From f3f176b9e2be6a7ae9dbf04c122a49f4137bed69 Mon Sep 17 00:00:00 2001 From: garrytan Date: Tue, 3 Nov 2026 03:44:01 +0000 Subject: [PATCH 1/6] test(autoplan): failing-first: secret files and keys reach the lean reviewer's draft (GST-1164, #3914) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- test/autoplan-lean.test.ts | 50 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/test/autoplan-lean.test.ts b/test/autoplan-lean.test.ts index da8cd329a..9fa011d6f 100644 --- a/test/autoplan-lean.test.ts +++ b/test/autoplan-lean.test.ts @@ -388,6 +388,56 @@ describe('draft capture edges', () => { expect(diff).toContain('+export const attempts = new Map'); }); + const FAKE_KEY = ['sk', 'ant', 'api03', 'C'.repeat(93) + 'AA'].join('-'); + + test('the whole .env family and other secret files are left out before they are read (GST-1164, #3914)', () => { + const cwd = repo('envrc', true); + const files = ['.envrc', '.env-production', '.env_local', 'config/credentials-prod.json', '.ssh/id_ed25519_sk', '_netrc', '.git-credentials', '.pgpass']; + for (const f of files) { + fs.mkdirSync(path.dirname(path.join(cwd, f)), { recursive: true }); + fs.writeFileSync(path.join(cwd, f), `export ANTHROPIC_API_KEY=${FAKE_KEY}\n`); + } + const { ps, prompt } = lean('envrc', cwd); + const diff = fs.readFileSync(path.join(ps.snapshot_dir, 'draft.diff'), 'utf8'); + for (const text of [diff, prompt]) { + expect(text).not.toContain(FAKE_KEY.slice(0, 20)); + for (const f of files) expect(text).toContain(`# draft: untracked ${f} left out (its name looks like a secret)`); + } + expect(diff).toContain('+export const attempts = new Map'); + }); + + test('a secret file committed or edited on the branch is left out of the tracked diff too', () => { + const cwd = repo('tracked-envrc', true); + fs.writeFileSync(path.join(cwd, '.envrc'), `export ANTHROPIC_API_KEY=${FAKE_KEY}\n`); + git(cwd, 'add', '.envrc'); + git(cwd, 'commit', '-q', '-m', 'direnv'); + fs.appendFileSync(path.join(cwd, '.envrc'), 'export MORE=1\n'); + const { ps, prompt } = lean('tracked-envrc', cwd); + const diff = fs.readFileSync(path.join(ps.snapshot_dir, 'draft.diff'), 'utf8'); + for (const text of [diff, prompt]) { + expect(text).not.toContain(FAKE_KEY.slice(0, 20)); + expect(text).not.toContain('MORE=1'); + expect(text).toContain('# draft: .envrc left out (its name looks like a secret)'); + } + expect(ps.draft.files).toContain('.envrc'); + expect(diff).toContain('+export const JITTER = 0.1;'); + }); + + test('a key inside an ordinary file is redacted, untracked or edited in the working tree', () => { + const cwd = repo('redact', true); + fs.writeFileSync(path.join(cwd, 'lib', 'client.ts'), `export const KEY = '${FAKE_KEY}';\n`); + fs.appendFileSync(path.join(cwd, 'lib', 'worker.ts'), `const fallback = '${FAKE_KEY}';\n`); + const { ps, prompt } = lean('redact', cwd); + const diff = fs.readFileSync(path.join(ps.snapshot_dir, 'draft.diff'), 'utf8'); + for (const text of [diff, prompt]) { + expect(text).not.toContain(FAKE_KEY.slice(0, 20)); + expect(text).toMatch(/^\+export const KEY = ']+>';$/m); + expect(text).toMatch(/^\+const fallback = ']+>';$/m); + } + expect(diff).toContain('+export const JITTER = 0.1;'); + expect(ps.draft.sha256).toBe(sha256(fs.readFileSync(path.join(ps.snapshot_dir, 'draft.diff')))); + }); + test('the DRAFT line and the prompt name the checkout that was diffed', () => { const cwd = repo('root', true); const { r, ps, prompt } = lean('root', cwd); From e16009e054d5209731adeefd1b24e491cd3bef79 Mon Sep 17 00:00:00 2001 From: garrytan Date: Tue, 3 Nov 2026 03:44:01 +0000 Subject: [PATCH 2/6] fix(autoplan): keep the .env* family and secret files out of the lean draft, redact the rest (GST-1164, #3914) The lean reviewer's prompt goes to an outside model provider. captureDraft left out only some secret-named untracked files (.env and .env.*, not .envrc or .env-production), applied no name rule to tracked files and did no content check. Secret-named files are now never diffed, tracked or untracked, and every other patch goes through redactFindingSpans; a patch it cannot redact is left out with a note. Refs #3914 Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- changelog.d/gsta258-s1-envrc-redact.md | 9 +++++++++ docs/unattended.md | 11 ++++++++--- lib/autoplan-lean.ts | 27 ++++++++++++++++++-------- 3 files changed, 36 insertions(+), 11 deletions(-) create mode 100644 changelog.d/gsta258-s1-envrc-redact.md diff --git a/changelog.d/gsta258-s1-envrc-redact.md b/changelog.d/gsta258-s1-envrc-redact.md new file mode 100644 index 000000000..46a7d71ee --- /dev/null +++ b/changelog.d/gsta258-s1-envrc-redact.md @@ -0,0 +1,9 @@ +**Security: the lean /autoplan reviewer no longer gets `.envrc`, `.env-production` or a key pasted into an ordinary file (GST-1164, #3914).