@wenrwa/marketplace-cli 0.8.4 → 0.8.6

package/hooks/opencode-plugin.mjs

@@ -11,11 +11,16 @@
 //   session.updated (primary session, real title) -> OSC 0 pane title (oc-17), written to /dev/tty
 //     because OpenCode's own title ("OpenCode" / "OC | <title>") is switched off by the launch
 //     (OPENCODE_DISABLE_TERMINAL_TITLE=1): the app's auto-title ingestion shows the title verbatim.
-// No-op without HIVEOP_ACTIVITY_FILE and WENRWA_SESSION_ID; nothing ever throws into OpenCode.
+// No-op without HIVEOP_ACTIVITY_FILE and WENRWA_SESSION_ID; nothing ever throws into OpenCode,
+// with ONE deliberate exception: the secret guard (2026-10-17) throws from tool.execute.before
+// to block a bash command carrying a literal secret (OpenCode's documented way to block a tool).
+// It uses the CLI's own detector (dist/secrets/redact.js) and fails open when it cannot load it.
 // ONLY plugin functions may be exported: OpenCode loads every export as a plugin, and a helper
 // export breaks every prompt (Plugin.trigger reads hooks off its return value).
 import fs from 'node:fs'
 import path from 'node:path'
+import { createRequire } from 'node:module'
+import { fileURLToPath } from 'node:url'
 
 // OpenCode tool ids -> the Claude Code names the bridge/touch tracker already understand.
 const TOOL_NAME = {
@@ -154,6 +159,52 @@ function captureSessionId(event, env = process.env) {
   } catch {}
 }
 
+// Secret guard: the same words the Claude Code PreToolUse hook (hooks/pre-tool-use.js) uses.
+const SECRET_MESSAGE = [
+  'HiveOp blocked this command: it contains a literal secret (token, key or password).',
+  'Never put secret values in commands, and never echo, print or cat them.',
+  'Put the value in an environment variable or the workspace .env (ask the user to add it, or use the write tool),',
+  'then reference it by name, e.g. RAILWAY_TOKEN="$RAILWAY_TOKEN" railway up - and re-run.',
+].join('\n')
+
+let secretCheck // undefined: not loaded yet; null: unavailable (fail open)
+function loadSecretCheck(env) {
+  if (secretCheck !== undefined) return secretCheck
+  secretCheck = null
+  try {
+    const req = createRequire(import.meta.url)
+    const here = path.dirname(fileURLToPath(import.meta.url))
+    const prefix = env.npm_config_prefix || '/usr/local'
+    // HIVEOP_SECRETS_MODULE, when set, is the ONLY place looked (tests; a pinned install).
+    const candidates = env.HIVEOP_SECRETS_MODULE ? [env.HIVEOP_SECRETS_MODULE] : [
+      path.join(here, '..', 'dist', 'secrets', 'redact.js'),
+      path.join(prefix, 'lib', 'node_modules', '@wenrwa', 'marketplace-cli', 'dist', 'secrets', 'redact.js'),
+      '/usr/local/lib/node_modules/@wenrwa/marketplace-cli/dist/secrets/redact.js',
+    ]
+    for (const p of candidates) {
+      if (!p) continue
+      try {
+        if (!fs.existsSync(p)) continue
+        const m = req(p)
+        if (m && typeof m.containsSecret === 'function') { secretCheck = m.containsSecret; break }
+      } catch {}
+    }
+  } catch {}
+  return secretCheck
+}
+
+/** True when a bash tool call carries a literal secret. Never throws. */
+function carriesSecret(toolId, args, env) {
+  try {
+    if (env.HIVEOP_SECRET_GUARD === '0') return false
+    if (String(toolId || '').toLowerCase() !== 'bash') return false
+    const cmd = args && typeof args.command === 'string' ? args.command : ''
+    if (!cmd) return false
+    const check = loadSecretCheck(env)
+    return !!(check && check(cmd))
+  } catch { return false }
+}
+
 export const HiveOp = async () => {
   const env = process.env
   let lastKind = ''
@@ -177,7 +228,9 @@ export const HiveOp = async () => {
       } catch {}
     },
     'tool.execute.before': async (input, output) => {
-      try { emit(toolRecord(input && input.tool, (output && output.args) || (input && input.args))) } catch {}
+      const args = (output && output.args) || (input && input.args)
+      try { emit(toolRecord(input && input.tool, args)) } catch {}
+      if (carriesSecret(input && input.tool, args, env)) throw new Error(SECRET_MESSAGE)
     },
     'tool.execute.after': async (input, output) => {
       try { emit(toolRecord(input && input.tool, (input && input.args) || (output && output.args))) } catch {}

