rafter-cli 0.10.3__tar.gz → 0.10.4__tar.gz

{rafter_cli-0.10.3 → rafter_cli-0.10.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rafter-cli
-Version: 0.10.3
+Version: 0.10.4
 Summary: Rafter CLI — the default security agent for AI workflows. Free for individuals and open source.
 License: MIT
 Author: Rafter Team

{rafter_cli-0.10.3 → rafter_cli-0.10.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rafter-cli"
-version = "0.10.3"
+version = "0.10.4"
 description = "Rafter CLI — the default security agent for AI workflows. Free for individuals and open source."
 authors = ["Rafter Team <hello@rafter.so>"]
 license = "MIT"

{rafter_cli-0.10.3 → rafter_cli-0.10.4}/rafter_cli/core/command_interceptor.py

@@ -7,6 +7,7 @@ from dataclasses import dataclass
 from .audit_logger import AuditLogger
 from .config_manager import ConfigManager
 from .risk_rules import (
+    is_chained_command,
     assess_command_risk,
     match_critical_pattern,
     sanitize_command_for_matching,
@@ -69,6 +70,45 @@ class CommandInterceptor:
                     matched_pattern=pattern,
                 )
 
+        # Check the positive allowlist. Deliberately AFTER blocked_patterns and
+        # BEFORE require_approval: a deny rule always wins, and an allow rule's
+        # whole job is to suppress the approval prompt for a known-safe command.
+        #
+        # Two guards keep an allowlist from becoming a hole in the guard rail:
+        #
+        #   - A ``critical`` command is never allowlistable. NOTE: this guard is
+        #     currently UNREACHABLE — evaluate() hard-blocks critical above,
+        #     before this loop — and a mutation sweep proved it: deleting the
+        #     guard leaves every test green. It is kept as defence in depth,
+        #     because it becomes the only protection the day that early block is
+        #     narrowed. Do not write a test claiming to exercise it; such a test
+        #     passes with the guard deleted.
+        #   - A match does not apply when the command holds more than one
+        #     statement. Patterns are unanchored by request, so without this
+        #     "^git push" would wave through ``rm -rf / && git push`` — or, via
+        #     the newline the original regex missed, anything on a second line.
+        allowed = getattr(policy, "allowed_patterns", None) or []
+        if not isinstance(allowed, list):
+            # Defence in depth behind the validator: iterating a str yields
+            # CHARACTERS, and a leading "^" then matches every command.
+            allowed = []
+        for pattern in allowed:
+            if not self._matches(command, pattern):
+                continue
+            if is_chained_command(command):
+                # Fall through to normal classification rather than allowing.
+                break
+            if risk_level == "critical":
+                break
+            return CommandEvaluation(
+                command=command,
+                risk_level="low",
+                allowed=True,
+                requires_approval=False,
+                reason=f"Matches allowed pattern: {pattern}",
+                matched_pattern=pattern,
+            )
+
         # Check approval patterns
         for pattern in policy.require_approval:
             if self._matches(command, pattern):

{rafter_cli-0.10.3 → rafter_cli-0.10.4}/rafter_cli/core/config_manager.py

@@ -206,6 +206,17 @@ class ConfigManager:
                 if key in cp and (not isinstance(cp[key], list) or not all(isinstance(v, str) for v in cp[key])):
                     print(f'rafter: config "commandPolicy.{key}" must be an array of strings — using default.', file=sys.stderr)
                     del cp[key]
+            # Every sibling key is validated; this one was added to node's
+            # validator and not to python's. A bare STRING is the shape
+            # `rafter agent config set agent.commandPolicy.allowedPatterns
+            # '^git status'` actually writes — json.loads fails, the raw string
+            # is stored — and python then iterates its CHARACTERS, so the first
+            # one, "^", matches every command and the allowlist allows
+            # everything. Node warned and fell back to []; python did not.
+            for key in ("allowedPatterns", "allowed_patterns"):
+                if key in cp and (not isinstance(cp[key], list) or not all(isinstance(v, str) for v in cp[key])):
+                    print(f'rafter: config "commandPolicy.{key}" must be an array of strings — using default.', file=sys.stderr)
+                    del cp[key]
             for key in ("allowProjectOverride", "allow_project_override"):
                 if key in cp and not isinstance(cp[key], bool):
                     print(f'rafter: config "commandPolicy.{key}" must be a boolean — ignoring (project policies cannot loosen command policy).', file=sys.stderr)
@@ -514,6 +525,8 @@ def merge_command_policy(target, project: dict, allow_override: bool) -> None:
             target.blocked_patterns = project["blocked_patterns"]
         if project.get("require_approval") is not None:
             target.require_approval = project["require_approval"]
+        if project.get("allowed_patterns") is not None:
+            target.allowed_patterns = project["allowed_patterns"]
         return
 
