toolgovern-cli 0.1.5__tar.gz → 0.2.0__tar.gz

{toolgovern_cli-0.1.5 → toolgovern_cli-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: toolgovern-cli
-Version: 0.1.5
+Version: 0.2.0
 Summary: Runtime governance middleware for AI agent tool calls -- gate shell, filesystem, network, and credential access before a tool executes.
 Project-URL: Homepage, https://github.com/RudrenduPaul/toolgovern
 Project-URL: Repository, https://github.com/RudrenduPaul/toolgovern
@@ -27,7 +27,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.9
-Requires-Dist: cryptography<49,>=48.0.1
+Requires-Dist: cryptography<51,>=48.0.1
 Requires-Dist: pyyaml<7,>=6.0
 Provides-Extra: dev
 Requires-Dist: build<2,>=1.0; extra == 'dev'
@@ -38,6 +38,7 @@ Requires-Dist: mcp[cli]>=2.0.0; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 <!-- mcp-name: io.github.RudrenduPaul/toolgovern -->
+
 # toolgovern (Python)
 
 Gate every tool call an AI agent makes -- shell, filesystem, network, credential access -- before
@@ -339,7 +340,7 @@ run(args=["validate", "./toolgovern.policy.yml", "--json"])
 This is a generic subprocess wrapper around the real CLI (not a second implementation of each
 subcommand), so it stays in sync with `validate`, `audit`, and any future subcommand
 automatically. This is distinct from toolgovern's `mcp_trust` module, which is a client-side
-tool for verifying the trustworthiness of *other* MCP servers an agent connects to -- this
+tool for verifying the trustworthiness of _other_ MCP servers an agent connects to -- this
 section is about toolgovern-cli exposing its own MCP server for agents to call.
 
 ## The signed audit trail

{toolgovern_cli-0.1.5 → toolgovern_cli-0.2.0}/README.md

@@ -1,4 +1,5 @@
 <!-- mcp-name: io.github.RudrenduPaul/toolgovern -->
+
 # toolgovern (Python)
 
 Gate every tool call an AI agent makes -- shell, filesystem, network, credential access -- before
@@ -300,7 +301,7 @@ run(args=["validate", "./toolgovern.policy.yml", "--json"])
 This is a generic subprocess wrapper around the real CLI (not a second implementation of each
 subcommand), so it stays in sync with `validate`, `audit`, and any future subcommand
 automatically. This is distinct from toolgovern's `mcp_trust` module, which is a client-side
-tool for verifying the trustworthiness of *other* MCP servers an agent connects to -- this
+tool for verifying the trustworthiness of _other_ MCP servers an agent connects to -- this
 section is about toolgovern-cli exposing its own MCP server for agents to call.
 
 ## The signed audit trail

{toolgovern_cli-0.1.5 → toolgovern_cli-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "toolgovern-cli"
-version = "0.1.5"
+version = "0.2.0"
 description = "Runtime governance middleware for AI agent tool calls -- gate shell, filesystem, network, and credential access before a tool executes."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -31,7 +31,7 @@ classifiers = [
 ]
 dependencies = [
   "PyYAML>=6.0,<7",
-  "cryptography>=48.0.1,<49",
+  "cryptography>=48.0.1,<51",
 ]
 
 [project.optional-dependencies]

{toolgovern_cli-0.1.5 → toolgovern_cli-0.2.0}/src/toolgovern/shared/paths.py

@@ -15,8 +15,18 @@ _BRACKETED_HOST_PATTERN = re.compile(r"^\[([^\]]+)\]")
 
 
 def normalize_path(raw_path: str) -> str:
-    """Collapses ``./``, trailing slashes, and duplicate slashes for stable prefix comparison."""
+    """Collapses ``./``, trailing slashes, and duplicate slashes for stable prefix comparison.
+
+    Backslashes are treated as path separators too -- the same as forward slashes -- regardless
+    of the host OS this code happens to run on. A declared scope must hold whether the target
+    path is destined for a Windows filesystem (where ``\\`` is the native separator) or is simply
+    an attacker-supplied string mixing separators to dodge a ``/``-only prefix check; without
+    this, a path like ``/allowed/sub\\..\\..\\..\\secrets`` compares as a literal child of
+    ``/allowed`` even though it resolves outside it once backslashes are treated as separators
+    downstream.
+    """
     path = raw_path.strip()
+    path = path.replace("\\", "/")
     if path.startswith("./"):
         path = path[2:]
     path = re.sub(r"/+", "/", path)
@@ -37,8 +47,13 @@ def is_path_within(candidate: str, prefix: str) -> bool:
 
 
 def contains_path_traversal(raw_path: str) -> bool:
-    """True if the path contains a ``..`` segment that could escape a scoped prefix via traversal."""
-    return ".." in raw_path.split("/")
+    """True if the path contains a ``..`` segment that could escape a scoped prefix via traversal.
+
+    Splits on both ``/`` and ``\\`` (see ``normalize_path`` above for why backslash must count as
+    a separator here too) so ``sub\\..\\..\\..\\secrets`` is caught exactly like
+    ``sub/../../../secrets``.
+    """
+    return ".." in re.split(r"[/\\]", raw_path)
 
 
 def normalize_host(host_like: str) -> str:

{toolgovern_cli-0.1.5 → toolgovern_cli-0.2.0}/tests/test_classifier_filesystem_scope.py

@@ -121,6 +121,37 @@ class TestPathTraversal:
         decision, ids = _fired(ctx)
         assert "TG02-path-traversal" in ids
 
+    # 2026-08-24 security fix: `contains_path_traversal`/`is_path_within`
+    # (python/src/toolgovern/shared/paths.py) used to split only on "/", so a backslash-delimited
+    # ".." segment (e.g. "sub\..\..\..\secrets") was never recognized as traversal -- the same
+    # string compared as a literal in-scope child of the declared prefix because it happened to
+    # start with the right characters, letting a sub-agent escape its declared filesystem scope
+    # undetected. Identical bug in the TypeScript and .NET ports; all three share this fix.
+    def test_fires_on_backslash_delimited_dotdot(self, ctx_factory):
+        ctx = ctx_factory(
+            {"path": "/workspace/sub\\..\\..\\..\\secrets", "operation": "write"},
+            scope=ScopeDeclaration(filesystem=["/workspace"]),
+        )
+        decision, ids = _fired(ctx)
+        assert decision == "deny"
+        assert "TG02-path-traversal" in ids
+
+    def test_fires_on_bare_backslash_traversal(self, ctx_factory):
+        ctx = ctx_factory(
+            {"path": "..\\..\\secrets", "operation": "read"},
+            scope=ScopeDeclaration(filesystem=["/workspace"]),
+        )
+        decision, ids = _fired(ctx)
+        assert "TG02-path-traversal" in ids
+
+    def test_fires_on_mixed_separator_traversal(self, ctx_factory):
+        ctx = ctx_factory(
+            {"path": "/workspace/sub/..\\../etc/passwd", "operation": "write"},
+            scope=ScopeDeclaration(filesystem=["/workspace"]),
+        )
+        decision, ids = _fired(ctx)
+        assert "TG02-path-traversal" in ids
+
 
 class TestSymlinkEscape:
     def test_fires_outside_scope(self, ctx_factory):

toolgovern_cli-0.2.0/tests/test_shared_paths.py

@@ -0,0 +1,43 @@
+"""Unit tests for toolgovern.shared.paths -- 2026-08-24 security fix.
+
+Previously ``normalize_path``/``contains_path_traversal`` only split on "/", so a backslash-
+delimited ".." segment was invisible to traversal detection, and a scope prefix like "/allowed"
+would treat any candidate that merely started with the literal string "/allowed/" as in-scope even
+when the remainder was pure backslash-delimited traversal
+(``/allowed/sub\\..\\..\\..\\secrets``). This undercut the "sub-agent can't reach outside its
+declared scope" guarantee identically across the TypeScript, Python, and .NET ports.
+"""
+
+from toolgovern.shared.paths import contains_path_traversal, is_path_within, normalize_path
+
+
+def test_normalize_path_converts_backslashes_to_forward_slashes():
+    assert normalize_path("workspace\\sub\\file.txt") == "workspace/sub/file.txt"
+
+
+def test_normalize_path_collapses_mixed_separators_consistently():
+    assert normalize_path("./workspace\\sub/../file.txt") == "workspace/sub/../file.txt"
+
+
+def test_contains_path_traversal_detects_backslash_delimited_dotdot():
+    assert contains_path_traversal("sub\\..\\..\\..\\secrets") is True
+
+
+def test_contains_path_traversal_detects_mixed_separator_dotdot():
+    assert contains_path_traversal("sub/..\\../secrets") is True
+
+
+def test_contains_path_traversal_false_for_clean_backslash_path():
+    assert contains_path_traversal("workspace\\sub\\file.txt") is False
+
+
+def test_contains_path_traversal_still_detects_forward_slash_case():
+    assert contains_path_traversal("../../etc/passwd") is True
+
+
+def test_is_path_within_still_recognizes_nested_path_as_in_scope():
+    assert is_path_within("/allowed/sub/dir/file.txt", "/allowed") is True
+
+
+def test_is_path_within_still_rejects_unrelated_path():
+    assert is_path_within("/other/dir/file.txt", "/allowed") is False