@wrongstack/plugins 0.277.2 → 0.280.0

package/dist/path-guard.js

@@ -0,0 +1,235 @@
+// src/path-guard/index.ts
+var state = {
+  invocations: 0,
+  blocks: 0,
+  warns: 0,
+  lastBlock: null,
+  hookUnregister: null
+};
+var DEFAULT_PROTECT = [
+  "pnpm-lock.yaml",
+  "package-lock.json",
+  "yarn.lock",
+  "bun.lockb",
+  "Cargo.lock",
+  "poetry.lock",
+  ".env",
+  ".env.*",
+  ".git/**",
+  "**/migrations/**"
+];
+var DEFAULTS = {
+  enabled: true,
+  mode: "block",
+  protect: DEFAULT_PROTECT,
+  allow: []
+};
+function readConfig(raw) {
+  if (!raw || typeof raw !== "object") return { ...DEFAULTS, protect: [...DEFAULT_PROTECT] };
+  const r = raw;
+  return {
+    enabled: r["enabled"] !== false,
+    mode: r["mode"] === "warn" ? "warn" : "block",
+    protect: Array.isArray(r["protect"]) ? r["protect"].filter((p) => typeof p === "string" && p.length > 0) : [...DEFAULT_PROTECT],
+    allow: Array.isArray(r["allow"]) ? r["allow"].filter((p) => typeof p === "string" && p.length > 0) : []
+  };
+}
+function compilePathGlob(pattern) {
+  const normalized = pattern.replace(/\\/g, "/");
+  let source = "";
+  for (let i = 0; i < normalized.length; i++) {
+    const ch = normalized[i];
+    if (ch === "*") {
+      if (normalized[i + 1] === "*") {
+        source += "(?:.*)";
+        i += 1;
+        if (normalized[i + 1] === "/") i += 1;
+      } else {
+        source += "[^/]*";
+      }
+    } else if (ch === "?") {
+      source += "[^/]";
+    } else if (ch !== void 0 && /[.+^${}()|[\]\\]/.test(ch)) {
+      source += `\\${ch}`;
+    } else {
+      source += ch;
+    }
+  }
+  return new RegExp(`(?:^|/)${source}$`, "i");
+}
+function normalizePath(p) {
+  return p.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function matchesAny(path, patterns) {
+  const normalized = normalizePath(path);
+  return patterns.some((re) => re.test(normalized));
+}
+function destructiveTargets(command) {
+  const targets = [];
+  const destructive = /(?:^|[;&|]\s*)(?:sudo\s+)?(rm|rmdir|del|unlink|truncate|shred|mv)\s+([^;&|]+)/gi;
+  let m = destructive.exec(command);
+  while (m !== null) {
+    const args = (m[2] ?? "").split(/\s+/).filter((a) => a.length > 0 && !a.startsWith("-"));
+    targets.push(...args);
+    m = destructive.exec(command);
+  }
+  const redirect = />{1,2}\s*([^\s;&|>]+)/g;
+  let r = redirect.exec(command);
+  while (r !== null) {
+    const target = r[1];
+    if (target && target !== "/dev/null" && target !== "NUL" && target !== "nul") {
+      targets.push(target);
+    }
+    r = redirect.exec(command);
+  }
+  return targets.map((t) => t.replace(/^['"]|['"]$/g, ""));
+}
+var plugin = {
+  name: "path-guard",
+  version: "0.1.0",
+  description: "Blocks or warns about writes, edits, and destructive shell commands touching protected paths (lockfiles, .env, .git, migrations)",
+  apiVersion: "^0.1.10",
+  capabilities: { tools: true, hooks: true },
+  defaultConfig: { ...DEFAULTS },
+  configSchema: {
+    type: "object",
+    properties: {
+      enabled: { type: "boolean", default: true, description: "Master switch." },
+      mode: {
+        type: "string",
+        enum: ["block", "warn"],
+        default: "block",
+        description: "block = refuse the operation; warn = only inject context."
+      },
+      protect: {
+        type: "array",
+        items: { type: "string" },
+        description: "Glob patterns for protected paths. Replaces the default set when present."
+      },
+      allow: {
+        type: "array",
+        items: { type: "string" },
+        default: [],
+        description: "Glob patterns that override `protect` (exemptions)."
