@sweny-ai/core 0.1.112 → 0.1.113

package/dist/skills/betterstack.d.ts

@@ -5,4 +5,23 @@
  * CI-native alternative to the BetterStack MCP server.
  */
 import type { Skill } from "../types.js";
+/**
+ * Validate an LLM-chosen table name as a bare ClickHouse identifier.
+ * Anything outside [A-Za-z0-9_] is rejected — table names from
+ * BetterStack are always of the form t<id>_<name>.
+ */
+export declare function assertClickHouseIdentifier(name: string): string;
+/**
+ * Best-effort read-only guard for `betterstack_query`.
+ *
+ * Accepts SELECT / WITH / DESCRIBE statements, rejects everything else,
+ * rejects multi-statement input, and appends a LIMIT cap when the query
+ * has none. Keyword checks ignore string literal contents so a log
+ * message containing "LIMIT" doesn't skip the cap.
+ *
+ * This is UX, not a security boundary: a determined query can still do
+ * anything the ClickHouse connection's role allows. Use a read-only
+ * role for the configured credentials.
+ */
+export declare function prepareReadOnlyQuery(query: string): string;
 export declare const betterstack: Skill;

package/dist/skills/betterstack.js

@@ -37,6 +37,58 @@ async function bsQuery(sql, ctx) {
         .split("\n")
         .map((line) => JSON.parse(line));
 }
+// ─── Input hardening (issue #226) ──────────────────────────────
+//
+// Threat model: tool arguments are LLM-controlled at runtime and can be
+// steered by prompt-injected content (issue bodies, fetched logs). The
+// `table` argument reaches a ClickHouse query string, so it is strictly
+// validated as an identifier. The read-only query guard below is
+// best-effort UX — the real security boundary must be a read-only
+// ClickHouse role on the BETTERSTACK_QUERY_USERNAME connection.
+/**
+ * Validate an LLM-chosen table name as a bare ClickHouse identifier.
+ * Anything outside [A-Za-z0-9_] is rejected — table names from
+ * BetterStack are always of the form t<id>_<name>.
+ */
+export function assertClickHouseIdentifier(name) {
+    if (!/^[A-Za-z0-9_]+$/.test(name)) {
+        throw new Error(`[BetterStack] Invalid table identifier "${name}" — only letters, digits, and _ are allowed`);
+    }
+    return name;
+}
+/** Blank out string literal contents so keyword checks don't match inside them. */
+function stripStringLiterals(sql) {
+    // Handles both '' (SQL) and \' (ClickHouse) quote escaping.
+    return sql.replace(/'(?:[^'\\]|\\.|'')*'/g, "''");
+}
+/**
+ * Best-effort read-only guard for `betterstack_query`.
+ *
+ * Accepts SELECT / WITH / DESCRIBE statements, rejects everything else,
+ * rejects multi-statement input, and appends a LIMIT cap when the query
+ * has none. Keyword checks ignore string literal contents so a log
+ * message containing "LIMIT" doesn't skip the cap.
+ *
+ * This is UX, not a security boundary: a determined query can still do
+ * anything the ClickHouse connection's role allows. Use a read-only
+ * role for the configured credentials.
+ */
+export function prepareReadOnlyQuery(query) {
+    let sql = query.trim().replace(/;\s*$/, "").trim();
+    const stripped = stripStringLiterals(sql);
+    if (stripped.includes(";")) {
+        throw new Error("[BetterStack] Multi-statement queries are not allowed — send a single statement");
+    }
+    if (!/^(SELECT|WITH|DESCRIBE)\b/i.test(stripped)) {
+        throw new Error("[BetterStack] Only read-only queries are allowed (SELECT, WITH, or DESCRIBE)");
+    }
+    // Append LIMIT if none present to prevent unbounded result sets.
+    // DESCRIBE output is already bounded by the column count.
+    if (!/^DESCRIBE\b/i.test(stripped) && !/\bLIMIT\b/i.test(stripped)) {
+        sql = `${sql} LIMIT 500`;
+    }
+    return sql;
+}
