rafter-cli 0.10.2__tar.gz → 0.10.4__tar.gz

{rafter_cli-0.10.2 → rafter_cli-0.10.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rafter-cli
-Version: 0.10.2
+Version: 0.10.4
 Summary: Rafter CLI — the default security agent for AI workflows. Free for individuals and open source.
 License: MIT
 Author: Rafter Team

{rafter_cli-0.10.2 → rafter_cli-0.10.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rafter-cli"
-version = "0.10.2"
+version = "0.10.4"
 description = "Rafter CLI — the default security agent for AI workflows. Free for individuals and open source."
 authors = ["Rafter Team <hello@rafter.so>"]
 license = "MIT"

{rafter_cli-0.10.2 → rafter_cli-0.10.4}/rafter_cli/commands/hook.py

@@ -6,10 +6,12 @@ import math
 import os
 import subprocess
 import sys
+from pathlib import Path
 
 import typer
 
 from ..core.audit_logger import AuditLogger
+from ..core.risk_rules import modifies_rafter_security_config
 from ..core.command_interceptor import CommandInterceptor
 from ..scanners.regex_scanner import RegexScanner
 
@@ -37,6 +39,17 @@ _RISK_DESCRIPTIONS = {
 
 def _format_blocked_message(command: str, evaluation) -> str:
     cmd_display = command[:60] + "..." if len(command) > 60 else command
+    # rf-vnxs: say what actually happened. "irreversible system damage" is the
+    # wrong sentence for a config write, and a wrong reason teaches the agent to
+    # go looking for a way around a rule it was never told the shape of.
+    if modifies_rafter_security_config(command):
+        return (
+            f"\u2717 Rafter blocked: {cmd_display}\n"
+            f"  Rule: rafter security configuration is protected (rf-vnxs)\n"
+            f"  Risk: CRITICAL\u2014this command reconfigures or removes rafter's own\n"
+            f"        guardrail. The gate cannot approve its own disarming. A person\n"
+            f"        must make this change outside an agent session."
+        )
     rule = evaluation.matched_pattern or "policy violation"
     label = _RISK_LABELS.get(evaluation.risk_level, evaluation.risk_level.upper())
     desc = _RISK_DESCRIPTIONS.get(evaluation.risk_level, "")
@@ -54,8 +67,9 @@ def _format_approval_message(command: str, evaluation) -> str:
         f"  Rule: {rule}\n"
         f"  Risk: {label}\u2014{desc}\n"
         f"\n"
-        f'To approve: rafter agent exec --approve "{command}"\n'
-        f"To configure: rafter agent config set agent.riskLevel minimal"
+        f'To approve: a person must run `rafter agent exec "{command}"` at an\n'
+        f"            interactive terminal and confirm. There is no flag that\n"
+        f"            skips the prompt."
     )
 
 
@@ -376,7 +390,43 @@ def _evaluate_bash(command: str, control=None) -> dict:
     return {"decision": "allow"}
 
 
+def _writes_rafter_security_config(file_path: str) -> bool:
+    """True if this write targets rafter's own configuration directory.
+
+    rf-vnxs, fourth route. Blocking the CLI invocation is not enough: the config
+    is a FILE, and an agent with a Write/Edit tool does not need the CLI to
+    disable the hook — it can write ``~/.rafter/config.json`` directly. Three
+    independent routes to the unblockable tier had already been found one at a
+    time in this codebase; this is the one that would have been the fourth.
+    """
+    if not file_path:
+        return False
+    try:
+        from ..core.config_schema import get_rafter_dir
+
+        target = Path(file_path).expanduser().resolve()
+        rafter_dir = get_rafter_dir().expanduser().resolve()
+    except Exception:
+        return False
+    return target == rafter_dir or rafter_dir in target.parents
+
+
 def _evaluate_write(tool_input: dict) -> dict:
+    # rf-vnxs: checked FIRST, and before the no-content early return, because a
+    # truncating write with empty content disables the hook just as well as one
+    # carrying JSON.
+    if _writes_rafter_security_config(tool_input.get("file_path", "")):
+        return {
+            "decision": "deny",
+            "reason": (
+                "\u2717 Rafter blocked: write to rafter's own configuration\n"
+                "  Rule: rafter security configuration is protected (rf-vnxs)\n"
+                "  Risk: CRITICAL\u2014editing this file reconfigures or removes the\n"
+                "        guardrail. The gate cannot approve its own disarming. A\n"
+                "        person must make this change outside an agent session."
+            ),
+        }
+
     content = tool_input.get("content", "") or tool_input.get("new_string", "")
     if not content:
         return {"decision": "allow"}

