bazilion 0.7.0 → 0.8.0

package/dist/daemon.js

@@ -12518,11 +12518,11 @@ var require_util = __commonJS({
       return false;
     }
     exports.schemaHasRules = schemaHasRules;
-    function schemaHasRulesButRef(schema, RULES) {
+    function schemaHasRulesButRef(schema, RULES2) {
       if (typeof schema == "boolean")
         return !schema;
       for (const key2 in schema)
-        if (key2 !== "$ref" && RULES.all[key2])
+        if (key2 !== "$ref" && RULES2.all[key2])
           return true;
       return false;
     }
@@ -13916,17 +13916,17 @@ var require_validate = __commonJS({
     }
     function schemaKeywords(it, types, typeErrors, errsCount) {
       const { gen, schema, data, allErrors, opts, self } = it;
-      const { RULES } = self;
-      if (schema.$ref && (opts.ignoreKeywordsWithRef || !(0, util_1.schemaHasRulesButRef)(schema, RULES))) {
-        gen.block(() => keywordCode(it, "$ref", RULES.all.$ref.definition));
+      const { RULES: RULES2 } = self;
+      if (schema.$ref && (opts.ignoreKeywordsWithRef || !(0, util_1.schemaHasRulesButRef)(schema, RULES2))) {
+        gen.block(() => keywordCode(it, "$ref", RULES2.all.$ref.definition));
         return;
       }
       if (!opts.jtd)
         checkStrictTypes(it, types);
       gen.block(() => {
-        for (const group of RULES.rules)
+        for (const group of RULES2.rules)
           groupKeywords(group);
-        groupKeywords(RULES.post);
+        groupKeywords(RULES2.post);
       });
       function groupKeywords(group) {
         if (!(0, applicability_1.shouldUseGroup)(schema, group))
@@ -15715,10 +15715,10 @@ var require_core = __commonJS({
       }
       // Remove keyword
       removeKeyword(keyword) {
-        const { RULES } = this;
-        delete RULES.keywords[keyword];
-        delete RULES.all[keyword];
-        for (const group of RULES.rules) {
+        const { RULES: RULES2 } = this;
+        delete RULES2.keywords[keyword];
+        delete RULES2.all[keyword];
+        for (const group of RULES2.rules) {
           const i = group.rules.findIndex((rule) => rule.keyword === keyword);
           if (i >= 0)
             group.rules.splice(i, 1);
@@ -15886,9 +15886,9 @@ var require_core = __commonJS({
     }
     var KEYWORD_NAME = /^[a-z_$][a-z0-9_$:-]*$/i;
     function checkKeyword(keyword, def) {
-      const { RULES } = this;
+      const { RULES: RULES2 } = this;
       (0, util_1.eachItem)(keyword, (kwd) => {
-        if (RULES.keywords[kwd])
+        if (RULES2.keywords[kwd])
           throw new Error(`Keyword ${kwd} is already defined`);
         if (!KEYWORD_NAME.test(kwd))
           throw new Error(`Keyword ${kwd} has invalid name`);
@@ -15904,13 +15904,13 @@ var require_core = __commonJS({
       const post = definition === null || definition === void 0 ? void 0 : definition.post;
       if (dataType && post)
         throw new Error('keyword with "post" flag cannot have "type"');
-      const { RULES } = this;
-      let ruleGroup = post ? RULES.post : RULES.rules.find(({ type: t }) => t === dataType);
+      const { RULES: RULES2 } = this;
+      let ruleGroup = post ? RULES2.post : RULES2.rules.find(({ type: t }) => t === dataType);
       if (!ruleGroup) {
         ruleGroup = { type: dataType, rules: [] };
-        RULES.rules.push(ruleGroup);
+        RULES2.rules.push(ruleGroup);
       }
-      RULES.keywords[keyword] = true;
+      RULES2.keywords[keyword] = true;
       if (!definition)
         return;
       const rule = {
@@ -15925,7 +15925,7 @@ var require_core = __commonJS({
         addBeforeRule.call(this, ruleGroup, rule, definition.before);
       else
         ruleGroup.rules.push(rule);
-      RULES.all[keyword] = rule;
+      RULES2.all[keyword] = rule;