** Since v1.93.36.0 (#3897), the lean run puts the branch's draft code into a prompt that goes to an outside model provider. It left out only some secret-named untracked files: `.env` and `.env.*`, but not `.envrc` or `.env-production`. It applied no name rule to tracked files and no content check at all. So a direnv `.envrc`, a `.env-production`, a committed or edited secret file, or a key sitting in any source file could reach the provider. + +### Fixed +- **`lib/autoplan-lean.ts` `captureDraft`:** the secret-name rule now covers the whole `.env*` family, `.envrc` included, every `*credentials*` name, `_netrc`, `.pgpass`, `*.jks` and `id_*_sk` keys. Matching files are never diffed, tracked or untracked, and the draft names each one it left out. Every other file's patch goes through gstack's redact engine (`redactFindingSpans`), so a key in an ordinary file reaches the reviewer as ``. A patch the engine can't redact safely, including one over 1 MiB, is left out with a note. + +### Tests +- `test/autoplan-lean.test.ts`: an untracked `.envrc`, `.env-production` and six other secret files stay out of `draft.diff` and the prompt; a committed and edited `.envrc` stays out of the tracked diff; a fake key in an untracked file and in a working-tree edit to a tracked file comes out redacted. All three fail on main at b42ad1e. + +Thanks to the /ship pre-landing review of #3901, which filed the finding. diff --git a/docs/unattended.md b/docs/unattended.md index 08703d6b6..5f46e0517 100644 --- a/docs/unattended.md +++ b/docs/unattended.md @@ -385,9 +385,14 @@ The example above is the full run. The first `next` also takes `--kind`: hashed into `run.json` (`phases.eng.draft`) and the `phase_opened` journal row. With no code yet, the run says so: `DRAFT: none ()`. A git command that fails is `DRAFT: none (draft capture failed: …)`, never a - partial draft. An untracked file whose name looks like a secret (`.env*`, - `*.pem`, `*.key`, `id_rsa`, `credentials*`, `*secret*`) is left out with a - note, and the `DRAFT:` line names the checkout it diffed (`root=`). The prompt inlines the diff in a fence longer than any tilde + partial draft. The draft goes to a model provider, so a file whose name + looks like a secret (the whole `.env*` family, `.envrc` included, `*.pem`, + `*.key`, `*.p12`, `id_rsa` and the other SSH private keys, `.netrc`, + `.npmrc`, `.pgpass`, `*credentials*`, `*secret*`) is never read, tracked or + untracked, and is left out with a note. Every other file's patch goes + through the redact engine (`lib/redact-engine.ts`), so a key in an ordinary + file reaches the reviewer as ``; a patch it can't redact safely + is left out with a note. The `DRAFT:` line names the checkout it diffed (`root=`). The prompt inlines the diff in a fence longer than any tilde run inside it, cut at 100,000 bytes (`shown=` on the `DRAFT:` line) with a note asking the reviewer to name what it didn't see. The reviewer's line after INPUT names the draft (`DRAFT: ` or `DRAFT: none`), or diff --git a/lib/autoplan-lean.ts b/lib/autoplan-lean.ts index 57327b604..d690132f8 100644 --- a/lib/autoplan-lean.ts +++ b/lib/autoplan-lean.ts @@ -16,6 +16,7 @@ import * as fs from 'node:fs'; import * as path from 'node:path'; import { OUTSIDE_ROLE, sectionLoadFor, type Phase, type Scope } from './autoplan-prompts'; import { RunError, type RunState } from './autoplan-state'; +import { redactFindingSpans } from './redact-engine'; export const KINDS = ['fix', 'feature'] as const; export type AutoplanKind = typeof KINDS[number]; @@ -33,7 +34,7 @@ export const FIX_LINES = [ const LENS: Record = { ceo: 'CEO', design: 'Design', dx: 'DX', eng: 'Eng' }; const INLINE_DRAFT_BYTES = 100_000; const UNTRACKED_MAX = 200; -const SECRET_NAME = /(^|\/)(\.env(\.[^/]*)?|[^/]*\.(pem|key|p12|pfx|keystore)|id_(rsa|dsa|ecdsa|ed25519)|\.netrc|\.npmrc|\.pypirc|credentials(\.[^/]*)?|[^/]*secret[^/]*)$/i; +const SECRET_NAME = /(^|\/)(\.env[^/]*|[^/]*\.(pem|key|p12|pfx|keystore|jks)|id_(rsa|dsa|ecdsa|ed25519)(_sk)?