kritya 0.8.3-beta → 0.8.4-beta

package/dist/engine.js

@@ -68,7 +68,7 @@ export async function createEngineSession(dir, opts = {}) {
     SessionStore.cleanupOldSessions(retentionDays);
     AuditLog.cleanupOld(retentionDays);
     cleanupOldTelemetry(retentionDays);
-    const permissions = new PermissionManager(loadRules(workspace, trustWorkspace));
+    const permissions = new PermissionManager(loadRules(workspace, trustWorkspace), workspace);
     const agent = new Agent(client, () => currentModel, ALL_TOOLS, { workspace, sandboxMode: config.sandboxExec ?? defaultSandboxMode(), trustWorkspace }, permissions, session, []);
     agent.contextWindow = contextWindowFor(currentModel, config);
     if (config.maxSteps && config.maxSteps > 0)

package/dist/headless.js

@@ -156,7 +156,7 @@ export async function runHeadless(args) {
     const onElicitation = async () => ({ action: "cancel" });
     const mcpTools = await loadMcpTools(mergeMcpServers(config.mcpServers, approvedProjectMcp, approvedPluginMcp), { tracer: sessionTracer, audit: sessionAudit, workspace, onSampling, onElicitation });
     const tools = [...ALL_TOOLS, ...mcpTools];
-    const permissions = new PermissionManager(loadRules(workspace, trustWorkspace));
+    const permissions = new PermissionManager(loadRules(workspace, trustWorkspace), workspace);
     const agent = new Agent(client, () => model, tools, 
     // No requestElicitation here — no UI to ask through. Leaving it undefined
     // (rather than an always-cancel stub) lets ask_user report itself as

package/dist/index.js

@@ -477,7 +477,7 @@ async function main() {
         };
     }
     async function runReadOnlyAgent(task, signal) {
-        const sub = new Agent(client, () => modelRef.current, readOnlySubTools, { workspace, sandboxMode, trustWorkspace }, new PermissionManager(), new SessionStore(workspace, true), []);
+        const sub = new Agent(client, () => modelRef.current, readOnlySubTools, { workspace, sandboxMode, trustWorkspace }, new PermissionManager([], workspace), new SessionStore(workspace, true), []);
         sub.maxSteps = 15;
         sub.audit = sessionAudit;
         sub.tracer = sessionTracer;
@@ -524,7 +524,7 @@ async function main() {
             // since there's no one to confirm it and letting it run unattended would
             // be unsafe even inside an isolated worktree (it still has real shell/
             // network access).
-            const sub = new Agent(client, () => modelRef.current, writeSubTools, { workspace: wt.dir, sandboxMode, trustWorkspace }, new PermissionManager({ allow: ["write_file", "edit_file", "shell(*)"], deny: [] }), new SessionStore(wt.dir, true), []);
+            const sub = new Agent(client, () => modelRef.current, writeSubTools, { workspace: wt.dir, sandboxMode, trustWorkspace }, new PermissionManager({ allow: ["write_file", "edit_file", "shell(*)"], deny: [] }, wt.dir), new SessionStore(wt.dir, true), []);
             sub.maxSteps = 30;
             sub.audit = sessionAudit;
             sub.tracer = sessionTracer;
@@ -643,7 +643,7 @@ async function main() {
         },
         requestElicitation: onAskUser,
         spawnAgents,
-    }, new PermissionManager(loadRules(workspace, trustWorkspace)), session, initialHistory);
+    }, new PermissionManager(loadRules(workspace, trustWorkspace), workspace), session, initialHistory);
     agent.contextWindow = contextWindowFor(modelRef.current, config);
     if (config.maxSteps && config.maxSteps > 0)
         agent.maxSteps = config.maxSteps;