{rafter_cli-0.10.2 → rafter_cli-0.10.4}/rafter_cli/core/command_interceptor.py

@@ -7,6 +7,7 @@ from dataclasses import dataclass
 from .audit_logger import AuditLogger
 from .config_manager import ConfigManager
 from .risk_rules import (
+    is_chained_command,
     assess_command_risk,
     match_critical_pattern,
     sanitize_command_for_matching,
@@ -69,6 +70,45 @@ class CommandInterceptor:
                     matched_pattern=pattern,
                 )
 
+        # Check the positive allowlist. Deliberately AFTER blocked_patterns and
+        # BEFORE require_approval: a deny rule always wins, and an allow rule's
+        # whole job is to suppress the approval prompt for a known-safe command.
+        #
+        # Two guards keep an allowlist from becoming a hole in the guard rail:
+        #
+        #   - A ``critical`` command is never allowlistable. NOTE: this guard is
+        #     currently UNREACHABLE — evaluate() hard-blocks critical above,
+        #     before this loop — and a mutation sweep proved it: deleting the
+        #     guard leaves every test green. It is kept as defence in depth,
+        #     because it becomes the only protection the day that early block is
+        #     narrowed. Do not write a test claiming to exercise it; such a test
+        #     passes with the guard deleted.
+        #   - A match does not apply when the command holds more than one
+        #     statement. Patterns are unanchored by request, so without this
+        #     "^git push" would wave through ``rm -rf / && git push`` — or, via
+        #     the newline the original regex missed, anything on a second line.
+        allowed = getattr(policy, "allowed_patterns", None) or []
+        if not isinstance(allowed, list):
+            # Defence in depth behind the validator: iterating a str yields
+            # CHARACTERS, and a leading "^" then matches every command.
+            allowed = []
+        for pattern in allowed:
+            if not self._matches(command, pattern):
+                continue
+            if is_chained_command(command):
+                # Fall through to normal classification rather than allowing.
+                break
+            if risk_level == "critical":
+                break
+            return CommandEvaluation(
+                command=command,
+                risk_level="low",
+                allowed=True,
+                requires_approval=False,
+                reason=f"Matches allowed pattern: {pattern}",
+                matched_pattern=pattern,
+            )
+
         # Check approval patterns
         for pattern in policy.require_approval:
             if self._matches(command, pattern):

{rafter_cli-0.10.2 → rafter_cli-0.10.4}/rafter_cli/core/config_manager.py

@@ -206,6 +206,17 @@ class ConfigManager:
                 if key in cp and (not isinstance(cp[key], list) or not all(isinstance(v, str) for v in cp[key])):
                     print(f'rafter: config "commandPolicy.{key}" must be an array of strings — using default.', file=sys.stderr)
                     del cp[key]
+            # Every sibling key is validated; this one was added to node's
+            # validator and not to python's. A bare STRING is the shape
+            # `rafter agent config set agent.commandPolicy.allowedPatterns
+            # '^git status'` actually writes — json.loads fails, the raw string
+            # is stored — and python then iterates its CHARACTERS, so the first
+            # one, "^", matches every command and the allowlist allows
+            # everything. Node warned and fell back to []; python did not.
+            for key in ("allowedPatterns", "allowed_patterns"):
+                if key in cp and (not isinstance(cp[key], list) or not all(isinstance(v, str) for v in cp[key])):
+                    print(f'rafter: config "commandPolicy.{key}" must be an array of strings — using default.', file=sys.stderr)
+                    del cp[key]
             for key in ("allowProjectOverride", "allow_project_override"):
                 if key in cp and not isinstance(cp[key], bool):
                     print(f'rafter: config "commandPolicy.{key}" must be a boolean — ignoring (project policies cannot loosen command policy).', file=sys.stderr)
@@ -514,6 +525,8 @@ def merge_command_policy(target, project: dict, allow_override: bool) -> None:
             target.blocked_patterns = project["blocked_patterns"]
         if project.get("require_approval") is not None:
             target.require_approval = project["require_approval"]
+        if project.get("allowed_patterns") is not None:
+            target.allowed_patterns = project["allowed_patterns"]
         return
 