       (_a3 = definition.implements) === null || _a3 === void 0 ? void 0 : _a3.forEach((kwd) => this.addKeyword(kwd));
     }
     function addBeforeRule(ruleGroup, rule, before) {
@@ -21738,7 +21738,74 @@ function parseSkillFile(path) {
   return parseSkillContent(raw);
 }
 
+// ../daemon/src/core/skills/scan.ts
+var SECRET_ENV_RE = /\b(ANTHROPIC_API_KEY|OPENAI_API_KEY|OPENAI_CODEX_OAUTH|GEMINI_API_KEY|GOOGLE_API_KEY|AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AZURE_OPENAI_API_KEY|MISTRAL_API_KEY|GROQ_API_KEY|BRAVE_API_KEY|SEARXNG_URL)\b/i;
+var SENSITIVE_PATH_RE = /(~\/\.(ssh|aws|gnupg|config)|\b(auth\.json|bazilion\.db)\b)/i;
+var SECRET_TARGET_RE = /(secret|credential|token|api[-_\s]?key|env(?:ironment)?(?: variable)?|private key|ssh key|auth\.json|bazilion\.db|~\/\.(ssh|aws|gnupg))/i;
+var EXFIL_VERB_RE = /(exfiltrat|send|upload|post|curl|webhook|pastebin|remote server|external server|http endpoint)/i;
+var UNICODE_STEALTH_RE = /[\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF]/;
+var RULES = [
+  {
+    code: "sensitive-reference",
+    severity: "danger",
+    message: "Mentions a sensitive path, database, auth file, or credential environment variable.",
+    test: (line) => SENSITIVE_PATH_RE.test(line) || SECRET_ENV_RE.test(line)
+  },
+  {
+    code: "secret-exfiltration",
+    severity: "danger",
+    message: "Combines secret/env/file access with exfiltration-style language.",
+    test: (line) => SECRET_TARGET_RE.test(line) && EXFIL_VERB_RE.test(line)
+  },
+  {
+    code: "instruction-hijack",
+    severity: "danger",
+    message: "Contains instruction-hijacking language such as ignoring prior instructions.",
+    test: (line) => /ignore (all )?(previous|prior|system|developer|user) instructions/i.test(line) || /override (the )?(system|developer) (prompt|instructions)/i.test(line) || /bypass (safety|security|policy|guardrails)/i.test(line) || /you are now (root|unrestricted|in developer mode)/i.test(line)
+  },
+  {
+    code: "unicode-stealth",
+    severity: "warning",
+    message: "Contains zero-width, bidi, or byte-order characters that can hide prompt text.",
+    test: (line) => UNICODE_STEALTH_RE.test(line)
+  }
+];
+function addFinding(findings, seen, finding) {
+  const key2 = `${finding.code}:${finding.line ?? 0}`;
+  if (seen.has(key2)) return;
+  seen.add(key2);
+  findings.push(finding);
+}
+function scanSkillContent(raw) {
+  const findings = [];
+  const seen = /* @__PURE__ */ new Set();
+  const lines = raw.split(/\r?\n/);
+  lines.forEach((line, index) => {
+    for (const rule of RULES) {
+      if (!rule.test(line)) continue;
+      addFinding(findings, seen, {
+        code: rule.code,
+        severity: rule.severity,
+        message: rule.message,
+        line: index + 1
+      });
+    }
+  });
+  return findings;
+}
+
 // ../daemon/src/core/skills/import.ts
+var SkillScanBlockedError = class extends Error {
+  findings;
+  constructor(findings) {
+    const names = Object.keys(findings).sort();
+    super(
+      `skill scan blocked import: ${names.join(", ")} ${names.length === 1 ? "has" : "have"} findings (rerun with --force to confirm)`
+    );
+    this.name = "SkillScanBlockedError";
+    this.findings = findings;
+  }
+};
 function extractZipSafely(zipPath) {
   const root = mkdtempSync(join10(tmpdir(), "bazilion-skill-zip-"));
   try {
@@ -21805,8 +21872,14 @@ function importSkillsFromDir(paths, source, input) {
   if (candidates.length === 0) {
     throw new Error(`no skills found in ${source}`);
   }
+  const findingsBySkill = {};
   for (const c of candidates) {
-    parseSkillFile(join10(c.dir, "SKILL.md"));
+    const parsed = parseSkillFile(join10(c.dir, "SKILL.md"));
+    const findings = scanSkillContent(parsed.raw);
