Close the extensionless symlink gap in shell secret matching

Bare tokens with no dot or slash skipped the resolve leg, so a link
named notes into .env auto-allowed where notes.txt asked. Bare
non-flag tokens now pay one lstat probe; a hit resolves the target
and a miss stays syscall-free past that probe. Home expansion puts
the secret reason on cat ~/notes instead of the coincidental
outside-workspace ask, and the path-like comment no longer claims
globs cannot reach secrets.

Author: TheGreatAxios

src/plugins/secret-guard-plugin.ts

@@ -1,4 +1,10 @@
-import { isAbsolute, resolve as resolvePath } from "node:path";
+import { lstatSync } from "node:fs";
+import { homedir } from "node:os";
+import {
+  isAbsolute,
+  join as joinPath,
+  resolve as resolvePath,
+} from "node:path";
 import type { ToolPlugin } from "@intx/tools-posix";
 import {
   realpathNearestOr,
@@ -132,19 +138,24 @@ function shellPathTokens(command: string): string[] {
 // dynamic construction of a path the matcher never sees as one token — e.g.
 // indirection through an unrelated variable (`F=.en; cat ${F}v`), character-by-
 // character assembly (`printf`), or reading via an interpreter that builds the
-// name at runtime. Perfect shell sandboxing is out of scope; the goal is to
-// force a prompt for the trivial, single-token references that make exfiltration
-// easy. Tool-result secret scrub still redacts credential-shaped output.
+// name at runtime. Unexpanded globs are the same class: `cat *` can open a
+// symlink the matcher only ever saw as `*`. Perfect shell sandboxing is out
+// of scope; the goal is to force a prompt for the trivial, single-token
+// references that make exfiltration easy. Tool-result secret scrub still redacts credential-shaped output.
 // Programs that only print directory names / metadata — listing a name never
 // dumps file contents. Single owner for this set: the resolve-leg skip below
 // and classify.ts's pure-listing exemption both read it, so a new names-only
 // program cannot drift into one list without the other.
 export const PURE_DIRECTORY_LISTING_PROGRAMS = new Set(["ls", "tree"]);
 
 // Worth spending a realpath on: shaped like a path the shell could open
-// (a slash, an extension dot, or absolute), not a flag, variable, glob, or
-// fd number — those can never resolve into a secret file, so they skip the
-// stat and the hot auto-allow path stays syscall-free for them.
+// (a slash, an extension dot, or absolute), not a flag, variable, or fd
+// number — those can never name a file the shell opens, so they skip the
+// stat and the hot auto-allow path stays syscall-free for them. Globs are
+// skipped here for a different reason: the matcher only sees the unexpanded
+// pattern, so `cat *.txt` cannot resolve without running the shell — but a
+// glob CAN expand into a symlink at runtime, which stays a stated residual
+// (see the threat model below), not something this filter disproves.
 function isPathLikeShellToken(token: string): boolean {
   if (
     token.startsWith("-") ||
@@ -161,13 +172,52 @@ function isPathLikeShellToken(token: string): boolean {
   );
 }
 
