cortad 0.1.12 → 0.1.14

package/lib/keys.mjs

@@ -0,0 +1,38 @@
+// A file that carries a key stays on this machine, whatever git thinks of it: a catalogue that keeps
+// an AES key per video is tracked like code and is no more shareable than a .env.
+// The header alone is code that looks for keys; a key has its body after it.
+const PRIVATE_KEY = /-----BEGIN [A-Z ]*PRIVATE KEY-----(?:\\n|\s)*[A-Za-z0-9+/=]{40,}/;
+const PROVIDER_TOKEN = /\b((?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{36,}|xox[abprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{35}|[rs]k_live_[0-9A-Za-z]{24,}|glpat-[0-9A-Za-z_-]{20,}))\b/g;
+// A long literal under a key-like name. A name read from the environment is not a literal, so
+// `apiKey: process.env.KEY` never matches.
+const NAMED_LITERAL = /["']?[\w-]*(?:key|secret|token|passw(?:or)?d|aes|iv|salt)["']?\s*[:=]\s*["']([A-Fa-f0-9]{32,}|[A-Za-z0-9+/_-]{32,}={0,2})["']/gi;
+
+// A real key is random: digits and letters, many distinct characters. "sk-live-should-never-leak"
+// in a test is a name for a key, not one.
+const random = (s) => /\d/.test(s) && /[A-Za-z]/.test(s) && new Set(s).size >= 10;
+const any = (re, text) => [...text.matchAll(re)].some((m) => random(m[1]));
+
+export function holdsKeys(text, values = []) {
+  return PRIVATE_KEY.test(text) || any(PROVIDER_TOKEN, text) || any(NAMED_LITERAL, text) || values.some((v) => text.includes(v));
+}
+
+// The values worth looking for elsewhere: a variable whose name says it is a secret, from a real env
+// file. An example file's values are placeholders, and a bucket or model name is not a key.
+const SECRET_NAME = /KEY|SECRET|TOKEN|PASSW|PRIVATE|CREDENTIAL/i;
+const EXAMPLE = /\.(example|sample|template|dist)$/i;
+export function secretEnvValues(envFiles, read) {
+  const values = [];
+  for (const file of envFiles) {
+    if (EXAMPLE.test(file)) continue;
+    let text = "";
+    try { text = read(file); } catch { continue; }
+    for (const line of text.split("\n")) {
+      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+      if (!m || !SECRET_NAME.test(m[1])) continue;
+      const v = m[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+      // A value of few distinct characters is a placeholder or a published test key, not a secret.
+      if (v.length >= 12 && !/\s/.test(v) && new Set(v).size >= 8) values.push(v);
+    }
+  }
+  return values;
+}

package/local.mjs

@@ -11,6 +11,7 @@
 // (lib/lock.mjs) and cannot write your code at all. Nothing here touches git. Your environment
 // never leaves this machine. Ctrl-C ends everything.
 
+import { holdsKeys, secretEnvValues } from "./lib/keys.mjs";
 import { spawn, execFile, execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, watch, writeFileSync } from "node:fs";
@@ -119,6 +120,11 @@ function shareable(rel) {
   try { execFileSync("git", ["-C", root, "check-ignore", "-q", rel], { stdio: "ignore" }); return false; } catch (e) { return e.status === 1; }
 }
 let listed = null;
+// Read the same way for the upload and for any read the engine asks for later.
+let envKeys = [];
+function carriesKey(rel) {
+  try { return holdsKeys(readFileSync(join(root, rel), "utf8"), envKeys); } catch { return false; }
+}
 
