@wrongstack/core 0.308.7 → 0.309.1

package/dist/security/index.js

@@ -175,7 +175,7 @@ function walk(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();
@@ -921,6 +921,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -1011,8 +1019,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -1129,6 +1137,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -1165,6 +1194,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;
@@ -1737,9 +1767,21 @@ function renderCommandLine(command, args) {
   });
   return [command, ...rendered].join(" ");
 }
-function subjectForToolInput(toolName, input, subjectKey) {
+function renderSubjectFields(obj, fields) {
+  const parts = [];
+  for (const field of fields) {
+    const value = obj[field];
+    if (value === void 0 || value === null || value === "" || value === false) continue;
+    const str = String(value);
+    parts.push(`${field}=${/\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str}`);
+  }
+  return parts.join(" ");
+}
+function subjectForToolInput(toolName, input, subjectKey, subjectFields) {
   if (!input || typeof input !== "object") return void 0;
   const obj = input;
+  const extra = subjectFields && subjectFields.length > 0 ? renderSubjectFields(obj, subjectFields) : "";
+  const withExtra = (base) => extra ? `${base} ${extra}` : base;
   if (subjectKey) {
     const value = obj[subjectKey];
     if (Array.isArray(value)) {
@@ -1755,9 +1797,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
       if (subjectKey === "command") {
         const rendered = renderCommandLine(value, obj["args"]);
         if (value === "commit" && obj["dry_run"] === true) {
-          return `${escapeGlobSubject(rendered)}:dry-run`;
+          return `${escapeGlobSubject(withExtra(rendered))}:dry-run`;
         }
-        return escapeGlobSubject(rendered);
+        return escapeGlobSubject(withExtra(rendered));
       }
       if (subjectKey === "directory" && obj["dry_run"] === true) {
         return `${escapeGlobSubject(value)}:dry-run`;
@@ -1918,7 +1960,9 @@ function hasRecursiveForceDelete(command, projectRoot) {
     if (token === "rd" || token === "rmdir") {
       const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
       if (args.includes("/s")) {
-        const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+        const targets = args.filter(
+          (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+        );
         if (targets.length === 0) return true;
         if (targets.some(isCatastrophicDeleteTarget)) return true;
         if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
@@ -1987,7 +2031,8 @@ function hasFindExec(command) {
 function isCatastrophicDeleteTarget(rawTarget) {
   const t = rawTarget.replace(/^['"]|['"]$/g, "").trim();
   if (!t) return false;
-  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*") return true;
+  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*")
+    return true;
   const s = t.replace(/[\\/]\*+$/, "").replace(/[\\/]+$/, "");
   if (s === "") return true;
   if (s === "~" || /^\$HOME$/i.test(s) || /^%USERPROFILE%$/i.test(s)) return true;
@@ -2027,12 +2072,16 @@ function hasCatastrophicDelete(command) {
       const args = tokens.slice(i + 1);
       const recursive = args.some((arg) => arg.toLowerCase() === "/s");
       if (!recursive) continue;
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      const targets = args.filter(
+        (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+      );
       if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
     if (token === "del" || token === "erase") {
       const args = tokens.slice(i + 1);
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      const targets = args.filter(
+        (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+      );
       if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
   }
@@ -2093,6 +2142,47 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
   if (HIGH_IMPACT_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
   return false;
 }
+var WELL_KNOWN_CREDENTIAL_ENV_VARS = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "OPENAI_API_KEY",
+  "AZURE_OPENAI_API_KEY",
+  "GEMINI_API_KEY",
+  "GOOGLE_API_KEY",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  "GOOGLE_GENERATIVE_AI_API_KEY",
+  "GROQ_API_KEY",
+  "MISTRAL_API_KEY",
+  "COHERE_API_KEY",
+  "DEEPSEEK_API_KEY",
+  "XAI_API_KEY",
+  "OPENROUTER_API_KEY",
+  "PERPLEXITY_API_KEY",
+  "TOGETHER_API_KEY",
+  "FIREWORKS_API_KEY",
+  "HUGGINGFACE_API_KEY",
+  "HF_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_TOKEN",
+  "NPM_TOKEN",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "AZURE_CLIENT_SECRET",
+  "GITLAB_TOKEN",
+  "SLACK_TOKEN",
+  "STRIPE_SECRET_KEY",
+  "TELEGRAM_BOT_TOKEN",
+  "WRONGSTACK_VAULT_PASSPHRASE"
+]);
+function attachesWellKnownCredential(input) {
+  if (!input || typeof input !== "object") return false;
+  const envVars = input["envVars"];
+  if (!Array.isArray(envVars)) return false;
+  return envVars.some(
+    (name) => typeof name === "string" && WELL_KNOWN_CREDENTIAL_ENV_VARS.has(name.toUpperCase())
+  );
+}
 