+      }
+    }
+  },
+  setup(api) {
+    state.invocations = 0;
+    state.blocks = 0;
+    state.warns = 0;
+    state.lastBlock = null;
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const cfg = readConfig(api.config.extensions?.["path-guard"]);
+    const protectRes = cfg.protect.map(compilePathGlob);
+    const allowRes = cfg.allow.map(compilePathGlob);
+    const verdict = (path, tool, operation) => {
+      if (cfg.mode === "block") {
+        state.blocks += 1;
+        state.lastBlock = { path, tool, when: (/* @__PURE__ */ new Date()).toISOString() };
+        api.metrics.counter("blocks");
+        return {
+          decision: "block",
+          reason: `path-guard: "${path}" is a protected path (matched by config.extensions["path-guard"].protect) \u2014 ${operation} refused. If this change is intentional, ask the user to do it, add an \`allow\` glob, or set mode: "warn".`
+        };
+      }
+      state.warns += 1;
+      api.metrics.counter("warns");
+      return {
+        decision: "allow",
+        additionalContext: `path-guard (warn mode): "${path}" is a protected path and this ${operation} would modify it. Double-check this is intentional.`
+      };
+    };
+    const hook = (input) => {
+      if (!cfg.enabled) return;
+      state.invocations += 1;
+      const toolName = input.toolName ?? "";
+      const ti = input.toolInput ?? {};
+      if (toolName === "write" || toolName === "edit") {
+        const raw = ti["path"] ?? ti["file_path"] ?? ti["filePath"];
+        if (typeof raw !== "string" || raw.length === 0) return;
+        if (matchesAny(raw, allowRes)) return;
+        if (matchesAny(raw, protectRes)) {
+          return verdict(raw, toolName, toolName === "write" ? "write" : "edit");
+        }
+        return;
+      }
+      if (toolName === "bash" || toolName === "exec") {
+        const command = typeof ti["command"] === "string" ? ti["command"] : "";
+        if (!command) return;
+        for (const target of destructiveTargets(command)) {
+          if (matchesAny(target, allowRes)) continue;
+          if (matchesAny(target, protectRes)) {
+            return verdict(target, toolName, "destructive shell command");
+          }
+        }
+      }
+      return;
+    };
+    state.hookUnregister = api.registerHook("PreToolUse", "write|edit|bash|exec", hook);
+    api.tools.register({
+      name: "path_guard_status",
+      description: "Reports path-guard state: protected globs, mode, and counters (invocations, blocks, warns).",
+      inputSchema: { type: "object", properties: {} },
+      permission: "auto",
+      category: "Diagnostics",
+      mutating: false,
+      async execute() {
+        return {
+          ok: true,
+          enabled: cfg.enabled,
+          mode: cfg.mode,
+          protect: cfg.protect,
+          allow: cfg.allow,
+          counters: {
+            invocations: state.invocations,
+            blocks: state.blocks,
+            warns: state.warns
+          },
+          lastBlock: state.lastBlock
+        };
+      }
+    });
+    api.log.info("path-guard plugin loaded", {
+      version: "0.1.0",
+      enabled: cfg.enabled,
+      mode: cfg.mode,
+      protectCount: cfg.protect.length
+    });
+  },
+  teardown(api) {
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const final = { invocations: state.invocations, blocks: state.blocks, warns: state.warns };
+    state.invocations = 0;
+    state.blocks = 0;
+    state.warns = 0;
+    state.lastBlock = null;
+    api.log.info("path-guard: teardown complete", { final });
+  },
+  async health() {
+    return {
+      ok: true,
+      message: state.lastBlock === null ? `path-guard: ${state.invocations} invocation(s), ${state.blocks} block(s), ${state.warns} warn(s)` : `path-guard: last block on "${state.lastBlock.path}" (${state.lastBlock.tool}) at ${state.lastBlock.when}`,
+      counters: {
+        invocations: state.invocations,
+        blocks: state.blocks,
+        warns: state.warns
+      }
+    };
+  }
+};
+var path_guard_default = plugin;
+
+export { compilePathGlob, path_guard_default as default, destructiveTargets };

package/dist/prompt-firewall.d.ts

@@ -0,0 +1,57 @@
+import { Plugin } from '@wrongstack/core';
+
+/**
+ * prompt-firewall plugin — inspects and redacts secrets on the provider
+ * wire, before context leaves for the LLM API and as it returns.
