BitSquare/Codeman
2
0
Fork 0
mirror of https://github.com/Ark0N/Codeman.git synced 2026-09-30 12:39:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

review fixes: block Codeman's own credential-bearing JSON, make the inside-anchor test bite

Browse Source 
Widening the servable extensions to EDITABLE_EXTENSIONS made ~/.codeman
JSON previewable for the first time, and the blocklist named only
state.json. But settings.json holds a credential BY SCHEMA
(voiceSettings.apiKey), push-keys.json holds the VAPID PRIVATE key, and
intents.json is written 0600 precisely because captured prompts can carry
secrets — all three were one authenticated click away once an agent
printed the path. Blocked alongside state.json, whose rule now also
catches state-* siblings.

The never-re-cuts-inside-an-anchor test used an unmatchable URL tail, so
it passed with the guard deleted; the fixture now carries a matchable
/tmp path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Codeman maintainer
2026-08-16 19:21:43 +02:00
parent da999b130e
commit ea4b940cef
3 changed files with 30 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/web/sensitive-path.ts
+17 -6
View File
@@ -80,12 +80,23 @@ const SENSITIVE_PATTERNS: RegExp[] = [
/\/\.claude\/\.credentials\.json$/,
/\/\.codeman[^/]*\/hook-secret$/,
/\/\.codeman[^/]*\/users\.json$/,
// Codeman's own state file. Named once `.json` became previewable outside the
// workspace: `SessionState.envOverrides` persists whatever the user set for a
// session, and the env allowlist admits key-shaped names (`GEMINI_API_KEY`,
// `CLAUDE_CODE_*`), so this file can hold a live credential. Same reasoning
// as the two entries above, and it leaves the rest of ~/.codeman attachable.
/\/\.codeman[^/]*\/state\.json$/,
// Codeman's own state files. Named once `.json` became previewable outside
// the workspace: `SessionState.envOverrides` persists whatever the user set
// for a session, and the env allowlist admits key-shaped names
// (`GEMINI_API_KEY`, `CLAUDE_CODE_*`), so state can hold a live credential.
// `state[^/]*` rather than `state`: siblings like state-inner.json carry the
// same payload. Same reasoning as the two entries above, and it leaves the
// rest of ~/.codeman attachable.
/\/\.codeman[^/]*\/state[^/]*\.json$/,
// settings.json holds a credential BY SCHEMA (`voiceSettings.apiKey`, the
// Deepgram key); push-keys.json holds the VAPID PRIVATE key (enough to forge
// push notifications to every subscribed device); intents.json is written
// 0600 precisely because captured prompts can contain secrets, and is
// deliberately kept out of /api/search — it must not be readable through a
// different route instead.
/\/\.codeman[^/]*\/settings\.json$/,
/\/\.codeman[^/]*\/push-keys\.json$/,
/\/\.codeman[^/]*\/intents\.json$/,
];
/**