|[._]netrc|\.npmrc|\.pypirc|\.pgpass|[^/]*credentials[^/]*|[^/]*secret[^/]*)$/i; /** The first next's mode: lean for --kind feature, or for an unattended Capy run that names no kind; --full and --ceo-only keep today's run. */ export function leanMode(o: { kind?: AutoplanKind; full?: boolean; ceoOnly?: boolean; base?: string; sessionKind: string; env: NodeJS.ProcessEnv }): LeanMode | undefined { @@ -56,7 +57,9 @@ export const draftLine = (d: DraftInput) => /** * The draft code against the base: tracked changes since the merge base (committed and not) plus untracked files, * the run directory excluded, written once to /draft.diff (read-only) and hashed. No git, no merge base, no - * change or a git command that failed is an honest none with its reason, never a partial draft. + * change or a git command that failed is an honest none with its reason, never a partial draft. The draft goes to + * a model provider, so a file whose name looks like a secret is never diffed (tracked or untracked), and every + * file's patch passes through the redact engine; one it cannot redact is left out with a note (GST-1164, #3914). */ export function captureDraft(cwd: string, dir: string, out: string, base?: string): DraftInput { const git = (args: string[], at = cwd) => spawnSync('git', ['-c', 'core.quotepath=off', ...args], { cwd: at, encoding: 'utf8', timeout: 60_000, maxBuffer: 256 * 1024 * 1024 }); @@ -73,19 +76,27 @@ export function captureDraft(cwd: string, dir: string, out: string, base?: strin const failed = (r: ReturnType, what: string, ok = [0]) => r.error || r.status === null || !ok.includes(r.status) ? `draft capture failed: ${what} ${r.error ? `errored (${r.error.message})` : `exited ${r.status ?? r.signal}`}${r.stderr?.trim() ? `: ${r.stderr.trim().split('\n')[0]}` : ''}` : undefined; const raw = ['diff', '--no-color', '--no-ext-diff', '--no-textconv']; - const tracked = git([...raw, mergeBase, '--'], root); - const names = git(['diff', '--name-only', mergeBase, '--'], root); + const names = git(['diff', '--name-only', '-z', mergeBase, '--'], root); const others = git(['ls-files', '--others', '--exclude-standard', '-z'], root); - const broken = failed(tracked, 'git diff') ?? failed(names, 'git diff --name-only') ?? failed(others, 'git ls-files'); + const listed = failed(names, 'git diff') ?? failed(others, 'git ls-files'); + if (listed) return { base: ref, none: listed }; + const changed = names.stdout.split('\0').filter(Boolean); + const secretTracked = changed.filter(f => SECRET_NAME.test(f)); + const tracked = git([...raw, mergeBase, '--', '.', ...secretTracked.map(f => `:(exclude,literal)${f}`)], root); + const broken = failed(tracked, 'git diff'); if (broken) return { base: ref, none: broken }; + const redacted = (patch: string, what: string) => redactFindingSpans(patch) ?? `# draft: ${what} left out (it could not be redacted safely)\n`; const untracked = others.stdout.split('\0').filter(f => f && !inRun(f)).sort(); - const parts = [tracked.stdout]; + const parts = [ + ...tracked.stdout.split(/^(?=diff --git )/m).map(p => redacted(p, p.slice(0, p.indexOf('\n')))), + ...secretTracked.map(f => `# draft: ${f} left out (its name looks like a secret)\n`), + ]; for (const f of untracked.slice(0, UNTRACKED_MAX)) { if (SECRET_NAME.test(f)) { parts.push(`# draft: untracked ${f} left out (its name looks like a secret)\n`); continue; } const d = git([...raw, '--no-index', '--', '/dev/null', f], root); const bad = failed(d, `git diff --no-index ${f}`, [0, 1]); if (bad) return { base: ref, none: bad }; - parts.push(d.stdout); + parts.push(redacted(d.stdout, `untracked ${f}`)); } if (untracked.length > UNTRACKED_MAX) parts.push(`# draft: ${untracked.length - UNTRACKED_MAX} more untracked files not shown\n`); const text = parts.join(''); @@ -94,7 +105,7 @@ export function captureDraft(cwd: string, dir: string, out: string, base?: strin fs.writeFileSync(file, text, process.platform === 'win32' ? { flag: 'wx' } : { flag: 'wx', mode: 0o444 }); const bytes = fs.readFileSync(file); return { base: ref, root, merge_base: mergeBase, sha256: crypto.createHash('sha256').update(bytes).digest('hex'), bytes: bytes.length, - ...(bytes.length > INLINE_DRAFT_BYTES ? { shown_bytes: INLINE_DRAFT_BYTES } : {}), files: [...new Set([...names.stdout.split('\n').filter(Boolean), ...untracked])].sort() }; + ...