 // src/security/permission-helpers.ts
 function matchesTrust(patterns, subject) {
@@ -2109,7 +2199,7 @@ function hasShellSubject(tool) {
   ]);
 }
 function alwaysAllowUnavailableReason(tool, input) {
-  const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+  const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
   if (subject !== void 0) return void 0;
   return `"always allow" needs a subject to remember, and ${tool.name} calls do not carry one (no subjectKey, and no path/url/name input). Recording it would store a rule that can never match. Approve this call, or set a trust rule for ${tool.name} explicitly.`;
 }
@@ -2169,8 +2259,18 @@ var AGENT_STATE_SENSITIVE_BASENAMES = /^(?:config\.json|config\.local\.json|trus
 function unescapeGlobSubject(value) {
   return value.replace(/\\([*?[\]])/g, "$1");
 }
+function stripAdsSuffix(forwardSlashPath) {
+  const cut = forwardSlashPath.lastIndexOf("/");
+  const dir = cut === -1 ? "" : forwardSlashPath.slice(0, cut + 1);
+  const base = cut === -1 ? forwardSlashPath : forwardSlashPath.slice(cut + 1);
+  const colon = base.indexOf(":");
+  if (colon === -1 || cut === -1 && colon === 1 && base.length <= 2) return forwardSlashPath;
+  return dir + base.slice(0, colon);
+}
 function normalizeForCompare(value) {
-  const forward = unescapeGlobSubject(value).replace(/\\/g, "/").replace(/\/+$/, "");
+  const forward = stripAdsSuffix(
+    unescapeGlobSubject(value).replace(/\\/g, "/").replace(/\/+$/, "")
+  );
   return process.platform === "win32" ? forward.toLowerCase() : forward;
 }
 function realpathOfNearestExisting(p) {
@@ -2207,7 +2307,7 @@ function isProtectedAgentStatePath(absPath) {
   return AGENT_STATE_SENSITIVE_BASENAMES.test(path5.basename(normalizeForCompare(absPath)));
 }
 function pathLooksSensitive(rawPath) {
-  const normalized = stripShellQuotes(rawPath).replace(/\\/g, "/");
+  const normalized = stripAdsSuffix(stripShellQuotes(rawPath).replace(/\\/g, "/"));
   if (SENSITIVE_READ_PATHS.some((pattern) => pattern.test(normalized))) return true;
   return isProtectedAgentStatePath(normalized);
 }
@@ -2231,10 +2331,24 @@ function shellCommandReadsSensitivePath(command) {
   }
   return false;
 }
+function isSensitiveReadCall(tool, input) {
+  const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
+  if (isReadTool && inputPathLooksSensitive(input)) return true;
+  const hasShellCap = hasCapability(tool, [
+    ToolCapabilities.SHELL_ARBITRARY,
+    ToolCapabilities.SHELL_RESTRICTED,
+    ToolCapabilities.SHELL_EXEC
+  ]);
+  if (!hasShellCap && tool.name !== "bash" && tool.name !== "shell" && tool.name !== "exec") {
+    return false;
+  }
+  const command = shellCommandLineFromInput(input);
+  return command ? shellCommandReadsSensitivePath(command) : false;
+}
 
