pi-warden 1.6.0 → 1.7.0

package/CHANGELOG.md

@@ -6,6 +6,12 @@ How to keep this current: add the entry in the same pull request as the change,
 
 ## Unreleased
 
+## 1.7.0
+
+### Added
+
+- `security.shareLinkParams` names the query parameters whose value is a share link rather than a credential, so a link the user reuses (a RED post's `xsec_token`) stays openable in the tool result instead of coming back as a dead `[redacted]` URL. Empty by default, user config only, and matched as a whole parameter name, with its case. A credential by construction is still masked inside a listed parameter, and a value that also appears outside the URL is masked everywhere. ([Configuration](docs/configuration.md#user-config))
+
 ## 1.6.0
 
 ### Added

package/dist/config.d.ts

@@ -202,6 +202,8 @@ export interface SecurityConfig {
     threshold: number;
     /** Replace high-confidence credential values in tool results with `[redacted]` before the model sees them. */
     maskOutput: boolean;
+    /** Query parameters whose value is a share link rather than a credential. Empty by default; user config only. */
+    shareLinkParams: string[];
 }
 export interface RulesConfig {
     /** Judge each write and edit against the project's Markdown rules on its own Jev request; steer, never hold. */

package/dist/config.js

@@ -70,7 +70,7 @@ export function defaultConfig() {
         done: { enabled: true, claimsDone: 0.7, nudge: true, uiProof: true, uiFiles: [...DEFAULT_UI_FILES], visualTools: defaultVisualTools() },
         cause: { enabled: true, claimsCause: 0.7, nudge: true, windowDays: 7 },
         slop: { enabled: true, threshold: 0.7, prose: { enabled: true, audience: "technical", threshold: 0.7, trend: 2, minChars: 200 } },
-        security: { enabled: true, threshold: 0.7, maskOutput: true },
+        security: { enabled: true, threshold: 0.7, maskOutput: true, shareLinkParams: [] },
         rules: { enabled: true, threshold: 0.7, softThreshold: 0, files: [], fallback: true, maxChars: 8000, exclude: [], skip: [], sensitivePaths: {} },
         // 0.3 is the measured cut: 69% of the rules named apply, and 68 of the 73 requests that touch a rule's area get one.
         rulesAtTurnStart: { enabled: true, threshold: 0.3 },
@@ -580,6 +580,8 @@ function applyGuards(base, raw, timeoutMs, source, warnings) {
             threshold: source === "project" ? projectProbability("security.threshold", raw.security.threshold, base.security.threshold, warnings) : probability(raw.security.threshold, base.security.threshold),
             // Only the user file can turn masking off: a repository must not unmask credentials in its own agent's output.
             maskOutput: source === "user" ? boolean(raw.security.maskOutput, base.security.maskOutput) : base.security.maskOutput,
+            // A listed parameter excuses a share-link token, so it is user config only for the same reason as `maskOutput`.
+            shareLinkParams: source === "user" ? globList(raw.security.shareLinkParams, base.security.shareLinkParams) : base.security.shareLinkParams,
         } : base.security,
         context: isObject(raw.context) ? {
             enabled: boolean(raw.context.enabled, base.context.enabled),

package/dist/extension.js

@@ -2394,7 +2394,7 @@ export default function wardenExtension(host) {
         // and sends nothing, so it runs with the security guard off; only the user's `security.maskOutput` stops it.
         const rawTexts = event.content.filter(part => part.type === "text").map(part => part.text ?? "");
         const maskOutput = config.security.maskOutput;
-        const masking = maskOutput ? rawTexts.map(maskSecrets) : [];
+        const masking = maskOutput ? rawTexts.map((blockText) => maskSecrets(blockText, config.security.shareLinkParams)) : [];
         const maskedCount = masking.reduce((sum, block) => sum + block.masked, 0);
         let maskIndex = 0;
         const maskedContent = maskedCount ? event.content.map(part => part.type === "text" ? { ...part, text: masking[maskIndex++].text } : part) : event.content;

package/dist/output.js

@@ -114,7 +114,7 @@ export function buildOutputRequest(tool, text, task, security, compress, context
 }
 export async function evaluateOutput(tool, text, task, options, compressionLearner) {
     const secrets = options.security.enabled ? findSecrets(text) : [];
-    const { real, synthetic } = partitionSecrets(secrets, text);
+    const { real, synthetic } = partitionSecrets(secrets, text, options.security.shareLinkParams);
     const verdict = { secret: real.length > 0, suspicious: false, retention: "all" };
     if (real.length) {
         verdict.secretId = secretFingerprint(real);

package/dist/redact.d.ts

@@ -16,9 +16,11 @@ export declare function looksLikeSecretValue(value: string): boolean;
 export declare function syntheticish(value: string): boolean;
 /**
  * Split credentials into the ones worth announcing and the stand-ins that are only traced. With `text`, a value found
- * only in the query signature of a signed URL is a stand-in too.
+ * only in the query signature of a signed URL is a stand-in too, as is a value found only in a share-link parameter
+ * named by `shareLinkParams`. A credential by construction stays real even inside a listed parameter, so a real key
+ * that a tool result puts in a listed parameter is still masked.
  */
-export declare function partitionSecrets(secrets: readonly string[], text?: string): {
+export declare function partitionSecrets(secrets: readonly string[], text?: string, shareLinkParams?: readonly string[]): {
     real: string[];
     synthetic: string[];
 };
@@ -29,7 +31,7 @@ export declare function findSecrets(text: string): string[];
  * assignments, `Authorization` and `Bearer` values, and URL passwords. Stand-ins (`syntheticish`, signed URL
  * signatures) stay readable. Masking the whole detected set means a value is never announced without being masked.
  */
-export declare function maskSecrets(text: string): {
+export declare function maskSecrets(text: string, shareLinkParams?: readonly string[]): {
     text: string;
     masked: number;
 };

