codiedev 0.9.88 → 0.9.90

package/dist/promptGuard.js

@@ -0,0 +1,261 @@
+"use strict";
+// Stop a prompt that has a key in it before it reaches the model. Off unless
+// a company admin turns it on (Team Security → Settings → Stop prompts with a
+// key). Everything happens on the laptop: the prompt and the key are never
+// sent anywhere; when a prompt is stopped the server only hears which kind of
+// key it was and which harness, for the team's activity feed.
+//
+// Precision over recall: only a provider's own key format (sk-ant-…, ghp_…,
+// AKIA…), a private key block, a password in a URL, or one of the company's
+// own token formats stops a prompt, and only when the value looks real (not a
+// placeholder, sample or test value: scrub/rules notWorthRotating). Generic
+// shapes (KEY=value, Bearer …, JWTs) never stop one; the scrub still removes
+// them from stored sessions.
+//
+// The hook must answer fast and offline, so it reads a cached copy of the
+// company's setting. The cache is refreshed in the background (at session
+// start, and from the prompt hook when it is over REFRESH_MS old).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFRESH_MS = void 0;
+exports.keyLabel = keyLabel;
+exports.formatRules = formatRules;
+exports.findPromptKey = findPromptKey;
+exports.blockMessage = blockMessage;
+exports.blockResponse = blockResponse;
+exports.readPromptGuardPolicy = readPromptGuardPolicy;
+exports.writePromptGuardPolicy = writePromptGuardPolicy;
+exports.refreshPromptGuardPolicy = refreshPromptGuardPolicy;
+exports.maybeSpawnPromptGuardRefresh = maybeSpawnPromptGuardRefresh;
+exports.checkPrompt = checkPrompt;
+exports.reportPromptBlocked = reportPromptBlocked;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const configDir_1 = require("./configDir");
+const promptRules_1 = require("./scrub/promptRules");
+const scrubProviderRules_1 = require("./scrub/scrubProviderRules");
+exports.REFRESH_MS = 10 * 60_000;
+const CACHE_FILE = "prompt-guard.json";
+const FETCH_TIMEOUT_MS = 8_000;
+const LABELS = {
+    ...scrubProviderRules_1.PROVIDER_RULE_LABELS,
+    "supabase-token": "Supabase token", "groq-key": "Groq key", "xai-key": "xAI key", "replicate-token": "Replicate token",
+    "aws-access-key": "AWS key", "openai-key": "OpenAI key", "anthropic-key": "Anthropic key",
+    "github-token": "GitHub token", "gitlab-token": "GitLab token", "stripe-key": "Stripe key",
+    "slack-token": "Slack token", "slack-webhook": "Slack webhook", "google-api-key": "Google API key",
+    "pem-private-key": "private key", "convex-deploy-key": "Convex deploy key", "linear-key": "Linear key",
+    "codiedev-key": "Codiedev key", "fireworks-key": "Fireworks key", "npm-token": "npm token",
+    "sendgrid-key": "SendGrid key", "twilio-key": "Twilio key", "azure-storage-key": "Azure storage key",
+    "azure-sas": "Azure SAS token", "url-password": "password in a URL",
+    "curl-auth-header": "token in a curl command", "curl-auth-user": "password in a curl command",
+};
+/** Keys that are real but not worth stopping a prompt for: Stripe test-mode
+ *  keys (sandbox data only), and a Firebase web config's apiKey (public by
+ *  design: it ships in every Firebase web app). A Google key anywhere else
+ *  (Gemini, Maps server keys) still stops the prompt. */
+function harmlessHere(rule, value, prompt) {
+    if (rule === "stripe-key" && /^[sr]k_test_/.test(value))
+        return true;
+    if (rule === "google-api-key" && /firebaseapp\.com|authDomain|firebaseConfig/i.test(prompt))
+        return true;
+    return false;
+}
+function keyLabel(rule) {
+    if (rule.startsWith("custom:"))
+        return rule.slice("custom:".length);
+    return LABELS[rule] ?? rule.replace(/-/g, " ");
+}
+/** The company's own token formats as scrub rules; a bad one is skipped. */
+function formatRules(formats) {
+    const out = [];
+    for (const f of formats) {
+        try {
+            out.push({ name: `custom:${f.name}`, re: new RegExp(`(?<![A-Za-z0-9])${f.source}(?![A-Za-z0-9_-])`, "g"), ...(f.keyword ? { keywords: [f.keyword] } : {}) });
