fix(secret-guard): accept leading-zero curl range steps

Author: TheGreatAxios

src/permission/auto-shell-policy.test.ts

@@ -42,6 +42,9 @@ describe("local file URL glob expansion", () => {
       "F{ILE,OO}:///tmp/%2Eenv",
       "f[i-i]le:///tmp/%2Eenv",
       "f[a-z]le:///tmp/%2Eenv",
+      "f[a-z:02]le:///tmp/%2Eenv",
+      "f[a-z:0002]le:///tmp/%2Eenv",
+      "f[a-z:0]le:///tmp/%2Eenv",
       "F[I-I]LE:///tmp/%2Eenv",
       "f[i-i]l{e,x}:///tmp/%2Eenv",
       "f[i]le:///tmp/%2Eenv",
@@ -73,6 +76,9 @@ describe("local file URL glob expansion", () => {
       "https://example.com/{one",
       "https://example.com/two}",
       "h[t-t]tp://example.com/[a-z]",
+      "f[a-z:3]le:///tmp/%2Eenv",
+      "f[z-a:02]le:///tmp/%2Eenv",
+      "h[t-z:02]tp://example.com/%2Eenv",
       "https://example.com/[a-z]?q=[0-9]",
       overlengthRemote,
     ]) {

src/permission/classify-security.test.ts

@@ -580,6 +580,25 @@ describe("sensitive-path shell commands require approval, not a hard deny", () =
     expect(asked).toBe(1);
   });
 
+  test("stored curl grants do not authorize stepped file-scheme synthesis", async () => {
+    let asked = 0;
+    const gate = createPermissionGate({
+      approvals: [{ tool: "run_shell", pattern: "curl *" }],
+      requestApproval: async () => {
+        asked++;
+        return { allow: true };
+      },
+      interactive: true,
+      skipPermissions: false,
+      reactorGated: false,
+    });
+    const verdict = await gate.evaluate(
+      shellCall("curl 'f[a-z:02]le:///tmp/%2Eenv'"),
+    );
+    expect(verdict.allowed).toBe(true);
+    expect(asked).toBe(1);
+  });
+
   test("stored grants still authorize ordinary shell reads", async () => {
     let asked = 0;
     const gate = createPermissionGate({

src/plugins/secret-guard-plugin.test.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { createPosixTools } from "@intx/tools-posix";
 import type { ToolCall, ToolResult } from "@intx/types/runtime";
 import { buildCorePosixToolPlugins } from "../agent/posix-tool-plugins.js";
+import { autoShellRuleForCall } from "../permission/auto-shell-policy.js";
 import { createPermissionGate } from "../permission/gate.js";
 import { loadProjectApprovals } from "../permission/store.js";
 import {
@@ -452,6 +453,8 @@ describe("secret-guard file URL normalization", () => {
     "F{ILE,OO}:///tmp/%2Eenv",
     "f[i-i]le:///tmp/%2Eenv",
     "f[a-z]le:///tmp/%2Eenv",
+    "f[a-z:02]le:///tmp/%2Eenv",
+    "f[a-z:0002]le:///tmp/%2Eenv",
     "F[I-I]LE:///tmp/%2Eenv",
     "f[i-i]l{e,x}:///tmp/%2Eenv",
   ];
@@ -488,6 +491,41 @@ describe("secret-guard file URL normalization", () => {
     );
   }
 
+  test("auto mode asks for leading-zero curl ranges across wrappers", () => {
+    for (const step of ["02", "0002"]) {
+      const url = `f[a-z:${step}]le:///tmp/%2Eenv`;
+      for (const command of [
+        `curl '${url}'`,
+        `env curl '${url}'`,
+        `bash -c "curl '${url}'"`,
+        `sh -c "curl '${url}'"`,
+      ]) {
+        expect(autoShellRuleForCall(shell(command), () => false)?.name).toBe(
+          "sensitive-path",
+        );
+      }
+    }
+  });
+
+  test("classifies stepped scheme ranges without widening remote URLs", () => {
+    for (const url of [
+      "f[a-z:2]le:///tmp/%2Eenv",
+      "f[a-z:02]le:///tmp/%2Eenv",
+      "f[a-z:0002]le:///tmp/%2Eenv",
+      "f[a-z:0]le:///tmp/%2Eenv",
+      "f[i]le:///tmp/%2Eenv",
+    ]) {
+      expect(commandReferencesSensitivePath(`curl '${url}'`)).toBeDefined();
+    }
+    for (const url of [
+      "f[a-z:3]le:///tmp/%2Eenv",
+      "f[z-a:02]le:///tmp/%2Eenv",
+      "h[t-z:02]tp://example.com/%2Eenv",
+    ]) {
+      expect(commandReferencesSensitivePath(`curl '${url}'`)).toBeUndefined();
+    }
+  });
+
   test("keeps remote-only scheme globs allowed", () => {
     const overflow = `{${Array.from({ length: 80 }, (_, index) =>
       index % 2 === 0 ? "https" : "http",
@@ -512,7 +550,7 @@ describe("secret-guard file URL normalization", () => {
   });
 
   test("classifies 1000 remote-only bracket URLs within a bounded time", () => {
-    const url = `f[t-t]p://example.com/${"[a-z]".repeat(1_000)}`;
+    const url = `f[t-t:0002]p://example.com/${"[a-z:02]".repeat(1_000)}`;
     const started = performance.now();
     for (let index = 0; index < 1_000; index++) {
       expect(commandReferencesSensitivePath(`curl '${url}'`)).toBeUndefined();

src/plugins/secret-guard-plugin.ts

@@ -495,9 +495,7 @@ interface RangeEmission {
 }
 
 function rangeEmission(expression: string, expected: string): RangeEmission {
-  const range = /^([A-Za-z0-9])-([A-Za-z0-9])(?::([1-9][0-9]*))?$/.exec(
-    expression,
-  );
+  const range = /^([A-Za-z0-9])-([A-Za-z0-9])(?::([0-9]+))?$/.exec(expression);
   if (range === null) {
     const single = /^[A-Za-z0-9]$/.test(expression);
     return {
@@ -525,6 +523,15 @@ function rangeEmission(expression: string, expected: string): RangeEmission {
     expected.toLowerCase().codePointAt(0) ?? -1,
     expected.toUpperCase().codePointAt(0) ?? -1,
   ];
+  if (!Number.isInteger(step) || step <= 0) {
+    return {
+      includesExpected: expectedCodes.some(
+        (code) => code >= startCode && code <= endCode,
+      ),
+      includesOther: true,
+      valid: false,
+    };
+  }
   const includesExpected = expectedCodes.some(
     (code) =>
       code >= startCode && code <= endCode && (code - startCode) % step === 0,