@wrongstack/core 0.269.0 → 0.272.0

package/dist/{secret-vault-BLsVmTIK.d.ts → secret-vault-eMBKfheR.d.ts}

@@ -1,4 +1,4 @@
-import { S as SecretScrubber } from './permission-CvYQNUqZ.js';
+import { S as SecretScrubber } from './permission-CC7XFYWG.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { R as RotatableSecretVault, S as SecretVault } from './secret-vault-BAKpgFw_.js';
 
@@ -51,6 +51,14 @@ declare class DefaultSecretVault implements RotatableSecretVault {
         oldVersion: number;
         newVersion: number;
     };
+    /**
+     * If WRONGSTACK_VAULT_PASSPHRASE is set but the key on disk is still stored
+     * unwrapped (legacy v1 / versioned v2), re-write it in passphrase-wrapped (v3)
+     * form. The data key is preserved, so all existing ciphertext keeps
+     * decrypting. Best-effort: a write failure leaves the working unwrapped file
+     * in place and is not fatal to load.
+     */
+    private migrateToWrappedIfPassphrase;
     private loadOrCreateKey;
 }
 /**

package/dist/security/index.d.ts

@@ -1,8 +1,8 @@
-export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-BLsVmTIK.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-D5Ss8j4B.js';
-export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-whDfTANu.js';
-import '../permission-CvYQNUqZ.js';
-import '../context-Dp87Bcaq.js';
+export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-eMBKfheR.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-cYR4RJmw.js';
+export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-2Lhk5v0o.js';
+import '../permission-CC7XFYWG.js';
+import '../context-Dw55zZ_Q.js';
 import '../logger-B63L5bTg.js';
 import '../secret-vault-BAKpgFw_.js';
 import '../input-reader-E-ffP2ee.js';