     mode = project.get("mode")
@@ -540,3 +553,20 @@ def merge_command_policy(target, project: dict, allow_override: bool) -> None:
         target.require_approval = _union_patterns(
             target.require_approval, project["require_approval"]
         )
+
+    # allowed_patterns is NOT unioned, and that asymmetry is the whole point.
+    # Unioning blocked_patterns or require_approval can only ever ADD
+    # restriction, so a project contributing to them is safe. An allowlist is
+    # the opposite: it is a grant. Union it and a cloned repo ships
+    #     command_policy: {allowed_patterns: [".*"]}
+    # and waves every non-critical command through — precisely the bypass the
+    # floor exists to prevent (sable-nz4y / rf-adth). So the owner's allowlist
+    # stands and the project's is refused unless the owner opted in.
+    if project.get("allowed_patterns") is not None:
+        print(
+            "rafter: project policy sets agent.commandPolicy.allowed_patterns, which can "
+            "only loosen command policy — ignoring. Set "
+            "agent.commandPolicy.allowProjectOverride: true in your global config to "
+            "allow project policies to loosen command policy.",
+            file=sys.stderr,
+        )

{rafter_cli-0.10.2 → rafter_cli-0.10.4}/rafter_cli/core/config_schema.py

@@ -56,6 +56,20 @@ class CommandPolicyConfig:
     #: would be no floor at all. Default (absent/False) keeps the floor: a
     #: project policy may tighten command policy, never loosen it.
     allow_project_override: bool = False
+    #: Positive allowlist: unanchored regexes that force a command to ``low``
+    #: and skip the approval prompt. For the known-safe command that would
+    #: otherwise trip a broad risk tier — the motivating case being
+    #: ``git push --force-with-lease`` to a feature branch on a repo whose main
+    #: is protected server-side.
+    #:
+    #: Three properties make this safe to put on a guard rail, and all three are
+    #: enforced in CommandInterceptor, not here:
+    #:   1. blocked_patterns always wins. An allowlist never re-opens what a
+    #:      deny rule closed.
+    #:   2. A ``critical`` command is never allowlistable.
+    #:   3. A match does not apply when the command contains a chain operator,
+    #:      so ``^git push`` cannot wave through ``rm -rf / && git push``.
+    allowed_patterns: list[str] = field(default_factory=list)
 
 
 @dataclass

{rafter_cli-0.10.2 → rafter_cli-0.10.4}/rafter_cli/core/policy_loader.py

@@ -94,6 +94,13 @@ def _map_policy(raw: dict) -> dict:
             policy["command_policy"]["blocked_patterns"] = cp["blocked_patterns"]
         if isinstance(cp.get("require_approval"), list):
             policy["command_policy"]["require_approval"] = cp["require_approval"]
+        # Without this the allowlist is unreachable from .rafter.yml: the
+        # interceptor reads allowed_patterns off the merged config and nothing
+        # ever put it there. Any new command_policy key needs a line HERE and
+        # in config_manager's merge, or it is documentation for a feature that
+        # does not run. (rf-3n1i)
+        if isinstance(cp.get("allowed_patterns"), list):
+            policy["command_policy"]["allowed_patterns"] = cp["allowed_patterns"]
 
     scan = raw.get("scan")
     if isinstance(scan, dict):
@@ -252,6 +259,13 @@ def _validate_policy(policy: dict, raw: dict) -> dict:
         if "mode" in cp and cp["mode"] not in _VALID_COMMAND_MODES:
             print('Warning: "command_policy.mode" must be one of: allow-all, approve-dangerous, deny-list \u2014 ignoring.', file=sys.stderr)
             del cp["mode"]
+        if "allowed_patterns" in cp:
+            if not isinstance(cp["allowed_patterns"], list) or not all(isinstance(v, str) for v in cp["allowed_patterns"]):
+                print(
+                    'rafter: "command_policy.allowed_patterns" must be a list of strings — ignoring.',
+                    file=sys.stderr,
+                )
+                cp.pop("allowed_patterns", None)
         if "blocked_patterns" in cp:
             if not isinstance(cp["blocked_patterns"], list) or not all(isinstance(v, str) for v in cp["blocked_patterns"]):
                 print('Warning: "command_policy.blocked_patterns" must be an array of strings \u2014 ignoring.', file=sys.stderr)

