prae-cli 0.3.0 → 0.5.0

package/lib/receipt-check-Dql0uqxw.js

@@ -0,0 +1,39 @@
+import { c as verifyReceipt, i as fingerprint } from "./src-CXU0_W1P.js";
+
+//#region src/receipt-check.ts
+/** Shape we require before we will call it a receipt at all. */
+function looksLikeReceipt(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const r = value;
+	return typeof r.signature === "string" && typeof r.publicKey === "string" && typeof r.entry === "object" && r.entry !== null;
+}
+function checkReceipt(parsed) {
+	if (!looksLikeReceipt(parsed)) return {
+		ok: false,
+		lines: ["✗ not a receipt: expected `entry`, `signature` and `publicKey` fields"]
+	};
+	const result = verifyReceipt(parsed);
+	if (!result.ok) return {
+		ok: false,
+		lines: [`✗ receipt does NOT verify: ${result.reason}`]
+	};
+	const { verdict, tool, rule, subject } = parsed.entry;
+	return {
+		ok: true,
+		lines: [
+			"✓ receipt verifies — authentic and unaltered",
+			`  ${[
+				verdict,
+				tool,
+				rule === void 0 ? void 0 : `· ${rule}`,
+				subject === void 0 ? void 0 : `· ${subject}`
+			].filter((part) => part !== void 0).join(" ")}`,
+			`  sealed by key  ${fingerprint(parsed.publicKey)}`,
+			"  Compare that fingerprint to the one you pinned out of band.",
+			"  It matches → this is a decision that key’s holder sealed, unchanged."
+		]
+	};
+}
+
+//#endregion
+export { checkReceipt };

package/lib/secret-catcher.prae.json

@@ -0,0 +1,49 @@
+{
+  "prae": "0.1",
+  "pack": "secret-catcher",
+  "version": "1.0.0",
+  "rules": [
+    {
+      "id": "SEC-001",
+      "title": "Reads carrying credentials are refused",
+      "when": {
+        "capability": "fs:read",
+        "path": {
+          "outside": [
+            "./**/test/**",
+            "./**/tests/**",
+            "./**/fixtures/**",
+            "./**/*.example",
+            "./**/*.sample"
+          ]
+        },
+        "secrets": { "minConfidence": 0.8 }
+      },
+      "effect": {
+        "kind": "deny",
+        "because": "the requested file contains a protected credential; the contents were not returned"
+      }
+    },
+    {
+      "id": "SEC-002",
+      "title": "Private keys are refused everywhere",
+      "when": {
+        "capability": "fs:read",
+        "secrets": { "types": ["private-key"] }
+      },
+      "effect": {
+        "kind": "deny",
+        "because": "the requested file contains a private key; the contents were not returned"
+      }
+    },
+    {
+      "id": "SEC-003",
+      "title": "Anything credential-shaped is at least recorded",
+      "when": { "capability": "fs:read", "secrets": { "minConfidence": 0.5 } },
+      "effect": {
+        "kind": "warn",
+        "because": "a possible credential was noticed in this file; where no stronger rule fired, the read proceeded and this row is the record"
+      }
+    }
+  ]
+}