package/dist/security/index.js

@@ -1,4 +1,4 @@
-import { randomBytes, createCipheriv, createDecipheriv } from 'crypto';
+import { randomBytes, createCipheriv, createDecipheriv, scryptSync } from 'crypto';
 import * as fs2 from 'fs';
 import * as fs from 'fs/promises';
 import * as path3 from 'path';
@@ -310,6 +310,7 @@ function escapeRegex(s) {
 }
 var COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
 var CACHE_MAX_SIZE = 2e3;
+var NEVER_MATCH = /[^\s\S]/;
 function getCachedGlob(pattern) {
   const cached = COMPILED_GLOB_CACHE.get(pattern);
   if (cached) return cached;
@@ -319,7 +320,12 @@ function getCachedGlob(pattern) {
       COMPILED_GLOB_CACHE.delete(expectDefined(keys[i]));
     }
   }
-  const re = compileGlob(pattern);
+  let re;
+  try {
+    re = compileGlob(pattern);
+  } catch {
+    re = NEVER_MATCH;
+  }
   COMPILED_GLOB_CACHE.set(pattern, re);
   return re;
 }
@@ -543,6 +549,83 @@ var ALGO = "aes-256-gcm";
 var KEY_FILE_MODE = 384;
 var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
 var VERSIONED_KEY_FILE_SIZE = KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
+var KEK_MAGIC = Buffer.from("WSKW", "ascii");
+var KEK_SALT_BYTES = 16;
+var WRAPPED_KEY_FILE_SIZE = KEK_MAGIC.length + 1 + KEK_SALT_BYTES + IV_BYTES + TAG_BYTES + KEY_BYTES;
+var SCRYPT_N = 1 << 15;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SCRYPT_MAXMEM = 64 * 1024 * 1024;
+function getVaultPassphrase() {
+  const v = process.env["WRONGSTACK_VAULT_PASSPHRASE"];
+  return v && v.length > 0 ? v : void 0;
+}
+function isWrappedKeyFile(buf) {
+  return buf.length === WRAPPED_KEY_FILE_SIZE && buf.subarray(0, KEK_MAGIC.length).equals(KEK_MAGIC);
+}
+function deriveKEK(passphrase, salt) {
+  return scryptSync(passphrase, salt, KEY_BYTES, {
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P,
+    maxmem: SCRYPT_MAXMEM
+  });
+}
+function wrapDataKey(dataKey, keyVersion, passphrase) {
+  const salt = randomBytes(KEK_SALT_BYTES);
+  const iv = randomBytes(IV_BYTES);
+  const kek = deriveKEK(passphrase, salt);
+  const cipher = createCipheriv(ALGO, kek, iv);
+  const ct = Buffer.concat([cipher.update(dataKey), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const out = Buffer.alloc(WRAPPED_KEY_FILE_SIZE);
+  let off = 0;
+  KEK_MAGIC.copy(out, off);
+  off += KEK_MAGIC.length;
+  out[off] = keyVersion & 255;
+  off += 1;
+  salt.copy(out, off);
+  off += KEK_SALT_BYTES;
+  iv.copy(out, off);
+  off += IV_BYTES;
+  tag.copy(out, off);
+  off += TAG_BYTES;
+  ct.copy(out, off);
+  return out;
+}
+function unwrapDataKey(buf, keyFile) {
+  const passphrase = getVaultPassphrase();
+  if (!passphrase) {
+    throw new ConfigError({
+      message: `SecretVault: key file ${keyFile} is passphrase-protected \u2014 set the WRONGSTACK_VAULT_PASSPHRASE environment variable to unlock it.`,
+      code: ERROR_CODES.CONFIG_INVALID,
+      context: { keyFile }
+    });
+  }
+  let off = KEK_MAGIC.length;
+  const version = buf[off];
+  off += 1;
+  const salt = buf.subarray(off, off + KEK_SALT_BYTES);
+  off += KEK_SALT_BYTES;
+  const iv = buf.subarray(off, off + IV_BYTES);
+  off += IV_BYTES;
+  const tag = buf.subarray(off, off + TAG_BYTES);
+  off += TAG_BYTES;
+  const ct = buf.subarray(off, off + KEY_BYTES);
+  const kek = deriveKEK(passphrase, salt);
+  const decipher = createDecipheriv(ALGO, kek, iv);
+  decipher.setAuthTag(tag);
+  try {
+    const key = Buffer.concat([decipher.update(ct), decipher.final()]);
+    return { key: Buffer.from(key), version };
+  } catch {
+    throw new ConfigError({
+      message: `SecretVault: failed to unlock key file ${keyFile} \u2014 wrong WRONGSTACK_VAULT_PASSPHRASE (key unwrap authentication failed).`,
+      code: ERROR_CODES.CONFIG_INVALID,
+      context: { keyFile }
+    });
+  }
+}
 function checkKeyFilePermissions(keyFile) {
   if (process.platform === "win32") return;
   try {
@@ -635,25 +718,56 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
-    KEY_FILE_MAGIC.copy(keyFileBuf, 0);
-    keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
-    newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
     fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
-    fs2.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
+    const passphrase = getVaultPassphrase();
+    if (passphrase) {
+      fs2.writeFileSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase), { mode: 384 });
+    } else {
+      const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
+      KEY_FILE_MAGIC.copy(keyFileBuf, 0);
+      keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
+      newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
+      fs2.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
+    }
     checkKeyFilePermissions(this.keyFile);
     this.key = newKey;
     this._keyVersion = newVersion;
     return { oldVersion, newVersion };
   }
+  /**
+   * If WRONGSTACK_VAULT_PASSPHRASE is set but the key on disk is still stored
+   * unwrapped (legacy v1 / versioned v2), re-write it in passphrase-wrapped (v3)
+   * form. The data key is preserved, so all existing ciphertext keeps
+   * decrypting. Best-effort: a write failure leaves the working unwrapped file
+   * in place and is not fatal to load.
+   */
+  migrateToWrappedIfPassphrase() {
+    const passphrase = getVaultPassphrase();
+    if (!passphrase || !this.key) return;
+    try {
+      fs2.writeFileSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase), {
+        mode: 384
+      });
+      checkKeyFilePermissions(this.keyFile);
+    } catch {
+    }
+  }
   loadOrCreateKey() {
     if (this.key) return this.key;
     try {
       const buf = fs2.readFileSync(this.keyFile);
+      if (isWrappedKeyFile(buf)) {
+        const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
+        this.key = key2;
+        this._keyVersion = version;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
+      }
       if (buf.length === KEY_BYTES) {
         this.key = buf;
         this._keyVersion = 1;
         checkKeyFilePermissions(this.keyFile);
+        this.migrateToWrappedIfPassphrase();
         return this.key;
       }
       if (buf.length === VERSIONED_KEY_FILE_SIZE) {
@@ -677,6 +791,7 @@ var DefaultSecretVault = class {
         this.key = Buffer.from(key2);
         this._keyVersion = version;
         checkKeyFilePermissions(this.keyFile);
+        this.migrateToWrappedIfPassphrase();
         return this.key;
       }
       throw new ConfigError({
@@ -689,11 +804,20 @@ var DefaultSecretVault = class {
     }
     fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
     const key = randomBytes(KEY_BYTES);
+    const passphrase = getVaultPassphrase();
+    const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
     try {
-      fs2.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
+      fs2.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       const buf = fs2.readFileSync(this.keyFile);
+      if (isWrappedKeyFile(buf)) {
+        const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
+        this.key = winnerKey;
+        this._keyVersion = version;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
+      }
       if (buf.length === KEY_BYTES) {
         this.key = buf;
         this._keyVersion = 1;
@@ -1086,6 +1210,9 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
 }
 
 // src/security/permission-policy.ts
+function matchesTrust(patterns, subject) {
+  return patterns.includes(subject) || matchAny(patterns, subject);
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -1222,7 +1349,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(cacheKey, decision);
       return decision;
     }
-    if (entry?.deny && subject && matchAny(entry.deny, subject)) {
+    if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
       const decision = { permission: "deny", source: "deny", reason: "matched deny pattern" };
       this._evalCache.set(cacheKey, decision);
       return decision;
@@ -1232,7 +1359,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(cacheKey, decision);
       return decision;
     }
-    if (entry?.allow && subject && matchAny(entry.allow, subject)) {
+    if (entry?.allow && subject && matchesTrust(entry.allow, subject)) {
       const decision = { permission: "auto", source: "trust", reason: "matched allow pattern" };
       this._evalCache.set(cacheKey, decision);
       return decision;