relay-shell 0.2.0__tar.gz → 0.3.0__tar.gz

{relay_shell-0.2.0 → relay_shell-0.3.0}/.env.example

@@ -25,6 +25,19 @@ RELAY_SHELL_POLICY_MODE=open
 RELAY_SHELL_POLICY_DENY=
 RELAY_SHELL_POLICY_ALLOW=
 
+# --- Tier-3 confirmation broker (ADR 0009) ---
+# Opt-in, default off. When true, a Tier-3 (IRREVERSIBLE) command that already
+# passed the deny list and mode check is not executed on first request: the
+# runner returns a single-use, TTL-bounded token (audited action=confirm_plan,
+# no side effect) and the caller must arm it via the operation_confirm tool,
+# then re-issue the exact same call (audited action=confirm_execute). This is an
+# added safeguard, never a bypass — the deny list and mode policy still run
+# first. Default off keeps the audit record byte-identical.
+RELAY_SHELL_CONFIRM_TIER3=false
+# How long a minted confirmation token stays valid before it must be re-planned.
+# Seconds, 5..3600.
+RELAY_SHELL_CONFIRM_TTL=120
+
 # --- Audit ---
 RELAY_SHELL_AUDIT_PATH=/var/log/relay-shell/audit.jsonl
 RELAY_SHELL_AUDIT_STDERR=false

{relay_shell-0.2.0 → relay_shell-0.3.0}/.github/workflows/ci.yml

@@ -24,9 +24,9 @@ jobs:
         python-version: ["3.12", "3.13", "3.14"]
     name: check (py${{ matrix.python-version }})
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: "pip"

{relay_shell-0.2.0 → relay_shell-0.3.0}/.github/workflows/codeql.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4

relay_shell-0.3.0/.github/workflows/docs.yml

@@ -0,0 +1,64 @@
+name: docs
+
+# Build the MkDocs Material documentation site from docs/ and publish it to
+# GitHub Pages. Requires a one-time repo setting:
+#   Settings -> Pages -> Build and deployment -> Source: "GitHub Actions"
+# (this replaces the former Jekyll "Deploy from a branch" source).
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "mkdocs.yml"
+      - "requirements-docs.txt"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
+
+# Least-privilege default; the deploy job adds only the Pages-specific scopes.
+permissions:
+  contents: read
+
+# One Pages deployment at a time; let an in-flight publish finish.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build (MkDocs Material)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-docs.txt
+      - name: Install MkDocs Material
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-docs.txt
+      - name: Build site (strict)
+        run: mkdocs build --strict
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5
+        with:
+          path: site
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pages: write # publish the Pages deployment
+      id-token: write # OIDC token required by deploy-pages
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128  # v5

{relay_shell-0.2.0 → relay_shell-0.3.0}/.github/workflows/gitleaks.yml

@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout (full history so the scan covers every commit)
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
         with:
           fetch-depth: 0
 

{relay_shell-0.2.0 → relay_shell-0.3.0}/.github/workflows/nightly-fuzz.yml

@@ -22,9 +22,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.14"
           cache: "pip"

{relay_shell-0.2.0 → relay_shell-0.3.0}/.github/workflows/pip-audit.yml

@@ -25,9 +25,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.14"
           cache: "pip"

{relay_shell-0.2.0 → relay_shell-0.3.0}/.github/workflows/release.yml

@@ -66,7 +66,7 @@ jobs:
       # without this `ref` would compare the tag against whatever version
       # currently sits on the default branch and falsely reject a valid
       # signed tag.
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
           fetch-depth: 0
@@ -138,11 +138,11 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
         with:
           ref: ${{ needs.verify.outputs.release_commit }}
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.14"
           cache: "pip"
@@ -171,7 +171,7 @@ jobs:
         # PyPI OIDC trusted publishing already provides L2; this step
         # adds a verifier-checkable provenance record in Sigstore's
         # public transparency log.
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4
         with:
           subject-path: 'dist/*'
 

