feat(validators): add outbound query privacy gate for research egress

lib/validators/query-privacy-gate.mjs

@@ -0,0 +1,110 @@
+// lib/validators/query-privacy-gate.mjs
+// Inspect an outbound research query before it leaves the machine. Called
+// only from the new high-effort steps (Phase 4.5 dimension discovery + the
+// bounded Phase 5 loop turns) — the existing single-pass Phase 5 path is
+// unchanged (Step 6, plan-v2).
+//
+// Two-tier, same shape as lib/exporters/endpoint-validator.mjs's SSRF gate:
+//   - WARN tier  — absolute filesystem paths, repo-internal identifiers.
+//     Operator-overridable via `strict: false` / `--soft` (matches
+//     lib/validators/research-validator.mjs's strict/soft convention), and
+//     fully bypassable via the VOYAGE_QUERY_PRIVACY_ALLOW=1 opt-in.
+//   - HARD-BLOCK tier — secret-shaped tokens. NEVER overridable by strict,
+//     --soft, or the opt-in env var — mirrors endpoint-validator.mjs's
+//     HARD_BLOCKED_HOSTS, where an opt-in widens the warn tier but never
+//     unlocks the permanently-blocked one.
+//
+// CLI shim:
+//   node lib/validators/query-privacy-gate.mjs [--soft] "<query text>"
+//   → JSON {valid, errors, warnings}; exit 0 valid, 1 invalid.
+
+import { issue } from '../util/result.mjs';
+
+// WARN tier — absolute filesystem paths (leaks local directory layout).
+export const ABSOLUTE_PATH_PATTERNS = Object.freeze([
+  /\/Users\/[^\s"'`]+/,
+  /\/home\/[^\s"'`]+/,
+  /[A-Za-z]:\\[^\s"'`]+/,
+  /\$\{?HOME\}?\/[^\s"'`]+/,
+]);
+
+// WARN tier — repo-internal identifiers that don't need to leave the
+// machine in a generic research query.
+export const REPO_IDENTIFIER_PATTERNS = Object.freeze([
+  /git\.fromaitochitta\.com[^\s"'`]*/,
+  /\bktg-plugin-marketplace\b/,
+  /\bplugins\/cache\/[^\s"'`]+/,
+]);
+
+// HARD-BLOCK tier — secret-shaped strings. Never operator-overridable.
+export const SECRET_SHAPED_PATTERNS = Object.freeze([
+  /\bsk-[A-Za-z0-9]{20,}\b/, // OpenAI/Anthropic-style API keys
+  /\bAKIA[0-9A-Z]{16}\b/, // AWS access key ID
+  /\bghp_[A-Za-z0-9]{36,}\b/, // GitHub personal access token
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, // Slack token
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM private key block
+]);
+
+function findMatch(patterns, text) {
+  for (const re of patterns) {
+    const m = re.exec(text);
+    if (m) return m[0];
+  }
+  return null;
+}
+
+/**
+ * @param {string} text
+ * @param {{strict?: boolean, env?: object}} [opts]
+ * @returns {{valid: boolean, errors: import('../util/result.mjs').Issue[], warnings: import('../util/result.mjs').Issue[]}}
+ */
+export function validateOutboundQuery(text, opts = {}) {
+  const strict = opts.strict !== false;
+  const env = opts.env || process.env;
+  // Bypasses the WARN tier entirely — never affects the hard-block tier below.
+  const allowWarnTier = env.VOYAGE_QUERY_PRIVACY_ALLOW === '1';
+
+  if (typeof text !== 'string' || text.length === 0) {
+    return { valid: false, errors: [issue('PRIVACY_EMPTY_QUERY', 'Outbound query must be a non-empty string')], warnings: [] };
+  }
+
+  const errors = [];
+  const warnings = [];
+
+  // Hard-block tier — checked unconditionally; no opt-in reaches this branch.