(bytes.length > INLINE_DRAFT_BYTES ? { shown_bytes: INLINE_DRAFT_BYTES } : {}), files: [...new Set([...changed, ...untracked])].sort() }; } /** The merged brief (before the shared blocks) and the receipt line (after RESULT FORMAT) a lean phase's native prompt adds. */ From 029ff4e0af5ebd559cd8bc784535f33ad97262f9 Mon Sep 17 00:00:00 2001 From: garrytan Date: Tue, 3 Nov 2026 03:56:52 +0000 Subject: [PATCH 3/6] fix(autoplan): list renames as delete and add so a renamed secret file stays out of the draft (GST-1164) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- changelog.d/gsta258-s1-envrc-redact.md | 4 ++-- lib/autoplan-lean.ts | 4 ++-- test/autoplan-lean.test.ts | 21 +++++++++++++++++++++ 3 files changed, 25 insertions(+), 4 deletions(-) diff --git a/changelog.d/gsta258-s1-envrc-redact.md b/changelog.d/gsta258-s1-envrc-redact.md index 46a7d71ee..4f374daae 100644 --- a/changelog.d/gsta258-s1-envrc-redact.md +++ b/changelog.d/gsta258-s1-envrc-redact.md @@ -1,9 +1,9 @@ **Security: the lean /autoplan reviewer no longer gets `.envrc`, `.env-production` or a key pasted into an ordinary file (GST-1164, #3914).** Since v1.93.36.0 (#3897), the lean run puts the branch's draft code into a prompt that goes to an outside model provider. It left out only some secret-named untracked files: `.env` and `.env.*`, but not `.envrc` or `.env-production`. It applied no name rule to tracked files and no content check at all. So a direnv `.envrc`, a `.env-production`, a committed or edited secret file, or a key sitting in any source file could reach the provider. ### Fixed -- **`lib/autoplan-lean.ts` `captureDraft`:** the secret-name rule now covers the whole `.env*` family, `.envrc` included, every `*credentials*` name, `_netrc`, `.pgpass`, `*.jks` and `id_*_sk` keys. Matching files are never diffed, tracked or untracked, and the draft names each one it left out. Every other file's patch goes through gstack's redact engine (`redactFindingSpans`), so a key in an ordinary file reaches the reviewer as ``. A patch the engine can't redact safely, including one over 1 MiB, is left out with a note. +- **`lib/autoplan-lean.ts` `captureDraft`:** the secret-name rule now covers the whole `.env*` family, `.envrc` included, every `*credentials*` name, `_netrc`, `.pgpass`, `*.jks` and `id_*_sk` keys. Matching files are never diffed, tracked or untracked, and the draft names each one it left out. Renames are listed as a delete and an add, so a secret file renamed on the branch stays out under both names. Every other file's patch goes through gstack's redact engine (`redactFindingSpans`), so a key in an ordinary file reaches the reviewer as ``. A patch the engine can't redact safely, including one over 1 MiB, is left out with a note. ### Tests -- `test/autoplan-lean.test.ts`: an untracked `.envrc`, `.env-production` and six other secret files stay out of `draft.diff` and the prompt; a committed and edited `.envrc` stays out of the tracked diff; a fake key in an untracked file and in a working-tree edit to a tracked file comes out redacted. All three fail on main at b42ad1e. +- `test/autoplan-lean.test.ts`: an untracked `.envrc`, `.env-production` and six other secret files stay out of `draft.diff` and the prompt; a committed and edited `.envrc` stays out of the tracked diff, and so does one renamed to `.envrc.local`; a fake key in an untracked file and in a working-tree edit to a tracked file comes out redacted. All four fail on main at b42ad1e. Thanks to the /ship pre-landing review of #3901, which filed the finding. diff --git a/lib/autoplan-lean.ts b/lib/autoplan-lean.ts index d690132f8..bc84ceea6 100644 --- a/lib/autoplan-lean.ts +++ b/lib/autoplan-lean.ts @@ -75,8 +75,8 @@ export function captureDraft(cwd: string, dir: string, out: string, base?: strin const inRun = (f: string) => !runDir.startsWith('..') && !path.isAbsolute(runDir) && (runDir === '' || f === runDir || f.startsWith(`${runDir}/`)); const failed = (r: ReturnType, what: string, ok = [0]) => r.error || r.status === null || !ok.includes(r.status) ? `draft capture failed: ${what} ${r.error ? `errored (${r.error.message})` : `exited ${r.status ?? r.signal}`}${r.stderr?.trim() ? `: ${r.stderr.trim().split('\n')[0]}` : ''}` : undefined; - const raw = ['diff', '--no-color', '--no-ext-diff', '--no-textconv']; - const names = git(['diff', '--name-only', '-z', mergeBase, '--'], root); + const raw = ['diff', '--no-color', '--no-ext-diff', '--no-textconv', '--no-renames']; + const names = git(['diff', '--name-only', '-z', '--no-renames', mergeBase, '--'], root); const others = git(['ls-files', '--others', '--exclude-standard', '-z'], root); const listed = failed(names, 'git diff') ?? failed(others, 'git ls-files'); if (listed) return { base: ref, none: listed }; diff --git a/test/autoplan-lean.test.ts b/test/autoplan-lean.test.ts index 9fa011d6f..79abe33ce 100644 --- a/test/autoplan-lean.test.ts +++ b/test/autoplan-lean.test.ts @@ -423,6 +423,27 @@ describe('draft capture edges', () => { expect(diff).toContain('+export const JITTER = 0.1;'); }); + test('a secret file renamed on the branch stays out under both names', () => { + const cwd = repo('rename-envrc', false); + git(cwd, 'checkout', '-q', 'main'); + fs.writeFileSync(path.join(cwd, '.envrc'), 'dotenv_if_exists marker-zz9-old\n'); + git(cwd, 'add', '.envrc'); + git(cwd, 'commit', '-q', '-m', 'direnv'); + git(cwd, 'checkout', '-q', 'feature'); + git(cwd, 'merge', '-q', 'main'); + git(cwd, 'mv', '.envrc', '.envrc.local'); + fs.appendFileSync(path.join(cwd, '.envrc.local'), 'dotenv_if_exists marker-zz9-new\n'); + fs.appendFileSync(path.join(cwd, 'lib', 'worker.ts'), 'export const JITTER = 0.1;\n'); + const { ps, prompt } = lean('rename-envrc', cwd); + const diff = fs.readFileSync(path.join(ps.snapshot_dir, 'draft.diff'), 'utf8'); + for (const text of [diff, prompt]) { + expect(text).not.toContain('marker-zz9'); + expect(text).toContain('# draft: .envrc left out (its name looks like a secret)'); + expect(text).toContain('# draft: .envrc.local left out (its name looks like a secret)'); + } + expect(diff).toContain('+export const JITTER = 0.1;'); + }); + test('a key inside an ordinary file is redacted, untracked or edited in the working tree', () => { const cwd = repo('redact', true); fs.writeFileSync(path.join(cwd, 'lib', 'client.ts'), `export const KEY = '${FAKE_KEY}';\n`); From f1e40af14bc391e1ab38a0e3c5d78bd5ed67e3ff Mon Sep 17 00:00:00 2001 From: garrytan Date: Tue, 3 Nov 2026 04:00:00 +0000 Subject: [PATCH 4/6] test(autoplan): isolate the lean draft tests from global git config Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- test/autoplan-lean.test.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/test/autoplan-lean.test.ts b/test/autoplan-lean.test.ts index 79abe33ce..8716fadcc 100644 --- a/test/autoplan-lean.test.ts +++ b/test/autoplan-lean.test.ts @@ -21,9 +21,11 @@ const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'ap-lean-')); afterAll(() => fs.rmSync(TMP, { recursive: true, force: true })); const sha256 = (b: string | Buffer) => crypto.createHash('sha256').update(b).digest('hex'); const OFF_CAPY = { GSTACK_CAPY: '' }; +const GIT_ISOLATED = { GIT_CONFIG_GLOBAL: path.join(TMP, 'empty-gitconfig'), GIT_CONFIG_NOSYSTEM: '1' }; +fs.writeFileSync(GIT_ISOLATED.GIT_CONFIG_GLOBAL, ''); function git(cwd: string, ...args: string[]): string { - const r = spawnSync('git', ['-c', 'user.name=fixture', '-c', 'user.email=fixture@example.com', '-c', 'commit.gpgsign=false', ...args], { cwd, encoding: 'utf8', timeout: 30_000 }); + const r = spawnSync('git', ['-c', 'user.name=fixture', '-c', 'user.email=fixture@example.com', '-c', 'commit.gpgsign=false', ...args], { cwd, encoding: 'utf8', timeout: 30_000, env: { ...process.env, ...GIT_ISOLATED } }); if (r.status !== 0) throw new Error(`git ${args.join(' ')}: ${r.stderr}`); return r.stdout; } @@ -323,8 +325,9 @@ describe('which runs are lean', () => { }); describe('draft capture edges', () => { + const isolated = { ...OFF_CAPY, ...GIT_ISOLATED }; const lean = (name: string, cwd: string, out = path.join(TMP, name, 'run'), base = 'main') => { - const r = run(['next', '--kind', 'feature', '--base', base, '--out', out, '--plan', plan(name), '--no-ui'], cwd); + const r = run(['next', '--kind', 'feature', '--base', base, '--out', out, '--plan', plan(name), '--no-ui'], cwd, isolated); if (r.status !