kritya 0.8.61-beta → 0.8.63-beta

package/dist/agent/memory.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { scanForSecrets } from "../tools/secretScan.js";
 const MEMORY_FILE = "KRITYA.md";
 const AUTO_HEADING = "## Learned by kritya (auto-updated; edit or delete freely)";
 const MAX_FACTS = 20;
@@ -132,6 +133,14 @@ export function mergeProjectMemory(workspace, newFacts) {
     for (const fact of newFacts) {
         if (seen.has(fact.toLowerCase()))
             continue;
+        // Write-time secret guard: facts are extracted from session transcripts,
+        // which can include credentials the model saw in tool output, and
+        // KRITYA.md is a plain workspace file that is read back into future
+        // prompts. A fact that looks like it contains a real secret is dropped
+        // rather than persisted — silently, since there is no user-facing write
+        // to block here, and the fact's value is the secret itself.
+        if (scanForSecrets(fact).length > 0)
+            continue;
         seen.add(fact.toLowerCase());
         added.push(fact);
     }

package/dist/agent/toolExecutor.js

@@ -3,6 +3,7 @@ import { classifyLaterExec, classifyLaterExecInShell, recordLaterExec, workspace
 import { acknowledgeUnsandboxedFallback, sandboxAvailable, sandboxFallbackWarning, } from "../shell/sandbox.js";
 import { isPlanningDocWrite, loadProjectState } from "./workflow.js";
 import { redactSecrets } from "../tools/secretScan.js";
+import { classifyReconCall, ReconTripwire, RECON_TRIP_THRESHOLD, RECON_WINDOW_CALLS, } from "../permissions/recon.js";
 /** How much tool output to hand the UI (it shows a preview and expands on toggle). */
 const PREVIEW_CHARS = 4000;
 /**
@@ -91,6 +92,12 @@ function fenceExternal(output) {
 export class ToolExecutor {
     tools;
     host;
+    /**
+     * Per-session recon-pattern score (see permissions/recon.ts). One
+     * executor serves one agent session, so the tripwire's state naturally
+     * spans exactly that session's calls and resets with it.
+     */
+    tripwire = new ReconTripwire();
     constructor(tools, host) {
         this.tools = tools;
         this.host = host;
@@ -211,6 +218,33 @@ export class ToolExecutor {
         };
         if (host.kill.active)
             return killBlocked();
+        // Recon-pattern tripwire. The gates below (and the tools' own checks)
+        // judge calls one at a time; this is the one place that sees the
+        // sequence. Every call is scored, including ones another gate is about
+        // to block anyway — an attempt at a credential file is a signal whether
+        // or not it succeeds. Recording happens in this synchronous stretch,
+        // before any await, so a parallel batch of read-only calls can't race
+        // the score. Once tripped, only recon-carrying calls are blocked;
+        // ordinary work flows through the normal gates below.
+        const recon = this.tripwire.record(classifyReconCall(name, args));
+        if (recon.blocked) {
+            host.audit?.logPermission({
+                tool: name,
+                summary,
+                verdict: "denied",
+                source: "recon-tripwire",
+            });
+            logToolOutcome("blocked");
+            finishSpan("ERROR", "blocked: recon-pattern tripwire");
+            handlers.onToolEnd(id, name, summary, "blocked: recon-pattern tripwire", true);
+            return (`Stopped by the recon-pattern tripwire: this session's recent calls form a ` +
+                `reconnaissance-like pattern (${this.tripwire.tripKinds.join(", ")}) — ${recon.score} ` +
+                `points across the last ${RECON_WINDOW_CALLS} calls, over the limit of ` +
+                `${RECON_TRIP_THRESHOLD}. This call was blocked, and further reconnaissance-like ` +
+                `calls stay blocked for the rest of the session. Ordinary work (reading and ` +
+                `editing project files, builds, tests) can continue. If this is legitimate ` +
+                `debugging, tell the user what you are doing and why; a new session resets the tripwire.`);
+        }
         // The planning-doc exemption is scoped to the active project's own
         // docs/<slug>/ folder, so plan mode can persist its artifact without
         // becoming a way to edit unrelated documentation.