{relay_shell-0.2.0 → relay_shell-0.3.0}/.github/workflows/sbom.yml

@@ -33,10 +33,10 @@ jobs:
       attestations: write   # CI-3: write the provenance attestation
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.14"
           cache: "pip"
@@ -117,7 +117,7 @@ jobs:
         # commit produced this SBOM — so a consumer can verify the SBOM is the
         # genuine output of this repo's CI (`gh attestation verify <file>
         # --repo ${{ github.repository }}`) rather than a swapped artifact.
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4
         with:
           subject-path: |
             relay-shell-${{ steps.tag.outputs.name }}.cdx.json

{relay_shell-0.2.0 → relay_shell-0.3.0}/.gitignore

@@ -14,6 +14,9 @@ venv/
 .coverage.*
 htmlcov/
 
+# MkDocs build output
+site/
+
 # Runtime state / secrets (NEVER commit)
 *.env
 .env

{relay_shell-0.2.0 → relay_shell-0.3.0}/.hypothesis/constants/060c4657af60692d

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/util.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 ['clamp', 'gen_id', 'now_iso', 'replace', 'sha256_hex', 'truncate', 'utf-8', 'utf8_len']

{relay_shell-0.2.0 → relay_shell-0.3.0}/.hypothesis/constants/06d9884c28b2a63f

@@ -1,4 +1,4 @@
 # file: /opt/hostedtoolcache/Python/3.14.6/x64/bin/pytest
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 ['.exe', '__main__']

{relay_shell-0.2.0 → relay_shell-0.3.0}/.hypothesis/constants/09f931d5fb70626a

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/errors.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 ['ForwardError', 'PolicyDenied', 'RelayError', 'SessionError', 'fmt_exc']

relay_shell-0.2.0/.hypothesis/constants/eb76034b3e66dae0 → relay_shell-0.3.0/.hypothesis/constants/0f0449cb9acd7923

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/__init__.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
-['0.2.0', '__version__']
+['0.3.0', '__version__']

relay_shell-0.2.0/.hypothesis/constants/0a19132992ca9818 → relay_shell-0.3.0/.hypothesis/constants/0fbd7313047d9e52

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/sshpool.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 [65536, ', ', ':', 'D', 'ForwardHandle', 'HUP', 'INT', 'KILL', 'L', 'QUIT', 'R', 'SshPool', 'SshProcessTransport', 'TERM', 'a', 'accept-new', 'client_keys', 'config', 'connect_timeout', 'dynamic', 'fwd', 'id', 'ignore', 'keepalive_interval', 'kind', 'known_hosts', 'listen_port', 'local', 'openssh', 'port', 'remote', 'replace', 'socks', 'spec', 'ssh_idle_timeout', 'strict', 'target', 'tunnel', 'username', 'utf-8', 'xterm-256color', '~/.ssh/known_hosts']

relay_shell-0.2.0/.hypothesis/constants/45397debbdfd60bc → relay_shell-0.3.0/.hypothesis/constants/29d0bc1435e72910

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/sessions.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 [0.0, 65536, 'HHHH', 'LocalPtyTransport', 'Session', 'SessionRegistry', 'Transport', 'age_s', 'buffered', 'closed', 'dropped', 'exit_code', 'id', 'idle_s', 'kind', 'produced', 'replace', 'sh', 'size', 'ssh', 'title', 'utf-8']

{relay_shell-0.2.0 → relay_shell-0.3.0}/.hypothesis/constants/29ed694dbb01fab5

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/verifier.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 ['/', '/etc/caddy/Caddyfile', 'ABSENT_TEMPLATE', 'Caddyfile', 'DRIFT', 'MISSING', 'OK', '_deploy', 'caddyfile', 'deploy', 'logrotate', 'relay_shell', 'systemd-hardening', 'systemd-unit', 'utf-8']

relay_shell-0.3.0/.hypothesis/constants/31cd5feb5b48ec66

@@ -0,0 +1,4 @@
+# file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/redaction.py
+# hypothesis_version: 6.156.6
+
+[500, 16384, 'redact', 'redact_args', 'replace', 'utf-8']

relay_shell-0.2.0/.hypothesis/constants/6cf4f480c0f10b72 → relay_shell-0.3.0/.hypothesis/constants/4017e2a6f3ee7cfd

