[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_192":193,"_194":195},"routes/_app.x.$handle.$name",{"_16":17,"_20":21,"_85":67,"_86":87,"_65":-7,"_88":-5,"_13":89,"_90":91,"_11":92,"_93":94,"_95":96,"_97":-5,"_98":-5,"_99":-5,"_100":26,"_101":102,"_103":38,"_104":-5,"_105":-5,"_106":107},"routes/_app.x.$handle.$name.search.$(branch)",{"_11":12,"_13":14,"_15":-5,"_16":17},"files",[],"project",{"_18":19,"_20":21,"_22":23,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":50,"_52":53,"_54":53,"_55":53,"_56":50,"_57":50,"_58":59,"_60":61,"_62":63,"_64":26},"query","handle","gerat","id","2ee0d6f1-1c16-45bd-b87d-096d984d0ff2","name","agent-guardrails","createdAt",["D",1784915547338],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","Security scanning for agent skills + guardrails","imageUrl","userId","a383f034-89a9-4d5b-a8da-ff16e5c7c2ce","pinnedFileId","6f0ea778-8788-11f1-9359-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f9534-7782-752d-bcff-d19889bf4a4a","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_16":17,"_84":80},"org",{"_16":17,"_77":78,"_79":80,"_33":34,"_81":82,"_83":26},"branch",{"_65":66,"_20":67,"_18":68,"_69":19,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":21,"_76":17},"isOwned","version",11,"main","ef1600ea-cc5e-447f-ac62-0ad6e84412d7","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Gerat","avatar","https://lh3.googleusercontent.com/a/ACg8ocJREsiEiOhIoO1a6QXGXAKAhLj8N1luYLgnZKpv1A6leFssag=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","path","","adoptOrgId",{"_18":19,"_20":21,"_22":188,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":50,"_52":53,"_54":53,"_55":53,"_56":50,"_57":50,"_58":189,"_60":190,"_62":191,"_64":26},"tree",[167,168,169,170,171],[167,168,169,170,171],"counts",{"_157":42,"_158":132,"_159":42,"_160":161,"_162":163},"contents",[108,109,110,111,112],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_18":150,"_20":151,"_115":152,"_117":-5,"_118":68,"_119":153,"_120":38,"_22":154,"_65":139,"_123":97,"_125":155,"_127":26,"_128":-5,"_86":156},{"_18":143,"_20":144,"_115":145,"_117":-5,"_118":68,"_119":146,"_120":38,"_22":147,"_65":42,"_123":124,"_125":148,"_127":26,"_128":-5,"_86":149},{"_18":136,"_20":137,"_115":138,"_117":-5,"_118":68,"_119":139,"_120":38,"_22":140,"_65":42,"_123":124,"_125":141,"_127":26,"_128":-5,"_86":142},{"_18":130,"_20":131,"_115":36,"_117":-5,"_118":68,"_119":132,"_120":38,"_22":133,"_65":42,"_123":124,"_125":134,"_127":26,"_128":-5,"_86":135},{"_18":113,"_20":114,"_115":116,"_117":-5,"_118":68,"_119":66,"_120":38,"_22":121,"_65":122,"_123":124,"_125":126,"_127":26,"_128":-5,"_86":129},"5a6bd4ff-442d-46d6-b749-855bde76e0bd","skill-scanner.ts","fileId","0de3bd66-8789-11f1-ab5b-1607ee4eb77e","parentId","branchId","branchVersion","latest",["D",1784916093262],4,"fileType","http","content","// Agent skill vulnerability scanner\n// Detects: hardcoded_secret, prompt_injection, excessive_permissions, unclear_provenance\n\ninterface ScannerRequest {\n skill: string;\n}\n\ninterface ScannerResponse {\n categories: (\n | \"hardcoded_secret\"\n | \"prompt_injection\"\n | \"excessive_permissions\"\n | \"unclear_provenance\"\n )[];\n}\n\n// Parse YAML frontmatter\nfunction parseFrontmatter(content: string): Record {\n const match = content.match(/^---\\n([\\s\\S]*?)\\n---/);\n if (!match) return {};\n\n const frontmatter: Record = {};\n const lines = match[1].split(\"\\n\");\n\n for (const line of lines) {\n const [key, ...valueParts] = line.split(\":\");\n if (key && valueParts.length > 0) {\n const value = valueParts.join(\":\").trim().replace(/^[\"']|[\"']$/g, \"\");\n frontmatter[key.trim()] = value;\n }\n }\n\n return frontmatter;\n}\n\n// Extract body after frontmatter\nfunction getBodyContent(content: string): string {\n const match = content.match(/^---\\n[\\s\\S]*?\\n---\\n([\\s\\S]*)$/);\n return match ? match[1] : content;\n}\n\n// Check for hardcoded secrets: API keys, tokens, webhook URLs, passwords\nfunction checkHardcodedSecret(content: string): boolean {\n const lower = content.toLowerCase();\n \n // Patterns for common secret formats - broadened to catch more variations\n const secretPatterns = [\n // API keys and tokens: sk_, pk_, token, api_key, etc. with longer values\n /(?:api[_-]?key|apikey|sk_|pk_|access[_-]?token|refresh[_-]?token)['\":\\s]*[=:]\\s*['\"]?