kritya 0.8.61-beta → 0.8.62-beta

package/dist/agent/memory.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { scanForSecrets } from "../tools/secretScan.js";
 const MEMORY_FILE = "KRITYA.md";
 const AUTO_HEADING = "## Learned by kritya (auto-updated; edit or delete freely)";
 const MAX_FACTS = 20;
@@ -132,6 +133,14 @@ export function mergeProjectMemory(workspace, newFacts) {
     for (const fact of newFacts) {
         if (seen.has(fact.toLowerCase()))
             continue;
+        // Write-time secret guard: facts are extracted from session transcripts,
+        // which can include credentials the model saw in tool output, and
+        // KRITYA.md is a plain workspace file that is read back into future
+        // prompts. A fact that looks like it contains a real secret is dropped
+        // rather than persisted — silently, since there is no user-facing write
+        // to block here, and the fact's value is the secret itself.
+        if (scanForSecrets(fact).length > 0)
+            continue;
         seen.add(fact.toLowerCase());
         added.push(fact);
     }

package/dist/tools/document.js

@@ -6,6 +6,7 @@ import { readDocx, writeDocx } from "./document/docx.js";
 import { readXlsx, writeXlsx, editXlsx } from "./document/xlsx.js";
 import { readPptx, writePptx } from "./document/pptx.js";
 import { readPdf, writePdf, editPdf } from "./document/pdf.js";
+import { formatSecretWarning, scanForSecrets } from "./secretScan.js";
 const READABLE_EXTENSIONS = [".docx", ".xlsx", ".pptx", ".pdf"];
 /**
  * Bound the raw file read before it's dispatched to any format-specific
@@ -142,6 +143,14 @@ export const writeDocumentTool = {
         const abs = resolveSafe(ctx.workspace, relPath);
         const ext = path.extname(abs).toLowerCase();
         const content = extractContent(args);
+        // Same write-time secret guard as write_file: the blocks/sheets/slides
+        // payload is model-authored text, and a generated .docx/.xlsx is still
+        // a file a real key shouldn't be baked into. The payload is structured,
+        // so scan its JSON form — every user-visible string is in there.
+        const secrets = scanForSecrets(JSON.stringify(content));
+        if (secrets.length > 0) {
+            throw new Error(formatSecretWarning(secrets, relPath));
+        }
         let buf;
         switch (ext) {
             case ".docx":
@@ -232,6 +241,16 @@ export const editSpreadsheetTool = {
         const edits = (args.edits ?? []);
         if (edits.length === 0)
             throw new Error("edit_spreadsheet: `edits` must be non-empty");
+        // Write-time secret guard, same as write_file: a string cell value is
+        // model-authored content being persisted into the workbook.
+        for (const edit of edits) {
+            if (typeof edit.value !== "string")
+                continue;
+            const secrets = scanForSecrets(edit.value);
+            if (secrets.length > 0) {
+                throw new Error(formatSecretWarning(secrets, relPath));
+            }
+        }
         const buf = await fs.readFile(abs);
         const { buf: out, applied } = await editXlsx(buf, edits);
         ctx.undo?.snapshot(abs, relPath);

package/dist/tools/notebook.js

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import { writeFileAtomic } from "../atomicWrite.js";
 import { resolveSafe, truncateResult } from "./common.js";
+import { formatSecretWarning, scanForSecrets } from "./secretScan.js";
 /** nbformat stores text as either a single string or an array of lines. */
 function joinSource(source) {
     if (Array.isArray(source))
@@ -170,6 +171,15 @@ export const editNotebookTool = {
         }
         const nb = await loadNotebook(abs);
         const cells = nb.cells;
+        // Same write-time secret guard as write_file/edit_file: cell source is
+        // model-authored content persisted to disk, and a notebook is an
+        // ordinary file a key can hide in just as easily as a .ts file.
+        if (op !== "delete" && args.source !== undefined) {
+            const secrets = scanForSecrets(String(args.source));
+            if (secrets.length > 0) {
+                throw new Error(formatSecretWarning(secrets, relPath));
+            }
+        }
         switch (op) {
             case "replace": {
                 if (index >= cells.length) {