 // ─── Skill definition ──────────────────────────────────────────
 export const betterstack = {
     id: "betterstack",
@@ -55,7 +107,8 @@ export const betterstack = {
             env: "BETTERSTACK_QUERY_ENDPOINT",
         },
         BETTERSTACK_QUERY_USERNAME: {
-            description: "ClickHouse connection username",
+            description: "ClickHouse connection username. Use a read-only role — the in-skill query guard is best-effort, " +
+                "not a security boundary",
             required: true,
             env: "BETTERSTACK_QUERY_USERNAME",
         },
@@ -114,7 +167,7 @@ export const betterstack = {
                 required: ["table"],
             },
             handler: async (input, ctx) => {
-                return bsQuery(`DESCRIBE TABLE remote(${input.table}_logs)`, ctx);
+                return bsQuery(`DESCRIBE TABLE remote(${assertClickHouseIdentifier(input.table)}_logs)`, ctx);
             },
         },
         {
@@ -123,28 +176,19 @@ export const betterstack = {
 Tables: remote(TABLE_logs) for recent logs, s3Cluster(primary, TABLE_s3) for historical (add WHERE _row_type = 1).
 Key fields: dt (timestamp), raw (JSON blob with all log fields).
 Extract nested fields: JSONExtract(raw, 'field_name', 'Nullable(String)').
-Use betterstack_get_source_fields to discover available columns.`,
+Use betterstack_get_source_fields to discover available columns.
+Only single SELECT / WITH / DESCRIBE statements are accepted.`,
             input_schema: {
                 type: "object",
                 properties: {
-                    query: { type: "string", description: "ClickHouse SQL query (SELECT only)" },
+                    query: { type: "string", description: "ClickHouse SQL query (single SELECT, WITH, or DESCRIBE statement)" },
                     source_id: { type: "number", description: "Source ID (for context)" },
                     table: { type: "string", description: "Table name (e.g. t273774_offload_ecs_production)" },
                 },
                 required: ["query", "source_id", "table"],
             },
             handler: async (input, ctx) => {
-                const trimmed = input.query.trim();
-                const upper = trimmed.toUpperCase();
-                if (!upper.startsWith("SELECT") && !upper.startsWith("DESCRIBE")) {
-                    throw new Error("[BetterStack] Only SELECT and DESCRIBE queries are allowed");
-                }
-                // Append LIMIT if none present to prevent unbounded result sets
-                let sql = trimmed;
-                if (!upper.includes("LIMIT")) {
-                    sql = `${sql} LIMIT 500`;
-                }
-                return bsQuery(sql, ctx);
+                return bsQuery(prepareReadOnlyQuery(input.query), ctx);
             },
         },
     ],

package/dist/skills/github.d.ts

@@ -5,4 +5,19 @@
  * ~800 lines → ~120 lines
  */
 import type { Skill } from "../types.js";
+/**
+ * Encode an LLM-chosen repo file path for safe interpolation into a
+ * GitHub API request path.
+ *
+ * Trust model (issue #226): tool arguments are runtime-controlled by the
+ * model and can be steered by prompt-injected content. Without encoding,
+ * a `path` containing `?` or `#` rewrites the request (injects query
+ * params / truncates via fragment), and `..` segments walk out of the
+ * `/contents/` endpoint entirely.
+ *
+ * Each `/`-separated segment is percent-encoded (so `/` between segments
+ * is preserved); `.` and `..` segments are rejected outright because
+ * URL normalization resolves them server-side even when encoded.
+ */
+export declare function encodeRepoFilePath(path: string): string;
 export declare const github: Skill;