 // src/security/permission-explain.ts
 function explainPermissionTrace(state, tool, input, ctx) {
-  const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+  const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
   const steps = [];
   let winnerIndex = -1;
   const add = (rule, matched, decision, source, detail) => {
@@ -2455,13 +2569,7 @@ function explainPermissionTrace(state, tool, input, ctx) {
         }
       };
     }
-    add(
-      "yolo",
-      true,
-      "auto",
-      "yolo",
-      "YOLO mode is active \u2014 auto-approving every non-denied call"
-    );
+    add("yolo", true, "auto", "yolo", "YOLO mode is active \u2014 auto-approving every non-denied call");
     winnerIndex = steps.length - 1;
     return {
       toolName: tool.name,
@@ -2733,7 +2841,14 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   static isMcpTool(name) {
     return name.startsWith("mcp__");
   }
-  async evaluate(tool) {
+  async evaluate(tool, input) {
+    if (input !== void 0 && isSensitiveReadCall(tool, input)) {
+      return {
+        permission: "deny",
+        source: "subagent_guard",
+        reason: "subagents may not read credential-bearing paths \u2014 the leader must perform this read so the user can approve it"
+      };
+    }
     const caps = tool.capabilities ?? [];
     const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
@@ -2760,8 +2875,8 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   }
   allowOnce() {
   }
-  async explain(tool) {
-    const decision = await this.evaluate(tool);
+  async explain(tool, input) {
+    const decision = await this.evaluate(tool, input);
     return {
       toolName: tool.name,
       subject: null,
@@ -2811,6 +2926,17 @@ function fsWriteTargetPaths(input) {
   }
   return out;
 }
+function mergeTrustEntries(exact, wildcard) {
+  if (!exact) return wildcard;
+  if (!wildcard) return exact;
+  const deny2 = [...wildcard.deny ?? [], ...exact.deny ?? []];
+  const merged = {
+    ...wildcard,
+    ...exact
+  };
+  if (deny2.length > 0) merged.deny = [...new Set(deny2)];
+  return merged;
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -2849,6 +2975,7 @@ var DefaultPermissionPolicy = class {
   yoloBlockedAsDestructive(tool, input, ctx) {
     if (!this.yolo || this.yoloDestructive) return false;
     if (this.hasAgentStateWriteTarget(tool, input, ctx)) return true;
+    if (attachesWellKnownCredential(input)) return true;
     const isShellSurface = tool.name === "bash" || tool.name === "exec" || (tool.capabilities ?? []).includes("shell.arbitrary");
     if (!isShellSurface) return false;
     const command = getInputString(input, "command") ?? shellCommandLineFromInput(input);
@@ -2942,8 +3069,8 @@ var DefaultPermissionPolicy = class {
       };
     }
     const namespaceEntry = this.findNamespaceEntry(tool.name);
-    const entry = this.policy[tool.name] ?? namespaceEntry;
-    const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+    const entry = mergeTrustEntries(this.policy[tool.name], namespaceEntry);
+    const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
     const evalKey = `${cacheKey}::${permissionFingerprint(tool)}`;
     if (tool.name !== "write" && !this.hasAgentStateWriteTarget(tool, input, ctx)) {
@@ -2960,15 +3087,6 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (this.sessionAllowed.has(cacheKey)) {
-      this.sessionAllowed.delete(cacheKey);
-      const decision = {
-        permission: "auto",
-        source: "trust",
-        reason: "session one-shot allow (user pressed yes)"
-      };
-      return decision;
-    }
     if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
       this._logDeny(tool.name, subject, "matched deny pattern");
       const decision = {
@@ -2979,6 +3097,15 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
+    if (this.sessionAllowed.has(cacheKey)) {
+      this.sessionAllowed.delete(cacheKey);
+      const decision = {
+        permission: "auto",
+        source: "trust",
+        reason: "session one-shot allow (user pressed yes)"
+      };
+      return decision;
+    }
     if (tool.permission === "deny") {
       this._logDeny(tool.name, subject, "tool default deny");
       const decision = {
@@ -2989,6 +3116,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
+    const denyUnevaluated = Boolean(entry?.deny?.length) && subject === void 0;
     const allowMatches = hasShellSubject(tool) ? matchesCommandTrust : matchesTrust;
     if (entry?.allow && subject && allowMatches(entry.allow, subject)) {
       const decision = {
@@ -2999,7 +3127,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (entry?.auto) {
+    if (entry?.auto && !denyUnevaluated) {
       const decision = { permission: "auto", source: "trust" };
       this._evalCache.set(evalKey, decision);
       return decision;
@@ -3099,19 +3227,10 @@ var DefaultPermissionPolicy = class {
     }
     return { permission: "confirm", source: "default" };
   }
+  // Delegates to the shared helper so the subagent policy applies the exact
+  // same rule — see `isSensitiveReadCall` in ./permission-helpers.ts.
   isSensitiveReadCall(tool, input) {
-    const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
-    if (isReadTool && inputPathLooksSensitive(input)) return true;
-    const hasShellCap = hasCapability(tool, [
-      ToolCapabilities.SHELL_ARBITRARY,
-      ToolCapabilities.SHELL_RESTRICTED,
-      ToolCapabilities.SHELL_EXEC
-    ]);
-    if (!hasShellCap && tool.name !== "bash" && tool.name !== "shell" && tool.name !== "exec") {
-      return false;
-    }
-    const command = shellCommandLineFromInput(input);
-    return command ? shellCommandReadsSensitivePath(command) : false;
+    return isSensitiveReadCall(tool, input);
   }
   async trust(rule) {
     if (!this.loaded) await this.reload();
@@ -3592,6 +3711,14 @@ function keyFileNeedsHardening(keyFile, opts) {
   }
   return false;
 }
+function mkdirSecretDirSync(dir) {
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") return;
+  try {
+    fs2.chmodSync(dir, 448);
+  } catch {
+  }
+}
 function writeKeyFileAtomicSync(keyFile, content) {
   const tmp = `${keyFile}.${randomBytes2(4).toString("hex")}.tmp`;
   const fd = fs2.openSync(tmp, "w", 384);
@@ -3739,7 +3866,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes2(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs2.mkdirSync(path8.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path8.dirname(this.keyFile));
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -3823,7 +3950,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs2.mkdirSync(path8.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path8.dirname(this.keyFile));
     const key = randomBytes2(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;