+        }
+        catch { /* skip */ }
+    }
+    return out;
+}
+/** The first real key in a prompt, or null. */
+function findPromptKey(prompt, formats = [], now = Date.now()) {
+    if (!prompt || prompt.length > 2_000_000)
+        return null;
+    const { redactions } = (0, promptRules_1.scrubSecrets)(prompt, { extraRules: formatRules(formats) });
+    for (const r of redactions) {
+        if (promptRules_1.GENERIC_RULES.has(r.rule))
+            continue;
+        const value = prompt.slice(r.start, r.end);
+        if ((0, promptRules_1.notWorthRotating)({ rule: r.rule, value }, now))
+            continue;
+        if (harmlessHere(r.rule, value, prompt))
+            continue;
+        return { rule: r.rule, label: keyLabel(r.rule), hint: (0, promptRules_1.hintOf)(r.rule, value) };
+    }
+    return null;
+}
+/** What the person sees. Names the kind of key and its last four, says
+ *  nothing was sent, and how to do it instead. */
+function blockMessage(key) {
+    const article = /^[aeiou]/i.test(key.label) ? "an" : "a";
+    return `Codiedev stopped this prompt: it has ${article} ${key.label} in it (…${key.hint}). ` +
+        "Nothing was sent to the model. Put the key in an environment variable or .env file and refer to it by name " +
+        "(for example $API_KEY), then send the prompt again. Your team turned on this check.";
+}
+/** The hook's stdout for each harness when it stops a prompt. */
+function blockResponse(harness, message) {
+    // Cursor: beforeSubmitPrompt. Everyone else that reads stdout (Claude
+    // Code, Codex, Copilot's userPromptSubmitted, and our Codie / pi adapters)
+    // takes the Claude-style decision.
+    if (harness === "cursor")
+        return { continue: false, user_message: message };
+    return { decision: "block", reason: message };
+}
+// ---------------------------------------------------------------------------
+// The company's setting, cached on the laptop
+// ---------------------------------------------------------------------------
+function cachePath(stateDir) {
+    return path.join(stateDir, CACHE_FILE);
+}
+function readPromptGuardPolicy(stateDir = (0, configDir_1.codiedevStateDir)()) {
+    try {
+        const v = JSON.parse(fs.readFileSync(cachePath(stateDir), "utf8"));
+        if (typeof v.fetchedAt !== "number")
+            return null;
+        return {
+            blockPrompts: v.blockPrompts === true,
+            formats: Array.isArray(v.formats) ? v.formats.filter((f) => f && typeof f.name === "string" && typeof f.source === "string").slice(0, 50) : [],
+            fetchedAt: v.fetchedAt,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writePromptGuardPolicy(policy, stateDir = (0, configDir_1.codiedevStateDir)()) {
+    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    const file = cachePath(stateDir);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(policy), { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+/** Ask the server for the company's setting and cache it. On any failure the
+ *  last cached answer stays (and its age makes the next hook try again). */
+async function refreshPromptGuardPolicy(config, fetchImpl = fetch, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now()) {
+    if (!config?.token || !config.backendUrl)
+        return null;
+    try {
+        const res = await fetchImpl(`${config.backendUrl}/api/cli/promptGuard`, {
+            headers: { Authorization: `Bearer ${config.token}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const formats = Array.isArray(body.formats)
+            ? body.formats.filter((f) => f && typeof f.name === "string" && typeof f.source === "string" && f.source.length <= 300).slice(0, 50)
+            : [];
+        const policy = { blockPrompts: body.blockPrompts === true, formats, fetchedAt: now };
+        writePromptGuardPolicy(policy, stateDir);
+        return policy;
+    }
+    catch {
+        return null;
+    }
+}
+/** Start a background refresh when the cached setting is missing or stale.