package/dist/skills/github.js

@@ -34,6 +34,32 @@ function isAlreadyExistsError(err) {
         return false;
     return /pull request already exists/i.test(err.body);
 }
+/**
+ * Encode an LLM-chosen repo file path for safe interpolation into a
+ * GitHub API request path.
+ *
+ * Trust model (issue #226): tool arguments are runtime-controlled by the
+ * model and can be steered by prompt-injected content. Without encoding,
+ * a `path` containing `?` or `#` rewrites the request (injects query
+ * params / truncates via fragment), and `..` segments walk out of the
+ * `/contents/` endpoint entirely.
+ *
+ * Each `/`-separated segment is percent-encoded (so `/` between segments
+ * is preserved); `.` and `..` segments are rejected outright because
+ * URL normalization resolves them server-side even when encoded.
+ */
+export function encodeRepoFilePath(path) {
+    return path
+        .split("/")
+        .filter((segment) => segment !== "")
+        .map((segment) => {
+        if (segment === "." || segment === "..") {
+            throw new Error(`[GitHub] Invalid path segment "${segment}" — relative path segments are not allowed`);
+        }
+        return encodeURIComponent(segment);
+    })
+        .join("/");
+}
 export const github = {
     id: "github",
     name: "GitHub",
@@ -224,8 +250,8 @@ export const github = {
                 required: ["repo", "path"],
             },
             handler: async (input, ctx) => {
-                const ref = input.ref ? `?ref=${input.ref}` : "";
-                const data = await gh(`/repos/${input.repo}/contents/${input.path}${ref}`, ctx);
+                const ref = input.ref ? `?ref=${encodeURIComponent(input.ref)}` : "";
+                const data = await gh(`/repos/${input.repo}/contents/${encodeRepoFilePath(input.path)}${ref}`, ctx);
                 if (data.content && data.encoding === "base64") {
                     return { ...data, decoded_content: Buffer.from(data.content, "base64").toString("utf-8") };
                 }

package/dist/skills/supabase.d.ts

@@ -6,4 +6,15 @@
  * and the Management API for project-level operations.
  */
 import type { Skill } from "../types.js";
+/** Validate an LLM-chosen table/column name as a bare PostgREST identifier. */
+export declare function assertSupabaseIdentifier(name: string, label?: string): string;
+/** Validate an LLM-chosen RPC / edge function name (hyphens allowed for edge functions). */
+export declare function assertSupabaseFunctionName(name: string): string;
+/**
+ * Append PostgREST filter strings ("column=op.value") to query params.
+ * Each filter is split at its first `=`; the value side is appended as a
+ * single parameter value so `&`/`=` inside it are percent-encoded rather
+ * than interpreted as additional parameters.
+ */
+export declare function appendPostgrestFilters(params: URLSearchParams, filters: string[]): URLSearchParams;
 export declare const supabase: Skill;

