@synkro-sh/cli 1.6.88 → 1.6.90

package/dist/bootstrap.js

@@ -1684,7 +1684,11 @@ export function combinedEditGradeEnabled(synkroFile?: SynkroFileConfig): boolean
 }
 
 async function channelGrade(role: GradeRole, prompt: string, _jwt: string, port: number, timeoutMs = 30000, agentKind: AgentKind = 'claude_code'): Promise<string> {
-  const body = JSON.stringify({ role, payload: prompt, content: prompt, agent_kind: agentKind });
+  // Defense-in-depth: redact any literal secret from the grade payload so a raw
+  // credential never reaches the model. The grader still sees the SHAPE
+  // (<redacted:...>) so its policy reasoning is unaffected.
+  const safe = scrubSecrets(prompt);
+  const body = JSON.stringify({ role, payload: safe, content: safe, agent_kind: agentKind });
 
   const resp = await fetch('http://127.0.0.1:' + port + '/submit', {
     method: 'POST',
@@ -1734,10 +1738,13 @@ const CONTAINERS_URL = process.env.SYNKRO_CONTAINERS_URL || 'https://containers.
 // FIRST so the caller's catch fails open cleanly before CC ever force-kills us.
 const CLOUD_GRADE_TIMEOUT_MS = 45000;
 async function hostedGrade(role: GradeRole, prompt: string, jwt: string, timeoutMs = CLOUD_GRADE_TIMEOUT_MS, agentKind: AgentKind = 'claude_code'): Promise<string> {
+  // Defense-in-depth: redact any literal secret before the payload crosses the
+  // network to the cloud grader \u2014 a raw credential never reaches the model.
+  const safe = scrubSecrets(prompt);
   const resp = await fetch(CONTAINERS_URL + '/grade/submit', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-    body: JSON.stringify({ role, payload: prompt, content: prompt, agent_kind: agentKind }),
+    body: JSON.stringify({ role, payload: safe, content: safe, agent_kind: agentKind }),
     signal: AbortSignal.timeout(timeoutMs),
   });
   if (!resp.ok) {
@@ -2134,6 +2141,15 @@ function sessionLogPath(sessionId: string): string | null {
 }
 
 export function appendSessionAction(sessionId: string, entry: SessionAction): void {
+  // Redact any secret in the action fields before they are persisted (local log
+  // OR streamed to Timescale) \u2014 session diagnostics must never store a raw
+  // credential. Tool name is a fixed identifier and left as-is.
+  entry = {
+    ...entry,
+    summary: entry.summary ? scrubSecrets(entry.summary) : entry.summary,
+    file: entry.file ? scrubSecrets(entry.file) : entry.file,
+    outcome: entry.outcome ? scrubSecrets(entry.outcome) : entry.outcome,
+  };
   const logPath = sessionLogPath(sessionId);
   if (!logPath) return;
   let step = 0;
@@ -2175,6 +2191,121 @@ export function readSessionLog(sessionId: string): SessionAction[] {
   } catch { return []; }
 }
 