package/dist/tools/secretScan.js

@@ -148,3 +148,31 @@ export function formatSecretWarning(matches, path) {
         `match common key formats or lower its entropy — for example, using an obvious placeholder ` +
         `like "sk-ant-EXAMPLE...".`);
 }
+/**
+ * Shell commands are the one write path the file tools can't see: a command
+ * like `echo '<key>' > notes.txt` or a heredoc puts a literal secret on disk
+ * without going through write_file/edit_file. The command string itself is
+ * the only place to catch that — but a secret merely *appearing* in a
+ * command (a curl Authorization header, say) doesn't put it in a file, so
+ * this only fires when the command also has a file-writing construct: an
+ * output redirect to a real target (not `>&` fd duplication or a `>=`
+ * comparison), `tee`, or `dd of=`. Heredocs are covered through the
+ * redirect they almost always pair with (`cat > f <<EOF`); a heredoc fed
+ * to an interpreter that then writes the secret itself is out of reach for
+ * a string scan and remains a known gap, like novel key formats.
+ */
+const SHELL_WRITE_RE = />{1,2}\s*(?![&=>])|\btee\b|\bdd\b[^|;&]*\bof=/;
+export function scanCommandForSecretWrite(command) {
+    if (!SHELL_WRITE_RE.test(command))
+        return [];
+    return scanForSecrets(command);
+}
+export function formatShellSecretWarning(matches) {
+    const lines = matches.map((m) => `  - ${m.kind}: ${m.snippet}`);
+    return (`Blocked shell command: it writes to a file and contains what looks like real secret(s):\n` +
+        lines.join("\n") +
+        `\n\nEmbedding a literal secret in a shell command writes it to disk and shell history. ` +
+        `Reference the value from the environment instead (e.g. $API_KEY), or if this is ` +
+        `genuinely not a secret (e.g. a test fixture), rewrite it so it doesn't match common ` +
+        `key formats — for example, using an obvious placeholder like "sk-ant-EXAMPLE...".`);
+}

package/dist/tools/shell.js

@@ -4,7 +4,7 @@ import { gitDiffStat } from "../git/git.js";
 import { backgroundManager } from "../shell/background.js";
 import { buildSandboxedCommand, networkBlockedHint, requiresSandbox, sandboxUnavailableReason, shouldSandbox, } from "../shell/sandbox.js";
 import { commandTouchesSensitivePath, truncateTail } from "./common.js";
-import { redactSecrets } from "./secretScan.js";
+import { redactSecrets, scanCommandForSecretWrite, formatShellSecretWarning, } from "./secretScan.js";
 const DEFAULT_TIMEOUT_S = 120;
 const MAX_TIMEOUT_S = 600;
 /** git subcommands that rewrite the working tree, index, or history. */
@@ -63,6 +63,14 @@ export const shellTool = {
         if (sensitivePath) {
             throw new Error(`Command references "${sensitivePath}", which looks like a secret file, and is blocked from tool access`);
         }
+        // A command can also *create* the secret leak: a literal key in the
+        // command string plus a redirect/tee/dd target writes it to a file
+        // without going through the scanned file tools. Block that here, for
+        // background commands too — this check sits above the background branch.
+        const secretWrite = scanCommandForSecretWrite(command);
+        if (secretWrite.length > 0) {
+            throw new Error(formatShellSecretWarning(secretWrite));
+        }
         if (args.background) {
             const { id } = backgroundManager.start(command, ctx.workspace, ctx.sandboxMode);
             // Echoing the command back can leak a credential embedded in it (e.g. a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.61-beta",
+  "version": "0.8.62-beta",
   "description": "Kritya — Superintelligence at your command line",
   "type": "module",
   "publishConfig": {