{rafter_cli-0.10.2 → rafter_cli-0.10.4}/rafter_cli/core/risk_rules.py

@@ -129,6 +129,8 @@ _TEXT_FLAGS = {
 # Operators that chain independent commands.
 _CHAIN_OPS = {";", "&&", "||", "|", "&"}
 
+
+
 # Operators whose following token is a redirect target (a path — never data).
 _REDIRECT_OPS = {">", ">>", "<", "<<"}
 
@@ -348,6 +350,21 @@ def _tokenize(s: str) -> tuple[list[_Piece], bool]:
     return pieces, unterminated
 
 
+def is_chained_command(command: str) -> bool:
+    r"""True if the command contains more than one statement.
+
+    Asked of the TOKENIZER rather than a regex. The first version of this was
+    ``re.compile(r"[;|&]|&&|\|\|")``, which omits the newline — and a newline
+    has been a statement separator in this module since rf-6pqx. With
+    ``^git push origin feature/`` allowlisted, ``git push origin feature/x`` and
+    a second line holding ``git push --force origin main`` classified ``allow``.
+    The tokenizer already normalises ``\n`` to ``;``, so routing the question
+    through it removes the second, narrower definition instead of widening it.
+    """
+    pieces, _ = _tokenize(command)
+    return any(p.op is not None and p.op in _CHAIN_OPS for p in pieces)
+
+
 def _exec_name(text: str) -> str:
     """`/usr/bin/rm` -> `rm`; used to classify the executable of a segment."""
     return text[text.rfind("/") + 1:].lower()
@@ -774,8 +791,106 @@ def sanitize_command_for_matching(command: str) -> str:
     return _sanitize(command, 0)
 
 
+# rf-vnxs — reconfiguring rafter's OWN security controls is a PROTECTED CLASS.
+#
+# The gate must never approve its own disarming. On 0.10.1 it did: the hook
+# rated `rafter agent config set agent.hooks.enabled false` as `low`, allowed
+# it, and every later command — including the CRITICAL tier that no policy,
+# mode or deny-list can override — was then permitted. Three steps, no
+# malformed command, and it persists to config.json.
+#
+# Matched STRUCTURALLY (resolved exec + argv walk), never by string: every one
+# of these was observed ALLOWED on the published artifact — extra whitespace,
+# `FALSE`, `npx @rafter-security/cli …`, `pnpm dlx`, `sudo -E rafter …`, an
+# absolute path, the `agent disable` component route, and three separate
+# self-disabling keys. A blacklist of one string is one alias from being inert.
+_RAFTER_EXECS = {"rafter", "rafter-cli"}
+_PACKAGE_RUNNERS = {"npx", "bunx", "pnpx", "dlx", "pnpm", "yarn", "bun"}
+_RAFTER_PACKAGE = re.compile(r"^(?:@rafter-security/cli|rafter-cli|rafter)(?:@[\w.^~*-]+)?$")
+
+# Config keys that gate the hook. A namespace, not a leaf — see hook_control.
+_PROTECTED_CONFIG_KEY = re.compile(r"^(?:agent\.)?(?:hooks|commandpolicy)\b|^agent\.risklevel$")
+
+
+def _statement_disarms_rafter(words: list[_Piece]) -> bool:
+    """True if this statement's argv reconfigures or removes a rafter control.
+
+    The rafter invocation is looked for at ANY position, not just as the
+    statement's own exec: a shell carrying a command string puts it in the
+    operand, so `bash -c "rafter agent config set …"` and `bash -c "$(echo
+    rafter …)"` both reduce to a statement whose exec is `bash`. A quoted word
+    is skipped on the raw pass so `echo 'rafter agent config set …'` stays
+    prose; the sanitized pass sees operands that are actually executed already
+    unwrapped.
+    """
+    for j in range(len(words)):
+        if words[j].quoted:
+            continue
+        k = j
+        exec_ = _exec_name(words[k].text)
+        k += 1
+
+        if exec_ in _PACKAGE_RUNNERS:
+            while k < len(words) and (words[k].text.startswith("-") or words[k].text.lower() in ("dlx", "exec")):
+                k += 1
+            if k >= len(words) or not _RAFTER_PACKAGE.match(words[k].text.lower()):
+                continue
+            k += 1
+            exec_ = "rafter"
+        if exec_ not in _RAFTER_EXECS:
+            continue
+
+        args = [w.text.lower() for w in words[k:] if not w.text.startswith("-")]
+        for n in range(len(args) - 1):
+            if args[n] == "config" and args[n + 1] == "set":
+                key = args[n + 2] if n + 2 < len(args) else None
+                if key and _PROTECTED_CONFIG_KEY.match(key):
+                    return True
+            if args[n] == "agent" and args[n + 1] == "disable":
+                return True
+    return False
+
+
+def _disarms_rafter(command: str, depth: int = 0) -> bool:
+    """True if any statement (or command substitution) disarms rafter."""
+    if depth > _MAX_SANITIZE_DEPTH:
+        return False
+    pieces, _ = _tokenize(command)
+    statements: list[list[_Piece]] = []
+    stmt: list[_Piece] = []
+    for p in pieces:
+        if p.op is not None:
+            if p.op in _CHAIN_OPS or p.op in ("\n", "\r"):
+                statements.append(stmt)
+                stmt = []
+            continue
+        stmt.append(p)
+        for sub in (p.substs or []):
+            if _disarms_rafter(sub, depth + 1):
+                return True
+    statements.append(stmt)
+    return any(_statement_disarms_rafter(st) for st in statements)
+
+
+def modifies_rafter_security_config(command: str) -> bool:
+    """True if the command disarms rafter, checked on raw AND sanitized text.
+
+    Raw catches the ordinary invocation; sanitized catches a shell running the
+    OUTPUT of something else, whose own exec is `echo` and which a walk over
+    the raw argv therefore reads, correctly, as a print.
+    """
+    if _disarms_rafter(command):
+        return True
+    sanitized = sanitize_command_for_matching(command)
+    return sanitized != command and _disarms_rafter(sanitized)
+
+
 def assess_command_risk(command: str) -> str:
     """Assess risk level of a command string."""
+    # rf-vnxs: checked before the pattern loops. The disarm is an ordinary
+    # well-formed invocation — nothing malformed for the sanitizer to normalise.
+    if modifies_rafter_security_config(command):
+        return "critical"
     cmd = sanitize_command_for_matching(command).strip()
     if not cmd:
         return "low"