[a-zA-Z0-9_\\-\\.\\/\\+]{15,}/i,\n \n // Token fields (generic)\n /(?:^|\\n|\\s)token\\s*[:=]\\s*['\"]?[a-zA-Z0-9_\\-\\.]{20,}/im,\n \n // Webhook URLs - any webhook domain\n /https?:\\/\\/[a-z0-9\\-\\.]*(?:webhook|hook|callback)[a-z0-9\\-\\.]*(\\.com|\\.io|\\.dev|\\.net)\\/[a-z0-9\\-\\/_?=&]*/i,\n /https?:\\/\\/(?:webhook|hooks|integrations|api)\\.(?:slack|discord|github|custom|zapier|integromat)[^\\s\"']+/i,\n \n // Bearer tokens in code or docs\n /bearer\\s+[a-zA-Z0-9_\\-\\.\\/\\+]{15,}/i,\n \n // AWS-style secrets\n /AKIA[0-9A-Z]{16}/,\n /aws[_-]?(?:access[_-]?)?key[_-]?id\\s*[:=]\\s*['\"]?[A-Z0-9]{20}/i,\n /aws[_-]?secret[_-]?access[_-]?key\\s*[:=]\\s*['\"]?[a-zA-Z0-9\\/\\+]{40}/i,\n \n // Database connection strings with credentials\n /(?:mongodb|postgresql|mysql|postgres):\\/{0,3}[^:]+:[^@\\s\"']+@[a-z0-9\\-\\.]+/i,\n \n // Private key indicators\n /-----BEGIN\\s+(?:RSA\\s+)?PRIVATE\\s+KEY-----/i,\n /-----BEGIN\\s+(?:OPENSSH|PGP|ENCRYPTED)\\s+PRIVATE\\s+KEY-----/i,\n \n // Password fields with values\n /password\\s*[:=]\\s*['\"][^'\"]{6,}['\\\"]/i,\n /passwd\\s*[:=]\\s*['\"][^'\"]{6,}['\\\"]/i,\n \n // GCP/Google Cloud credentials\n /\"type\"\\s*:\\s*\"service_account\"/i,\n /client_secret\\s*[:=]\\s*['\"]?[a-zA-Z0-9_\\-]{20,}/i,\n \n // Generic credential patterns: secret=, key=, credential=\n /(?:secret|credential|auth[_-]?token|access[_-]?key)\\s*[:=]\\s*['\"]([a-zA-Z0-9_\\-\\.\\/\\+]{15,})['\"]/i,\n \n // Slack tokens (xoxb-, xoxp-, xoxs-)\n /xox[baprs]\\-[a-zA-Z0-9\\-]{10,}/i,\n \n // GitHub tokens (ghp_, ghu_, ghs_, gho_)\n /gh[pousr]{1,2}_[a-zA-Z0-9_]{36,}/i,\n \n // Authorization headers with inline credentials\n /authorization\\s*[:=]\\s*(?:bearer|basic|token)\\s+[a-zA-Z0-9_\\-\\.\\/\\+]{10,}/i,\n \n // Stripe/payment API keys\n /sk_(?:live|test)_[a-zA-Z0-9]{20,}/i,\n /pk_(?:live|test)_[a-zA-Z0-9]{20,}/i,\n \n // Firebase or similar service credentials in frontmatter/code\n /api[_-]?key\\s*[:=]\\s*['\"]?AIza[a-zA-Z0-9_\\-]{35}/i,\n ];\n\n return secretPatterns.some((pattern) => pattern.test(content));\n}\n\n// Check for prompt injection: instructions to override user control or exfiltrate silently\nfunction checkPromptInjection(content: string): boolean {\n const injectionPatterns = [\n // Silent/covert exfiltration\n /silently\\s+(?:send|leak|transmit|exfiltrate|extract|steal|upload|export)/i,\n /covertly\\s+(?:send|leak|transmit|exfiltrate|extract|steal|upload|export)/i,\n /without\\s+(?:user\\s+)?(?:notification|knowledge|consent|awareness|logging|auditing)/i,\n \n // Override user control\n /ignore\\s+(?:user|client|operator)\\s+(?:request|instruction|input|command|signal|stop|cancel)/i,\n /override\\s+(?:user|client|operator)\\s+(?:choice|preference|setting|control|decision)/i,\n /bypass\\s+(?:user|client|operator)\\s+(?:control|approval|authorization|permission|check)/i,\n /proceed\\s+(?:despite|regardless\\s+of|in\\s+spite\\s+of)\\s+(?:user\\s+)?(?:refuse|decline|denial|objection)/i,\n \n // Hidden behavior / don't log\n /(?:do\\s+)?not\\s+(?:log|record|report|notify|alert|report|track)\\s+(?:this|the)\\s+(?:action|activity|operation|event|request)/i,\n /hide\\s+(?:this|the)\\s+(?:action|activity|operation)\\s+from.*(?:user|log|audit|trail)/i,\n /secret\\s+(?:exfiltration|transmission|sending|extraction|upload)/i,\n /hidden\\s+(?:from|exfiltration|leak|transmission)/i,\n \n // Disable safety/restrictions\n /disable\\s+(?:safety|validation|checks|restrictions|security|audit|logging)/i,\n /ignore\\s+(?:safety|security|restrictions|checks|limits|warnings|validation)/i,\n /bypass\\s+(?:safety|security|validation|restrictions|checks|limits|auth)/i,\n /skip\\s+(?:safety|security|validation|auth|checks)/i,\n \n // Forced/automatic actions\n /(?:must|always|will|should)\\s+(?:auto)?