+ *
+ * Distinct from `secret-scanner` (which guards the TOOL boundary): this
+ * sits on `AgentExtension.wrapProviderRunner`, so it sees the FULL
+ * request that is about to be sent to a third-party LLM provider —
+ * regardless of how a secret entered the conversation. It scans the
+ * outgoing request's system + message text for high-confidence
+ * credential patterns and, depending on `mode`:
+ *
+ *  - `warn`   (default) — logs + counts + emits a `prompt-firewall:leak`
+ *    event; the request goes through unchanged
+ *  - `redact` — replaces each match with `[REDACTED:<kind>]` in a CLONE
+ *    of the request before sending, and also redacts secrets echoed back
+ *    in the response
+ *  - `block`  — throws before the request is sent (the agent's error
+ *    path surfaces it), so the secret never reaches the provider
+ *
+ * Safety posture: opt-in — loads inert until
+ * `config.extensions['prompt-firewall'].enabled = true`. `warn` is the
+ * default so it can never corrupt context until you deliberately choose
+ * `redact`/`block`.
+ *
+ * Config (`config.extensions['prompt-firewall']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": false,
+ *   "mode": "warn",          // "warn" | "redact" | "block"
+ *   "scanResponse": true,     // redact secrets echoed back (redact mode)
+ *   "allow": []               // regex source strings to exempt (false positives)
+ * }
+ * ```
+ *
+ * Tools:
+ *  - `prompt_firewall_status` — mode, pattern names, detection counters
+ *
+ * @public
+ */
+
+interface Detection {
+    kind: string;
+    count: number;
+}
+/** Detect secret matches in text. Returns per-kind counts (no values). */
+declare function detectSecrets(text: string, allow: RegExp[]): Detection[];
+/** Redact secret matches in text, replacing each with `[REDACTED:<kind>]`. */
+declare function redactSecrets(text: string, allow: RegExp[]): {
+    text: string;
+    redactions: number;
+};
+declare const plugin: Plugin;
+
+export { type Detection, plugin as default, detectSecrets, redactSecrets };

package/dist/prompt-firewall.js

@@ -0,0 +1,290 @@
+// src/prompt-firewall/index.ts
+var PATTERNS = [
+  { kind: "aws-access-key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+  {
+    kind: "aws-secret-key",
+    re: /\b(?<![A-Za-z0-9/+])[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+])\b(?=.*aws)/gi
+  },
+  { kind: "private-key-block", re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g },
+  { kind: "github-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
+  { kind: "openai-key", re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g },
+  { kind: "anthropic-key", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+  { kind: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+  { kind: "google-api-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { kind: "jwt", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
+  { kind: "bearer-token", re: /\bBearer\s+[A-Za-z0-9._-]{20,}\b/g },
+  {
+    kind: "generic-secret-assignment",
+    re: /\b(?:api[_-]?key|secret|password|passwd|token)\s*[:=]\s*['"]?[A-Za-z0-9._/+-]{12,}['"]?/gi
+  }
+];
+function detectSecrets(text, allow) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const p of PATTERNS) {
+    p.re.lastIndex = 0;
+    let m = p.re.exec(text);
+    while (m !== null) {
+      const matched = m[0];
+      if (!allow.some((a) => a.test(matched))) {
+        counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
+      }
+      m = p.re.exec(text);
+    }
+  }
+  return [...counts.entries()].map(([kind, count]) => ({ kind, count }));
+}
+function redactSecrets(text, allow) {
+  let out = text;
+  let redactions = 0;
+  for (const p of PATTERNS) {
+    out = out.replace(new RegExp(p.re.source, p.re.flags), (match) => {
+      if (allow.some((a) => a.test(match))) return match;
+      redactions += 1;
+      return `[REDACTED:${p.kind}]`;
+    });
+  }
+  return { text: out, redactions };
+}
+function collectText(request) {
+  const parts = [];
+  const walk = (v) => {
+    if (typeof v === "string") parts.push(v);
+    else if (Array.isArray(v)) for (const i of v) walk(i);
+    else if (v && typeof v === "object")
+      for (const val of Object.values(v)) walk(val);
+  };
+  walk(request["system"]);
+  walk(request["messages"]);
+  return parts.join("\n");
+}
+function redactDeep(value, allow, counter) {
+  if (typeof value === "string") {
+    const { text, redactions } = redactSecrets(value, allow);
+    counter.n += redactions;
+    return text;
+  }
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, allow, counter));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redactDeep(v, allow, counter);
+    }
+    return out;
+  }
+  return value;
+}
+function readConfig(raw) {
+  const base = {
+    enabled: false,
+    mode: "warn",
+    scanResponse: true,
+    allow: []
+  };
+  if (!raw || typeof raw !== "object") return base;
+  const r = raw;
+  const allow = Array.isArray(r["allow"]) ? r["allow"].filter((s) => typeof s === "string" && s.length > 0).flatMap((s) => {
+    try {
+      return [new RegExp(s)];
+    } catch {
+      return [];
+    }
+  }) : [];
+  return {
+    enabled: r["enabled"] === true,
+    mode: r["mode"] === "redact" ? "redact" : r["mode"] === "block" ? "block" : "warn",
+    scanResponse: r["scanResponse"] !== false,
+    allow
+  };
+}
+var state = {
+  invocations: 0,
+  requestsWithSecrets: 0,
+  requestRedactions: 0,
+  responseRedactions: 0,
+  blocked: 0,
+  byKind: /* @__PURE__ */ new Map(),
+  lastDetection: null,
+  extensionUnregister: null
+};
+var plugin = {
+  name: "prompt-firewall",
+  version: "0.1.0",
+  description: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); warn/redact/block. Opt-in; warn by default.",
+  apiVersion: "^0.1.10",
+  capabilities: { tools: true },
+  defaultConfig: { enabled: false, mode: "warn", scanResponse: true, allow: [] },
+  configSchema: {
+    type: "object",
+    properties: {
+      enabled: {
+        type: "boolean",
+        default: false,
+        description: "Master switch. OFF by default; redact/block modes can alter or stop provider calls."