package/lib/src-Br1tGPtS.js

@@ -0,0 +1,182 @@
+//#region ../inspect/src/index.ts
+/**
+* The built-in detectors.
+*
+* Anchored provider formats first — those prefixes exist precisely so that
+* scanners can find them, and they carry the confidence to prove it. The
+* loose assignment patterns at the bottom earn their keep only with an
+* entropy check, because `password = "password"` is not a leak, it is a test.
+*/
+const DETECTORS = [
+	{
+		rule: "private-key",
+		type: "private-key",
+		pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g,
+		confidence: .99
+	},
+	{
+		rule: "aws-access-key-id",
+		type: "cloud-credential",
+		pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g,
+		confidence: .9
+	},
+	{
+		rule: "github-token",
+		type: "token",
+		pattern: /\b(?:gh[poasur]_[A-Za-z0-9]{36,251}|github_pat_[A-Za-z0-9_]{22,255})\b/g,
+		confidence: .95
+	},
+	{
+		rule: "gitlab-token",
+		type: "token",
+		pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g,
+		confidence: .95
+	},
+	{
+		rule: "slack-token",
+		type: "token",
+		pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
+		confidence: .9
+	},
+	{
+		rule: "stripe-live-key",
+		type: "api-key",
+		pattern: /\b[sr]k_live_[A-Za-z0-9]{16,}\b/g,
+		confidence: .95
+	},
+	{
+		rule: "google-api-key",
+		type: "api-key",
+		pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+		confidence: .9
+	},
+	{
+		rule: "anthropic-key",
+		type: "api-key",
+		pattern: /\bsk-ant-[A-Za-z0-9-]{32,}\b/g,
+		confidence: .95
+	},
+	{
+		rule: "openai-key",
+		type: "api-key",
+		pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}\b/g,
+		confidence: .8
+	},
+	{
+		rule: "npm-token",
+		type: "token",
+		pattern: /\bnpm_[A-Za-z0-9]{36}\b/g,
+		confidence: .95
+	},
+	{
+		rule: "credential-in-url",
+		type: "credential-in-url",
+		pattern: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?|ftp):\/\/[^:\s/@'"]+:[^@\s/'"]+@/g,
+		confidence: .85
+	},
+	{
+		rule: "jwt",
+		type: "token",
+		pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}\b/g,
+		confidence: .6
+	},
+	{
+		rule: "password-assignment",
+		type: "password",
+		pattern: /\b(?:password|passwd|pwd)\b\s*[:=]\s*['"]([^'"\s]{6,})['"]/gi,
+		confidence: .5,
+		minEntropy: 3
+	},
+	{
+		rule: "secret-assignment",
+		type: "generic-secret",
+		pattern: /\b(?:secret|token|api[_-]?key|auth[_-]?token|access[_-]?key)\b\w*\s*[:=]\s*['"]([A-Za-z0-9/+_=-]{20,})['"]/gi,
+		confidence: .6,
+		minEntropy: 3.5
+	}
+];
+/**
+* Markers of a value that exists to be seen.
+*
+* A finding whose match carries one of these is dropped, not down-scored:
+* `AKIAIOSFODNN7EXAMPLE` is in more documentation than any real key is in
+* code, and a gate that denies the README teaches operators to turn it off.
+* The AWS docs key is listed literally because it does not say "example"
+* anywhere a case-insensitive substring would find. Real secrets do not
+* contain these words; a placeholder that does is doing its job.
+*/
+const PLACEHOLDER = /example|changeme|change-me|placeholder|your[_-]|xxxx|dummy|sample|redacted|<[a-z_-]+>|AKIAIOSFODNN7/i;
+/** Shannon entropy in bits per character. */
+function entropy(text) {
+	if (text.length === 0) return 0;
+	const counts = /* @__PURE__ */ new Map();
+	for (const ch of text) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+	let sum = 0;
+	for (const n of counts.values()) {
+		const p = n / text.length;
+		sum -= p * Math.log2(p);
+	}
+	return sum;
+}
+/**
+* Content larger than this is not scanned — the caller is told, not silently
+* covered. Regex over an unbounded file in the hot path of every read is how
+* a gate becomes an outage; 2 MiB covers any file a secret plausibly lives in.
+*/
+const MAX_SCAN_BYTES = 2 * 1024 * 1024;
+/** NUL in the first 8 KiB: binary, not text. Scanned as nothing. */
+function looksBinary(content) {
+	return content.slice(0, 8192).includes("\0");
+}
+/**
+* Scan text for secrets. Findings in document order, deduplicated by span —
+* when two rules claim the same region, the higher confidence keeps it.
+*/
+function scan(content, options = {}) {
+	if (looksBinary(content)) return [];
+	const detectors = options.detectors ?? DETECTORS;
+	const floor = options.minConfidence ?? 0;
+	const starts = [0];
+	for (let i = 0; i < content.length; i++) if (content[i] === "\n") starts.push(i + 1);
+	const position = (offset) => {
+		let low = 0;
+		let high = starts.length - 1;
+		while (low < high) {
+			const mid = low + high + 1 >> 1;
+			if (starts[mid] <= offset) low = mid;
+			else high = mid - 1;
+		}
+		return {
+			line: low + 1,
+			column: offset - starts[low] + 1
+		};
+	};
+	const bySpan = /* @__PURE__ */ new Map();
+	for (const detector of detectors) {
+		const pattern = new RegExp(detector.pattern.source, detector.pattern.flags);
+		for (const match of content.matchAll(pattern)) {
+			const text = match[0];
+			if (PLACEHOLDER.test(text)) continue;
+			if (detector.minEntropy !== void 0) {
+				if (entropy(match[1] ?? text) < detector.minEntropy) continue;
+			}
+			if (detector.confidence < floor) continue;
+			const key = `${match.index}:${text.length}`;
+			const standing = bySpan.get(key);
+			if (standing !== void 0 && standing.confidence >= detector.confidence) continue;
+			const { line, column } = position(match.index);
+			bySpan.set(key, {
+				rule: detector.rule,
+				type: detector.type,
+				line,
+				column,
+				length: text.length,
+				confidence: detector.confidence
+			});
+		}
+	}
+	return [...bySpan.values()].sort((a, b) => a.line - b.line || a.column - b.column);
+}
+
+//#endregion
+export { scan as a, looksBinary as i, MAX_SCAN_BYTES as n, entropy as r, DETECTORS as t };

