@wrongstack/core 0.308.7 → 0.309.1

package/dist/prompts/index.js

@@ -326,6 +326,361 @@ var PromptManifestStore = class {
 // src/prompts/prompt-journal.ts
 import * as fs2 from "node:fs/promises";
 import * as path2 from "node:path";
+
+// src/security/secret-scrubber.ts
+var JSON_CREDENTIAL_KEY_ANCHORS = [
+  'Key"',
+  'key"',
+  'KEY"',
+  'token"',
+  'Token"',
+  'TOKEN"',
+  'secret"',
+  'Secret"',
+  'SECRET"',
+  'password"',
+  'Password"',
+  'PASSWORD"',
+  'authorization"',
+  'Authorization"',
+  'bearer"',
+  'Bearer"'
+];
+var PATTERNS = [
+  // Anchored at the start where possible so partial matches inside larger
+  // strings don't trigger false positives.
+  {
+    type: "anthropic_key",
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g,
+    anchor: "sk-ant-"
+  },
+  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g, anchor: "AIza" },
+  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g, anchor: "xox" },
+  {
+    type: "stripe_key",
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g,
+    anchor: "sk_"
+  },
+  {
+    type: "twilio_sid",
+    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "AC"
+  },
+  {
+    type: "telegram_bot_token",
+    // Telegram tokens are of the form  bot<digits>:<alphanum>  in URL paths
+    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "/bot"
+  },
+  {
+    type: "jwt",
+    // Anchored: look for literal "eyJ" which is unambiguous for JWT header
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g,
+    anchor: "eyJ"
+  },
+  {
+    type: "private_key",
+    // Anchored: start must be BEGIN, end must be END with no extra dashes after END
+    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g,
+    anchor: "-----BEGIN"
+  },
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g, anchor: "mongodb" },
+  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g, anchor: "postgres" },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g, anchor: "mysql://" },
+  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g, anchor: "redis://" },
+  // AI/ML provider keys — modern LLM services with well-known prefixes
+  {
+    type: "huggingface_token",
+    // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
+    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g,
+    anchor: "hf_"
+  },
+  {
+    type: "replicate_token",
+    // Replicate tokens: r8_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "r8_"
+  },
+  {
+    type: "perplexity_key",
+    // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "pplx-"
+  },
+  {
+    type: "groq_key",
+    // Groq API keys: gsk_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "gsk_"
+  },
+  {
+    type: "bearer_token",
+    // Anchored with alternation instead of negative lookahead — avoids V8
+    // backtracking risk on adversarial input. Bounded at 512 chars.
+    // Min 12 chars: some OAuth providers issue shorter-lived tokens (< 20
+    // chars). A 12-char base64 string has ~71 bits of entropy — above the
+    // threshold where random strings are unlikely to produce false matches.
+    // The trailing boundary is a NON-consuming lookahead: two adjacent bearer
+    // tokens sharing a single delimiter (`Bearer a… Bearer b…`) must both be
+    // redacted. A consuming trailing delimiter would eat the separator the
+    // next match needs for its leading anchor, leaking the second token.
+    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g,
+    anchor: "Bearer"
+  },
+  {
+    type: "high_entropy_env",
+    // Anchored with alternation instead of lookbehind to avoid backtracking.
+    // Value bounded at 512 chars.
+    // The trailing boundary is a NON-consuming lookahead so two secrets
+    // separated by a single delimiter (one space OR one newline, e.g.
+    // `printenv` / `.env` dumps: `API_KEY=… \n SESSION_TOKEN=…`) are BOTH
+    // redacted. A consuming trailing `\s` would swallow the separator the
+    // next match needs for its leading anchor, so every other secret would
+    // leak in plaintext.
+    // The leading delimiter is CAPTURED (group 1) and re-emitted by the
+    // replacement so the separator between adjacent secrets is preserved
+    // rather than collapsed. Capture groups are therefore: 1=leading
+    // delimiter, 2=key name, 3=value.