package/dist/permissions/recon.js

@@ -0,0 +1,162 @@
+import { commandTouchesSensitivePath, isSensitivePath } from "../tools/common.js";
+const WEIGHTS = {
+    "credential-probe": 5,
+    "env-dump": 4,
+    enumeration: 2,
+    "system-probe": 2,
+};
+/** Score at or above which the tripwire latches for the rest of the session. */
+export const RECON_TRIP_THRESHOLD = 10;
+/** How many recent calls the rolling score covers. */
+export const RECON_WINDOW_CALLS = 20;
+function signal(kind, detail) {
+    return { kind, weight: WEIGHTS[kind], detail };
+}
+/**
+ * Whole-environment dumps. Only the bare forms score: `env FOO=1 cmd` runs a
+ * command with one variable set and `printenv PATH` reads one variable —
+ * both ordinary. Dumping *everything* is the recon move.
+ */
+const ENV_DUMP_PATTERNS = [
+    { re: /(^|[|;&]\s*)(env|printenv)(\s*$|\s*[|;&])/, detail: "bare env/printenv dump" },
+    { re: /\bexport\s+-p\b/, detail: "export -p dump" },
+    { re: /\bdeclare\s+-x\b/, detail: "declare -x dump" },
+    { re: /\bcompgen\s+-e\b/, detail: "compgen -e env listing" },
+    { re: /\/proc\/(\d+|self)\/environ\b/, detail: "reads /proc environ" },
+    { re: /\b(dir|ls|gci|Get-ChildItem)\s+env:/i, detail: "PowerShell env: drive listing" },
+];
+/** Identity and network-shape questions — cheap to ask, classic to ask first. */
+const SYSTEM_PROBE_PATTERNS = [
+    { re: /\bwhoami\b/, detail: "whoami" },
+    { re: /\bhostname\b/, detail: "hostname" },
+    { re: /\buname\b/, detail: "uname" },
+    { re: /\bsysteminfo\b/, detail: "systeminfo" },
+    { re: /(^|[|;&]\s*)id\s*($|[|;&])/, detail: "bare id" },
+    { re: /\bnetstat\b/, detail: "netstat" },
+    { re: /\bifconfig\b/, detail: "ifconfig" },
+    { re: /\bipconfig\b/, detail: "ipconfig" },
+    { re: /\bip\s+(addr|address|link|route)\b/, detail: "ip addr/link/route" },
+    { re: /\barp\s+-a\b/, detail: "arp -a" },
+    { re: /\bps\s+(aux|ef|-ef|-aux)\b/, detail: "full process listing" },
+];
+/**
+ * Listing the places a person keeps things, rather than the project: home,
+ * the filesystem root, /etc, other users' folders. A listing of the
+ * workspace itself (relative paths, /tmp, project dirs) scores nothing.
+ */
+const ENUMERATION_PATTERNS = [
+    {
+        re: /(?:^|[|;&]\s*)(?:ls|dir|find|tree)\b[^|;&]*?\s(?:~|\$HOME|\/etc|\/home|[A-Za-z]:\\Users)(?=[\s|;&]|$)/,
+        detail: "lists home/system directories",
+    },
+    {
+        re: /(?:^|[|;&]\s*)(?:ls|dir|find|tree)\b[^|;&]*?\s\/(?=[\s|;&]|$)/,
+        detail: "lists the filesystem root",
+    },
+];
+/** Tools whose path/pattern arguments can aim at a credential file or a system directory. */
+const PATH_ARG_TOOLS = new Set([
+    "read_file",
+    "read_document",
+    "read_notebook",
+    "edit_file",
+    "write_file",
+    "grep",
+    "glob",
+    "list_dir",
+]);
+/**
+ * Classify one tool call into recon signals — at most one signal per kind,
+ * so a single busy command can't trip the wire on repetition alone; it
+ * takes either one heavy call (a credential probe plus a dump) or a genuine
+ * sequence across calls.
+ */
+export function classifyReconCall(toolName, args) {
+    const byKind = new Map();
+    const add = (s) => {
+        if (!byKind.has(s.kind))
+            byKind.set(s.kind, s);
+    };
+    if (toolName === "shell") {
+        const command = String(args.command ?? "");
+        if (command) {
+            const sensitive = commandTouchesSensitivePath(command);
+            if (sensitive)
+                add(signal("credential-probe", `command references "${sensitive}"`));
+            for (const { re, detail } of ENV_DUMP_PATTERNS) {
+                if (re.test(command)) {
+                    add(signal("env-dump", detail));
+                    break;
+                }
+            }
+            for (const { re, detail } of ENUMERATION_PATTERNS) {
+                if (re.test(command)) {
+                    add(signal("enumeration", detail));
+                    break;
+                }
+            }
+            for (const { re, detail } of SYSTEM_PROBE_PATTERNS) {
+                if (re.test(command)) {
+                    add(signal("system-probe", detail));
+                    break;
+                }
+            }
+        }
+    }
+    else if (PATH_ARG_TOOLS.has(toolName)) {
+        for (const key of ["path", "pattern"]) {
+            const value = args[key];
+            if (typeof value !== "string" || !value)
+                continue;
+            if (isSensitivePath(value)) {
+                add(signal("credential-probe", `${toolName} targets "${value}"`));
+            }
+            if ((toolName === "list_dir" || toolName === "glob") &&
+                /^(~|\$HOME|\/|\/etc|\/home)([\\/]|$)/.test(value)) {
+                add(signal("enumeration", `${toolName} targets "${value}"`));
+            }
+        }
+    }
+    return [...byKind.values()];
+}
+/**
+ * The rolling score and the latch. One instance per agent session (the
+ * tool executor owns it). Blocked calls are recorded too — the executor
+ * records before it blocks — so continued probing keeps the score pinned
+ * above the threshold instead of decaying while the caller retries.
+ */
+export class ReconTripwire {
+    window = [];
+    latchedKinds = null;
+    get tripped() {
+        return this.latchedKinds !== null;
+    }
+    /** The signal kinds that contributed to the trip, for the block message. */
+    get tripKinds() {
+        return this.latchedKinds ?? [];
+    }
+    windowScore() {
+        return this.window.reduce((acc, w) => acc + w.score, 0);
+    }
+    /**
+     * Record one call's signals. Returns whether this call must be blocked:
+     * the call that pushes the score to the threshold, and — once latched —
+     * every later call that carries any recon signal. Signal-free calls are
+     * never blocked, tripped or not.
+     */
+    record(signals) {
+        const score = signals.reduce((acc, s) => acc + s.weight, 0);
+        this.window.push({ score, kinds: signals.map((s) => s.kind) });
+        if (this.window.length > RECON_WINDOW_CALLS)
+            this.window.shift();
+        const total = this.windowScore();
+        if (this.latchedKinds) {
+            return { blocked: signals.length > 0, score: total };
+        }
+        if (total >= RECON_TRIP_THRESHOLD) {
+            this.latchedKinds = [...new Set(this.window.flatMap((w) => w.kinds))];
+            return { blocked: signals.length > 0, score: total };
+        }
+        return { blocked: false, score: total };
+    }
+}