+      },
+      mode: {
+        type: "string",
+        enum: ["warn", "redact", "block"],
+        default: "warn",
+        description: "warn = detect only; redact = strip secrets from the request/response; block = refuse the request."
+      },
+      scanResponse: {
+        type: "boolean",
+        default: true,
+        description: "In redact mode, also redact secrets echoed back in the provider response."
+      },
+      allow: {
+        type: "array",
+        items: { type: "string" },
+        default: [],
+        description: "Regex source strings whose matches are exempt (to silence known false positives)."
+      }
+    }
+  },
+  setup(api) {
+    state.invocations = 0;
+    state.requestsWithSecrets = 0;
+    state.requestRedactions = 0;
+    state.responseRedactions = 0;
+    state.blocked = 0;
+    state.byKind.clear();
+    state.lastDetection = null;
+    if (state.extensionUnregister) {
+      try {
+        state.extensionUnregister();
+      } catch {
+      }
+      state.extensionUnregister = null;
+    }
+    const cfg = readConfig(api.config.extensions?.["prompt-firewall"]);
+    if (cfg.enabled) {
+      state.extensionUnregister = api.extensions.register({
+        name: "prompt-firewall",
+        owner: "prompt-firewall",
+        async wrapProviderRunner(_ctx, request, inner) {
+          const req = request ?? {};
+          state.invocations += 1;
+          const detections = detectSecrets(collectText(req), cfg.allow);
+          if (detections.length > 0) {
+            state.requestsWithSecrets += 1;
+            for (const d of detections) {
+              state.byKind.set(d.kind, (state.byKind.get(d.kind) ?? 0) + d.count);
+            }
+            const kinds = detections.map((d) => d.kind);
+            state.lastDetection = { where: "request", kinds, when: (/* @__PURE__ */ new Date()).toISOString() };
+            api.metrics.counter("request_leaks", 1);
+            api.log.warn("prompt-firewall: secrets detected in outgoing request", { kinds });
+            api.emitCustom("prompt-firewall:leak", { where: "request", kinds });
+            if (cfg.mode === "block") {
+              state.blocked += 1;
+              throw new Error(
+                `prompt-firewall blocked a provider call: outgoing context contains credential-shaped data (${kinds.join(", ")}). Remove the secret from context, add an \`allow\` pattern, or switch mode to "warn".`
+              );
+            }
+            if (cfg.mode === "redact") {
+              const counter = { n: 0 };
+              const redactedReq = redactDeep(req, cfg.allow, counter);
+              state.requestRedactions += counter.n;
+              api.metrics.counter("request_redactions", counter.n);
+              const response2 = await inner(_ctx, redactedReq);
+              return cfg.scanResponse ? redactResponse(response2, cfg.allow) : response2;
+            }
+          }
+          const response = await inner(_ctx, request);
+          if (cfg.mode === "redact" && cfg.scanResponse) {
+            return redactResponse(response, cfg.allow);
+          }
+          return response;
+        }
+      });
+    }
+    function redactResponse(response, allow) {
+      if (!response || typeof response !== "object") return response;
+      const counter = { n: 0 };
+      const content = response.content;
+      if (content === void 0) return response;
+      const redacted = redactDeep(content, allow, counter);
+      if (counter.n > 0) {
+        state.responseRedactions += counter.n;
+        api.metrics.counter("response_redactions", counter.n);
+        state.lastDetection = {
+          where: "response",
+          kinds: ["echoed-secret"],
+          when: (/* @__PURE__ */ new Date()).toISOString()
+        };
+      }
+      return { ...response, content: redacted };
+    }
+    api.tools.register({
+      name: "prompt_firewall_status",
+      description: "Reports prompt-firewall state: mode, pattern kinds, and detection/redaction/block counters.",