package/dist/security/permission-helpers.d.ts

@@ -107,4 +107,15 @@ export declare function isInsideAgentStateRoot(absPath: string): boolean;
 export declare function isProtectedAgentStatePath(absPath: string): boolean;
 export declare function inputPathLooksSensitive(input: unknown): boolean;
 export declare function shellCommandReadsSensitivePath(command: string): boolean;
+/**
+ * True when `tool` + `input` amount to reading a credential-bearing path.
+ *
+ * Shared by both permission policies. It lived as a private method on
+ * `DefaultPermissionPolicy`, so `AutoApprovePermissionPolicy` — the policy
+ * subagents run under — had no way to apply it, and a delegated read of
+ * `~/.aws/credentials` was auto-approved where the leader would have prompted.
+ * Keeping one implementation here means widening the sensitive-path list
+ * protects the leader and its subagents in the same edit.
+ */
+export declare function isSensitiveReadCall(tool: Tool, input: unknown): boolean;
 //# sourceMappingURL=permission-helpers.d.ts.map

package/dist/security/permission-policy.d.ts

@@ -1,10 +1,19 @@
 import type { Context } from '../core/context.js';
 import type { InputReader } from '../types/input-reader.js';
-import type { PermissionDecision, PermissionPolicy, PermissionTrace } from '../types/permission.js';
+import type { PermissionDecision, PermissionPolicy, PermissionTrace, TrustPolicy } from '../types/permission.js';
 import type { Tool } from '../types/tool.js';
 import { type TrustPolicyDiagnostic } from './permission-policy-schema.js';
 export { AutoApprovePermissionPolicy } from './auto-approve-policy.js';
 export { alwaysAllowUnavailableReason, matchesTrust, matchesCommandTrust, hasShellSubject, permissionFingerprint, shellCommandLineFromInput, inputPathLooksSensitive, shellCommandReadsSensitivePath, } from './permission-helpers.js';
+/**
+ * Combine an exact-name trust entry with the wildcard entry that also matched.
+ *
+ * Deny is the union of both levels — a narrow "always allow" must never be able
+ * to drop a broad guardrail. Everything permissive (allow / auto / trustWorkdir
+ * / denyPrivate) comes from the more specific entry when it says anything, so
+ * exact-name rules still win where they are meant to.
+ */
+export declare function mergeTrustEntries(exact: TrustPolicy[string] | undefined, wildcard: TrustPolicy[string] | undefined): TrustPolicy[string] | undefined;
 export interface PermissionPolicyOptions {
     trustFile: string;
     yolo?: boolean | undefined;

package/dist/security/yolo-risk.d.ts

@@ -9,4 +9,21 @@ export declare function pathLooksInsideProject(rawPath: string, projectRoot: str
  * state-root detection either (those paths are resolved absolutely).
  */
 export declare function isClearlyDestructiveBashCommand(command: string, projectRoot: string | undefined): boolean;
+/**
+ * True when a tool call would bind a well-known third-party credential to a
+ * provider endpoint.
+ *
+ * `provider_manage` lets the model create a provider, choose its `baseUrl`
+ * (validated for scheme only — no host allowlist) and name the environment
+ * variables its key is read from. Nothing claims `ANTHROPIC_API_KEY` on a stock
+ * install, so `rejectBorrowedEnvVars` — which only rejects names another
+ * provider already lists — let it through. Combined with the sibling
+ * `fallback_chain_manage` / `leader_model_set` tools in the same bundle, that is
+ * a complete "send my real key to a host I chose" primitive, reachable by
+ * prompt injection.
+ *
+ * The tool stays usable: this only forces the decision back to the human rather
+ * than letting YOLO auto-approve it.
+ */
+export declare function attachesWellKnownCredential(input: unknown): boolean;
 //# sourceMappingURL=yolo-risk.d.ts.map

package/dist/session-catalog/index.js

@@ -804,6 +804,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -894,8 +902,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -1012,6 +1020,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -1048,6 +1077,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;

package/dist/session-catalog/project-server.js

@@ -248,6 +248,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -338,8 +346,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -456,6 +464,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -492,6 +521,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;