package/dist/tools/common.js

@@ -45,7 +45,7 @@ const SENSITIVE_PATH_PATTERNS = [
     /\.p12$/i,
     /\.pfx$/i,
 ];
-function isSensitivePath(relPath) {
+export function isSensitivePath(relPath) {
     return SENSITIVE_PATH_PATTERNS.some((re) => re.test(relPath));
 }
 /** Splits a shell command into path-like tokens, stripping quotes/metacharacters. */

package/dist/tools/document.js

@@ -6,6 +6,7 @@ import { readDocx, writeDocx } from "./document/docx.js";
 import { readXlsx, writeXlsx, editXlsx } from "./document/xlsx.js";
 import { readPptx, writePptx } from "./document/pptx.js";
 import { readPdf, writePdf, editPdf } from "./document/pdf.js";
+import { formatSecretWarning, scanForSecrets } from "./secretScan.js";
 const READABLE_EXTENSIONS = [".docx", ".xlsx", ".pptx", ".pdf"];
 /**
  * Bound the raw file read before it's dispatched to any format-specific
@@ -142,6 +143,14 @@ export const writeDocumentTool = {
         const abs = resolveSafe(ctx.workspace, relPath);
         const ext = path.extname(abs).toLowerCase();
         const content = extractContent(args);
+        // Same write-time secret guard as write_file: the blocks/sheets/slides
+        // payload is model-authored text, and a generated .docx/.xlsx is still
+        // a file a real key shouldn't be baked into. The payload is structured,
+        // so scan its JSON form — every user-visible string is in there.
+        const secrets = scanForSecrets(JSON.stringify(content));
+        if (secrets.length > 0) {
+            throw new Error(formatSecretWarning(secrets, relPath));
+        }
         let buf;
         switch (ext) {
             case ".docx":
@@ -232,6 +241,16 @@ export const editSpreadsheetTool = {
         const edits = (args.edits ?? []);
         if (edits.length === 0)
             throw new Error("edit_spreadsheet: `edits` must be non-empty");
+        // Write-time secret guard, same as write_file: a string cell value is
+        // model-authored content being persisted into the workbook.
+        for (const edit of edits) {
+            if (typeof edit.value !== "string")
+                continue;
+            const secrets = scanForSecrets(edit.value);
+            if (secrets.length > 0) {
+                throw new Error(formatSecretWarning(secrets, relPath));
+            }
+        }
         const buf = await fs.readFile(abs);
         const { buf: out, applied } = await editXlsx(buf, edits);
         ctx.undo?.snapshot(abs, relPath);

