@sema-agent/settings-schema 6.1.0 → 6.3.0

package/dist/types.js

@@ -18,6 +18,7 @@
 import { z } from "zod";
 import { MAX_EXTRA_BODY_DEPTH } from "./hash.js"; // reconcile the extraBody depth cap with the hash cap (R18)
 import { DispatchPolicy } from "./fleet.js"; // WorkerSpec.fleet.dispatch (scheduling framework D3)
+import { carriesUserinfo, percentLayers } from "./secret-scan.js"; // package-private normalization + the userinfo judgement (not in the barrel)
 // COARSE, best-effort literal-secret SHAPE detector (NOT exhaustive — the real boundary is the env-NAME schema
 // on structured fields). Rejected in free-form value fields (worker `env`, model `extraBody`), URL components,
 // AND as an env-NAME value (an AWS key id is a valid env-NAME charset yet is a secret VALUE, not a NAME). Case-
@@ -28,9 +29,10 @@ import { DispatchPolicy } from "./fleet.js"; // WorkerSpec.fleet.dispatch (sched
 // which review flagged as a bypass (a private key misnamed `*_PUBKEY` skipped scanning entirely).
 /** A private-key PEM header (`-----BEGIN [RSA |EC |OPENSSH |ENCRYPTED ]PRIVATE KEY`), unanchored — the ONE definition
  *  of that shape: {@link SECRET_LITERAL_RE} is composed from it (anchored, as one of its branches), and
- *  `redactSecrets` (config-fns) tests it ANYWHERE in a string. It carries spaces, so the token-splitting detector
- *  {@link containsSecretToken} only sees it at the very start of a string; a PEM behind a newline or a `key: ` prefix
- *  slipped past (S-712 codex review [high]). Public keys / certificates never match (see above). */
+ *  `redactSecrets` (config-fns) tests it ANYWHERE in a string, on every display-side normalized form. It carries spaces,
+ *  so the token-splitting detector {@link containsSecretToken} only sees it at the very start of a string; a PEM behind
+ *  a newline or a `key: ` prefix slipped past (S-712 codex review [high]), and a `key=`-prefixed percent-encoded one
+ *  hid it behind `%20` on the raw form, a form-urlencoded one behind `+` (6.3.0). Public keys / certificates never match. */
 export const PRIVATE_KEY_PEM_HEADER = /-----BEGIN[A-Z0-9 ]*PRIVATE KEY/i;
 export const SECRET_LITERAL_RE = new RegExp(`^(sk-|gh[opus]_|github_pat_|xox[baprse]-|xapp-|bearer\\s|basic\\s|eyJ[A-Za-z0-9_-]{10,}\\.|AKIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|${PRIVATE_KEY_PEM_HEADER.source})`, "i");
 // 所有 *Env / *tokenEnv 字段的值是宿主机 env 变量的 NAME（不是值）。合法 env 变量名 + 拒绝 secret 形状的值（AKIA…
@@ -71,33 +73,17 @@ function scanForSecret(s) {
  *  fs path — so the worker dies at exec/boot, not at config edit. A NUL is never legitimate in a command / path
  *  / host / image, so reject it on every exec-bound string field (mcp stdio + the whole remoteExec contract). R20. */
 export const hasNul = (s) => s.includes("\0");
-/** Does `s` contain a secret-shaped token? Scans the raw string AND a percent-decoded form (a secret can hide
- *  as `%73%6B-…`) — so mcp args / dockerHost / URL components all get uniform percent-decode coverage. Tokenized
- *  + JWT-aware (see scanForSecret). Shared by NON_SECRET_URL + dockerHost + mcp stdio. Round-4/5/11. */
+/** Does `s` contain a secret-shaped token? Scans every percent layer of it — the raw string AND up to three tolerant
+ *  percent-decoded layers (a secret can hide as `%73%6B-…`; the ONE definition of those layers is `percentLayers` in the
+ *  package-private `./secret-scan`) — so mcp args / dockerHost / URL components all get uniform percent-decode coverage.
+ *  Tokenized + JWT-aware (see scanForSecret). Shared by NON_SECRET_URL + dockerHost + mcp stdio. Round-4/5/11. (6.3.0 moved
+ *  the decode loop out, unchanged in result — same layers, same bound, same verdict — and made it exception-free; the
+ *  display-side readings the redactor also judges are not this detector's.) We do NOT fail-closed on a bare `%` — that
+ *  would false-reject legit values like `100%` / `%s`. A secret glued to a malformed escape (`%ZZsk-`) is an accepted
+ *  coarse-heuristic gap (no consumer reconstructs it; the real guarantee is the env-NAME boundary on structured fields).
+ *  R11/R13/R14. */
 export function containsSecretToken(s) {
-    // scan the raw string AND up to 3 percent-decoded layers (handles a multi-encoded `%2573%256B…` → `%73%6B…`
-    // → `sk-…`). TOLERANT decode: each valid %HH is decoded, a malformed escape (`%ZZ`, `%` at end) is left as-is
-    // so one bad escape elsewhere can't abort the whole decode (R13's all-or-nothing decodeURIComponent did). We
-    // do NOT fail-closed on a bare `%` — that would false-reject legit values like `100%` / `%s`. A secret glued
-    // to a malformed escape (`%ZZsk-`) is an accepted coarse-heuristic gap (no consumer reconstructs it; the real
-    // guarantee is the env-NAME boundary on structured fields). Bounded → deterministic. R11/R13/R14. */
-    let cur = s;
-    for (let i = 0; i < 4; i++) {
-        if (scanForSecret(cur))
-            return true;
-        const next = cur.replace(/%[0-9A-Fa-f]{2}/g, (m) => {
-            try {
-                return decodeURIComponent(m);
-            }
-            catch {
-                return m;
-            }
-        });
-        if (next === cur)
-            break;
-        cur = next;
-    }
-    return false;
+    return percentLayers(s).some((form) => scanForSecret(form));
 }
 /** Scan a URL's PATH + query + fragment (KEYS and values, decoded, tokenized) for a secret-shaped literal.
  *  Userinfo is handled separately (NON_SECRET_URL bans it; dockerHost scans the ssh user). Round-4/5. */
@@ -141,7 +127,7 @@ export const NON_SECRET_URL = z
     .refine((s) => {
     try {
         const u = new URL(s);
-        if (!(u.protocol === "http:" || u.protocol === "https:") || !u.host || u.username || u.password)
+        if (!(u.protocol === "http:" || u.protocol === "https:") || !u.host || carriesUserinfo(u))
             return false;
         return !urlQueryFragmentHasSecret(u);
     }
@@ -2053,7 +2039,7 @@ export const PLUGIN_ORIGIN = z
         return true; // 已被上一条拒;避免对非 URL 再报一条噪声
     try {
         const u = new URL(s);
-        return !u.username && !u.password && !urlQueryFragmentHasSecret(u);
+        return !carriesUserinfo(u) && !urlQueryFragmentHasSecret(u);
     }
     catch {
         return false; // claims to be https but does not parse → reject

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "6.1.0",
+  "version": "6.3.0",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",
@@ -128,7 +128,7 @@
     "publish:npm": "npm publish --access public --@sema-agent:registry=https://registry.npmjs.org/ --\"//registry.npmjs.org/:_authToken=${NPM_TOKEN}\""
   },
   "devDependencies": {
-    "@sema-agent/core": "^2.1.0",
+    "@sema-agent/core": "7.33.1",
     "@types/node": "^22.10.0",
     "esbuild": "^0.21.5",
     "typescript": "^5.7.0",