     mode = project.get("mode")
@@ -540,3 +553,20 @@ def merge_command_policy(target, project: dict, allow_override: bool) -> None:
         target.require_approval = _union_patterns(
             target.require_approval, project["require_approval"]
         )
+
+    # allowed_patterns is NOT unioned, and that asymmetry is the whole point.
+    # Unioning blocked_patterns or require_approval can only ever ADD
+    # restriction, so a project contributing to them is safe. An allowlist is
+    # the opposite: it is a grant. Union it and a cloned repo ships
+    #     command_policy: {allowed_patterns: [".*"]}
+    # and waves every non-critical command through — precisely the bypass the
+    # floor exists to prevent (sable-nz4y / rf-adth). So the owner's allowlist
+    # stands and the project's is refused unless the owner opted in.
+    if project.get("allowed_patterns") is not None:
+        print(
+            "rafter: project policy sets agent.commandPolicy.allowed_patterns, which can "
+            "only loosen command policy — ignoring. Set "
+            "agent.commandPolicy.allowProjectOverride: true in your global config to "
+            "allow project policies to loosen command policy.",
+            file=sys.stderr,
+        )

{rafter_cli-0.10.3 → rafter_cli-0.10.4}/rafter_cli/core/config_schema.py

@@ -56,6 +56,20 @@ class CommandPolicyConfig:
     #: would be no floor at all. Default (absent/False) keeps the floor: a
     #: project policy may tighten command policy, never loosen it.
     allow_project_override: bool = False
+    #: Positive allowlist: unanchored regexes that force a command to ``low``
+    #: and skip the approval prompt. For the known-safe command that would
+    #: otherwise trip a broad risk tier — the motivating case being
+    #: ``git push --force-with-lease`` to a feature branch on a repo whose main
+    #: is protected server-side.
+    #:
+    #: Three properties make this safe to put on a guard rail, and all three are
+    #: enforced in CommandInterceptor, not here:
+    #:   1. blocked_patterns always wins. An allowlist never re-opens what a
+    #:      deny rule closed.
+    #:   2. A ``critical`` command is never allowlistable.
+    #:   3. A match does not apply when the command contains a chain operator,
+    #:      so ``^git push`` cannot wave through ``rm -rf / && git push``.
+    allowed_patterns: list[str] = field(default_factory=list)
 
 
 @dataclass

{rafter_cli-0.10.3 → rafter_cli-0.10.4}/rafter_cli/core/policy_loader.py

@@ -94,6 +94,13 @@ def _map_policy(raw: dict) -> dict:
             policy["command_policy"]["blocked_patterns"] = cp["blocked_patterns"]
         if isinstance(cp.get("require_approval"), list):
             policy["command_policy"]["require_approval"] = cp["require_approval"]
+        # Without this the allowlist is unreachable from .rafter.yml: the
+        # interceptor reads allowed_patterns off the merged config and nothing
+        # ever put it there. Any new command_policy key needs a line HERE and
+        # in config_manager's merge, or it is documentation for a feature that
+        # does not run. (rf-3n1i)
+        if isinstance(cp.get("allowed_patterns"), list):
+            policy["command_policy"]["allowed_patterns"] = cp["allowed_patterns"]
 