package/dist/skills/supabase.js

@@ -5,6 +5,73 @@
  * Uses the Supabase REST API (PostgREST) for data operations
  * and the Management API for project-level operations.
  */
+// ─── Input hardening (issue #226) ──────────────────────────────
+//
+// Threat model: this skill runs with SUPABASE_SERVICE_ROLE_KEY, which
+// bypasses RLS entirely, and `table`, `filters[]`, and function names are
+// LLM-controlled at runtime (steerable by prompt-injected content).
+// Identifiers are validated before they reach the request path, filter
+// values are URL-encoded so one filter string cannot smuggle extra query
+// parameters, and the optional SUPABASE_ALLOWED_TABLES /
+// SUPABASE_ALLOWED_FUNCTIONS allowlists bound what the agent can touch.
+/** Validate an LLM-chosen table/column name as a bare PostgREST identifier. */
+export function assertSupabaseIdentifier(name, label = "table") {
+    if (!/^[A-Za-z0-9_]+$/.test(name)) {
+        throw new Error(`[Supabase] Invalid ${label} identifier "${name}" — only letters, digits, and _ are allowed`);
+    }
+    return name;
+}
+/** Validate an LLM-chosen RPC / edge function name (hyphens allowed for edge functions). */
+export function assertSupabaseFunctionName(name) {
+    if (!/^[A-Za-z0-9_-]+$/.test(name)) {
+        throw new Error(`[Supabase] Invalid function name "${name}" — only letters, digits, _ and - are allowed`);
+    }
+    return name;
+}
+/**
+ * Append PostgREST filter strings ("column=op.value") to query params.
+ * Each filter is split at its first `=`; the value side is appended as a
+ * single parameter value so `&`/`=` inside it are percent-encoded rather
+ * than interpreted as additional parameters.
+ */
+export function appendPostgrestFilters(params, filters) {
+    for (const filter of filters) {
+        const eq = filter.indexOf("=");
+        if (eq <= 0) {
+            throw new Error(`[Supabase] Invalid filter "${filter}" — expected "column=operator.value" (e.g. "id=eq.1")`);
+        }
+        params.append(filter.slice(0, eq), filter.slice(eq + 1));
+    }
+    return params;
+}
+/** Parse an optional comma-separated allowlist config value. Returns null when unset (no restriction). */
+function resolveAllowlist(config, key) {
+    const raw = config[key];
+    if (!raw || !raw.trim())
+        return null;
+    return new Set(raw
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean));
+}
+/** Validate a table name and check it against SUPABASE_ALLOWED_TABLES (when configured). */
+function checkTable(table, ctx) {
+    assertSupabaseIdentifier(table);
+    const allowlist = resolveAllowlist(ctx.config, "SUPABASE_ALLOWED_TABLES");
+    if (allowlist && !allowlist.has(table)) {
+        throw new Error(`[Supabase] Table "${table}" is not on the SUPABASE_ALLOWED_TABLES allowlist (${[...allowlist].join(", ")})`);
+    }
+    return table;
+}
+/** Validate a function name and check it against SUPABASE_ALLOWED_FUNCTIONS (when configured). */
+function checkFunction(name, ctx) {
+    assertSupabaseFunctionName(name);
+    const allowlist = resolveAllowlist(ctx.config, "SUPABASE_ALLOWED_FUNCTIONS");
+    if (allowlist && !allowlist.has(name)) {
+        throw new Error(`[Supabase] Function "${name}" is not on the SUPABASE_ALLOWED_FUNCTIONS allowlist (${[...allowlist].join(", ")})`);
+    }
+    return name;
+}
 async function supabaseRest(path, ctx, init) {
     const url = ctx.config.SUPABASE_URL;
     const key = ctx.config.SUPABASE_SERVICE_ROLE_KEY;
@@ -54,10 +121,24 @@ export const supabase = {
             env: "SUPABASE_URL",
         },
         SUPABASE_SERVICE_ROLE_KEY: {
-            description: "Supabase service role key (full access, server-side only)",
+            description: "Supabase service role key (full access, bypasses RLS — high blast radius). " +
+                "Prefer a scoped key where possible, and bound exposure with SUPABASE_ALLOWED_TABLES / " +
+                "SUPABASE_ALLOWED_FUNCTIONS",
             required: true,
             env: "SUPABASE_SERVICE_ROLE_KEY",
         },
+        SUPABASE_ALLOWED_TABLES: {
+            description: "Optional comma-separated table allowlist. When set, data tools (query/count/insert/update/delete) " +
+                "are restricted to these tables",
+            required: false,
+            env: "SUPABASE_ALLOWED_TABLES",
+        },
+        SUPABASE_ALLOWED_FUNCTIONS: {
+            description: "Optional comma-separated function allowlist. When set, supabase_rpc and supabase_invoke_function " +
+                "are restricted to these RPC / edge function names",
+            required: false,
+            env: "SUPABASE_ALLOWED_FUNCTIONS",
+        },
     },
     tools: [
         // ─── Read ────────────────────────────────────────────────
@@ -89,18 +170,14 @@ export const supabase = {
                 required: ["table"],