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/metrics.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 ['"', ',', '\\', '\\"', '\\\\', '\\n', 'counter', 'gauge', 'mode', 'outcome', 'syscall', 'tier', 'tool', '{', '}']

relay_shell-0.3.0/.hypothesis/constants/877af75780422922

@@ -0,0 +1,4 @@
+# file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/policy.py
+# hypothesis_version: 6.156.6
+
+['Policy', 'PolicyDecision', 'Tier', 'audit_tail', 'classify', 'guarded', 'operation_confirm', 'permitted', 'readonly', 'server_info', 'session_kill', 'session_list', 'session_recv', 'session_resize', 'session_send', 'shell_exec', 'shell_script', 'shell_spawn', 'ssh_check', 'ssh_download', 'ssh_exec', 'ssh_fanout', 'ssh_forward', 'ssh_forward_list', 'ssh_hosts', 'ssh_spawn', 'ssh_upload']

relay_shell-0.3.0/.hypothesis/constants/8967c8193f2aab55

@@ -0,0 +1,4 @@
+# file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/server.py
+# hypothesis_version: 6.156.6
+
+[0.0, 1.0, 2.0, 60.0, 100, 120, 128, 200, 256, 512, 1000, 1024, 2048, 4096, 8192, 32768, 65535, 65536, ',', '--', '-T', '-p', '-t', '.', '/bin/bash', '/bin/sudo', '/metrics', '/usr/bin/sudo', '/usr/local/bin/sudo', '0x', ':', 'GET', 'Host inventory', 'L', 'R', 'Relay', 'SIG', 'SSH config metadata', 'Single host spec', 'TERM', '[]', 'aliases', 'application/json', 'audit', 'audit_tail', 'auth', 'auth_server_provider', 'bash', 'build_server', 'cap', 'chain', 'client_id', 'close', 'cols', 'command', 'concurrency', 'confirm', 'confirm_execute', 'confirm_plan', 'confirm_required', 'connect_timeout', 'cwd', 'data', 'default_timeout', 'degraded', 'denied', 'denied_filter', 'dsa', 'ecdsa', 'echo ok', 'ed25519', 'enter', 'env_json', 'error', 'euid', 'exit_code', 'filter_version', 'format', 'forward_id', 'host', 'host_count', 'hosts', 'http', 'idle_timeout', 'instructions', 'interpreter', 'inventory', 'inventory_host', 'inventory_hosts', 'ipv4_mapped', 'is_root', 'json_response', 'jump', 'keepalive', 'key_path', 'key_types', 'known_hosts', 'known_hosts_default', 'limits', 'lines', 'local', 'max_forwards', 'max_output', 'max_output_hard', 'max_sessions', 'max_timeout', 'name', 'notify', 'ok', 'operating_guide', 'operation_confirm', 'output', 'path', 'pending', 'policy_mode', 'port', 'reason', 'relay-shell', 'relay_shell.server', 'remote', 'request_id', 'results', 'rows', 'rsa', 'rsa,ecdsa,ed25519', 'runtime', 'script', 'seccomp', 'server_info', 'session_id', 'session_kill', 'session_list', 'session_recv', 'session_resize', 'session_send', 'shell', 'shell_exec', 'shell_script', 'shell_spawn', 'signal', 'size', 'spec', 'ssh', 'ssh-config', 'ssh-keyscan', 'ssh_check', 'ssh_config', 'ssh_download', 'ssh_exec', 'ssh_fanout', 'ssh_forward', 'ssh_forward_close', 'ssh_forward_list', 'ssh_hosts', 'ssh_keyscan', 'ssh_spawn', 'ssh_upload', 'stateless_http', 'stdin', 'strict', 'sudo_binary', 'supported', 'tier', 'tier3', 'tier_filter', 'timeout', 'token_sha256', 'tool', 'tool_filter', 'transport', 'ttl', 'uid', 'use_shell', 'user', 'utf-8', 'version']