+ *  Stamps the cache's age first so a burst of hooks starts only one. */
+function maybeSpawnPromptGuardRefresh(opts) {
+    try {
+        if (!opts.connected || process.env.CODIEDEV_PROMPT_GUARD_CHILD)
+            return "disabled";
+        const stateDir = opts.stateDir ?? (0, configDir_1.codiedevStateDir)();
+        const now = opts.now ?? Date.now();
+        const stamp = path.join(stateDir, "prompt-guard.refresh");
+        if (!opts.force) {
+            const cached = readPromptGuardPolicy(stateDir);
+            if (cached && now - cached.fetchedAt < exports.REFRESH_MS && cached.fetchedAt <= now)
+                return "fresh";
+        }
+        try {
+            const last = fs.statSync(stamp).mtimeMs;
+            if (now - last < 60_000 && last <= now)
+                return "fresh"; // one in flight
+        }
+        catch { /* never */ }
+        fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+        fs.writeFileSync(stamp, String(now));
+        const t = new Date(now);
+        fs.utimesSync(stamp, t, t);
+        const child = (opts.spawn ?? child_process_1.spawn)(process.execPath, [opts.hookEntry ?? path.join(__dirname, "hook.js"), "prompt-guard-refresh"], {
+            detached: true,
+            stdio: "ignore",
+            env: { ...process.env, CODIEDEV_PROMPT_GUARD_CHILD: "1" },
+        });
+        child.on?.("error", () => { });
+        child.unref?.();
+        return "spawned";
+    }
+    catch {
+        return "error";
+    }
+}
+/** Check one prompt against the cached setting. Never throws. */
+function checkPrompt(prompt, harness, policy, now = Date.now()) {
+    try {
+        if (!policy?.blockPrompts || !prompt)
+            return { blocked: false };
+        const key = findPromptKey(prompt, policy.formats, now);
+        if (!key)
+            return { blocked: false };
+        const message = blockMessage(key);
+        return { blocked: true, key, message, response: blockResponse(harness, message) };
+    }
+    catch {
+        return { blocked: false };
+    }
+}
+/** Tell the server a prompt was stopped: the rule and harness only. Detached
+ *  and best-effort; a slow network never holds the prompt hook. */
+function reportPromptBlocked(config, rule, harness, fetchImpl = fetch) {
+    if (!config?.token || !config.backendUrl)
+        return Promise.resolve();
+    return fetchImpl(`${config.backendUrl}/api/cli/promptBlocked`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${config.token}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ rule: rule.slice(0, 80), harness }),
+        signal: AbortSignal.timeout(3_000),
+    }).then(() => undefined, () => undefined);
+}

package/dist/scrub/promptRules.d.ts

@@ -0,0 +1,119 @@
+export interface Redaction {
+    rule: string;
+    start: number;
+    end: number;
+}
+export interface ScrubResult {
+    text: string;
+    redactions: Redaction[];
+}
+/** Rules a caller adds for one scrub (a company's own token formats). */
+export interface ExtraRule {
+    name: string;
+    re: RegExp;
+    keywords?: readonly string[];
+}
+/** Shannon entropy in bits per character, as Gitleaks measures it. */
+export declare function shannonEntropy(s: string): number;
+export declare function scrubSecrets(input: string, opts?: {
+    extraRules?: readonly ExtraRule[];
+}): ScrubResult;
+/** Rewrite `input` with each span replaced by `[REDACTED:<rule>]`. Spans must
+ *  be sorted by start and not overlap. One forward pass: repeated
+ *  slice+concat would copy the whole string per redaction (quadratic). */
+export declare function redactSpans(input: string, spans: readonly Redaction[]): string;
+/** Where in a session a secret appeared. "typed" is a short message the
+ *  person wrote; "pasted" is a long one (a log, config or JSON dump pasted in);
+ *  "attached" is text the harness added to the person's turn (an @-mentioned
+ *  file, a resumed session's summary). Older rows say "prompt" for all three. */
+export type SecretWhere = "typed" | "pasted" | "attached" | "prompt" | "tool_call" | "commit" | "tool_output" | "assistant" | "unknown";
+export interface SecretLocation {
+    where: SecretWhere;
+    /** Tool or MCP tool name for tool calls/outputs when the transcript has it. */
+    tool?: string;
+}
+export interface SecretFinding {
+    rule: string;
+    /** Last four alphanumeric characters of the redacted value — enough for a
+     *  person to recognise which key to rotate, never enough to use it. */
+    hint: string;
+    /** Distinct places in the session the key appeared. */
+    locations: SecretLocation[];
+    /** The variable or field it was assigned to (`X_BEARER_TOKEN`), when the
+     *  text shows one. A name, never the value. */
+    name?: string;
+    /** The file it was written to or read from (`altcap-bot/.env`), when the
+     *  text shows one: last two path parts only. */
+    file?: string;
+}
+/** What a caller may check before a key becomes a finding (exceptions).