== 0) throw new Error(`${r.stderr}\n${r.stdout}`); return { r, ps: readRun(out).phases.eng, prompt: fs.readFileSync(path.join(out, 'eng-native-prompt.md'), 'utf8') }; }; From f8571f33d5a3ecc931e7acc544e1167cca30d69f Mon Sep 17 00:00:00 2001 From: garrytan Date: Tue, 3 Nov 2026 04:09:15 +0000 Subject: [PATCH 5/6] fix(autoplan): keep compact renames and leave out both sides of a secret file renamed or copied on the branch (GST-1164) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- changelog.d/gsta258-s1-envrc-redact.md | 4 ++-- docs/unattended.md | 3 ++- lib/autoplan-lean.ts | 18 ++++++++++++------ test/autoplan-lean.test.ts | 12 +++++++----- 4 files changed, 23 insertions(+), 14 deletions(-) diff --git a/changelog.d/gsta258-s1-envrc-redact.md b/changelog.d/gsta258-s1-envrc-redact.md index 4f374daae..ab0b6444a 100644 --- a/changelog.d/gsta258-s1-envrc-redact.md +++ b/changelog.d/gsta258-s1-envrc-redact.md @@ -1,9 +1,9 @@ **Security: the lean /autoplan reviewer no longer gets `.envrc`, `.env-production` or a key pasted into an ordinary file (GST-1164, #3914).** Since v1.93.36.0 (#3897), the lean run puts the branch's draft code into a prompt that goes to an outside model provider. It left out only some secret-named untracked files: `.env` and `.env.*`, but not `.envrc` or `.env-production`. It applied no name rule to tracked files and no content check at all. So a direnv `.envrc`, a `.env-production`, a committed or edited secret file, or a key sitting in any source file could reach the provider. ### Fixed -- **`lib/autoplan-lean.ts` `captureDraft`:** the secret-name rule now covers the whole `.env*` family, `.envrc` included, every `*credentials*` name, `_netrc`, `.pgpass`, `*.jks` and `id_*_sk` keys. Matching files are never diffed, tracked or untracked, and the draft names each one it left out. Renames are listed as a delete and an add, so a secret file renamed on the branch stays out under both names. Every other file's patch goes through gstack's redact engine (`redactFindingSpans`), so a key in an ordinary file reaches the reviewer as ``. A patch the engine can't redact safely, including one over 1 MiB, is left out with a note. +- **`lib/autoplan-lean.ts` `captureDraft`:** the secret-name rule now covers the whole `.env*` family, `.envrc` included, every `*credentials*` name, `_netrc`, `.pgpass`, `*.jks` and `id_*_sk` keys. Matching files are never diffed, tracked or untracked, and the draft names each one it left out. A secret-named file renamed or copied on the branch stays out under both names, even when the new name looks ordinary. Every other file's patch goes through gstack's redact engine (`redactFindingSpans`), so a key in an ordinary file reaches the reviewer as ``. A patch the engine can't redact safely, including one over 1 MiB, is left out with a note. ### Tests -- `test/autoplan-lean.test.ts`: an untracked `.envrc`, `.env-production` and six other secret files stay out of `draft.diff` and the prompt; a committed and edited `.envrc` stays out of the tracked diff, and so does one renamed to `.envrc.local`; a fake key in an untracked file and in a working-tree edit to a tracked file comes out redacted. All four fail on main at b42ad1e. +- `test/autoplan-lean.test.ts`: an untracked `.envrc`, `.env-production` and six other secret files stay out of `draft.diff` and the prompt; a committed and edited `.envrc` stays out of the tracked diff, and so do an `.envrc` renamed to `.envrc.local` and a `.pgpass` renamed to `pg.txt`; a fake key in an untracked file and in a working-tree edit to a tracked file comes out redacted. All four fail on main at b42ad1e. Thanks to the /ship pre-landing review of #3901, which filed the finding. diff --git a/docs/unattended.md b/docs/unattended.md index 5f46e0517..be490f6b5 100644 --- a/docs/unattended.md +++ b/docs/unattended.md @@ -389,7 +389,8 @@ The example above is the full run. The first `next` also takes `--kind`: looks like a secret (the whole `.env*` family, `.envrc` included, `*.pem`, `*.key`, `*.p12`, `id_rsa` and the other SSH private keys, `.netrc`, `.npmrc`, `.pgpass`, `*credentials*`, `*secret*`) is never read, tracked or - untracked, and is left out with a note. Every other file's patch goes + untracked, and is left out with a note; so is a file renamed or copied from + one on the branch. Every other file's patch goes through the redact engine (`lib/redact-engine.ts`), so a key in an ordinary file reaches the reviewer as ``; a patch it can't redact safely is left out with a note. The `DRAFT:` line names the checkout it diffed (`root=`). The prompt inlines the diff in a fence longer than any tilde diff --git a/lib/autoplan-lean.ts b/lib/autoplan-lean.ts index bc84ceea6..d27efe67f 100644 --- a/lib/autoplan-lean.ts +++ b/lib/autoplan-lean.ts @@ -75,21 +75,27 @@ export function captureDraft(cwd: string, dir: string, out: string, base?: strin const inRun = (f: string) => !runDir.startsWith('..') && !path.isAbsolute(runDir) && (runDir === '' || f === runDir || f.startsWith(`${runDir}/`)); const failed = (r: ReturnType, what: string, ok = [0]) => r.error || r.status === null || !ok.includes(r.status) ? `draft capture failed: ${what} ${r.error ? `errored (${r.error.message})` : `exited ${r.status ?? r.signal}`}${r.stderr?.trim() ? `: ${r.stderr.trim().split('\n')[0]}` : ''}` : undefined; - const raw = ['diff', '--no-color', '--no-ext-diff', '--no-textconv', '--no-renames']; - const names = git(['diff', '--name-only', '-z', '--no-renames', mergeBase, '--'], root); + const raw = ['diff', '--no-color', '--no-ext-diff', '--no-textconv']; + const names = git(['diff', '--name-status', '-z', '-M', '-C', mergeBase, '--'], root); const others = git(['ls-files', '--others', '--exclude-standard', '-z'], root); const listed = failed(names, 'git diff') ?? failed(others, 'git ls-files'); if (listed) return { base: ref, none: listed }; - const changed = names.stdout.split('\0').filter(Boolean); - const secretTracked = changed.filter(f => SECRET_NAME.test(f)); - const tracked = git([...raw, mergeBase, '--', '.', ...secretTracked.map(f => `:(exclude,literal)${f}`)], root); + const fields = names.stdout.split('\0'); + const changed: string[] = []; + const secretTracked: string[][] = []; + for (let i = 0; fields[i];) { + const entry = /^[RC]/.test(fields[i++]!) ? [fields[i++]!, fields[i++]!] : [fields[i++]!]; + changed.push(...entry); + if (entry.some(f => SECRET_NAME.test(f))) secretTracked.push(entry); + } + const tracked = git([...raw, '-M', mergeBase, '--', '.', ...secretTracked.flat().map(f => `:(exclude,literal)${f}`)], root); const broken = failed(tracked, 'git diff'); if (broken) return { base: ref, none: broken }; const redacted = (patch: string, what: string) => redactFindingSpans(patch) ?? `# draft: ${what} left out (it could not be redacted safely)\n`; const untracked = others.stdout.split('\0').filter(f => f && !inRun(f)).sort(); const parts = [ ...tracked.stdout.split(/^(?=diff --git )/m).map(p => redacted(p, p.slice(0, p.indexOf('\n')))), - ...secretTracked.map(f => `# draft: ${f} left out (its name looks like a secret)\n`), + ...secretTracked.map(e => `# draft: ${e.join(' -> ')} left out (${e.length > 1 ? 'a rename or copy of a file whose name looks like a secret' : 'its name looks like a secret'})\n`), ]; for (const f of untracked.slice(0, UNTRACKED_MAX)) { if (SECRET_NAME.test(f)) { parts.push(`# draft: untracked ${f} left out (its name looks like a secret)\n`); continue; } diff --git a/test/autoplan-lean.test.ts b/test/autoplan-lean.test.ts index 8716fadcc..449b5b3f2 100644 --- a/test/autoplan-lean.test.ts +++ b/test/autoplan-lean.test.ts @@ -430,21 +430,23 @@ describe('draft capture edges', () => { const cwd = repo('rename-envrc', false); git(cwd, 'checkout', '-q', 'main'); fs.writeFileSync(path.join(cwd, '.envrc'), 'dotenv_if_exists marker-zz9-old\n'); - git(cwd, 'add', '.envrc'); + fs.writeFileSync(path.join(cwd, '.pgpass'), 'db.example.com:5432:app:bot:marker-zz9-pg\n'); + git(cwd, 'add', '.envrc', '.pgpass'); git(cwd, 'commit', '-q', '-m', 'direnv'); git(cwd, 'checkout', '-q', 'feature'); git(cwd, 'merge', '-q', 'main'); git(cwd, 'mv', '.envrc', '.envrc.local'); fs.appendFileSync(path.join(cwd, '.envrc.local'), 'dotenv_if_exists marker-zz9-new\n'); - fs.appendFileSync(path.join(cwd, 'lib', 'worker.ts'), 'export const JITTER = 0.1;\n'); + git(cwd, 'mv', '.pgpass', 'pg.txt'); + git(cwd, 'mv', 'lib/worker.ts', 'lib/retry.ts'); const { ps, prompt } = lean('rename-envrc', cwd); const diff = fs.readFileSync(path.join(ps.snapshot_dir, 'draft.diff'), 'utf8'); for (const text of [diff, prompt]) { expect(text).not.toContain('marker-zz9'); - expect(text).toContain('# draft: .envrc left out (its name looks like a secret)'); - expect(text).toContain('# draft: .envrc.local left out (its name looks like a secret)'); + expect(text).toContain('# draft: .envrc -> .envrc.local left out (a rename or copy of a file whose name looks like a secret)'); + expect(text).toContain('# draft: .pgpass -> pg.txt left out (a rename or copy of a file whose name looks like a secret)'); } - expect(diff).toContain('+export const JITTER = 0.1;'); + expect(diff).toContain('rename from lib/worker.ts\nrename to lib/retry.ts'); }); test('a key