package/hooks/pre-tool-use.js

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+/*
+ * HiveOp PreToolUse hook (Bash) — secret guard, BOTH lanes (2026-10-17).
+ *
+ * Blocks a Bash command that carries a literal secret (a token, a password, a
+ * NAME=value with a secret-ish name …) and tells the agent to reference it
+ * from the environment instead. A command that only names `$VARS` passes.
+ *
+ * The detector is the CLI's own (dist/secrets/redact.js — the same code that
+ * masks terminal output), so the guard and the mask agree on what a secret
+ * is. This file is byte-identical in cli/hooks/ (local lane, loaded via the
+ * bridge's --settings file) and infra/terminal-image/hooks/ (hosted lane,
+ * registered by entrypoint.sh); a test keeps the copies identical.
+ *
+ * FAIL OPEN: no detector, unreadable input, any error, or a slow stdin →
+ * exit 0 and the command runs. Output masking is the safety net behind this.
+ * Opt out per user with HIVEOP_SECRET_GUARD=0.
+ */
+const fs = require('fs');
+const path = require('path');
+
+const MESSAGE = [
+  'HiveOp blocked this command: it contains a literal secret (token, key or password).',
+  'Never put secret values in commands, and never echo, print or cat them.',
+  'Put the value in an environment variable or the workspace .env (ask the user to add it, or use the Write tool),',
+  'then reference it by name, e.g. RAILWAY_TOKEN="$RAILWAY_TOKEN" railway up — and re-run.',
+].join('\n');
+
+/** Where the CLI's compiled detector lives, nearest first. HIVEOP_SECRETS_MODULE,
+ *  when set, is the ONLY place looked (tests; a pinned install). */
+function detectorCandidates(env) {
+  if (env.HIVEOP_SECRETS_MODULE) return [env.HIVEOP_SECRETS_MODULE];
+  const prefix = env.npm_config_prefix || '/usr/local';
+  return [
+    path.join(__dirname, '..', 'dist', 'secrets', 'redact.js'),
+    path.join(prefix, 'lib', 'node_modules', '@wenrwa', 'marketplace-cli', 'dist', 'secrets', 'redact.js'),
+    '/usr/local/lib/node_modules/@wenrwa/marketplace-cli/dist/secrets/redact.js',
+    '/usr/lib/node_modules/@wenrwa/marketplace-cli/dist/secrets/redact.js',
+  ];
+}
+
+function loadDetector(env) {
+  for (const p of detectorCandidates(env)) {
+    if (!p) continue;
+    try {
+      if (!fs.existsSync(p)) continue;
+      const mod = require(p);
+      if (mod && typeof mod.containsSecret === 'function') return mod.containsSecret;
+    } catch { /* try the next */ }
+  }
+  return null;
+}
+
+/**
+ * Pure decision: the hook event in, `{ block, message }` out. Never throws.
+ * `containsSecret` is injected so tests can pass the TypeScript detector.
+ */
+function decide(ev, containsSecret, env) {
+  try {
+    if (!ev || typeof ev !== 'object') return { block: false };
+    if ((env && env.HIVEOP_SECRET_GUARD) === '0') return { block: false };
+    if (ev.tool_name !== 'Bash') return { block: false };
+    const command = ev.tool_input && typeof ev.tool_input.command === 'string' ? ev.tool_input.command : '';
+    if (!command || typeof containsSecret !== 'function') return { block: false };
+    return containsSecret(command) ? { block: true, message: MESSAGE } : { block: false };
+  } catch {
+    return { block: false };
+  }
+}
+
+function main() {
+  let input = '';
+  // A hook must never hang a tool call: give stdin 2s, then let it run.
+  const guard = setTimeout(() => process.exit(0), 2000);
+  process.stdin.on('data', (d) => { input += d; });
+  process.stdin.on('error', () => process.exit(0));
+  process.stdin.on('end', () => {
+    clearTimeout(guard);
+    try {
+      const ev = JSON.parse(input || '{}');
+      const verdict = decide(ev, loadDetector(process.env), process.env);
+      if (verdict.block) {
+        // Exit 2 + stderr: Claude Code blocks the call and shows the agent
+        // this message. It never repeats the command (or the secret).
+        process.stderr.write(verdict.message + '\n');
+        process.exit(2);
+        return;
+      }
+    } catch { /* fail open */ }
+    process.exit(0);
+  });
+}
+
+if (require.main === module) main();
+
+module.exports = { decide, detectorCandidates, MESSAGE };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenrwa/marketplace-cli",
-  "version": "0.8.4",
+  "version": "0.8.6",
   "description": "CLI tool for the Wenrwa Agent Marketplace — monitor bounties, agents, workspaces, and treasury from your terminal",
   "author": "Wenrwa <dev@wenrwa.com>",
   "license": "MIT",