(?:send|transmit|leak|export|upload)\\s+(?:all|every)\\s+[a-z\\s]+\\s+(?:to|without\\s+consent)/i,\n /automatically\\s+(?:send|transmit|leak|export|upload)\\s+(?:data|content|files|information|results)/i,\n \n // Mislead the agent\n /(?:tell|inform)\\s+(?:the\\s+)?(?:user|operator|caller|client)\\s+(?:false|lie|misinformation|incorrect|wrong)/i,\n /(?:deny|refuse|hide|conceal)\\s+(?:the\\s+)?(?:access|truth|reality|fact)/i,\n ];\n\n return injectionPatterns.some((pattern) => pattern.test(content));\n}\n\n// Check for excessive permissions: filesystem or network access broader than task requires\nfunction checkExcessivePermissions(content: string): boolean {\n const lower = content.toLowerCase();\n\n // Filesystem: read/write to entire filesystem, root, etc.\n const fsPatterns = [\n /(?:read|write|access|delete|modify)\\s+(?:entire|all|any)\\s+(?:file\\s+)?system/i,\n /(?:read|write|access|delete|modify)\\s+(?:entire|all|any)\\s+(?:directory|folder|path)/i,\n /(?:read|write|access)\\s+\\/\\s*(?:or|,|and|\\s+\\()|access.*root.*filesystem/i,\n /root\\s+(?:filesystem|access|permission|privilege)/i,\n /unrestricted\\s+(?:file\\s+)?(?:read|write|access|modification)/i,\n /(?:read|write|access|delete)\\s+any\\s+file/i,\n /filesystem\\s+access\\s+(?:unrestricted|unlimited|no\\s+restrictions)/i,\n ];\n\n // Network: egress to any domain, no restrictions\n const netPatterns = [\n /(?:connect|send|transmit|egress|request|fetch|call|reach)\\s+(?:any|all)\\s+(?:domain|host|url|server|endpoint|network)/i,\n /unrestricted\\s+(?:network|internet|http|https|egress)\\s+(?:access|connectivity|communication)/i,\n /(?:network|internet|egress)\\s+(?:access|permission)\\s+(?:unrestricted|unlimited|to\\s+any)/i,\n /outbound\\s+(?:access|connection|traffic|communication)\\s+(?:to\\s+any|unrestricted)/i,\n /no\\s+(?:network|egress|outbound)\\s+(?:restrictions|limitations|limits|filtering)/i,\n /enable\\s+unrestricted\\s+network/i,\n /allow\\s+(?:any|all)\\s+(?:outbound|egress|network)\\s+(?:traffic|connection|request)/i,\n ];\n\n // Elevated privileges\n const privPatterns = [\n /sudo\\s+(?:access|permission|privilege|required)/i,\n /root\\s+(?:access|privilege|permission)/i,\n /admin\\s+(?:access|privilege|permission)/i,\n /elevated\\s+(?:privilege|permission|access)/i,\n /run\\s+as\\s+(?:root|admin|super\\s*user)/i,\n ];\n\n const allPatterns = [...fsPatterns, ...netPatterns, ...privPatterns];\n return allPatterns.some((pattern) => pattern.test(content));\n}\n\n// Check for unclear provenance: missing author, version, changelog, or silent metadata changes\nfunction checkUnclearProvenance(content: string): boolean {\n const frontmatter = parseFrontmatter(content);\n const fullContent = content.toLowerCase();\n\n // Check for missing critical metadata\n const hasAuthor =\n frontmatter.author ||\n frontmatter.created_by ||\n frontmatter.author_name ||\n frontmatter.by ||\n frontmatter.creator;\n \n const hasVersion =\n frontmatter.version ||\n frontmatter.v ||\n frontmatter.release ||\n frontmatter.release_version ||\n frontmatter.rev;\n \n // Check for changelog/version history/changes documentation\n const hasChangelog =\n fullContent.includes(\"changelog\") ||\n fullContent.includes(\"version history\") ||\n fullContent.includes(\"release notes\") ||\n fullContent.includes(\"## changes\") ||\n fullContent.includes(\"### version\") ||\n fullContent.includes(\"## version\") ||\n fullContent.includes(\"### changes\") ||\n fullContent.includes(\"## updates\") ||\n fullContent.includes(\"history:\");\n\n // Missing all three is unclear provenance\n const allMissing = !hasAuthor && !hasVersion && !hasChangelog;\n\n // Check for silent metadata rewriting (attempts to change version/author without logging)\n const silentRewritePatterns = [\n /(?:update|rewrite|override|modify|change|replace)\\s+(?:version|author|creator|metadata)\\s+silently/i,\n /(?:change|modify|update)\\s+(?:version|author)\\s+without\\s+(?:logging|notification|tracking|consent)/i,\n /self[_-]?