 // Values from your env files, read here and only here, so nothing a command prints can carry one.
 function secretValues(envFiles) {
@@ -280,7 +286,8 @@ const readable = (p) => {
   let landed; try { landed = realpathSync(r); } catch { return null; }
   const home = realpathSync(root);
   if (!landed.startsWith(home + sep) || ENV_FILE.test(basename(landed)) || SECRET_PATH.test(landed)) return null;
-  return shareable(relative(home, landed)) ? landed : null;
+  const rel = relative(home, landed);
+  return shareable(rel) && !carriesKey(rel) ? landed : null;
 };
 // A shell line runs with a plain environment: the app's own process reads its .env itself, and
 // nothing a world sends inherits this terminal's keys.
@@ -746,9 +753,15 @@ const envFiles = [];
 const files = [];
 listed = gitListed();
 walk(root, 0, files, envFiles, 0);
+secrets = secretValues(envFiles);
+envKeys = secretEnvValues(envFiles, (f) => readFileSync(f, "utf8"));
+const kept = [];
+for (let i = files.length - 1; i >= 0; i -= 1) if (carriesKey(files[i])) kept.unshift(...files.splice(i, 1));
 // --explain: what this would send and start, from this folder, and nothing else. No network, no
 // app started, nothing written. For the person (or the agent) who reads before running.
 if (explain) {
+  const going = new Set([...files, ...kept]);
+  const left = listed ? [...listed].filter((f) => !going.has(f) && !ENV_FILE.test(basename(f))).sort() : [];
   const bytes = files.reduce((n, f) => { try { return n + statSync(join(root, f)).size; } catch { return n; } }, 0);
   const plan = startPlan({ root, typed: flag("--start"), onPath });
   const rel = (f) => relative(root, f) || ".";
@@ -757,6 +770,8 @@ if (explain) {
     ``,
     `talks to        ${origin.origin}, localhost (your app's port only), and your own model providers, to ask each which models your key can use`,
     `would send      ${files.length} source files, ${Math.round(bytes / 1024)} KB, once${listed ? " (what git would commit)" : ""}`,
+    ...(kept.length ? [`kept here       ${kept.length} file${kept.length === 1 ? " that holds" : "s that hold"} keys: ${kept.slice(0, 6).join(", ")}${kept.length > 6 ? ", ..." : ""}`] : []),
+    ...(left.length ? [`also not sent   ${left.length} tracked data, media or lock file${left.length === 1 ? "" : "s"}: ${left.slice(0, 6).join(", ")}${left.length > 6 ? ", ..." : ""}`] : []),
     `not sent        anything git ignores, env files (${envFiles.length} here: ${envFiles.slice(0, 6).map(rel).join(", ") || "none"}), key files, data files, node_modules, .git`,
     `env files       values read here only: to hide them in replies, to sign in a test account, and to ask your providers what your keys reach. Variable names and whether a switch is on or off go up; no value does`,
     `would start     ${flag("--port") ? `nothing: uses your app on port ${flag("--port")}` : plan?.cmd ? `${plan.cmd}   (in ${rel(plan.cwd)})` : plan?.noServer ? "nothing: this repository has no server to run" : "asks you how your app starts"}`,
@@ -769,7 +784,7 @@ if (explain) {
   ].join("\n"));
   process.exit(0);
 }
-secrets = secretValues(envFiles);
+if (kept.length) say(`kept on this machine, ${kept.length === 1 ? "it holds" : "they hold"} keys: ${kept.join(", ")}`);
 const keepSecret = (v) => { if (v && v.length >= 12 && !secrets.includes(v)) secrets.push(v); };
 identities = makeIdentities({ root, work, envFiles, sourceFiles: () => files, say, keepSecret, appDir: () => appDir });
 // One message sent in their own app tells us the door for certain. The route and the body go up,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Connects the AI app on your machine to Cortad for test conversations. No dependencies.",
   "bin": {
     "cortad": "local.mjs"
@@ -11,6 +11,7 @@
     "lib/door.mjs",
     "lib/identities.mjs",
     "lib/listing.mjs",
+    "lib/keys.mjs",
     "lib/lock.mjs",
     "lib/mint.mjs",
     "lib/pyhook/sitecustomize.py",