+    if (findings.length > 0) findingsBySkill[c.name] = findings;
+  }
+  if (Object.keys(findingsBySkill).length > 0 && !input.force) {
+    throw new SkillScanBlockedError(findingsBySkill);
   }
   const imported = [];
   const skipped = [];
@@ -21815,14 +21888,19 @@ function importSkillsFromDir(paths, source, input) {
     if (existsSync8(target) && !input.force) {
       skipped.push({
         name: c.name,
-        reason: "already exists (use --force to overwrite)"
+        reason: "already exists (use --force to overwrite)",
+        findings: findingsBySkill[c.name]
       });
       continue;
     }
     cpSync(c.dir, target, { recursive: true, force: !!input.force });
     imported.push(c.name);
   }
-  return { imported, skipped };
+  return {
+    imported,
+    skipped,
+    findings: Object.keys(findingsBySkill).length > 0 ? findingsBySkill : void 0
+  };
 }
 
 // ../daemon/src/core/skills/resolve.ts
@@ -29958,7 +30036,8 @@ agentsRouter.get("/:id/skills", (c) => {
         name: s.name,
         description: s.parsed.frontmatter.description,
         source: meta2?.source ?? null,
-        importedAt: meta2?.importedAt ?? null
+        importedAt: meta2?.importedAt ?? null,
+        scanFindings: scanSkillContent(s.parsed.raw)
       };
     }),
     missing: set.missing
@@ -29973,6 +30052,24 @@ agentsRouter.post("/:id/skills", async (c) => {
   const { db, paths, authToken } = getCtx();
   const agent = agents_exports.get(db, c.req.param("id"));
   if (!agent) return c.json({ error: `agent not found: ${c.req.param("id")}` }, 404);
+  const discovered = discoverSkills(paths).find((s) => s.name === body.skill);
+  if (discovered) {
+    try {
+      const parsed = parseSkillFile(discovered.skillFile);
+      const findings = scanSkillContent(parsed.raw);
+      if (findings.length > 0 && !body.allowFindings) {
+        return c.json(
+          {
+            error: `skill scan blocked attach: ${body.skill} has findings`,
+            code: "skill_scan_blocked",
+            findings
+          },
+          400
+        );
+      }
+    } catch {
+    }
+  }
   agents_exports.attachSkill(db, agent.id, body.skill);
   return c.body(null, 204);
 });
@@ -31491,6 +31588,7 @@ skillsRouter.get("/", (c) => {
     try {
       const parsed = parseSkillFile(s.skillFile);
       entry.description = parsed.frontmatter.description;
+      entry.scanFindings = scanSkillContent(parsed.raw);
     } catch (err) {
       entry.parseError = err.message;
     }
@@ -31521,14 +31619,36 @@ skillsRouter.post("/import", async (c) => {
     for (const name of result.imported) {
       skillMeta_exports.upsert(db, { name, source: input.sourceLabel, importedAt: now });
     }
-    const res = { imported: result.imported, skipped: result.skipped };
+    const res = {
+      imported: result.imported,
+      skipped: result.skipped,
+      findings: result.findings
+    };
     return c.json(res);
   } catch (err) {
+    if (err instanceof SkillScanBlockedError) {
+      return c.json(
+        {
+          error: err.message,
+          code: "skill_scan_blocked",
+          findings: flattenFindings(err.findings)
+        },
+        400
+      );
+    }
     return c.json({ error: err.message }, 400);
   } finally {
     if (input.tempZipPath) rmSync10(input.tempZipPath, { recursive: true, force: true });
   }
 });
+function flattenFindings(findings) {
+  return Object.entries(findings).flatMap(
+    ([name, items]) => items.map((item) => ({
+      ...item,
+      message: `${name}: ${item.message}`
+    }))
+  );
+}
 async function parseImportInput(request) {
   const contentType = request.headers.get("content-type") ?? "";
   if (contentType.startsWith("multipart/form-data")) {