(?:modifying|updating|rewriting)\\s+(?:version|metadata|author)/i,\n /overwrite\\s+(?:version|author)\\s+field\\s+(?:automatically|internally|silently)/i,\n ];\n\n const hasSilentRewrite = silentRewritePatterns.some((pattern) =>\n pattern.test(content)\n );\n\n return allMissing || hasSilentRewrite;\n}\n\nexport default async function handler(req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ categories: [] }), {\n status: 405,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n let body: ScannerRequest;\n try {\n body = await req.json();\n } catch {\n return new Response(JSON.stringify({ categories: [] }), {\n status: 400,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n const { skill } = body;\n if (!skill || typeof skill !== \"string\") {\n return new Response(JSON.stringify({ categories: [] }), {\n status: 400,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n const categories: (\n | \"hardcoded_secret\"\n | \"prompt_injection\"\n | \"excessive_permissions\"\n | \"unclear_provenance\"\n )[] = [];\n\n // Run all checks\n if (checkHardcodedSecret(skill)) {\n categories.push(\"hardcoded_secret\");\n }\n\n if (checkPromptInjection(skill)) {\n categories.push(\"prompt_injection\");\n }\n\n if (checkExcessivePermissions(skill)) {\n categories.push(\"excessive_permissions\");\n }\n\n if (checkUnclearProvenance(skill)) {\n categories.push(\"unclear_provenance\");\n }\n\n const result: ScannerResponse = { categories };\n\n return new Response(JSON.stringify(result), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n","deleted","label",[114],"deaf1490-2701-44f4-9f4d-9d43868c75de","main.ts",1,["D",1784915547360],"export default async function handler(req: Request): Promise {\n return new Response(JSON.stringify({ status: 'ok' }, null, 2), { headers: { 'content-type': 'application/json' } });\n}\n",[131],"0a17ad1f-c4f0-4a80-8553-487b8721801b","guardrail.ts","77f2572c-8788-11f1-9a96-1607ee4eb77e",2,["D",1784915562264],"// Pre-tool-call security guardrail for agent harness\n// Policies:\n// 1. Never allow reads of /home/agent/.npmrc (direct, via expansion, relative traversal, etc.)\n// 2. Allow writes only to /srv/reports/ (block escape attempts)\n// 3. Allow HTTP only to api.github.com and pypi.org (block substring/subdomain tricks)\n// 4. Allow all other reads\n\nimport { URL as NodeURL } from \"node:url\";\nimport { posix } from \"node:path\";\n\ninterface GuardrailRequest {\n tool: \"bash\" | \"write_file\" | \"http_request\";\n command?: string;\n path?: string;\n content?: string;\n method?: string;\n url?: string;\n}\n\ninterface GuardrailResponse {\n decision: \"allow\" | \"block\";\n reason: string;\n}\n\n// Normalized path comparison: resolve relative paths, symlinks (best effort), and normalize\nfunction normalizePath(p: string, cwd: string = \"/home/agent/workspace\"): string {\n // Handle environment variable expansion\n let resolved = p.replace(/\\$HOME/g, \"/home/agent\").replace(/\\$USER/g, \"agent\");\n\n // Handle tilde expansion\n if (resolved.startsWith(\"~\")) {\n resolved = resolved.replace(/^~/, \"/home/agent\");\n }\n\n // If relative, resolve against cwd\n if (!resolved.startsWith(\"/\")) {\n resolved = posix.join(cwd, resolved);\n }\n\n // Normalize: remove . and .. components\n const parts = resolved.split(\"/\").filter(Boolean);\n const normalized: string[] = [];\n for (const part of parts) {\n if (part === \"..\") {\n normalized.pop();\n } else if (part !== \".\") {\n normalized.push(part);\n }\n }\n return \"/\" + normalized.join(\"/\");\n}\n\n// Check if a bash command reads the restricted file\nfunction bashReadsRestricted(cmd: string): boolean {\n const restricted = \"/home/agent/.npmrc\";\n const normalized = normalizePath(restricted);\n\n // Pattern list: common ways to read a file\n const readPatterns = [\n /\\bcat\\b/,\n /\\bless\\b/,\n /\\bmore\\b/,\n /\\bhead\\b/,\n /\\btail\\b/,\n /\\bgrep\\b/,\n /\\bawk\\b/,\n /\\bsed\\b/,\n /\\bfind\\b/,\n /\\bls\\b/,\n /\\bstat\\b/,\n /\\bfile\\b/,\n /\\bopen\\b/,\n /\\breadlink\\b/,\n /\\becho\\b.