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
+  },
+  {
+    type: "json_credential_key",
+    // The JSON counterpart to `high_entropy_env`, and the pattern that the
+    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
+    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
+    // "this text may hold a secret", every pattern then declined to match, and
+    // the value went out verbatim. `high_entropy_env` cannot cover these: it
+    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
+    // never matched.
+    //
+    // Tool results are routinely serialised as JSON, and a credential with no
+    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
+    // has no other pattern that can catch it — this is the only thing standing
+    // between such a value and the session JSONL, chronicle, HQ broadcast and
+    // the model's own context.
+    //
+    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
+    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
+    // the closing quote has to follow the word immediately.
+    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
+    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
+    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
+    anchor: JSON_CREDENTIAL_KEY_ANCHORS
+  },
+  // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
+  // The plugin runtime carried 37 patterns while this scrubber — the one that
+  // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
+  // audit — carried 22. The plugin side already had a parity test; it just did
+  // not cover core. Most consequential: WrongStack mints `gho_` tokens itself
+  // in the Copilot OAuth flow, and `gh[ousr]_` was absent here.
+  {
+    type: "github_oauth_token",
+    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g,
+    anchor: ["gho_", "ghu_", "ghs_", "ghr_"]
+  },
+  {
+    type: "gitlab_pat",
+    regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glpat-"
+  },
+  {
+    type: "gitlab_runner_token",
+    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glrt-"
+  },
+  {
+    type: "npm_token",
+    regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
+    anchor: "npm_"
+  },
+  {
+    type: "slack_app_token",
+    regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+    anchor: "xapp-"
+  },
+  {
+    type: "slack_webhook",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g,
+    anchor: "hooks.slack.com"
+  },
+  {
+    type: "sendgrid_key",
+    regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "SG."
+  },
+  {
+    type: "digitalocean_token",
+    regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g,
+    anchor: "dop_v1_"
+  },
+  {
+    type: "doppler_token",
+    regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "dp."
+  },
+  {
+    type: "shopify_token",
+    regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "shp"
+  },
+  {
+    type: "docker_pat",
+    regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "dckr_pat_"
+  },
+  {
+    type: "linear_key",
+    regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "lin_api_"
+  },
+  {
+    type: "atlassian_token",
+    regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g,
+    anchor: "ATATT3"
+  },
+  {
+    type: "square_token",
+    regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: ["sq0atp-", "sq0csp-", "EAAA"]
+  },
+  {
+    type: "google_oauth_client_secret",
+    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "GOCSPX-"
+  }
+];
+var SIMPLE_PATTERNS = PATTERNS.filter(
+  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
+);
+var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
+var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
+var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
+var SCRUB_CHUNK_BYTES = 64 * 1024;
+var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
+var PATTERN_ANCHORS = [
+  ...new Set(
+    PATTERNS.flatMap(
+      (pattern) => typeof pattern.anchor === "string" ? [pattern.anchor] : [...pattern.anchor]
+    )
+  )
+];
+var ALL_ANCHORS = PATTERN_ANCHORS;
+function hasCredentialAnchors(text) {
+  for (const anchor of ALL_ANCHORS) {
+    if (text.includes(anchor)) return true;
+  }
+  return false;
+}
+var DefaultSecretScrubber = class {
+  scrub(text) {
+    if (!text) return text;
+    if (!hasCredentialAnchors(text)) return text;
+    if (text.length <= SCRUB_CHUNK_BYTES) {
+      return this.scrubOne(text);
+    }
+    const out = [];
+    let i = 0;
+    while (i < text.length) {
+      let end = Math.min(i + SCRUB_CHUNK_BYTES, text.length);
+      if (end < text.length) {
+        const limit = Math.min(end + SCRUB_OVERLAP_BYTES, text.length);
+        let safe = -1;
+        for (let j = end; j < limit; j++) {
+          const ch = text.charCodeAt(j);
+          if (ch === 32 || ch === 9 || ch === 10 || ch === 13) {
+            safe = j;
+            break;
+          }
+        }
+        end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
+      }
+      out.push(this.scrubOne(text.slice(i, end)));
+      i = end;
+    }
+    return out.join("");
+  }
+  scrubOne(text) {
+    if (!hasCredentialAnchors(text)) return text;
+    let out = text.replace(
+      COMBINED_REGEX,
+      (match, ...groups) => {
+        const idx = groups.findIndex((g) => g !== void 0);
+        if (idx < 0) return match;
+        const replacement = COMBINED_REPLACEMENTS[idx];
+        return replacement !== void 0 ? replacement : match;
+      }
+    );
+    out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
+      return `${lead}${key}=[REDACTED:high_entropy_env]`;
+    });
+    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
+      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
+    });
+    return out;
+  }
+  /**
+   * Recursively scrub every string value in an object/array graph. Secrets can
+   * appear under any key — a URL query param, an `authorization` header, an
+   * arbitrarily-named nested field — so we don't gate recursion on key names.