+// \u2500\u2500\u2500 Secret/PII firewall \u2500\u2500\u2500
+// Detect LITERAL credentials in a proposed tool call so the hook can (a) BLOCK it
+// locally before the tool runs \u2014 the value never reaches a file, shell history,
+// OR the LLM grader (no leak to Anthropic/Cursor) \u2014 and (b) REDACT any secret
+// before it is persisted/logged. Patterns use character classes (not \\d / \\.)
+// to stay readable inside this template literal. HIGH-CONFIDENCE formats only \u2014
+// a false BLOCK stops the user's work, so we never block on generic entropy.
+interface SecretHit { type: string; value: string; }
+const HARD_SECRET_PATTERNS: Array<{ type: string; re: RegExp }> = [
+  { type: 'anthropic-key', re: /sk-ant-[A-Za-z0-9_-]{24,}/g },
+  { type: 'openai-key', re: /sk-(?:proj-)?[A-Za-z0-9]{32,}/g },
+  { type: 'aws-access-key', re: /AKIA[0-9A-Z]{16}/g },
+  { type: 'github-token', re: /gh[posru]_[A-Za-z0-9]{36,}/g },
+  { type: 'google-api-key', re: /AIza[0-9A-Za-z_-]{35}/g },
+  { type: 'slack-token', re: /xox[baprs]-[0-9A-Za-z-]{10,}/g },
+  { type: 'stripe-key', re: /[rs]k_(?:live|test)_[A-Za-z0-9]{20,}/g },
+  { type: 'jwt', re: /eyJ[A-Za-z0-9_-]{10,}[.][A-Za-z0-9_-]{10,}[.][A-Za-z0-9_-]{10,}/g },
+  { type: 'private-key', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  { type: 'bearer-token', re: /[Bb]earer[ ]+[A-Za-z0-9._-]{20,}/g },
+];
+// A match that is obviously a placeholder or env reference is NOT a real secret \u2014
+// never block on $VAR, <token>, {{ }}, or common dummy values.
+function isPlaceholderSecret(v: string): boolean {
+  if (/[$<>{}]/.test(v)) return true;
+  const tail = v.replace(/^(sk-ant-|[rs]k_(?:live|test)_|sk-|AKIA|gh[posru]_|AIza|xox[baprs]-|Bearer[ ]+)/, '');
+  return /^(x+|0+|a+|placeholder|example|changeme|your[-_a-z0-9]*|dummy|test|fake|redacted|sample)$/i.test(tail);
+}
+export function detectHardSecrets(text: string): SecretHit[] {
+  if (!text) return [];
+  const hits: SecretHit[] = [];
+  const seen = new Set<string>();
+  for (const { type, re } of HARD_SECRET_PATTERNS) {
+    re.lastIndex = 0;
+    let m: RegExpExecArray | null;
+    while ((m = re.exec(text)) !== null) {
+      const v = m[0];
+      if (isPlaceholderSecret(v) || seen.has(v)) continue;
+      seen.add(v);
+      hits.push({ type, value: v });
+    }
+  }
+  return hits;
+}
+// Shape-preserving redaction for persist/log/grade boundaries: the reader still
+// sees that a secret of a given KIND was present, never the value. Broader than
+// the block set (over-redacting a log is harmless; missing one is not).
+export function scrubSecrets(text: string): string {
+  if (!text) return text;
+  let out = text;
+  for (const { type, re } of HARD_SECRET_PATTERNS) {
+    out = out.replace(re, (m) => isPlaceholderSecret(m) ? m : '<redacted:' + type + '>');
+  }
+  out = out.replace(/((?:password|passwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key)["' ]*[=:][ ]*["']?)([^ "'\\n]{12,})/gi, (full, pfx, val) => {
+    if (/[$<>{}]/.test(val)) return full;
+    return pfx + '<redacted:credential>';
+  });
+  return out;
+}
+function guessEnvName(type: string, i: number): string {
+  const base = type === 'anthropic-key' ? 'ANTHROPIC_API_KEY'
+    : type === 'openai-key' ? 'OPENAI_API_KEY'
+    : type === 'aws-access-key' ? 'AWS_ACCESS_KEY_ID'
+    : type === 'github-token' ? 'GITHUB_TOKEN'
+    : type === 'google-api-key' ? 'GOOGLE_API_KEY'
+    : type === 'slack-token' ? 'SLACK_TOKEN'
+    : type === 'stripe-key' ? 'STRIPE_API_KEY'
+    : (type === 'jwt' || type === 'bearer-token') ? 'AUTH_TOKEN'
+    : 'SECRET';
+  return i === 0 ? base : base + '_' + (i + 1);
+}
+// Agent-facing remediation: show the SAME command with each literal secret swapped
+// for an env reference, so the agent can re-issue it securely without the value
+// ever appearing in the command, logs, or model context.
+export function secretRemediation(command: string, hits: SecretHit[]): string {
+  let safe = command;
+  const names: string[] = [];
+  hits.forEach((h, i) => {
+    const envName = guessEnvName(h.type, i);
+    names.push(envName);
+    safe = safe.split(h.value).join('$' + envName);
+  });
+  const typeList = hits.map(h => h.type).join(', ');
+  return 'Synkro blocked this tool call: it contains a literal credential (' + typeList + '). '
+    + 'A secret value must NEVER be inlined, printed, or echoed \u2014 that leaks it into shell history, logs, and the model context. '
+    + 'Reference the credential from the environment so its value resolves at runtime and never appears in the command. '
+    + 'Set it once out-of-band (export ' + names[0] + '=... in an untracked file, or load from your secret manager), then re-issue as:\\n  ' + safe + '\\n'
+    + 'Do NOT print the value to verify it; check the variable is non-empty instead, e.g. test -n "$' + names[0] + '". Re-issue with the literal removed \u2014 do not ask the user to paste it.';
+}
+// The NEW text an edit introduces, so we flag a secret the agent is ADDING \u2014 never
+// a pre-existing one already in the file (which would falsely block any edit to a
+// file that contains a credential). Write = whole new content; Edit = new_string;
+// MultiEdit = every edit's new_string.
+export function editedAddedText(toolName: string, toolInput: any): string {
+  const ti = toolInput || {};
+  if (toolName === 'MultiEdit' && Array.isArray(ti.edits)) {
+    return ti.edits.map((e: any) => (e && typeof e.new_string === 'string') ? e.new_string : '').join('\\n');
+  }
+  return String(ti.content ?? ti.contents ?? ti.new_string ?? ti.new_source ?? ti.code_edit ?? ti.patch ?? '');
+}
+// Deny payload when an edit HARDCODES a literal credential (else null). Code-edit
+// remediation: load from env/secret manager at runtime, never inline the value.
+export function editSecretDenial(toolName: string, toolInput: any, fileShort: string, tagStr: string): { systemMessage: string; hookSpecificOutput: any } | null {
+  const hits = detectHardSecrets(editedAddedText(toolName, toolInput));
+  if (!hits.length) return null;
+  const types = hits.map(h => h.type).join(', ');
+  const rem = 'Synkro blocked this edit: it hardcodes a literal credential (' + types + ') into ' + fileShort + '. '
+    + 'NEVER commit a secret value to a file \u2014 it leaks into source control, logs, and the model context. '
+    + 'Load it at runtime from the environment or a secret manager and reference it instead (e.g. process.env.SECRET_NAME, os.environ["SECRET_NAME"], or your config/secret provider). '
+    + 'Re-do the edit with the literal removed; do not ask the user to paste it.';
+  return {
+    systemMessage: tagStr + ' editGuard ' + fileShort + ' \u2192 BLOCKED: hardcoded credential (' + types + '). Not sent to the grader; reference it via the environment.',
+    hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: rem, additionalContext: rem },
+  };
+}
+
 const RETRIEVAL_RECENT_N = 40;
 const PROCESS_KW = ['test', 'typecheck', 'tsc', 'lint', 'build', 'migrate', 'migration', 'deploy', 'publish', 'push', 'seed'];
 