     scan = raw.get("scan")
     if isinstance(scan, dict):
@@ -252,6 +259,13 @@ def _validate_policy(policy: dict, raw: dict) -> dict:
         if "mode" in cp and cp["mode"] not in _VALID_COMMAND_MODES:
             print('Warning: "command_policy.mode" must be one of: allow-all, approve-dangerous, deny-list \u2014 ignoring.', file=sys.stderr)
             del cp["mode"]
+        if "allowed_patterns" in cp:
+            if not isinstance(cp["allowed_patterns"], list) or not all(isinstance(v, str) for v in cp["allowed_patterns"]):
+                print(
+                    'rafter: "command_policy.allowed_patterns" must be a list of strings — ignoring.',
+                    file=sys.stderr,
+                )
+                cp.pop("allowed_patterns", None)
         if "blocked_patterns" in cp:
             if not isinstance(cp["blocked_patterns"], list) or not all(isinstance(v, str) for v in cp["blocked_patterns"]):
                 print('Warning: "command_policy.blocked_patterns" must be an array of strings \u2014 ignoring.', file=sys.stderr)

{rafter_cli-0.10.3 → rafter_cli-0.10.4}/rafter_cli/core/risk_rules.py

@@ -129,6 +129,8 @@ _TEXT_FLAGS = {
 # Operators that chain independent commands.
 _CHAIN_OPS = {";", "&&", "||", "|", "&"}
 
+
+
 # Operators whose following token is a redirect target (a path — never data).
 _REDIRECT_OPS = {">", ">>", "<", "<<"}
 
@@ -348,6 +350,21 @@ def _tokenize(s: str) -> tuple[list[_Piece], bool]:
     return pieces, unterminated
 
 
+def is_chained_command(command: str) -> bool:
+    r"""True if the command contains more than one statement.
+
+    Asked of the TOKENIZER rather than a regex. The first version of this was
+    ``re.compile(r"[;|&]|&&|\|\|")``, which omits the newline — and a newline
+    has been a statement separator in this module since rf-6pqx. With
+    ``^git push origin feature/`` allowlisted, ``git push origin feature/x`` and
+    a second line holding ``git push --force origin main`` classified ``allow``.
+    The tokenizer already normalises ``\n`` to ``;``, so routing the question
+    through it removes the second, narrower definition instead of widening it.
+    """
+    pieces, _ = _tokenize(command)
+    return any(p.op is not None and p.op in _CHAIN_OPS for p in pieces)
+
+
 def _exec_name(text: str) -> str:
     """`/usr/bin/rm` -> `rm`; used to classify the executable of a segment."""
     return text[text.rfind("/") + 1:].lower()

{rafter_cli-0.10.3 → rafter_cli-0.10.4}/rafter_cli/resources/rafter-security-skill.md

@@ -1,7 +1,7 @@
 ---
 name: rafter-security
 description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.
-version: 0.10.3
+version: 0.10.4
 homepage: https://rafter.so
 metadata:
   openclaw:

{rafter_cli-0.10.3 → rafter_cli-0.10.4}/rafter_cli/scanners/secret_patterns.py

@@ -81,6 +81,34 @@ DEFAULT_SECRET_PATTERNS: list[Pattern] = [
         severity="critical",
         description="Stripe Restricted API Key detected",
     ),
+    # OpenAI (rf-f5is / se-wagv, external report). The hook's Write gate is
+    # regex-only and this file had NO OpenAI rule at all, so `sk-proj-` and
+    # legacy keys were ALLOWED through the gate at any length while
+    # `rafter secrets` caught them via betterleaks. The two engines disagreed
+    # and the one guarding writes was the blind one.
+    #
+    # No `(?i)`: these prefixes and their base62 bodies are case-sensitive, and
+    # the convention here is that prefixed vendor tokens (ghp_, AKIA, AIza, xox)
+    # match case-sensitively. Lower-casing them would only add false positives.
+    Pattern(
+        name="OpenAI API Key",
+        regex=r"sk-(proj|svcacct|admin)-[A-Za-z0-9_-]{40,}",
+        severity="critical",
+        description="OpenAI project/service/admin API key detected",
+    ),
+    Pattern(
+        name="OpenAI API Key (legacy)",
+        regex=r"sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}",
+        severity="critical",
+        description="OpenAI legacy API key detected",
+    ),
+    # Supabase (rf-f5is / se-wagv). Detected by NEITHER engine at any length.
+    Pattern(
+        name="Supabase Secret Key",
+        regex=r"sb_secret_[A-Za-z0-9_-]{20,}",
+        severity="critical",
+        description="Supabase secret key detected",
+    ),
     # Twilio
     Pattern(
         name="Twilio API Key",