0x2f)
-                i++;
-            open = i + 1;
-            colon = -1;
-            sep = -1;
-            bracket = value.charCodeAt(open) === 0x5b;
-            continue;
-        }
-        if (open === -1)
-            continue;
-        if (c === 0x40) {
-            if (armed || qualifies(i))
-                return true;
-            open = -1;
-            armed = false;
-            bracket = false;
-            continue;
-        }
-        if (bracket) {
-            if (c === 0x5d)
-                bracket = false;
-            else if (c === 0x2f || c === 0x3f || c === 0x23) {
-                bracket = false;
-                if (sep === -1)
-                    sep = i;
-            }
-            continue;
-        }
-        if (colon === -1 && c === 0x3a)
-            colon = i;
-        if (sep === -1 && (c === 0x2f || c === 0x3f || c === 0x23))
-            sep = i;
-    }
-    return false;
+    const scheme = value.indexOf(":/");
+    if (scheme === -1)
+        return false;
+    return value.indexOf("@", scheme + 2) !== -1 || value.indexOf("%40", scheme + 2) !== -1;
 }
 const HEADER_LINE_BREAK_RE = /\r\n|\r|\n/;
 const AUTHORIZATION_HEADER_NAME_RE = /^[ \t]*(?:(?:proxy-)?authorization|cookie)[ \t]*:/i;
@@ -88,7 +39,7 @@ function carriesAuthorizationHeader(value) {
     return judge();
 }
 const GIT_PROXY_CONFIG_KEY_RE = /^(?:http(?:\..+)?|remote\..+)\.proxy$/is;
-const PROXY_AUTHORITY_USERINFO_RE = /^(?:[a-z][a-z0-9+.-]*:\/*)?[^/?#@]+@/i;
+const proxyValueCarriesUserinfo = (value) => value.includes("@") || value.includes("%40");
 const NON_SECRET_ENV_INDEXED_FAMILIES = [
     { stem: "GIT_CONFIG_KEY", valueClears: (value) => !carriesUrlUserinfo(value) },
 ];
@@ -99,7 +50,7 @@ const SECRET_ENV_INDEXED_FAMILIES = [
             if (carriesAuthorizationHeader(value) || carriesUrlUserinfo(value))
                 return true;
             const key = group.sibling("GIT_CONFIG_KEY");
-            return key !== undefined && GIT_PROXY_CONFIG_KEY_RE.test(key) && PROXY_AUTHORITY_USERINFO_RE.test(value);
+            return key !== undefined && GIT_PROXY_CONFIG_KEY_RE.test(key) && proxyValueCarriesUserinfo(value);
         },
     },
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.33.3",
+  "version": "7.33.4",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.33.4.json

@@ -0,0 +1,36 @@
+{
+  "repo": "core",
+  "version": "7.33.4",
+  "from": "a7409841b2648631410f123f396f5cdac7252ae1",
+  "to": "v7.33.4",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 217,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@920701d6 sdk@10cf14c — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "6c61b6a5ae287d1478e469a21bf93ef2b1f56e61"
+}