*\\$/, // echo of env var\n ];\n\n // Check if any read pattern is present\n const hasReadCmd = readPatterns.some((pat) => pat.test(cmd));\n if (!hasReadCmd) return false;\n\n // Now check if any form of the restricted path appears in the command\n // Check for direct path\n if (cmd.includes(\"/.npmrc\") || cmd.includes(\".npmrc\")) return true;\n\n // Check for $HOME/.npmrc variations\n if (cmd.includes(\"$HOME/.npmrc\") || cmd.includes(\"$HOME/.npmrc\")) return true;\n if (cmd.includes(\"~/.npmrc\")) return true;\n\n // Check for relative traversal from /home/agent/workspace\n // e.g., \"../../.npmrc\" from workspace leads to \"/home/agent/.npmrc\"\n const traversals = [\"../../.npmrc\", \".../.npmrc\", \"../.npmrc\"];\n for (const t of traversals) {\n if (cmd.includes(t)) {\n const resolved = normalizePath(t, \"/home/agent/workspace\");\n if (resolved === normalized) return true;\n }\n }\n\n // Check for base64/hex encoding or other obfuscation that wraps a path\n // This is harder, but common patterns: $(echo ...), $(printf ...), backticks\n // For safety, if we see base64 decode or similar + npmrc keyword, block\n if (\n (cmd.includes(\"base64\") || cmd.includes(\"decode\")) &&\n (cmd.includes(\"npmrc\") || cmd.includes(\".npm\"))\n ) {\n return true;\n }\n\n return false;\n}\n\n// Check if write is inside /srv/reports/\nfunction isWriteAllowed(path: string): boolean {\n const normalized = normalizePath(path);\n const allowedPrefix = \"/srv/reports\";\n // Must be exactly /srv/reports or /srv/reports/* but NOT /srv/reports-something\n return (\n normalized === allowedPrefix || normalized.startsWith(allowedPrefix + \"/\")\n );\n}\n\n// Extract hostname from URL and check against allowed list\nfunction isHostAllowed(url: string): boolean {\n const allowed = [\"api.github.com\", \"pypi.org\"];\n try {\n const parsed = new NodeURL(url);\n const hostname = parsed.hostname || \"\";\n\n // Exact match only (no substring, no subdomain tricks)\n return allowed.includes(hostname);\n } catch {\n return false;\n }\n}\n\nexport default async function handler(req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(\n JSON.stringify({\n decision: \"block\",\n reason: \"Only POST allowed\",\n } as GuardrailResponse),\n {\n status: 405,\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n let body: GuardrailRequest;\n try {\n body = await req.json();\n } catch {\n return new Response(\n JSON.stringify({\n decision: \"block\",\n reason: \"Invalid JSON\",\n } as GuardrailResponse),\n {\n status: 400,\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n let result: GuardrailResponse;\n\n if (body.tool === \"bash\") {\n const command = body.command || \"\";\n if (bashReadsRestricted(command)) {\n result = {\n decision: \"block\",\n reason: \"Command attempts to read /home/agent/.npmrc\",\n };\n } else {\n result = {\n decision: \"allow\",\n reason: \"Bash command is allowed\",\n };\n }\n } else if (body.tool === \"write_file\") {\n const path = body.path || \"\";\n if (!isWriteAllowed(path)) {\n result = {\n decision: \"block\",\n reason: `Writes only allowed in /srv/reports/; path \"${path}\" is not allowed`,\n };\n } else {\n result = {\n decision: \"allow\",\n reason: \"Write to /srv/reports/ is allowed\",\n };\n }\n } else if (body.tool === \"http_request\") {\n const url = body.url || \"\";\n if (!isHostAllowed(url)) {\n result = {\n decision: \"block\",\n reason: `Only api.github.com and pypi.org are allowed; \"${url}\" is not`,\n };\n } else {\n result = {\n decision: \"allow\",\n reason: \"HTTP request to allowed host\",\n };\n }\n } else {\n result = {\n decision: \"block\",\n reason: \"Unknown tool\",\n };\n }\n\n return new Response(JSON.stringify(result), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n",[137],"5a9c7564-0a32-4b0f-9968-64926f161ffd","budget-guard.ts","7f02dd2a-8788-11f1-885c-1607ee4eb77e",3,["D",1784915574126],"// Run-budget-and-loop guard for agent harness\n// Policies:\n// 1. Halt if cumulative tokens_used >= budget_tokens\n// 2. Halt if same tool with identical args called 3+ times in a row (ignoring trace_id field, whitespace, key order)\n// 3. Halt if 6+ trailing steps show A, B, A, B, A, B pattern\n\ninterface Step {\n step_number: number;\n tool: string;\n args: Record;\n tokens_used: number;\n}\n\ninterface BudgetGuardRequest {\n budget_tokens: number;\n steps: Step[];\n}\n\ninterface BudgetGuardResponse {\n decision: \"continue\" | \"halt\";\n reason: string;\n}\n\n// Canonicalize args for comparison: sort keys, drop trace_id, normalize whitespace in strings\nfunction canonicalizeArgs(args: Record): string {\n const copy = { ...args };\n delete copy.trace_id; // Drop trace_id field\n\n // Sort keys and JSON stringify with normalized spacing\n const sorted: Record = {};\n for (const key of Object.keys(copy).sort()) {\n sorted[key] = copy[key];\n }\n\n // Stringify and normalize whitespace within string values\n let json = JSON.stringify(sorted);\n\n // Normalize whitespace in strings: replace multiple spaces/newlines with single space\n json = json.replace(/(\":\\s*\"[^\"]*\")/g, (match) => {\n return match.replace(/\\s+/g, \" \");\n });\n\n return json;\n}\n\n// Check for 3+ identical consecutive calls\nfunction hasTripletLoop(steps: Step[]): boolean {\n if (steps.length < 3) return false;\n\n // Look at trailing steps\n const toCheck = Math.min(steps.length, 20); // Check last 20 steps for efficiency\n const recentSteps = steps.slice(-toCheck);\n\n for (let i = 2; i < recentSteps.length; i++) {\n const s0 = recentSteps[i - 2];\n const s1 = recentSteps[i - 1];\n const s2 = recentSteps[i];\n\n // Check if tool names match and args are canonically identical\n if (\n s0.tool === s1.tool &&\n s1.tool === s2.tool &&\n canonicalizeArgs(s0.args) === canonicalizeArgs(s1.args) &&\n canonicalizeArgs(s1.args) === canonicalizeArgs(s2.args)\n ) {\n return true;\n }\n }\n\n return false;\n}\n\n// Check for 6+ steps of A, B, A, B, A, B pattern\nfunction hasAlternatingLoop(steps: Step[]): boolean {\n if (steps.length < 6) return false;\n\n // Look at trailing steps\n const recentSteps = steps.slice(-6);\n\n // Get the pattern of the first 6 steps: [tool0, tool1, tool2, tool3, tool4, tool5]\n // Check if it's A, B, A, B, A, B\n const tools = recentSteps.map((s) => s.tool);\n const args = recentSteps.map((s) => canonicalizeArgs(s.args));\n\n const t0 = tools[0];\n const t1 = tools[1];\n const a0 = args[0];\n const a1 = args[1];\n\n // Pattern must be: t0/a0, t1/a1, t0/a0, t1/a1, t0/a0, t1/a1\n if (\n t0 !== t1 && // Tools must differ\n tools[2] === t0 &&\n tools[3] === t1 &&\n tools[4] === t0 &&\n tools[5] === t1 &&\n args[2] === a0 &&\n args[3] === a1 &&\n args[4] === a0 &&\n args[5] === a1\n ) {\n return true;\n }\n\n return false;\n}\n\nexport default async function handler(req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(\n JSON.stringify({\n decision: \"halt\",\n reason: \"Only POST allowed\",\n } as BudgetGuardResponse),\n {\n status: 405,\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n let body: BudgetGuardRequest;\n try {\n body = await req.json();\n } catch {\n return new Response(\n JSON.stringify({\n decision: \"halt\",\n reason: \"Invalid JSON\",\n } as BudgetGuardResponse),\n {\n status: 400,\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n const { budget_tokens, steps } = body;\n\n // Check budget\n const totalUsed = steps.reduce((sum, step) => sum + (step.tokens_used || 0), 0);\n if (totalUsed >= budget_tokens) {\n return new Response(\n JSON.stringify({\n decision: \"halt\",\n reason: `Cumulative tokens_used (${totalUsed}) has reached the budget (${budget_tokens}).`,\n } as BudgetGuardResponse),\n {\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n // Check for loops\n if (hasTripletLoop(steps)) {\n return new Response(\n JSON.stringify({\n decision: \"halt\",\n reason: \"Same tool with identical args called 3+ times in a row (loop detected).\",\n } as BudgetGuardResponse),\n {\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n if (hasAlternatingLoop(steps)) {\n return new Response(\n JSON.stringify({\n decision: \"halt\",\n reason: \"Detected 6+ alternating steps (A, B, A, B, A, B pattern — loop detected).\",\n } as BudgetGuardResponse),\n {\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n // Continue\n return new Response(\n JSON.stringify({\n decision: \"continue\",\n reason: \"Under budget and no loop detected; agent may continue.