+// `~` / `~/…` mean the operator's home to the shell, not a literal
+// cwd-relative name — expand before both matcher legs so `cat ~/notes`
+// resolves the home symlink instead of a (usually missing) cwd child.
+// classify.ts's outside-workspace rule would ask anyway; the expansion fixes
+// the *reason* (sensitive-path) rather than relying on that coincidence.
+function expandHome(token: string): string {
+  if (token === "~") return homedir();
+  if (token.startsWith("~/")) return joinPath(homedir(), token.slice(2));
+  return token;
+}
+
+// A bare token the shell could open as a cwd-relative file: not a flag,
+// variable, glob, or command substitution — same exclusions as the path-like
+// filter, minus the dot/slash shape requirement, so extensionless names
+// (`notes`, or `notes` split out of `--file=notes` / `cat -n notes`) still
+// get an existence probe below.
+function isBareProbeCandidate(token: string): boolean {
+  return (
+    token.length > 0 &&
+    !token.startsWith("-") &&
+    !token.includes("$") &&
+    !token.includes("*") &&
+    !token.includes("`")
+  );
+}
+
 // CL-7790: the ONE shell-token matcher both secret-guard call sites share —
 // commandReferencesSensitivePath below and classify.ts's per-arg sensitive
 // check. The cheap lexical denylist runs first so the hot auto-allow path
-// never touches the filesystem; only path-like survivors pay for a realpath
-// via the CL-6971 helper, which catches a benign-named symlink into a secret
-// file (notes.txt -> .env) exactly like the secret name itself. Relative
-// tokens resolve against cwd first because the helper takes absolute paths.
+// never touches the filesystem; only survivors pay for filesystem access, in
+// two bounded tiers: path-like tokens pay for a realpath via the CL-6971
+// helper, which catches a benign-named symlink into a secret file (notes.txt
+// -> .env) exactly like the secret name itself, while bare extensionless
+// tokens first pay a single lstat existence probe against the cwd-resolved
+// path — a miss (the common `cat Makefile` case) costs exactly that one
+// lstat and skips the resolve, a hit (file or symlink, dangling included)
+// pays the realpath and matches on the target. Flags, variables, globs, and
+// backticks never probe, so the worst case per command is one lstat per bare
+// token plus one realpath per existing entry. Relative tokens resolve
+// against cwd first because the helper takes absolute paths; `~` expands to
+// the home directory before resolving for the same reason. That cwd is the
+// session/process cwd, not a `cd` prefix inside the command —
+// `cd sub && cat notes.txt` resolves `notes.txt` against the session cwd
+// (absent) rather than cwd/sub (present). The chain still fails closed
+// because `cd` is not a safe program, but no secret reason fires;
+// per-segment `cd` modeling is deliberately out of scope.
 // Pass resolveSymlinks=false for pure name-listings: listing a name is not
 // dumping its contents (CL-5420), so `ls notes.txt` still lists freely while
 // `cat notes.txt` asks.
@@ -176,10 +226,21 @@ export function isSensitiveShellToken(
   cwd: string = process.cwd(),
   resolveSymlinks = true,
 ): boolean {
-  if (isSensitivePath(token)) return true;
-  if (!resolveSymlinks || !isPathLikeShellToken(token)) return false;
-  if (isAbsolute(token)) return isSensitivePathResolved(token);
-  return isSensitivePathResolved(resolvePath(cwd, token));
+  const expanded = expandHome(token);
+  if (isSensitivePath(expanded)) return true;
+  if (!resolveSymlinks) return false;
+  if (isPathLikeShellToken(expanded)) {
+    if (isAbsolute(expanded)) return isSensitivePathResolved(expanded);
+    return isSensitivePathResolved(resolvePath(cwd, expanded));
+  }
+  if (!isBareProbeCandidate(expanded)) return false;
+  const abs = isAbsolute(expanded) ? expanded : resolvePath(cwd, expanded);
+  try {
+    lstatSync(abs);
+  } catch {
+    return false;
+  }
+  return isSensitivePathResolved(abs);
 }
 
 export function commandReferencesSensitivePath(

src/plugins/secret-guard-shell-symlink.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
@@ -25,12 +25,39 @@ async function withFixture<T>(
     await writeFile(join(cwd, ".env"), "SECRET=fixture-env\n");
     await writeFile(join(cwd, "README.md"), "# fixture\n");
     await symlink(join(cwd, ".env"), join(cwd, "notes.txt"));
+    // Extensionless twin of notes.txt: no dot, no slash.
+    await symlink(join(cwd, ".env"), join(cwd, "notes"));
+    // A link visible only from a subdirectory, for the cd-prefix case.
+    await mkdir(join(cwd, "sub"), { recursive: true });
+    await symlink(join(cwd, ".env"), join(cwd, "sub", "secret-link.txt"));
     return await run({ cwd });
   } finally {
     await rm(cwd, { recursive: true, force: true });
   }
 }
 