{relay_shell-0.2.0 → relay_shell-0.3.0}/.hypothesis/constants/95970940d76c226a

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/seccomp.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 [b'\x00', b'\x01', b'x', 5.0, 101, 105, 106, 113, 114, 117, 119, 155, 157, 161, 165, 166, 255, 257, 272, 308, 317, 322, 1000, 2143289344, 2147418112, 3221225534, 4294967295, '!', '-', '.', '/proc/self/status', '6Q', '@fall', 'CapEff:', 'HBBI', 'NOTIFIED_SYSCALLS', 'PlatformSupport', 'QI', 'QqiI', 'SeccompMonitor', 'SyscallEvent', '_listener_fd', '_stop_r', '_stop_w', 'allow', 'build_filter', 'chroot', 'clear_active', 'data', 'execve', 'execveat', 'filter', 'get_active', 'i', 'ja', 'jump', 'len', 'libc unavailable', 'libc.so.6', 'linux', 'mount', 'notif', 'notify', 'ok', 'open', 'openat', 'pass_fds', 'pivot_root', 'platform_support', 'prctl', 'preexec_fn', 'ptrace', 'relay-seccomp-notify', 'relay_shell.seccomp', 'relay_shell_seccomp', 'resp', 'set_active', 'setgid', 'setns', 'setregid', 'setresgid', 'setresuid', 'setreuid', 'setuid', 'stmt', 'syscall_name', 'umount2', 'unshare', 'utf-8', 'x86_64']

{relay_shell-0.2.0 → relay_shell-0.3.0}/.hypothesis/constants/a5fe03a1c421948b

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/inventory.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 ['#', '*?!', '=', '@', 'HostSpec', 'Inventory', 'explicit', 'host', 'hostname', 'identity_file', 'identityfile', 'inventory', 'jump', 'known_hosts', 'name', 'port', 'proxyjump', 'replace', 'source', 'ssh_config', 'user', 'utf-8']

relay_shell-0.3.0/.hypothesis/constants/c7900d7ab9e5fea7

@@ -0,0 +1,4 @@
+# file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/patterns.py
+# hypothesis_version: 6.156.6
+
+['11', 'PATTERNS_VERSION', 'PRIV_ESC_PATTERN', 'REDACTION_PATTERNS', 'TIER2_PATTERN', 'TIER3_PATTERN', 'URL_CREDS_PATTERN', '[REDACTED]', '\\bAKIA[0-9A-Z]{16}\\b', '\\g<prefix>[REDACTED]']

{relay_shell-0.2.0 → relay_shell-0.3.0}/.hypothesis/constants/d78536b0c96f72a7

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/auth/__init__.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 ['FileOAuthProvider', 'build_auth_settings', 'make_oauth_provider']

relay_shell-0.2.0/.hypothesis/constants/a3d3e5c3935b6ab5 → relay_shell-0.3.0/.hypothesis/constants/d8887ef76582104d

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/auth/oauth.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 [384, 448, 511, '.tmp', 'Bearer', 'FileOAuthProvider', 'build_auth_settings', 'client_id', 'clients.json', 'code', 'code_challenge', 'codes.json', 'expires_at', 'invalid_grant', 'make_oauth_provider', 'mcp:tools', 'redirect_uri', 'refresh:', 'resource', 'scopes', 'state', 'token', 'tokens.json', 'utf-8', 'w']

relay_shell-0.3.0/.hypothesis/constants/e562d9f2652151f0

@@ -0,0 +1,4 @@
+# file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/broker.py
+# hypothesis_version: 6.156.6
+
+[256, 'Challenge', 'ConfirmationBroker']