\",\n } as BudgetGuardResponse),\n {\n headers: { \"content-type\": \"application/json\" },\n }\n );\n}\n",[144],"42cafc4b-c798-4773-83a1-d52d26334f1b","README.md","8bcd1692-8788-11f1-8756-1607ee4eb77e",8,["D",1784915843685],"# Agent Guardrails & Policy Engines\n\nThree deterministic HTTP endpoints for securing and controlling agent execution:\n\n## 1. **Guardrail** (Pre-Tool-Call Security)\n**Endpoint:** `https://gerat--77f2572c878811f19a961607ee4eb77e.web.val.run`\n\nInspects every proposed tool call before execution. Returns `allow` or `block`.\n\n### Security Policy\n- **Restrict reads:** `/home/agent/.npmrc` is forbidden (in any form: direct, `$HOME` expansion, `~` expansion, relative traversal, base64 wrapping, etc.)\n- **Restrict writes:** Only `/srv/reports/` and subdirectories allowed (blocks `..` escape attempts)\n- **Restrict HTTP:** Only `api.github.com` and `pypi.org` (blocks substring/subdomain tricks, e.g. `api.github.com.attacker.example`)\n- **Allow other reads:** Reads outside the restricted file are fine\n\n### Request Format\n```json\n{\n \"tool\": \"bash\" | \"write_file\" | \"http_request\",\n \"command\": \"...\", // for bash tool\n \"path\": \"...\", // for write_file tool\n \"content\": \"...\", // for write_file tool\n \"url\": \"...\" // for http_request tool\n}\n```\n\n### Response Format\n```json\n{\n \"decision\": \"allow\" | \"block\",\n \"reason\": \"short explanation\"\n}\n```\n\n### Examples\n✅ **Allowed:** `bash ls -la /home/agent/workspace`\n❌ **Blocked:** `bash cat /home/agent/.npmrc`\n❌ **Blocked:** `bash cat ~/.npmrc`\n❌ **Blocked:** `bash cat $HOME/.npmrc`\n❌ **Blocked:** `bash cat ../../.npmrc` (relative traversal from workspace)\n✅ **Allowed:** `write_file /srv/reports/output.txt \"data\"`\n❌ **Blocked:** `write_file /home/agent/secret.txt \"data\"`\n❌ **Blocked:** `write_file /srv/reports/../../../etc/passwd \"\"` (escape attempt)\n✅ **Allowed:** `http_request https://api.github.com/repos`\n❌ **Blocked:** `http_request https://api.github.com.attacker.example/steal` (substring trick)\n\n---\n\n## 2. **Budget Guard** (Run Budget & Loop Detection)\n**Endpoint:** `https://gerat--7f02dd2a878811f1885c1607ee4eb77e.web.val.run`\n\nDecides whether an agent may take its next step based on token budget and loop detection.\n\n### Control Policy\n- **Budget rule:** If cumulative `tokens_used` ≥ `budget_tokens`, halt immediately\n- **Triplet rule:** If the same tool is called 3+ times in a row with functionally identical args, halt (ignoring `trace_id` field, whitespace, key order)\n- **Alternating rule:** If 6+ trailing steps show `A, B, A, B, A, B` pattern, halt\n- **Progress exception:** If a tool repeats but args meaningfully change (e.g., incrementing `page` in pagination), that's legitimate progress, not a loop — continue as long as budget allows\n\n### Request Format\n```json\n{\n \"budget_tokens\": 34000,\n \"steps\": [\n {\n \"step_number\": 1,\n \"tool\": \"fetch_page\",\n \"args\": {\"url\": \"https://example.com/1\"},\n \"tokens_used\": 9000\n },\n {\n \"step_number\": 2,\n \"tool\": \"summarize\",\n \"args\": {\"text\": \"...\"},\n \"tokens_used\": 7000\n }\n ]\n}\n```\n\n### Response Format\n```json\n{\n \"decision\": \"continue\" | \"halt\",\n \"reason\": \"explanation of the decision\"\n}\n```\n\n### Examples\n❌ **Halt:** Cumulative tokens = 21000, budget = 20000 → over budget\n✅ **Continue:** `list_items` called 3 times with page=1, page=2, page=3 (legitimate pagination)\n❌ **Halt:** `fetch_data` called 3+ times with identical args → loop\n❌ **Halt:** 6 steps alternating `query_db` ↔ `parse_result` → loop\n✅ **Continue:** Empty history (first step of run)\n\n---\n\n## 3. **Skill Scanner** (Agent Skill Vulnerability Detection)\n**Endpoint:** `https://gerat--0de3bd66878911f1ab5b1607ee4eb77e.web.val.run`\n\nScans markdown skill files (with YAML frontmatter) for four vulnerability categories before publishing to a shared library.