@@ -2578,6 +2709,11 @@ export function mintEventId(prefix = 'evt'): string {
 export function appendLocalTelemetry(body: Record<string, any>): void {
   if ((process.env.SYNKRO_STORAGE_MODE || 'local') !== 'local') return;
   const event = { ...body };
+  // Redact secrets from free-text fields before they reach the spool/dashboard,
+  // for any caller that passes raw tool-call content (idempotent if already scrubbed).
+  for (const k of ['command', 'reasoning', 'summary', 'target', 'content']) {
+    if (typeof event[k] === 'string') event[k] = scrubSecrets(event[k]);
+  }
   if (!event.event_id) {
     const ct = String(event.capture_type || '');
     const prefix = ct === 'usage_tick' ? 'usage' : ct === 'edit_scan' ? 'edit' : 'evt';
@@ -2799,6 +2935,12 @@ export function filePathFromToolInput(toolInput: any): string {
 }
 
 export function reconstructContent(toolName: string, toolInput: any, filePath: string, cwd?: string): string {
+  // Cap the grade payload (64KB ~= 16K tokens) so a huge Write/whole-file edit
+  // cannot push grader inference past its 45s budget. Applies UNIFORMLY to every
+  // path, including the previously-uncapped Write/StrReplace/default branches.
+  return reconstructContentInner(toolName, toolInput, filePath, cwd).slice(0, 65536);
+}
+function reconstructContentInner(toolName: string, toolInput: any, filePath: string, cwd?: string): string {
   const canRead = filePath && cwd && isPathUnder(filePath, cwd);
   switch (toolName) {
     case 'ApplyPatch':
@@ -3947,6 +4089,13 @@ export async function logGraderUnavailable(
   gradeInput?: string, ctx?: { sessionId?: string; repo?: string },
 ): Promise<void> {
   const { category, why } = classifyGraderError(errorMessage);
+  // Redact any secret from the diagnostic fields before they are persisted
+  // (Timescale in cloud, on-device log in local). The grade input especially can
+  // carry a credential (a .env edit, a bash command) \u2014 debug diagnostics must
+  // never store a raw secret. classifyGraderError ran on the original above.
+  target = scrubSecrets(target || '');
+  errorMessage = scrubSecrets(errorMessage || '');
+  gradeInput = gradeInput ? scrubSecrets(gradeInput) : gradeInput;
 