package/lib/{src-DGWTvmRZ.js → src-CXU0_W1P.js}

@@ -76,6 +76,23 @@ function makeReceipt(entry, privateKeyPem, publicKeyPem) {
 		publicKey: publicKeyPem
 	};
 }
+/** Verify a receipt from nothing but the receipt. */
+function verifyReceipt(receipt) {
+	if (receipt.receipt !== "prae/1") return {
+		ok: false,
+		reason: `unknown receipt format ${String(receipt.receipt)}`
+	};
+	const { seq, prev, hash, sig,...record } = receipt.entry;
+	if (hashEntry(record, seq, prev) !== hash) return {
+		ok: false,
+		reason: "entry contents do not match their seal; the row was altered"
+	};
+	if (!verifySignature(receipt.entry, receipt.signature, receipt.publicKey)) return {
+		ok: false,
+		reason: "signature does not verify; not sealed by this key"
+	};
+	return { ok: true };
+}
 /**
 * A short identifier for a public key, for pinning by eye.
 *
@@ -222,4 +239,4 @@ var Ledger = class Ledger {
 };
 
 //#endregion
-export { generateKeypair as a, verifySignature as c, chain as d, hashEntry as f, fingerprint as i, GENESIS as l, readEntries as n, makeReceipt as o, seal as p, verifyEntries as r, signEntry as s, Ledger as t, canonical as u };
+export { generateKeypair as a, verifyReceipt as c, canonical as d, chain as f, fingerprint as i, verifySignature as l, seal as m, readEntries as n, makeReceipt as o, hashEntry as p, verifyEntries as r, signEntry as s, Ledger as t, GENESIS as u };

package/lib/src-Kubj3MTX.js

@@ -0,0 +1,3 @@
+import { a as generateKeypair, c as verifyReceipt, d as canonical, f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, o as makeReceipt, p as hashEntry, r as verifyEntries, s as signEntry, t as Ledger, u as GENESIS } from "./src-CXU0_W1P.js";
+
+export { GENESIS, Ledger, canonical, chain, fingerprint, generateKeypair, hashEntry, makeReceipt, readEntries, seal, signEntry, verifyEntries, verifyReceipt, verifySignature };

package/lib/src-Vnr0fcpK.js

@@ -0,0 +1,3 @@
+import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-Br1tGPtS.js";
+
+export { DETECTORS, MAX_SCAN_BYTES, entropy, looksBinary, scan };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
@@ -31,6 +31,7 @@
     "node": ">=20"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "capmark": "^0.3.1",
     "dsh-overlay-check": "^0.4.0"
   },
@@ -41,6 +42,7 @@
     "vitest": "^3.2.4",
     "@prae/controls": "0.1.0",
     "@prae/extract": "0.1.0",
+    "@prae/inspect": "0.1.0",
     "@prae/instructions": "0.1.0",
     "@prae/kernel": "0.1.0",
     "@prae/ledger": "0.1.0",

package/lib/src-Cinsv7Wq.js

@@ -1,3 +0,0 @@
-import { a as generateKeypair, c as verifySignature, d as chain, f as hashEntry, i as fingerprint, l as GENESIS, n as readEntries, o as makeReceipt, p as seal, r as verifyEntries, s as signEntry, t as Ledger, u as canonical } from "./src-DGWTvmRZ.js";
-
-export { GENESIS, Ledger, canonical, chain, fingerprint, generateKeypair, hashEntry, makeReceipt, readEntries, seal, signEntry, verifyEntries, verifySignature };