package/dist/mcp/callback.js

@@ -14,13 +14,25 @@ import { debugLog } from "../config/debug.js";
  * mismatched callback is an attempted CSRF, not a user-visible error case.
  */
 const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
 function page(title, detail) {
     // Deliberately dependency-free and inline-styled: this renders in the user's
     // browser, and a login callback should not fetch anything from the network.
-    return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head>
+    // `detail` in particular can carry query-string content from the OAuth
+    // provider (e.g. error_description), so both fields must be HTML-escaped.
+    const safeTitle = escapeHtml(title);
+    const safeDetail = escapeHtml(detail);
+    return `<!doctype html><html><head><meta charset="utf-8"><title>${safeTitle}</title></head>
 <body style="font-family:system-ui,sans-serif;max-width:32rem;margin:6rem auto;padding:0 1.5rem;line-height:1.6">
-<h1 style="font-size:1.25rem;margin:0 0 .5rem">${title}</h1>
-<p style="color:#555;margin:0">${detail}</p>
+<h1 style="font-size:1.25rem;margin:0 0 .5rem">${safeTitle}</h1>
+<p style="color:#555;margin:0">${safeDetail}</p>
 </body></html>`;
 }
 export async function startCallbackServer(state) {

package/dist/permissions/permissions.js

@@ -26,7 +26,8 @@ export class PermissionManager {
     alwaysAllowed = new Set();
     allow;
     deny;
-    constructor(rules = []) {
+    workspace;
+    constructor(rules = [], workspace) {
         if (Array.isArray(rules)) {
             this.allow = rules;
             this.deny = [];
@@ -35,17 +36,18 @@ export class PermissionManager {
             this.allow = rules.allow;
             this.deny = rules.deny;
         }
+        this.workspace = workspace;
     }
     /** True if a deny rule blocks this call; such calls are never prompted, always refused. */
     isDenied(tool, args = {}) {
-        return this.deny.some((rule) => matchesRule(rule, tool.name, args));
+        return this.deny.some((rule) => matchesRule(rule, tool.name, args, this.workspace));
     }
     needsPrompt(tool, args = {}) {
         if (!tool.requiresPermission)
             return false;
         if (this.alwaysAllowed.has(alwaysAllowKey(tool.name, args)))
             return false;
-        return !this.allow.some((rule) => matchesRule(rule, tool.name, args));
+        return !this.allow.some((rule) => matchesRule(rule, tool.name, args, this.workspace));
     }
     record(toolName, decision, args = {}) {
         if (decision === "always")

package/dist/permissions/rules.js

@@ -25,11 +25,24 @@ export function loadRules(workspace, trustWorkspace = true) {
     return { allow, deny };
 }
 const RULE_RE = /^([a-z_]+)(?:\((.*)\))?$/;
-/** The string a pattern is matched against for a given tool. */
-function subjectFor(toolName, args) {
+/**
+ * The string a pattern is matched against for a given tool.
+ *
+ * File-tool paths are resolved against `workspace` (when given) before
+ * matching, the same way {@link resolveSafe} normalizes them: "./.env" and
+ * "sub/../.env" both become ".env". Without this, a rule like
+ * `write_file(.env*)` only matches the exact literal string the model
+ * happened to pass, and a differently-spelled equivalent path slips past it.
+ */
+function subjectFor(toolName, args, workspace) {
     if (toolName === "shell")
         return String(args.command ?? "").trim();
-    return String(args.path ?? args.pattern ?? "").trim();
+    const rawPath = args.path;
+    if (workspace && typeof rawPath === "string" && rawPath.trim()) {
+        const rel = path.relative(workspace, path.resolve(workspace, rawPath));
+        return rel.split(path.sep).join("/");
+    }
+    return String(rawPath ?? args.pattern ?? "").trim();
 }
 /**
  * Shell metacharacters that chain/substitute commands or redirect I/O
@@ -39,7 +52,7 @@ function subjectFor(toolName, args) {
  * because the allowed pattern never spelled those characters out.
  */
 const SHELL_METACHAR_RE = /&&|\|\||[;|`&\n]|\$\(|\$\{|<|>/;
-export function matchesRule(rule, toolName, args) {
+export function matchesRule(rule, toolName, args, workspace) {
     const m = RULE_RE.exec(rule.trim());
     if (!m)
         return false;
@@ -49,7 +62,7 @@ export function matchesRule(rule, toolName, args) {
     if (pattern === undefined)
         return true;
     const trimmedPattern = pattern.trim();
-    const subject = subjectFor(toolName, args);
+    const subject = subjectFor(toolName, args, workspace);
     // A wildcard shell(...) rule (e.g. shell(git *)) is only meant to allow one
     // command, not an arbitrary chain appended after it. If the actual command
     // contains shell metacharacters that the allowed pattern itself didn't

