@vtstech/pi-security 1.1.5 → 1.1.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -3
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -13,11 +13,13 @@ pi install "npm:@vtstech/pi-security"
|
|
|
13
13
|
## Protection
|
|
14
14
|
|
|
15
15
|
- **Partitioned command blocklist** — 41 CRITICAL commands (always blocked: system modification, privilege escalation, network attacks, shell escapes) + 25 EXTENDED commands (blocked in max mode: package management, process control, development tools)
|
|
16
|
-
- **Mode-aware SSRF protection** —
|
|
16
|
+
- **Mode-aware SSRF protection** — 22 ALWAYS_BLOCKED URL patterns (loopback, RFC1918 private ranges, cloud metadata endpoints) + 7 MAX_ONLY patterns (localhost by name, broadcast, link-local, current network) that are allowed in basic mode
|
|
17
17
|
- **Security mode toggle** — switch between `basic` and `max` modes at runtime; persisted to `~/.pi/agent/security.json`
|
|
18
18
|
- **Path validation** — prevents filesystem escape and access to critical system directories; symlinks are dereferenced via `fs.realpathSync()` to block `/tmp/evil → /etc/passwd` bypasses
|
|
19
19
|
- **Shell injection detection** — regex patterns for command chaining, substitution, and redirection
|
|
20
|
-
- **
|
|
20
|
+
- **Full-word command scanning** — all words in a command are checked against CRITICAL_COMMANDS (catches `sudo chmod`, `exec dd`, etc.)
|
|
21
|
+
- **Audit logging** — JSON-lines audit log at `~/.pi/agent/audit.log` with security mode recorded per entry, buffered writes (path exported as `AUDIT_LOG_PATH`)
|
|
22
|
+
- **DNS rebinding protection** — opt-in `resolveAndCheckHostname()` resolves hostnames via DNS and blocks loopback/private/cloud-metadata IPs
|
|
21
23
|
|
|
22
24
|
## Commands
|
|
23
25
|
|
|
@@ -35,4 +37,4 @@ pi install "npm:@vtstech/pi-security"
|
|
|
35
37
|
|
|
36
38
|
## License
|
|
37
39
|
|
|
38
|
-
MIT — [VTSTech](https://www.vts-tech.org)
|
|
40
|
+
MIT — [VTSTech](https://www.vts-tech.org)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vtstech/pi-security",
|
|
3
|
-
"version": "1.1.
|
|
3
|
+
"version": "1.1.7",
|
|
4
4
|
"description": "Security extension for Pi Coding Agent",
|
|
5
5
|
"main": "security.js",
|
|
6
6
|
"keywords": ["pi-extensions"],
|
|
@@ -14,7 +14,7 @@
|
|
|
14
14
|
"url": "https://github.com/VTSTech/pi-coding-agent"
|
|
15
15
|
},
|
|
16
16
|
"dependencies": {
|
|
17
|
-
"@vtstech/pi-shared": "1.1.
|
|
17
|
+
"@vtstech/pi-shared": "1.1.7"
|
|
18
18
|
},
|
|
19
19
|
"peerDependencies": {
|
|
20
20
|
"@mariozechner/pi-coding-agent": ">=0.66"
|