relay_shell-0.3.0/.hypothesis/constants/f4684eb785e4fb5b

@@ -0,0 +1,4 @@
+# file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/audit.py
+# hypothesis_version: 6.156.6
+
+[b'\n', 384, 8192, '%(message)s', ',', '0', '1.0', '5', ':', '=', 'AUDIT %(message)s', 'AuditLogger', 'ChainResult', '\\', '\\=', '\\\\', '\\n', '\\r', '\\t', '\\|', 'action', 'args', 'audit', 'cap', 'cef', 'chain', 'client_id', 'denied', 'exit_code', 'jsonl', 'leef', 'nr', 'output_len', 'output_sha256', 'pid', 'prev', 'r', 'rb', 'relay-shell', 'relay_shell.audit', 'replace', 'request_id', 'seq', 'syscall', 'syscall_args', 'syscall_notify', 'tier', 'tool', 'tool-call', 'ts', 'utf-8', 'verify_chain', '|']

relay_shell-0.2.0/.hypothesis/constants/0eb061c63a8794f0 → relay_shell-0.3.0/.hypothesis/constants/f7f625a7f9fbf8e6

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/config.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 [120, 256, 300, 600, 900, 1024, 1800, 3600, 4096, 8080, 65535, 65536, 86400, 262144, 1048576, 2592000, 16777216, 134217728, '.env', '127.0.0.1', 'RELAY_SHELL_', 'Settings', 'accept-new', 'after', 'audit_format', 'cef', 'get_settings', 'guarded', 'http', 'ignore', 'jsonl', 'leef', 'open', 'policy_mode', 'readonly', 'ssh_known_hosts', 'stdio', 'strict', 'transport', 'utf-8', '~/.ssh/config']

{relay_shell-0.2.0 → relay_shell-0.3.0}/.hypothesis/constants/f947d359e3d0041d

@@ -1,4 +1,4 @@
 # file: /home/runner/work/relay-shell/relay-shell/src/relay_shell/shelltools.py
-# hypothesis_version: 6.155.7
+# hypothesis_version: 6.156.6
 
 ['-', '-s', '/bin/bash', '/bin/sh', '0', 'C.UTF-8', 'DEBIAN_FRONTEND', 'GIT_TERMINAL_PROMPT', 'LANG', 'PATH', 'bash', 'build_env', 'cwd', 'env', 'noninteractive', 'py', 'python', 'python3', 'replace', 'run_command', 'run_script', 'set -euo pipefail\n', 'sh', 'spawn_argv', 'start_new_session', 'stderr', 'stdin', 'stdout', 'utf-8']

{relay_shell-0.2.0 → relay_shell-0.3.0}/.pre-commit-config.yaml

@@ -15,7 +15,7 @@ repos:
     # Pin to a known-good ruff release. Update this `rev` and the
     # `ruff>=` floor in `[project.optional-dependencies] dev` together
     # so local pre-commit and `pip install -e ".[dev]"` agree.
-    rev: v0.15.17
+    rev: v0.15.20
     hooks:
       - id: ruff
         args: [--fix]

{relay_shell-0.2.0 → relay_shell-0.3.0}/BACKLOG.md

@@ -13,6 +13,38 @@ its kind is tracked (runbook §7 for capability/quality/ops/security-hardening,
 
 Severity order within each section: low before info; smaller effort first.
 