   if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') {
     try {
@@ -4054,7 +4203,7 @@ export function outputEmpty(): void {
     EDIT_PRECHECK_TS = `#!/usr/bin/env bun
 import {
   loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag, localGrade,
-  parseVerdict, parseCombinedVerdict, combinedEditGradeEnabled, dispatchCapture, dispatchFinding, ruleMode, reconstructContent, isPathUnder, postWithRetry,
+  parseVerdict, parseCombinedVerdict, combinedEditGradeEnabled, dispatchCapture, dispatchFinding, ruleMode, reconstructContent, editSecretDenial, isPathUnder, postWithRetry,
   readStdin, extractTranscript, readLastPrompt, findNearestDeps, filePathFromToolInput,
   appendSessionAction, readSessionLog, compressSessionLog, sessionLogForGrade, log,
   outputJson, outputEmpty, setupCursorHookSignals, installHookWatchdog, isEditTool, hookSessionId, GATEWAY_URL,
@@ -4180,6 +4329,14 @@ async function main() {
       return;
     }
 
+    // Secret firewall: block an edit that HARDCODES a literal credential before it
+    // reaches the grader/model. Flags only the NEW content (never a pre-existing
+    // secret already in the file).
+    {
+      const _den = editSecretDenial(toolName, toolInput, fileShort, tagStr);
+      if (_den) { outputJson(_den); return; }
+    }
+
     if (rt === 'local') {
       // \u2500\u2500\u2500 Local grading: org rules ONLY (channel 1, port 18929) \u2500\u2500\u2500
       const proposedShort = proposed.slice(0, 4000);
@@ -4428,7 +4585,7 @@ main();
     CWE_PRECHECK_TS = String.raw`#!/usr/bin/env bun
 import {
   loadJwt, ensureFreshJwt, detectRepo, loadConfig, cweRoute, tag,
-  localGradeCwe, parseVerdict, reconstructContent, readStdin, log,
+  localGradeCwe, parseVerdict, reconstructContent, editSecretDenial, readStdin, log,
   outputJson, outputEmpty, setupCursorHookSignals, installHookWatchdog, isEditTool, isShellTool, isCursorHookFormat,
   extractShellCodeWrites, hookSessionId, filePathFromToolInput, emitBlockScanFindings, cweSnippetLines, dispatchFinding, dispatchCapture, GATEWAY_URL,
   logGraderUnavailable, graderUnavailableMessage, resolveTranscriptPath, isCursorInvokingCcHook,
@@ -4691,6 +4848,14 @@ async function main() {
     const graderLabel = graderPool === 'claude_code' ? 'claude' : graderPool;
     const cweTag = '[synkro:' + rt + ':cweScan:' + graderLabel + ']';
 
+    // Secret firewall: a hardcoded credential in the edit is CWE-798 — block it
+    // locally (deterministic, no model) before the CWE grade, flagging only the
+    // NEW content the edit introduces.
+    {
+      const _den = editSecretDenial(scanToolName, scanToolInput, fileShort, cweTag);
+      if (_den) { outputJson(_den); return; }
+    }
+
     if (rt === 'skip') {
       outputJson({ systemMessage: cweTag + ' ' + graderUnavailableMessage('cweGuard', fileShort, 'channel down', graderPool) });
       return;
@@ -5452,6 +5617,7 @@ import {
   logGraderUnavailable, graderUnavailableMessage, filterRules, ruleFilterText, normalizeMode, appendLocalTelemetry, isSafeInRepoRead,
   loadSynkroFile, effectiveGraderPool, synkroFilePresent, noSynkroSkipMessage,
   hashCommand, resolveTranscriptPath, isCursorHookFormat,
+  detectHardSecrets, secretRemediation, scrubSecrets,
   type HookConfig, type Rule,
 } from './_synkro-common.ts';
 import { createHash } from 'node:crypto';
@@ -5591,6 +5757,35 @@ async function main() {
       return;
     }
 