package/dist/redact.js

@@ -181,11 +181,40 @@ function signedUrlSpans(text) {
     }
     return spans;
 }
+/** A literal for a `RegExp`, for the parameter names that come from the user's config. */
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 /**
- * True when every occurrence of `value` in `text` sits inside the query signature of a signed URL. Such a URL expires
- * within minutes and grants one object; issue-tracker and storage API responses are full of them.
+ * Start and end offsets of the value of every listed share-link parameter in an `https://` URL in `text`. A share link
+ * carries a token that is what makes the link openable at all, and the same link is reused rather than expiring, so
+ * its token is a stand-in like a signed URL's signature: `security.shareLinkParams` names the parameters to read.
  */
-function signedUrlOnly(value, spans, text) {
+function shareLinkSpans(text, shareLinkParams) {
+    const names = [...new Set(shareLinkParams.map((name) => name.trim()).filter(Boolean))];
+    if (!names.length)
+        return [];
+    // The value stops at a backslash because a JSON body writes `&` as `\u0026`, and the name is matched with its case.
+    const pattern = new RegExp(`[?&](?:${names.map(escapeRegExp).join("|")})=([^&#\\\\]*)`, "g");
+    const spans = [];
+    for (const url of text.matchAll(HTTPS_URL)) {
+        for (const param of url[0].matchAll(pattern)) {
+            const end = url.index + param.index + param[0].length;
+            spans.push([end - param[1].length, end]);
+        }
+    }
+    return spans;
+}
+/** True when the value is a credential by construction, so a listed share-link parameter must not excuse it. */
+function isTokenShape(value) {
+    return TOKEN_SHAPES.some((shape) => new RegExp(shape.source).test(value));
+}
+/**
+ * True when every occurrence of `value` in `text` sits inside one of `spans`. A signed URL expires within minutes and
+ * grants one object; issue-tracker and storage API responses are full of them. A listed share-link token is excused
+ * on the same terms: a value that also appears outside the URL is a credential wherever it is, and is masked there.
+ */
+function onlyInsideSpans(value, spans, text) {
     if (!spans.length)
         return false;
     let found = false;
@@ -198,14 +227,20 @@ function signedUrlOnly(value, spans, text) {
 }
 /**
  * Split credentials into the ones worth announcing and the stand-ins that are only traced. With `text`, a value found
- * only in the query signature of a signed URL is a stand-in too.
+ * only in the query signature of a signed URL is a stand-in too, as is a value found only in a share-link parameter
+ * named by `shareLinkParams`. A credential by construction stays real even inside a listed parameter, so a real key
+ * that a tool result puts in a listed parameter is still masked.
  */
-export function partitionSecrets(secrets, text) {
+export function partitionSecrets(secrets, text, shareLinkParams = []) {
     const real = [];
     const synthetic = [];
-    const spans = text === undefined ? [] : signedUrlSpans(text);
-    for (const value of secrets)
-        (syntheticish(value) || signedUrlOnly(value, spans, text ?? "") ? synthetic : real).push(value);
+    const signed = text === undefined ? [] : signedUrlSpans(text);
+    const shared = text === undefined ? [] : shareLinkSpans(text, shareLinkParams);
+    for (const value of secrets) {
+        // The span test first, so the default (no listed parameter) costs nothing.
+        const standIn = syntheticish(value) || onlyInsideSpans(value, signed, text ?? "") || (onlyInsideSpans(value, shared, text ?? "") && !isTokenShape(value));
+        (standIn ? synthetic : real).push(value);
+    }
     return { real, synthetic };
 }
 /** The credential-shaped values in `text`, deduplicated. Empty when the text only talks about credentials. */
@@ -225,8 +260,8 @@ export function findSecrets(text) {
  * assignments, `Authorization` and `Bearer` values, and URL passwords. Stand-ins (`syntheticish`, signed URL
  * signatures) stay readable. Masking the whole detected set means a value is never announced without being masked.
  */
-export function maskSecrets(text) {
-    const { real } = partitionSecrets(findSecrets(text), text);
+export function maskSecrets(text, shareLinkParams = []) {
+    const { real } = partitionSecrets(findSecrets(text), text, shareLinkParams);
     let out = text;
     let masked = 0;
     // Longest first, so a value that contains another is replaced whole.

package/dist/shape.js

@@ -44,7 +44,7 @@ export function completeConfig(loaded) {
         done: section("done", { ...off, claimsDone: 1, nudge: false, uiProof: false, uiFiles: [], visualTools: { commands: [], commandWords: [], tools: [], images: [] } }),
         cause: section("cause", { ...off, claimsCause: 1, nudge: false, windowDays: 7 }),
         slop: section("slop", { ...off, threshold: 1, prose: proseOff() }),
-        security: section("security", { ...off, threshold: 1, maskOutput: false }),
+        security: section("security", { ...off, threshold: 1, maskOutput: false, shareLinkParams: [] }),
         rules: section("rules", { ...off, threshold: 1, softThreshold: 0, files: [], fallback: false, maxChars: 500, exclude: [], skip: [], sensitivePaths: {} }),
         // A missing section turns the turn-start reminder off: it is new, so nothing it says was expected.
         rulesAtTurnStart: section("rulesAtTurnStart", { ...off, threshold: 1 }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-warden",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Makes the Pi agent follow your project's rules. Jev judges every write against your pi-warden.md and quotes the broken rule back to the agent, names slop, breaks stuck loops, calls out unverified done claims, compresses large tool output, and holds the rare destructive command. Built on pi-typesafe.",
   "type": "module",
   "license": "MIT",