inside an ordinary file is redacted, untracked or edited in the working tree', () => { From e8aef87443877ac787c21ef0558a2858824b0f34 Mon Sep 17 00:00:00 2001 From: garrytan Date: Tue, 3 Nov 2026 04:15:40 +0000 Subject: [PATCH 6/6] docs(autoplan): say which renames and copies the lean draft name rule catches (GST-1164) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- changelog.d/gsta258-s1-envrc-redact.md | 2 +- docs/unattended.md | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/changelog.d/gsta258-s1-envrc-redact.md b/changelog.d/gsta258-s1-envrc-redact.md index ab0b6444a..113ecb7dc 100644 --- a/changelog.d/gsta258-s1-envrc-redact.md +++ b/changelog.d/gsta258-s1-envrc-redact.md @@ -1,7 +1,7 @@ **Security: the lean /autoplan reviewer no longer gets `.envrc`, `.env-production` or a key pasted into an ordinary file (GST-1164, #3914).** Since v1.93.36.0 (#3897), the lean run puts the branch's draft code into a prompt that goes to an outside model provider. It left out only some secret-named untracked files: `.env` and `.env.*`, but not `.envrc` or `.env-production`. It applied no name rule to tracked files and no content check at all. So a direnv `.envrc`, a `.env-production`, a committed or edited secret file, or a key sitting in any source file could reach the provider. ### Fixed -- **`lib/autoplan-lean.ts` `captureDraft`:** the secret-name rule now covers the whole `.env*` family, `.envrc` included, every `*credentials*` name, `_netrc`, `.pgpass`, `*.jks` and `id_*_sk` keys. Matching files are never diffed, tracked or untracked, and the draft names each one it left out. A secret-named file renamed or copied on the branch stays out under both names, even when the new name looks ordinary. Every other file's patch goes through gstack's redact engine (`redactFindingSpans`), so a key in an ordinary file reaches the reviewer as ``. A patch the engine can't redact safely, including one over 1 MiB, is left out with a note. +- **`lib/autoplan-lean.ts` `captureDraft`:** the secret-name rule now covers the whole `.env*` family, `.envrc` included, every `*credentials*` name, `_netrc`, `.pgpass`, `*.jks` and `id_*_sk` keys. Matching files are never diffed, tracked or untracked, and the draft names each one it left out. A secret-named file that git sees renamed or copied on the branch stays out under both names, even when the new name looks ordinary. A secret moved without `git add`, copied unchanged, or renamed and heavily edited still reaches the draft under its new name, guarded only by the content check. Every other file's patch goes through gstack's redact engine (`redactFindingSpans`), so a key in an ordinary file reaches the reviewer as ``. A patch the engine can't redact safely, including one over 1 MiB, is left out with a note. ### Tests - `test/autoplan-lean.test.ts`: an untracked `.envrc`, `.env-production` and six other secret files stay out of `draft.diff` and the prompt; a committed and edited `.envrc` stays out of the tracked diff, and so do an `.envrc` renamed to `.envrc.local` and a `.pgpass` renamed to `pg.txt`; a fake key in an untracked file and in a working-tree edit to a tracked file comes out redacted. All four fail on main at b42ad1e. diff --git a/docs/unattended.md b/docs/unattended.md index be490f6b5..913dce009 100644 --- a/docs/unattended.md +++ b/docs/unattended.md @@ -389,8 +389,10 @@ The example above is the full run. The first `next` also takes `--kind`: looks like a secret (the whole `.env*` family, `.envrc` included, `*.pem`, `*.key`, `*.p12`, `id_rsa` and the other SSH private keys, `.netrc`, `.npmrc`, `.pgpass`, `*credentials*`, `*secret*`) is never read, tracked or - untracked, and is left out with a note; so is a file renamed or copied from - one on the branch. Every other file's patch goes + untracked, and is left out with a note; so is either side of a rename or + copy git detects in the branch's commits or staged changes. A secret moved + without `git add`, copied unchanged, or renamed and heavily edited reaches + the draft under its new name, guarded only by the content check. Every other file's patch goes through the redact engine (`lib/redact-engine.ts`), so a key in an ordinary file reaches the reviewer as ``; a patch it can't redact safely is left out with a note. The `DRAFT:` line names the checkout it diffed (`root=`). The prompt inlines the diff in a fence longer than any tilde