package/dist/tools/notebook.js

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import { writeFileAtomic } from "../atomicWrite.js";
 import { resolveSafe, truncateResult } from "./common.js";
+import { formatSecretWarning, scanForSecrets } from "./secretScan.js";
 /** nbformat stores text as either a single string or an array of lines. */
 function joinSource(source) {
     if (Array.isArray(source))
@@ -170,6 +171,15 @@ export const editNotebookTool = {
         }
         const nb = await loadNotebook(abs);
         const cells = nb.cells;
+        // Same write-time secret guard as write_file/edit_file: cell source is
+        // model-authored content persisted to disk, and a notebook is an
+        // ordinary file a key can hide in just as easily as a .ts file.
+        if (op !== "delete" && args.source !== undefined) {
+            const secrets = scanForSecrets(String(args.source));
+            if (secrets.length > 0) {
+                throw new Error(formatSecretWarning(secrets, relPath));
+            }
+        }
         switch (op) {
             case "replace": {
                 if (index >= cells.length) {

package/dist/tools/secretScan.js

@@ -148,3 +148,31 @@ export function formatSecretWarning(matches, path) {
         `match common key formats or lower its entropy — for example, using an obvious placeholder ` +
         `like "sk-ant-EXAMPLE...".`);
 }
+/**
+ * Shell commands are the one write path the file tools can't see: a command
+ * like `echo '<key>' > notes.txt` or a heredoc puts a literal secret on disk
+ * without going through write_file/edit_file. The command string itself is
+ * the only place to catch that — but a secret merely *appearing* in a
+ * command (a curl Authorization header, say) doesn't put it in a file, so
+ * this only fires when the command also has a file-writing construct: an
+ * output redirect to a real target (not `>&` fd duplication or a `>=`
+ * comparison), `tee`, or `dd of=`. Heredocs are covered through the
+ * redirect they almost always pair with (`cat > f <<EOF`); a heredoc fed
+ * to an interpreter that then writes the secret itself is out of reach for
+ * a string scan and remains a known gap, like novel key formats.
+ */
+const SHELL_WRITE_RE = />{1,2}\s*(?![&=>])|\btee\b|\bdd\b[^|;&]*\bof=/;
+export function scanCommandForSecretWrite(command) {
+    if (!SHELL_WRITE_RE.test(command))
+        return [];
+    return scanForSecrets(command);
+}
+export function formatShellSecretWarning(matches) {
+    const lines = matches.map((m) => `  - ${m.kind}: ${m.snippet}`);
+    return (`Blocked shell command: it writes to a file and contains what looks like real secret(s):\n` +
+        lines.join("\n") +
+        `\n\nEmbedding a literal secret in a shell command writes it to disk and shell history. ` +
+        `Reference the value from the environment instead (e.g. $API_KEY), or if this is ` +
+        `genuinely not a secret (e.g. a test fixture), rewrite it so it doesn't match common ` +
+        `key formats — for example, using an obvious placeholder like "sk-ant-EXAMPLE...".`);
+}

package/dist/tools/shell.js

@@ -4,7 +4,7 @@ import { gitDiffStat } from "../git/git.js";
 import { backgroundManager } from "../shell/background.js";
 import { buildSandboxedCommand, networkBlockedHint, requiresSandbox, sandboxUnavailableReason, shouldSandbox, } from "../shell/sandbox.js";
 import { commandTouchesSensitivePath, truncateTail } from "./common.js";
-import { redactSecrets } from "./secretScan.js";
+import { redactSecrets, scanCommandForSecretWrite, formatShellSecretWarning, } from "./secretScan.js";
 const DEFAULT_TIMEOUT_S = 120;
 const MAX_TIMEOUT_S = 600;
 /** git subcommands that rewrite the working tree, index, or history. */
@@ -63,6 +63,14 @@ export const shellTool = {
         if (sensitivePath) {
             throw new Error(`Command references "${sensitivePath}", which looks like a secret file, and is blocked from tool access`);
         }
+        // A command can also *create* the secret leak: a literal key in the
+        // command string plus a redirect/tee/dd target writes it to a file
+        // without going through the scanned file tools. Block that here, for
+        // background commands too — this check sits above the background branch.
+        const secretWrite = scanCommandForSecretWrite(command);
+        if (secretWrite.length > 0) {
+            throw new Error(formatShellSecretWarning(secretWrite));
+        }
         if (args.background) {
             const { id } = backgroundManager.start(command, ctx.workspace, ctx.sandboxMode);
             // Echoing the command back can leak a credential embedded in it (e.g. a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.61-beta",
+  "version": "0.8.63-beta",
   "description": "Kritya — Superintelligence at your command line",
   "type": "module",
   "publishConfig": {