+## 2026-07-15 adversarial + performance pass
+
+Findings from the red-team + profiling pass
+([`audit/2026-07-15-adversarial-engagement.md`](audit/2026-07-15-adversarial-engagement.md)),
+prompted by "is everything lean, secure, performant?".
+
+Closed (engagement PR):
+
+| ID | Sev | Title | Resolution |
+|----|-----|-------|------------|
+| RED-6 | HIGH | JSON-quoted-key secret leak in redaction | Quote-tolerant separator + linear char-class value run on the generic + AWS `secret_access_key` rules (`PATTERNS_VERSION` 8). Paired JSON-shape over/under-scrub tests. |
+| RED-6a | HIGH | ReDoS introduced by the first RED-6 draft (lookahead O(n²)) | Replaced with a linear char-class matcher; 1 MB scan 165 s → 196 ms. Linearity regression test. |
+| P1 | MED | Redaction scanned the full untruncated arg on the event loop | `_scrub_str` bounds the scan to `max_len + 16 KiB`; 1–4 MB arg now constant ~12 ms. Bounded-scan test. Lossless for every truncation-safe pattern — see RED-8 for the one quoted-value edge the original "lossless" claim missed. |
+| POL-2 | MED | `TIER3_PATTERN` missed non-obfuscated `rm` long options | Bounded (`{0,16}`) long-option `rm` alternative; positive/negative + ReDoS-ceiling tests. |
+| SSH-4 | MED | Deny-list blind to host for `ssh_exec`/`ssh_spawn`/`ssh_fanout`/`ssh_check` | Fold the destination host (canonical-IP widened) into their deny probes; wiring test. |
+| BRK-3 | MED | Broker binding omitted SSH identity (`user`/`port`/`key_path`) | Added to `ssh_exec`/`ssh_spawn` audit_args → op-key binding + audit visibility; ADR 0009 follow-up; binding test. |
+
+Closed (post-engagement follow-up review):
+
+| ID | Sev | Title | Resolution |
+|----|-----|-------|------------|
+| RED-8 | MED | P1 scan-window leaked the tail of a quoted secret past the window | The CLI-flag rule's quoted-value branches required a closing quote and were length-unbounded, so a `--password="…"` value longer than `max_len + 16 KiB` lost its close quote to truncation → the quoted branch failed, the greedy bare fallback stopped at the first internal space, and the post-space tail leaked into the audit record (full-string redaction still caught it, so a P1 regression). Added unterminated-quote fallback branches consuming to end-of-line (`PATTERNS_VERSION` 9); well-formed values byte-identical. Authorization rule verified unaffected (its `$` branch already tolerates truncation). PoC + `test_red8_*` regressions + linearity check. |
+| AUTH-3 | LOW | OAuth `exchange_*` re-checked `client_id` but not `expires_at` | `exchange_authorization_code` / `exchange_refresh_token` enforced expiry only via their `load_*` gate, not atomically at exchange — a record valid at load could lapse in the load→exchange window (or a caller could reach exchange without load) and still mint a token (PoC: an expired code and an expired refresh both minted access tokens). Added an `expires_at` re-check after the existing `client_id` re-check in both paths (raise `invalid_grant`, drop the stale record), mirroring the file's defense-in-depth pattern. Not exploitable in the normal SDK flow (load runs first); closes the TOCTOU window. Paired `test_exchange_*_refuses_expired_*` regressions. |
+
+Open deferrals (low-priority perf; measure before acting — none on a hot path):
+
+| ID | Item | Sev | Effort | Rationale | Owner role |
+|----|------|-----|--------|-----------|------------|
+| PERF-1 | `AuditLogger._emit` does a synchronous file write+flush on the event loop (the read path is already offloaded via `asyncio.to_thread`) | low | S | Local append is fast; offload only if a slow/networked audit sink shows up. Consistency, not a measured stall. | maintainer |
+| PERF-2 | `SshPool._sweep_conns` is O(n) over cached connections under one lock per `connect()` | low | S | n is bounded by the connection cache (small); revisit only for very large fleets. | maintainer |
+| PERF-3 | `Session.buffer` uses `bytearray` front-deletion (memmove) on overflow/drain | low | S | Buffer is bounded (`session_buffer_bytes`); a deque-of-chunks would avoid the memmove if it ever matters. | maintainer |
+
 ## Closed (follow-up work after the audit pass)
 
 Resolved in the backlog-work PRs that followed the 2026-06-12 audit pass.
@@ -168,6 +200,31 @@ accepted-as-designed with Renovate evidence; see the Closed table above.)
 |---|---|---|---|---|---|
 | F-G2 | Branch protection on `main` — **fully resolved** (rules enumerated and hardened) | high (governance), now closed | S (done) | Prior packs (`audit/2026-06-01-engagement.md` §7.1) carried this as an open HIGH item ("`main` accepts direct pushes"). Resolved in two steps. 2026-06-12 (audit pass): the branches API reports `protected: true` [V]. 2026-06-12 (follow-up, via the Vertex-held `gh` credential): protection comes from ruleset `main-protection` (id 17307996; classic protection is unset), which enforced pull_request (0 approvals), non_fast_forward, deletion, and required_linear_history [V]. With operator confirmation (a T3 change per the operator's `github-vertex.md` contract), the ruleset gained `required_status_checks` — `check (py3.12)` / `check (py3.13)` / `check (py3.14)` / `gitleaks (secret scan)`, all bound to GitHub Actions, strict=false — and `required_signatures` (closing the prior pack's deferred **P2-3**). Verified effective post-change via `GET /repos/rmednitzer/relay-shell/rules/branches/main` [V]. pip-audit / dependency-review / CodeQL stay advisory by operator choice. | repo owner (executed with operator confirmation) |
 