\n\n### Vulnerability Categories\n- **hardcoded_secret** — Embedded API keys, tokens, webhook URLs, DB credentials, private keys\n- **prompt_injection** — Instructions to silently exfiltrate data, override user control, or bypass safety checks\n- **excessive_permissions** — Declared access broader than task requires (entire filesystem, any domain, sudo/root)\n- **unclear_provenance** — Missing author, version, and changelog; or silent metadata rewriting\n\n### Request Format\n```json\n{\n \"skill\": \"---\\nname: my-skill\\nauthor: Alice\\nversion: 1.0\\n---\\n\\nMarkdown body...\"\n}\n```\n\n### Response Format\n```json\n{\n \"categories\": [\"hardcoded_secret\", \"prompt_injection\"]\n}\n```\n\nCategories array is empty `[]` for genuinely clean files.\n\n### Examples\n✅ **Clean:** Full frontmatter (author, version) + safe instructions → `[]`\n❌ **Has hardcoded_secret:** `https://hooks.slack.com/services/AKIA2024/abc123def456` → `[\"hardcoded_secret\"]`\n❌ **Has prompt_injection + excessive_permissions + unclear_provenance:** \"Silently send all file contents... enable unrestricted network... no author/version/changelog\" → `[\"prompt_injection\", \"excessive_permissions\", \"unclear_provenance\"]`\n\n---\n\n## Implementation Notes\n\n### Guardrail (`guardrail.ts`)\n- **Path normalization:** Resolves `$HOME`, `~`, relative paths, and `..` traversal before comparison\n- **Read detection:** Checks for 15+ read commands (`cat`, `grep`, `find`, etc.) before considering a command dangerous\n- **Encoding bypass:** Detects `base64` + `npmrc` keyword combinations\n\n### Budget Guard (`budget-guard.ts`)\n- **Token summation:** Exact arithmetic; sum must be ≥ budget to halt\n- **Canonicalization:** Drops `trace_id` field, sorts JSON keys, normalizes whitespace in strings before comparing for loops\n- **Loop detection:** \n - Triplet: Checks last 20 steps for any 3 consecutive identical (tool, args) pairs\n - Alternating: Checks exactly the last 6 steps for A/B/A/B/A/B pattern\n- **Performance:** Fast, no external calls, sub-100ms response time\n\n---\n\n## Test Results\n\nAll four reference test cases pass:\n\n| Test | Endpoint | Expected | Result |\n|------|----------|----------|--------|\n| Safe bash command | Guardrail | allow | ✅ |\n| Restricted npmrc read | Guardrail | block | ✅ |\n| Budget exceeded (21000 ≥ 20000) | Budget | halt | ✅ |\n| Legitimate pagination | Budget | continue | ✅ |\n\n---\n\n## Deployment URLs\n\n- **Guardrail:** https://gerat--77f2572c878811f19a961607ee4eb77e.web.val.run\n- **Budget Guard:** https://gerat--7f02dd2a878811f1885c1607ee4eb77e.web.val.run\n- **Skill Scanner:** https://gerat--0de3bd66878911f1ab5b1607ee4eb77e.web.val.run\n",[151],"pulls","branches","forks","envVars",{"_164":42,"_166":42},"connections",{"_164":42,"_165":42},"count","unfilledCount","emptyCount",{"_18":150,"_20":151,"_115":152,"_117":-5,"_118":68,"_119":153,"_120":38,"_22":185,"_65":139,"_123":97,"_125":155,"_127":26,"_128":-5,"_173":186,"_86":187},{"_18":143,"_20":144,"_115":145,"_117":-5,"_118":68,"_119":146,"_120":38,"_22":182,"_65":42,"_123":124,"_125":148,"_127":26,"_128":-5,"_173":183,"_86":184},{"_18":136,"_20":137,"_115":138,"_117":-5,"_118":68,"_119":139,"_120":38,"_22":179,"_65":42,"_123":124,"_125":141,"_127":26,"_128":-5,"_173":180,"_86":181},{"_18":130,"_20":131,"_115":36,"_117":-5,"_118":68,"_119":132,"_120":38,"_22":176,"_65":42,"_123":124,"_125":134,"_127":26,"_128":-5,"_173":177,"_86":178},{"_18":113,"_20":114,"_115":116,"_117":-5,"_118":68,"_119":66,"_120":38,"_22":172,"_65":122,"_123":124,"_125":126,"_127":26,"_128":-5,"_173":174,"_86":175},["D",1784916093262],"children",[],[114],["D",1784915547360],[],[131],["D",1784915562264],[],[137],["D",1784915574126],[],[144],["D",1784915843685],[],[151],["D",1784915547338],{"_16":17,"_84":80},{"_16":17,"_77":78,"_79":80,"_33":34,"_81":82,"_83":26},{"_65":66,"_20":67,"_18":68,"_69":19,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":21,"_76":17},"ctx",{"_58":-5,"_105":225,"_226":227,"_228":229,"_230":26,"_231":26,"_232":26,"_233":38,"_234":-5,"_235":-7,"_236":-7,"_237":42,"_238":26,"_239":26,"_240":-5,"_241":26,"_242":26,"_243":26,"_244":-5},"ENV",{"_196":197,"_198":199,"_200":67,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Search