+  const secretMatch = findMatch(SECRET_SHAPED_PATTERNS, text);
+  if (secretMatch) {
+    errors.push(issue('PRIVACY_SECRET_SHAPED', `Outbound query contains a secret-shaped token: ${secretMatch}`));
+  }
+
+  if (!allowWarnTier) {
+    const pathMatch = findMatch(ABSOLUTE_PATH_PATTERNS, text);
+    if (pathMatch) {
+      const issueObj = issue('PRIVACY_ABSOLUTE_PATH', `Outbound query contains an absolute filesystem path: ${pathMatch}`);
+      if (strict) errors.push(issueObj); else warnings.push(issueObj);
+    }
+
+    const repoMatch = findMatch(REPO_IDENTIFIER_PATTERNS, text);
+    if (repoMatch) {
+      const issueObj = issue('PRIVACY_REPO_IDENTIFIER', `Outbound query contains a repo-internal identifier: ${repoMatch}`);
+      if (strict) errors.push(issueObj); else warnings.push(issueObj);
+    }
+  }
+
+  return { valid: errors.length === 0, errors, warnings };
+}
+
+// ---- CLI shim ----------------------------------------------------------------
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const args = process.argv.slice(2);
+  const strict = !args.includes('--soft');
+  const text = args.find(a => !a.startsWith('--'));
+  if (text === undefined) {
+    process.stderr.write('Usage: query-privacy-gate.mjs [--soft] "<query text>"\n');
+    process.exit(2);
+  }
+  const r = validateOutboundQuery(text, { strict });
+  process.stdout.write(JSON.stringify(r) + '\n');
+  process.exit(r.valid ? 0 : 1);
+}

tests/validators/query-privacy-gate.test.mjs

@@ -0,0 +1,143 @@
+// tests/validators/query-privacy-gate.test.mjs
+// Cover lib/validators/query-privacy-gate.mjs: two-sided code table
+// (absolute path / repo-internal identifier / secret-shaped token), a
+// benign query passing untouched, the opt-in env var reaching only the
+// warn tier (never the hard-block tier), strict/soft severity, and the
+// CLI shim.
+//
+// Secret-shaped fixtures are built via string concatenation/repeat, never
+// as literal tokens — the repo's own secrets pre-edit hook (correctly)
+// treats a literal AKIA/sk-/ghp_ string as a real credential.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  validateOutboundQuery,
+  ABSOLUTE_PATH_PATTERNS,
+  REPO_IDENTIFIER_PATTERNS,
+  SECRET_SHAPED_PATTERNS,
+} from '../../lib/validators/query-privacy-gate.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const SHIM = join(HERE, '..', '..', 'lib', 'validators', 'query-privacy-gate.mjs');
+
+const FAKE_OPENAI_KEY = 'sk-' + 'a'.repeat(24);
+const FAKE_AWS_KEY = 'AKIA' + 'Q'.repeat(16);
+const FAKE_GITHUB_PAT = 'ghp_' + 'b'.repeat(36);
+
+function runShim(args) {
+  try {
+    const out = execFileSync(process.execPath, [SHIM, ...args], {
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return { code: 0, out };
+  } catch (e) {
+    return { code: e.status ?? 1, out: e.stdout?.toString() ?? '' };
+  }
+}
+
+// ---- two-sided code table ----------------------------------------------------
+
+const TABLE = [
+  { label: 'absolute path (/Users/...)', text: 'find every caller of foo in /Users/ktg/repos/voyage/lib/util/foo.mjs', code: 'PRIVACY_ABSOLUTE_PATH' },
+  { label: 'absolute path (/home/...)', text: 'trace /home/alice/projects/app/src/index.js for imports', code: 'PRIVACY_ABSOLUTE_PATH' },
+  { label: 'repo-internal identifier (forgejo host)', text: 'what changed recently on git.fromaitochitta.com/open/voyage', code: 'PRIVACY_REPO_IDENTIFIER' },