package/dist/tools/fetchUrl.js

@@ -123,23 +123,26 @@ async function readBodyCapped(res, maxBytes) {
 }
 /** Collapse an HTML document down to readable plain text (best-effort, no deps). */
 function htmlToText(html) {
-    return html
-        .replace(/<script[\s\S]*?<\/script>/gi, " ")
-        .replace(/<style[\s\S]*?<\/style>/gi, " ")
-        .replace(/<noscript[\s\S]*?<\/noscript>/gi, " ")
+    return (html
+        .replace(/<script[\s\S]*?(<\/script\s*>|$)/gi, " ")
+        .replace(/<style[\s\S]*?(<\/style\s*>|$)/gi, " ")
+        .replace(/<noscript[\s\S]*?(<\/noscript\s*>|$)/gi, " ")
         .replace(/<!--[\s\S]*?-->/g, " ")
         .replace(/<\/(p|div|li|tr|h[1-6]|section|article|br)>/gi, "\n")
         .replace(/<br\s*\/?>/gi, "\n")
         .replace(/<[^>]+>/g, " ")
         .replace(/&nbsp;/gi, " ")
-        .replace(/&amp;/gi, "&")
         .replace(/&lt;/gi, "<")
         .replace(/&gt;/gi, ">")
         .replace(/&quot;/gi, '"')
         .replace(/&#39;/gi, "'")
+        // &amp; must decode last: an already-escaped "&amp;lt;" is meant to render as
+        // the literal text "&lt;", not as "<" — decoding &amp; first would collapse
+        // it two levels and let doubly-encoded markup smuggle a live "<" through.
+        .replace(/&amp;/gi, "&")
         .replace(/[ \t]+/g, " ")
         .replace(/\n{3,}/g, "\n\n")
-        .trim();
+        .trim());
 }
 /**
  * Fetch one URL and return its text content. HTML is reduced to plain text;

package/dist/tools/secretScan.js

@@ -36,6 +36,13 @@ const NAMED_PATTERNS = [
         kind: "Private key block",
         re: /-----BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g,
     },
+    { kind: "npm access token", re: /\bnpm_[A-Za-z0-9]{36}\b/g },
+    { kind: "PyPI upload token", re: /\bpypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}\b/g },
+    { kind: "Azure Storage Account key", re: /\b[A-Za-z0-9+/]{86}==(?![A-Za-z0-9+/=])/g },
+    {
+        kind: "GCP service account key",
+        re: /\b[a-z0-9-]+@[a-z0-9-]+\.iam\.gserviceaccount\.com\b/gi,
+    },
 ];
 // Generic "KEY = <opaque token>" assignments, gated by an entropy check so
 // ordinary identifiers/URLs/sentences don't trip it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.3-beta",
+  "version": "0.8.4-beta",
   "description": "Kritya — a lean, provider-agnostic terminal coding agent (NVIDIA, OpenAI, OpenRouter, Groq, Ollama, and more)",
   "type": "module",
   "bin": {
@@ -62,7 +62,7 @@
     "@types/node": "^26.2.0",
     "@types/react": "^19.2.18",
     "c8": "^12.0.0",
-    "electron": "^43.3.0",
+    "electron": "^43.4.1",
     "electron-builder": "^26.15.3",
     "eslint": "^10.8.1",
     "globals": "^17.11.0",