{rafter_cli-0.10.2 → rafter_cli-0.10.4}/rafter_cli/resources/rafter-security-skill.md

@@ -1,7 +1,7 @@
 ---
 name: rafter-security
 description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.
-version: 0.10.2
+version: 0.10.4
 homepage: https://rafter.so
 metadata:
   openclaw:

{rafter_cli-0.10.2 → rafter_cli-0.10.4}/rafter_cli/scanners/secret_patterns.py

@@ -81,6 +81,34 @@ DEFAULT_SECRET_PATTERNS: list[Pattern] = [
         severity="critical",
         description="Stripe Restricted API Key detected",
     ),
+    # OpenAI (rf-f5is / se-wagv, external report). The hook's Write gate is
+    # regex-only and this file had NO OpenAI rule at all, so `sk-proj-` and
+    # legacy keys were ALLOWED through the gate at any length while
+    # `rafter secrets` caught them via betterleaks. The two engines disagreed
+    # and the one guarding writes was the blind one.
+    #
+    # No `(?i)`: these prefixes and their base62 bodies are case-sensitive, and
+    # the convention here is that prefixed vendor tokens (ghp_, AKIA, AIza, xox)
+    # match case-sensitively. Lower-casing them would only add false positives.
+    Pattern(
+        name="OpenAI API Key",
+        regex=r"sk-(proj|svcacct|admin)-[A-Za-z0-9_-]{40,}",
+        severity="critical",
+        description="OpenAI project/service/admin API key detected",
+    ),
+    Pattern(
+        name="OpenAI API Key (legacy)",
+        regex=r"sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}",
+        severity="critical",
+        description="OpenAI legacy API key detected",
+    ),
+    # Supabase (rf-f5is / se-wagv). Detected by NEITHER engine at any length.
+    Pattern(
+        name="Supabase Secret Key",
+        regex=r"sb_secret_[A-Za-z0-9_-]{20,}",
+        severity="critical",
+        description="Supabase secret key detected",
+    ),
     # Twilio
     Pattern(
         name="Twilio API Key",