+ *  `value` is the key itself: use it to compare, never store it. */
+export interface KeyContext {
+    rule: string;
+    value: string;
+    name?: string;
+    file?: string;
+}
+export declare const GENERIC_RULES: ReadonlySet<string>;
+/** Values that share a key's shape but are test or sample values: words
+ *  joined by _ or - with only digits or one repeated character between
+ *  (`cdv_local_pilot_token_2026`, `…_token_000000`), a long counting run
+ *  (`sk-1234567890…`), or a long repeated tail. Still removed from sessions;
+ *  just not listed as a key to rotate. */
+export declare function looksLikeTestValue(value: string): boolean;
+export declare const isTestFile: (file: string) => boolean;
+/** Where in one transcript line (a JSONL record) some text appeared, and the
+ *  file that line reads or writes, if it names one. For any detector that
+ *  works line by line (PHI/PII). `text` is the matched text as it reads
+ *  after JSON unescaping. */
+export declare function locateInLine(line: string, text: string): SecretLocation & {
+    file?: string;
+};
+/** Where each `[REDACTED:<rule>]` marker sits in an already-scrubbed
+ *  transcript. Re-labels older findings that predate typed/pasted/attached. */
+export declare function locateMarkers(scrubbed: string, rule: string): SecretLocation[];
+/** Rules that match a shape (a secret-named variable, a header, a URL, a PEM
+ *  block) rather than a provider's own key format. */
+export declare const SHAPE_RULES: ReadonlySet<string>;
+/** The name or location of a secret, or a value built from words, rather
+ *  than a random key: an ARN, a secret-store path, or a value whose letters
+ *  are mostly whole words (`mobile-data/client2`, `bracecomb-hc-service`,
+ *  `mobileDataClientV2`). A random key does not break into words, whatever
+ *  separators it has: under 1% of random 16-character keys pass this, and
+ *  next to none at 24 or more. */
+export declare function namesASecret(v: string): boolean;
+/** True when a redacted value should not be listed as a key to rotate: a
+ *  placeholder, a sample or test value, a reference to a variable, or a
+ *  credential that expires by itself. `now` is injectable for tests. */
+export declare function notWorthRotating(k: KeyContext, now?: number): boolean;
+/** Last four letters or digits of a value. A PEM block ends in a fixed
+ *  footer, and in a transcript its line breaks are a literal `\n`: the hint
+ *  comes from the key body, without either. */
+export declare function hintOf(rule: string, value: string): string;
+/** One finding per distinct (rule, last-4) in a scrub result, with every
+ *  distinct place it appeared. */
+export declare function secretFindings(input: string, redactions: Redaction[], opts?: {
+    skip?: (k: KeyContext) => boolean;
+    now?: number;
+}): SecretFinding[];
+export interface PossibleSecret {
+    label: string;
+    prefix?: string;
+    hint: string;
+    length: number;
+    shape: "hex" | "base64" | "alnum";
+    snippet: string;
+    locations: SecretLocation[];
+    /** Spans in the text this was read from, for redaction once confirmed. */
+    spans: Array<{
+        start: number;
+        end: number;
+    }>;
+}
+export declare function possibleSecrets(text: string, limit?: number): PossibleSecret[];
+/** Redact every occurrence of an already-reviewed possible secret. */
+export declare function redactPossible(text: string, match: {
+    label: string;
+    hint: string;
+    length: number;
+}, rule?: string): ScrubResult;