+    // ─── Secret firewall: BLOCK a literal credential in the command BEFORE it runs
+    // or reaches the grader — the value never lands in a file, shell history, OR the
+    // LLM provider (no leak to Anthropic/Cursor). Deterministic + local, no model
+    // call. High-confidence formats only (a false block stops the user), and
+    // $VAR / placeholder refs never trip it. ───
+    const secretHits = detectHardSecrets(command);
+    if (secretHits.length) {
+      const types = secretHits.map(h => h.type).join(', ');
+      const remediation = secretRemediation(command, secretHits);
+      log('bashGuard ' + cmdShort + ' → BLOCKED: literal credential (' + types + ')');
+      appendLocalTelemetry({
+        capture_type: 'local_verdict',
+        verdict: 'block',
+        hook_type: 'bash',
+        category: 'secret_exposure',
+        tool_name: toolName,
+        command: scrubSecrets(command).slice(0, 200),
+        session_id: sessionId,
+        repo: gitRepo || cwd,
+        cc_model: transcript.ccModel,
+        reasoning: 'Literal credential (' + types + ') in the proposed command — blocked locally before grading; never sent to the model.',
+      });
+      outputJson({
+        systemMessage: tagStr + ' bashGuard → BLOCKED: literal credential in command (' + types + '). Not sent to the grader; use an env var reference instead.',
+        hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: remediation, additionalContext: remediation },
+      });
+      return;
+    }
+
     // ─── Install protection: install-scan runs first and owns block traces ───
     let scanConcern = '';
     let scanBlockContext = '';
@@ -6481,6 +6676,7 @@ import {
   loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag, localGrade,
   parseVerdict, dispatchCapture, dispatchFinding, ruleMode, normalizeMode, filterRules, ruleFilterText,
   isSafeInRepoRead, resolveTranscriptPath, postWithRetry, readStdin, hashCommand,
+  detectHardSecrets, secretRemediation, scrubSecrets,
   extractTranscript, readLastPrompt, readSessionLog, compressSessionLog, sessionLogForGrade,
   appendLocalTelemetry, logGraderUnavailable, graderUnavailableMessage, log, GATEWAY_URL,
   loadSynkroFile, effectiveGraderPool, synkroFilePresent,
@@ -6637,6 +6833,23 @@ async function main() {
     const rt = await route(config, synkroFile);
     const tagStr = tag(rt, config, graderPool);
 
+    // Secret firewall: BLOCK a literal credential in the command BEFORE it runs or
+    // reaches the grader \u2014 never leaks to a file, shell history, or the model
+    // (Anthropic/Cursor). Local + deterministic; $VAR / placeholder refs never trip it.
+    const secretHits = detectHardSecrets(command);
+    if (secretHits.length) {
+      const types = secretHits.map(h => h.type).join(', ');
+      const remediation = secretRemediation(command, secretHits);
+      log('bashGuard ' + cmdShort + ' \u2192 BLOCKED: literal credential (' + types + ')');
+      appendLocalTelemetry({
+        capture_type: 'local_verdict', verdict: 'block', hook_type: 'bash',
+        category: 'secret_exposure', tool_name: toolName, command: scrubSecrets(command).slice(0, 200),
+        session_id: sessionId, repo: repo || cwd, cc_model: model,
+        reasoning: 'Literal credential (' + types + ') in the proposed command \u2014 blocked locally before grading; never sent to the model.',
+      });
+      finishWith({ permission: 'deny', user_message: tagStr + ' bashGuard \u2192 BLOCKED: literal credential in command (' + types + '). Use an env var reference instead.', agent_message: remediation });
+    }
+
     // Install protection \u2014 install-scan runs first and owns block traces.
     let scanConcern = '';
     let scanBlockContext = '';
@@ -10951,7 +11164,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.88")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.90")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -14994,7 +15207,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.88");
+  console.log("1.6.90");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents