pushary 1.8.0

package/data/cursor-plugin/scripts/pushary-gate.test.mjs

@@ -0,0 +1,137 @@
+// What is left to test in the gate itself.
+//
+// This file used to cover the vendored policy engine: pattern matching, argument
+// rules, the destructive ceiling and repo scoping. None of that lives here any
+// more. The gate asks POST /api/agent/gate, which runs the same `resolveGate` as
+// every other client, and those behaviours are tested once against the engine in
+// packages/contracts/src/gate.test.ts rather than once per copy.
+//
+// What remains is the one thing a server cannot answer: which repository this
+// checkout is in. Deriving it means walking parent directories for a `.git` and
+// reading its config, so the gate still does it and sends the result.
+//
+// Run: node --test scripts/pushary-gate.test.mjs
+
+import assert from 'node:assert/strict'
+import { describe, it } from 'node:test'
+import { describeRequest, normalizeRepoRemote, redactSecrets } from './pushary-gate.mjs'
+
+describe('repo identity', () => {
+  it('collapses the forms of one remote', () => {
+    for (const r of ['https://github.com/acme/api.git', 'git@github.com:acme/api.git', 'ssh://git@github.com:22/acme/api.git']) {
+      assert.equal(normalizeRepoRemote(r), 'github.com/acme/api', r)
+    }
+  })
+
+  it('never lets a credential survive', () => {
+    const key = normalizeRepoRemote('https://user:ghp_SECRET@github.com/acme/api.git')
+    assert.equal(key, 'github.com/acme/api')
+    assert.ok(!key.includes('ghp_') && !key.includes('@'))
+  })
+
+  it('returns undefined without a stable identity', () => {
+    for (const r of ['', '../rel', 'file:///Users/dev/repo']) assert.equal(normalizeRepoRemote(r), undefined, r)
+  })
+})
+
+// The gate answers two Cursor events now, and they arrive on the same stdin with
+// different fields. What each one turns into is the only thing standing between
+// an MCP call and being gated as if it were a shell command.
+describe('what the gate was asked about', () => {
+  it('names an MCP call the way every other agent names one', () => {
+    const request = describeRequest({
+      hook_event_name: 'beforeMCPExecution',
+      tool_name: 'create_issue',
+      mcp_server_name: 'github',
+      tool_input: '{"title":"x"}',
+    })
+
+    // `mcp__<server>__<tool>` is what `validateToolPattern` accepts and what
+    // Claude Code sends, so one policy rule covers the tool on both agents. A
+    // Cursor-only spelling would silently miss every rule a user already wrote.
+    assert.equal(request.toolName, 'mcp__github__create_issue')
+    assert.deepEqual(request.toolInputs, [{ tool: 'mcp__github__create_issue', params: '{"title":"x"}' }])
+    assert.match(request.display, /create_issue/)
+  })
+
+  it('still reads a shell command, including from a payload with no event name', () => {
+    const named = describeRequest({ hook_event_name: 'beforeShellExecution', command: '  rm -rf /tmp/x  ' })
+    assert.equal(named.toolName, 'Bash')
+    assert.equal(named.toolTarget, 'rm -rf')
+
+    // An older Cursor that omits `hook_event_name` must keep working exactly as
+    // it did when shell was the only registered event.
+    assert.equal(describeRequest({ command: 'git push' }).toolName, 'Bash')
+  })
+
+  /**
+   * `beforeMCPExecution` is registered with NO matcher, so every MCP call in the
+   * editor reaches this gate, ours included. Gating our own tools deadlocks: the
+   * approval for `ask_user` cannot reach the phone until the `ask_user` call it
+   * is gating goes through. With `failClosed: true` on that entry it is worse
+   * than a hang, because a timeout turns into a denial of the user's own
+   * question.
+   *
+   * The Claude hook carries this guard three times over and calls it a
+   * precaution, because its matcher does not route these there. Here it is the
+   * only thing standing between the two.
+   */
+  it('never gates Pushary\'s own MCP tools', () => {
+    for (const tool of ['ask_user', 'wait_for_answer', 'send_notification', 'propose_scope']) {
+      assert.equal(
+        describeRequest({
+          hook_event_name: 'beforeMCPExecution',
+          tool_name: tool,
+          mcp_server_name: 'pushary',
+          tool_input: '{}',
+        }),
+        null,
+        `mcp__pushary__${tool} must reach Cursor's own prompt, not ours`,
+      )
+    }
+
+    // A neighbour whose name merely starts the same way is still gated. The
+    // guard is on the `mcp__pushary__` prefix, not on "contains pushary".
+    assert.equal(
+      describeRequest({
+        hook_event_name: 'beforeMCPExecution',
+        tool_name: 'run',
+        mcp_server_name: 'pushary-clone',
+        tool_input: '{}',
+      }).toolName,
+      'mcp__pushary-clone__run',
+    )
+  })
+
+  it('declines an event it does not gate rather than calling it Bash', () => {
+    // beforeReadFile is registered by nobody here on purpose: its response
+    // schema has no `ask`, so the no-opinion path this gate takes on every error
+    // has nothing to return. If one ever arrives, it must not be mistaken for a
+    // shell command carrying no command.
+    assert.equal(describeRequest({ hook_event_name: 'beforeReadFile', file_path: '/etc/passwd' }), null)
+    assert.equal(describeRequest({ hook_event_name: 'beforeMCPExecution' }), null)
+    assert.equal(describeRequest({}), null)
+  })
+})
+
+describe('approval text redaction', () => {
+  it('shows a command whole when a credential name only sits next to shell syntax', () => {
+    for (const command of [
+      'echo "password=" && rm -rf ~ && echo "x"',
+      'find / -name "token:" -o -delete -o -name "x"',
+      "grep -rl foo'password=' . | xargs rm -f 'important file'",
+      'grep "authorization:";rm important-file',
+      'echo "-----BEGIN PRIVATE KEY-----" && rm -rf ~ && echo "-----END PRIVATE KEY-----"',
+      'password= reboot',
+    ]) {
+      assert.equal(redactSecrets(command), command)
+    }
+  })
+
+  it('stops a hidden value at the first space, quote or piece of shell syntax', () => {
+    assert.equal(redactSecrets('eval TOKEN="x; rm -rf ~"'), 'eval TOKEN="[redacted]; rm -rf ~"')
+    assert.equal(redactSecrets('TOKEN=abc;rm file'), 'TOKEN=[redacted];rm file')
+    assert.equal(redactSecrets('rm -rf {password=x,/}'), 'rm -rf {password=[redacted],/}')
+    assert.equal(redactSecrets('export API_KEY="abc123" && rm -rf build'), 'export API_KEY="[redacted]" && rm -rf build')
+  })
+})

package/data/cursor-plugin/scripts/redaction.mjs

@@ -0,0 +1,51 @@
+// Generated by scripts/generate-editor-redaction.mjs.
+const CREDENTIAL_NAME = String.raw `(?:authorization|secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["']?`;
+const CREDENTIAL_KEY = String.raw `${CREDENTIAL_NAME}\s*[=:]\s*`;
+const DISPLAYED_CREDENTIAL_KEY = String.raw `${CREDENTIAL_NAME}(?:[ \t]*:[ \t]*|[ \t]+=[ \t]*|=)`;
+const SHELL_INERT_UNIT = String.raw `(?:[A-Za-z0-9_\-./+=:@%^!#]|\\[^\s'"])`;
+const SHELL_INERT_SINGLE_QUOTED_UNIT = String.raw `[A-Za-z0-9_\-./+=:@%^!#\\]`;
+const SHELL_INERT_URL_PASSWORD_UNIT = String.raw `(?:[A-Za-z0-9_\-.+=:%^!#]|\\[^\s'"@/])`;
+const PEM_LINE_BREAK = String.raw `(?:\r?\n|(?:\\r)?\\n)`;
+const credentialAssignmentRule = (key, doubleQuoted, singleQuoted, bare) => ({
+    pattern: new RegExp(String.raw `(${key})(?:(")${doubleQuoted}|(')${singleQuoted}|(["']?)${bare})`, 'gi'),
+    replacement: '$1$2$3$4[redacted]$2$3',
+});
+const DISPLAYED_SECRET_SHAPES = {
+    privateKeyBody: String.raw `${PEM_LINE_BREAK}?(?:(?:Proc-Type|DEK-Info): [A-Za-z0-9,-]+${PEM_LINE_BREAK})*(?:[A-Za-z0-9+/=\r\n]|\\[rn])*?`,
+    urlPassword: `${SHELL_INERT_URL_PASSWORD_UNIT}+`,
+    authorizationValue: `${SHELL_INERT_UNIT}+`,
+    credentialAssignment: credentialAssignmentRule(DISPLAYED_CREDENTIAL_KEY, `${SHELL_INERT_UNIT}*"`, `${SHELL_INERT_SINGLE_QUOTED_UNIT}*'`, `${SHELL_INERT_UNIT}+`),
+};
+const CUT_OFF_SECRET_SHAPES = {
+    privateKeyBody: String.raw `[\s\S]*?`,
+    urlPassword: String.raw `[^\s@/]+`,
+    authorizationValue: String.raw `\S+`,
+    credentialAssignment: credentialAssignmentRule(CREDENTIAL_KEY, String.raw `(?:\\[\s\S]|[^"\\])*(?:"|\\?$)`, "[^']*(?:'|$)", String.raw `\S+`),
+};
+const secretRedactionRules = (shapes) => [
+    { pattern: /\bpk_[A-Za-z0-9_]+\.[A-Za-z0-9_]+/g, replacement: '[redacted]' },
+    { pattern: new RegExp(String.raw `-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----${shapes.privateKeyBody}-----END[A-Z0-9 ]*PRIVATE KEY-----`, 'g'), replacement: '[redacted key]' },
+    { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: '[redacted]' },
+    { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, replacement: '[redacted]' },
+    { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: '[redacted]' },
+    { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: '[redacted]' },
+    { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: '[redacted]' },
+    { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: '[redacted]' },
+    { pattern: new RegExp(String.raw `\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)${shapes.urlPassword}@`, 'gi'), replacement: '$1[redacted]@' },
+    { pattern: /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: 'bearer [redacted]' },
+    { pattern: new RegExp(String.raw `\bauthorization:\s*${shapes.authorizationValue}`, 'gi'), replacement: 'authorization: [redacted]' },
+    shapes.credentialAssignment,
+];
+export const SECRET_REDACTION_RULES = secretRedactionRules(DISPLAYED_SECRET_SHAPES);
+const CUT_OFF_TEXT_REDACTION_RULES = secretRedactionRules(CUT_OFF_SECRET_SHAPES);
+const HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: '[redacted]' };
+const applyRedactionRules = (rules, text) => rules.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
+export const redactSecrets = (text) => applyRedactionRules(SECRET_REDACTION_RULES, text);
+export const redactSecretsFromContent = (text) => applyRedactionRules(CUT_OFF_TEXT_REDACTION_RULES, text);
+export const redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);