             },
             handler: async (input, ctx) => {
+                const table = checkTable(input.table, ctx);
                 const params = new URLSearchParams();
                 params.set("select", input.select || "*");
                 if (input.order)
                     params.set("order", input.order);
                 params.set("limit", String(input.limit || 100));
-                let path = `/${input.table}?${params}`;
-                if (input.filters) {
-                    for (const f of input.filters) {
-                        path += `&${f}`;
-                    }
-                }
-                return supabaseRest(path, ctx);
+                appendPostgrestFilters(params, input.filters ?? []);
+                return supabaseRest(`/${table}?${params}`, ctx);
             },
         },
         {
@@ -121,12 +198,10 @@ export const supabase = {
             handler: async (input, ctx) => {
                 const url = ctx.config.SUPABASE_URL;
                 const key = ctx.config.SUPABASE_SERVICE_ROLE_KEY;
-                let path = `${url}/rest/v1/${input.table}?select=count`;
-                if (input.filters) {
-                    for (const f of input.filters) {
-                        path += `&${f}`;
-                    }
-                }
+                const table = checkTable(input.table, ctx);
+                const params = new URLSearchParams({ select: "count" });
+                appendPostgrestFilters(params, input.filters ?? []);
+                const path = `${url}/rest/v1/${table}?${params}`;
                 const res = await fetch(path, {
                     headers: {
                         apikey: key,
@@ -165,11 +240,12 @@ export const supabase = {
                 required: ["table", "rows"],
             },
             handler: async (input, ctx) => {
+                const table = checkTable(input.table, ctx);
                 const headers = {};
                 if (input.upsert) {
                     headers["Prefer"] = "resolution=merge-duplicates,return=representation";
                 }
-                return supabaseRest(`/${input.table}`, ctx, {
+                return supabaseRest(`/${table}`, ctx, {
                     method: "POST",
                     headers,
                     body: JSON.stringify(input.rows),
@@ -199,10 +275,9 @@ export const supabase = {
                 if (!input.filters || input.filters.length === 0) {
                     throw new Error("Filters are required for update operations to prevent accidental full-table updates");
                 }
-                let path = `/${input.table}`;
-                const filterParts = input.filters.map((f) => f);
-                path += `?${filterParts.join("&")}`;
-                return supabaseRest(path, ctx, {
+                const table = checkTable(input.table, ctx);
+                const params = appendPostgrestFilters(new URLSearchParams(), input.filters);
+                return supabaseRest(`/${table}?${params}`, ctx, {
                     method: "PATCH",
                     body: JSON.stringify(input.data),
                 });
@@ -227,8 +302,9 @@ export const supabase = {
                 if (!input.filters || input.filters.length === 0) {
                     throw new Error("Filters are required for delete operations");
                 }
-                const path = `/${input.table}?${input.filters.join("&")}`;
-                return supabaseRest(path, ctx, { method: "DELETE" });
+                const table = checkTable(input.table, ctx);
+                const params = appendPostgrestFilters(new URLSearchParams(), input.filters);
+                return supabaseRest(`/${table}?${params}`, ctx, { method: "DELETE" });
             },
         },
         // ─── RPC ─────────────────────────────────────────────────
@@ -247,7 +323,7 @@ export const supabase = {
                 required: ["function_name"],
             },
             handler: async (input, ctx) => {
-                return supabaseRest(`/rpc/${input.function_name}`, ctx, {
+                return supabaseRest(`/rpc/${checkFunction(input.function_name, ctx)}`, ctx, {
                     method: "POST",
                     body: JSON.stringify(input.params || {}),
                 });
@@ -272,7 +348,7 @@ export const supabase = {
                 required: ["function_name", "body"],
             },
             handler: async (input, ctx) => {
-                return supabaseEdgeFunction(input.function_name, input.body, ctx);
+                return supabaseEdgeFunction(checkFunction(input.function_name, ctx), input.body, ctx);
             },
         },
         // ─── Auth Admin ──────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.112",
+  "version": "0.1.113",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"