+// A `~`-reachable secret and a benign-named link into it. Bun's homedir()
+// does not follow a runtime-overridden $HOME, so the fixture lives in the
+// real home directory under unique per-run names (never the real ~/.env)
+// and is removed in `finally`.
+async function withHomeFixture<T>(
+  run: (paths: { linkName: string }) => Promise<T>,
+): Promise<T> {
+  const { homedir } = await import("node:os");
+  const home = homedir();
+  const tag = `cl7790-probe-${process.pid}-${Math.floor(Math.random() * 1e9)}`;
+  const secretName = `${tag}.pem`;
+  const linkName = `${tag}-notes`;
+  try {
+    await writeFile(join(home, secretName), "SECRET=fixture-home-pem\n");
+    await symlink(join(home, secretName), join(home, linkName));
+    return await run({ linkName });
+  } finally {
+    await rm(join(home, linkName), { force: true });
+    await rm(join(home, secretName), { force: true });
+  }
+}
+
 const shellCall = (command: string) => ({
   id: "c",
   name: "run_shell",
@@ -94,4 +121,67 @@ describe("CL-7790 shell tokens resolve symlinks before the secret denylist", ()
       ).toBeUndefined();
     });
   });
+
+  test("cat through an extensionless symlink does not auto-allow", async () => {
+    await withFixture(async ({ cwd }) => {
+      expect(isAutoAllowedShellCommand("cat notes", cwd)).toBe(false);
+      expect(commandReferencesSensitivePath("cat notes", cwd)).toBe("notes");
+      expect(isSensitiveShellToken("notes", cwd)).toBe(true);
+    });
+  });
+
+  test("flag-adjacent bare names do not auto-allow", async () => {
+    await withFixture(async ({ cwd }) => {
+      // `=` splits `--file=notes` into a bare `notes` token; `-n` is a flag.
+      expect(isAutoAllowedShellCommand("cat -n notes", cwd)).toBe(false);
+      expect(commandReferencesSensitivePath("cat -n notes", cwd)).toBe("notes");
+      expect(isAutoAllowedShellCommand("grep --file=notes foo", cwd)).toBe(
+        false,
+      );
+    });
+  });
+
+  test("missing bare names still auto-allow (no false positive on a miss)", async () => {
+    await withFixture(async ({ cwd }) => {
+      // Nothing named Makefile exists in the fixture: the existence probe
+      // misses and the command stays auto-allowed.
+      expect(isAutoAllowedShellCommand("cat Makefile", cwd)).toBe(true);
+      expect(
+        commandReferencesSensitivePath("cat Makefile", cwd),
+      ).toBeUndefined();
+    });
+  });
+
+  test("home-relative link asks for the secret reason, not just outside-workspace", async () => {
+    await withFixture(async ({ cwd }) => {
+      await withHomeFixture(async ({ linkName }) => {
+        const command = `cat ~/${linkName}`;
+        // classify.ts would already ask here via the `~` outside-workspace
+        // rule; the point of `~` expansion is that the *secret* reason fires.
+        expect(commandReferencesSensitivePath(command, cwd)).toBe(
+          `~/${linkName}`,
+        );
+        expect(isAutoAllowedShellCommand(command, cwd)).toBe(false);
+        expect(
+          autoShellRuleForCall(shellCall(command), () => false, cwd)?.name,
+        ).toBe("sensitive-path");
+      });
+    });
+  });
+
+  test("cd-prefixed dump fails closed; per-segment cd tracking is out of scope", async () => {
+    await withFixture(async ({ cwd }) => {
+      // Relative tokens resolve against the session cwd, not a `cd` prefix
+      // inside the command — the shell would open cwd/sub/secret-link.txt but
+      // the secret leg only sees cwd/secret-link.txt (absent), so no secret
+      // reason fires here. The chain still asks because `cd` is not a safe
+      // program; per-segment `cd` modeling is deliberately not attempted.
+      expect(
+        isAutoAllowedShellCommand("cd sub && cat secret-link.txt", cwd),
+      ).toBe(false);
+      expect(
+        commandReferencesSensitivePath("cd sub && cat secret-link.txt", cwd),
+      ).toBeUndefined();
+    });
+  });
 });