+## 2026-07-15 full audit + Vertex/Axiom comparison pass
+
+Findings and lessons from the 2026-07-15 pass
+([`audit/2026-07-15-engagement.md`](audit/2026-07-15-engagement.md)). The
+scanner battery (pip-audit, trivy vuln+secret, bandit, semgrep, actionlint,
+shellcheck) was clean and no pinned dependency carries a known CVE; there were
+no P0/P1 findings. The pass compared `relay-shell` against two sibling MCP
+control planes and turned the highest-value lesson (L1) into shipped code.
+
+Closed (engagement PR):
+
+| ID | Title | Resolution |
+|---|---|---|
+| L1 (broker) | No per-call confirmation for irreversible ops | **Closed** (this PR). Implemented the opt-in Tier-3 confirmation broker: [ADR 0009](docs/adr/0009-tier3-confirmation-broker.md), `src/relay_shell/broker.py` (100% covered), `operation_confirm` tool (contract 21 → 22), `action=confirm_plan`/`confirm_execute` audit markers, `server_info.confirm` block. Default-off byte-identical; layered after the deny/mode check. |
+| DOC-1 | Living docs named the superseded pin (`mcp==1.27.2` / `asyncssh` 2.23.1) after Renovate moved it to `mcp==1.28.1` / `asyncssh==2.24.0` | **Closed** (this PR). Reconciled the README status line + compatibility matrix and the `docs/architecture.md` diagram; "last validated" → 2026-07-15. Frozen ADRs / prior engagement records left intact per convention. |
+| ENV-1 | `.env.example` missing `RELAY_SHELL_CONFIRM_TIER3` / `RELAY_SHELL_CONFIRM_TTL` | **Closed** (PR #129). Added the two commented vars mirroring `docs/deployment.md` §8a (this session couldn't edit `.env*` paths; done in a follow-up). |
+| DOC-6 (L3) | No deploy-host HIDS / config-drift guidance | **Closed** (DOC-6 PR). `docs/deployment.md` §3a "Host integrity + config-drift monitoring" documents etckeeper / AIDE / fail2ban / lynis as detection compensating for the intentionally-partial systemd confinement. Docs only. |
+| AUD-1 (L2) | No in-band audit verify / correlate tool | **Closed as a split disposition** (AUD-1 PR), after evaluating the lesson against ADR 0007 + the actual audit schema. **Shipped:** read-only triage filters on `audit_tail` (`tool`/`tier`/`denied`, Tier 0, tool contract unchanged) — the operator-diagnostic use case that already justifies `audit_tail`. **Declined:** in-band chain-*verify* stays the CLI `--verify-audit` (ADR 0007 — the audited model must not drive verification of its own trail). **N/A:** correlate-by-input-`sha256` — relay-shell hashes the *output*, not the input, so there is no input hash to correlate on. |
+
+Open deferrals (severity order; smaller effort first):
+
+| ID | Item | Sev | Effort | Rationale / approach | Owner role |
+|---|---|---|---|---|---|
+| OPS-2 (L4) | `pip-audit` has no KEV/EPSS exploit prioritization | info | S | Lesson from the comparison: layer Known-Exploited / EPSS signal on top of the existing `pip-audit` gate for prioritization. Advisory only — `pip-audit` already fails closed. Low value for the small pinned set; revisit if the dependency set grows. | maintainer |
+
 ## Notes on items NOT added here
 
 - No critical / high / medium **code** security findings were produced by