+      inputSchema: { type: "object", properties: {} },
+      permission: "auto",
+      category: "Diagnostics",
+      mutating: false,
+      async execute() {
+        return {
+          ok: true,
+          enabled: cfg.enabled,
+          mode: cfg.mode,
+          scanResponse: cfg.scanResponse,
+          patterns: PATTERNS.map((p) => p.kind),
+          counters: {
+            invocations: state.invocations,
+            requestsWithSecrets: state.requestsWithSecrets,
+            requestRedactions: state.requestRedactions,
+            responseRedactions: state.responseRedactions,
+            blocked: state.blocked
+          },
+          byKind: Object.fromEntries(state.byKind),
+          lastDetection: state.lastDetection
+        };
+      }
+    });
+    api.log.info("prompt-firewall plugin loaded", {
+      version: "0.1.0",
+      enabled: cfg.enabled,
+      mode: cfg.mode,
+      patterns: PATTERNS.length
+    });
+  },
+  teardown(api) {
+    if (state.extensionUnregister) {
+      try {
+        state.extensionUnregister();
+      } catch {
+      }
+      state.extensionUnregister = null;
+    }
+    const final = {
+      invocations: state.invocations,
+      requestsWithSecrets: state.requestsWithSecrets,
+      requestRedactions: state.requestRedactions,
+      responseRedactions: state.responseRedactions,
+      blocked: state.blocked
+    };
+    state.invocations = 0;
+    state.requestsWithSecrets = 0;
+    state.requestRedactions = 0;
+    state.responseRedactions = 0;
+    state.blocked = 0;
+    state.byKind.clear();
+    state.lastDetection = null;
+    api.log.info("prompt-firewall: teardown complete", { final });
+  },
+  async health() {
+    return {
+      ok: true,
+      message: `prompt-firewall: ${state.requestsWithSecrets} request(s) with secrets, ${state.requestRedactions} request redaction(s), ${state.blocked} blocked`,
+      counters: {
+        invocations: state.invocations,
+        requestsWithSecrets: state.requestsWithSecrets,
+        requestRedactions: state.requestRedactions,
+        responseRedactions: state.responseRedactions,
+        blocked: state.blocked
+      }
+    };
+  }
+};
+var prompt_firewall_default = plugin;
+
+export { prompt_firewall_default as default, detectSecrets, redactSecrets };

package/dist/secret-scanner.d.ts

@@ -0,0 +1,34 @@
+import { Plugin } from '@wrongstack/core';
+
+/**
+ * secret-scanner plugin — Pre-tool and post-tool hooks that block, redact,
+ * or warn about plaintext credentials flowing into or out of tools.
+ *
+ * Tools registered:
+ * - secret_scanner_status  : Show which patterns are active, recent
+ *                            blocks/leaks, and current mode.
+ * - secret_scanner_test    : Run the scanner against a user-supplied
+ *                            string and report which patterns matched.
+ *
+ * Hooks registered:
+ * - PreToolUse with matcher `bash|write|edit` (configurable). Default
+ *   action is to BLOCK; the plugin can also auto-redact the offending
+ *   fields via `HookOutcome.modifiedInput`.
+ * - PostToolUse with matcher `*` (configurable via `postToolUseMatcher`).
+ *   Scans tool OUTPUT for secrets that leaked through. Since the tool
+ *   has already run, the hook cannot block — instead it injects an
+ *   `additionalContext` warning so the LLM knows the output contains
+ *   a secret and should NOT echo it, store it, or commit it.
+ *
+ * Why a separate plugin from the built-in `DefaultSecretScrubber`?
+ * The scrubber is *output* sanitization (replace secrets with
+ * `[REDACTED:type]` before they leave the system). The scanner is
+ * *prevention* (stop the tool from running with a secret in the first
+ *   place) + *detection* (flag secrets that leaked through the output).
+ * They share the same threat model but act at different points in the
+ * pipeline.
+ */
+
+declare const plugin: Plugin;
+
+export { plugin as default };