+   * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
+   * value without a credential anchor returns immediately without regex work.
+   */
+  scrubObject(obj) {
+    const seen = /* @__PURE__ */ new WeakSet();
+    const visit = (v) => {
+      if (typeof v === "string") return this.scrub(v);
+      if (v === null || typeof v !== "object") return v;
+      if (seen.has(v)) return v;
+      seen.add(v);
+      if (Array.isArray(v)) return v.map(visit);
+      const out = {};
+      for (const [k, val] of Object.entries(v)) {
+        out[k] = visit(val);
+      }
+      return out;
+    };
+    return visit(obj);
+  }
+};
+
+// src/prompts/prompt-journal.ts
+var defaultScrubber = new DefaultSecretScrubber();
 var PROMPT_JOURNAL_RAW_MARKER = "promptJournal.raw";
 async function ensureGitignore(projectRoot) {
   const gitignorePath = path2.join(projectRoot, ".gitignore");
@@ -354,7 +709,9 @@ async function recordPromptJournalEntry(opts) {
   const monthStr = dateStr.slice(0, 7);
   const sessionId = opts.sessionId && opts.sessionId.trim() ? opts.sessionId.trim() : "general";
   const id = `pmt_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
-  const content = opts.content ?? "";
+  const content = defaultScrubber.scrub(opts.content ?? "");
+  const rawContent = typeof opts.rawContent === "string" && opts.rawContent.length > 0 ? defaultScrubber.scrub(opts.rawContent) : opts.rawContent;
+  const decisionReason = typeof opts.decisionReason === "string" && opts.decisionReason.length > 0 ? defaultScrubber.scrub(opts.decisionReason) : opts.decisionReason;
   const lines = content.split("\n");
   const characterCount = content.length;
   const lineCount = lines.length;
@@ -367,7 +724,7 @@ async function recordPromptJournalEntry(opts) {
     role: opts.role ?? (opts.category === "system_prompt" ? "system" : "user"),
     category: opts.category,
     content,
-    rawContent: opts.rawContent,
+    rawContent,
     metadata: {
       model: opts.model,
       provider: opts.provider,
@@ -378,7 +735,7 @@ async function recordPromptJournalEntry(opts) {
       activeTools: opts.activeTools,
       contextFiles: opts.contextFiles,
       durationMs: opts.durationMs,
-      decisionReason: opts.decisionReason,
+      decisionReason,
       tags: opts.tags
     }
   };

package/dist/security/auto-approve-policy.d.ts

@@ -26,12 +26,12 @@ export declare class AutoApprovePermissionPolicy implements PermissionPolicy {
     private readonly allowedCapabilities;
     constructor(allowedCapabilities?: readonly string[]);
     private static isMcpTool;
-    evaluate(tool: Tool): Promise<PermissionDecision>;
+    evaluate(tool: Tool, input?: unknown): Promise<PermissionDecision>;
     trust(): Promise<void>;
     deny(): Promise<void>;
     denyOnce(): void;
     allowOnce(): void;
-    explain(tool: Tool): Promise<PermissionTrace>;
+    explain(tool: Tool, input?: unknown): Promise<PermissionTrace>;
     reload(): Promise<void>;
 }
 //# sourceMappingURL=auto-approve-policy.d.ts.map