+  { label: 'repo-internal identifier (repo name)', text: 'search issues for ktg-plugin-marketplace regressions', code: 'PRIVACY_REPO_IDENTIFIER' },
+  { label: 'secret-shaped (OpenAI/Anthropic-style key)', text: `auth failing with key ${FAKE_OPENAI_KEY}`, code: 'PRIVACY_SECRET_SHAPED' },
+  { label: 'secret-shaped (AWS access key)', text: `rotate ${FAKE_AWS_KEY} now`, code: 'PRIVACY_SECRET_SHAPED' },
+  { label: 'secret-shaped (GitHub PAT)', text: `token leaked: ${FAKE_GITHUB_PAT}`, code: 'PRIVACY_SECRET_SHAPED' },
+];
+
+for (const { label, text, code } of TABLE) {
+  test(`validateOutboundQuery — ${label} → ${code} (strict, error)`, () => {
+    const r = validateOutboundQuery(text, { strict: true, env: {} });
+    assert.equal(r.valid, false);
+    assert.ok(r.errors.find(e => e.code === code), JSON.stringify(r.errors));
+  });
+}
+
+test('validateOutboundQuery — benign generic query passes untouched', () => {
+  const r = validateOutboundQuery('What are the tradeoffs between optimistic and pessimistic locking?', { env: {} });
+  assert.equal(r.valid, true);
+  assert.deepEqual(r.errors, []);
+  assert.deepEqual(r.warnings, []);
+});
+
+// ---- strict vs soft (warn tier only) -----------------------------------------
+
+test('validateOutboundQuery — soft mode downgrades warn-tier findings to warnings, stays valid', () => {
+  const r = validateOutboundQuery('inspect /Users/ktg/repos/voyage', { strict: false, env: {} });
+  assert.equal(r.valid, true);
+  assert.equal(r.errors.length, 0);
+  assert.ok(r.warnings.find(w => w.code === 'PRIVACY_ABSOLUTE_PATH'));
+});
+
+test('validateOutboundQuery — soft mode does NOT downgrade the hard-block tier', () => {
+  const r = validateOutboundQuery(`leaked ${FAKE_OPENAI_KEY}`, { strict: false, env: {} });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.find(e => e.code === 'PRIVACY_SECRET_SHAPED'));
+});
+
+// ---- opt-in env var reaches only the warn tier -------------------------------
+
+test('validateOutboundQuery — VOYAGE_QUERY_PRIVACY_ALLOW=1 bypasses the warn tier entirely', () => {
+  const r = validateOutboundQuery('inspect /Users/ktg/repos/voyage', { env: { VOYAGE_QUERY_PRIVACY_ALLOW: '1' } });
+  assert.equal(r.valid, true);
+  assert.equal(r.errors.length, 0);
+  assert.equal(r.warnings.length, 0);
+});
+
+test('validateOutboundQuery — VOYAGE_QUERY_PRIVACY_ALLOW=1 does NOT open the hard-block tier', () => {
+  const r = validateOutboundQuery(`leaked ${FAKE_OPENAI_KEY}`, { env: { VOYAGE_QUERY_PRIVACY_ALLOW: '1' } });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.find(e => e.code === 'PRIVACY_SECRET_SHAPED'), 'opt-in must never unlock the hard-block tier');
+});
+
+test('validateOutboundQuery — VOYAGE_QUERY_PRIVACY_ALLOW=1 combined with a secret still denies', () => {
+  const r = validateOutboundQuery(`/Users/ktg/x leaked ${FAKE_OPENAI_KEY}`, { env: { VOYAGE_QUERY_PRIVACY_ALLOW: '1' } });
+  assert.equal(r.valid, false);
+  assert.equal(r.errors.length, 1);
+  assert.equal(r.errors[0].code, 'PRIVACY_SECRET_SHAPED');
+});
+
+// ---- empty input --------------------------------------------------------------
+
+test('validateOutboundQuery — empty string is invalid', () => {
+  const r = validateOutboundQuery('', { env: {} });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.find(e => e.code === 'PRIVACY_EMPTY_QUERY'));
+});
+
+// ---- pattern set is frozen ----------------------------------------------------
+
+test('pattern sets are Object.frozen', () => {
+  assert.equal(Object.isFrozen(ABSOLUTE_PATH_PATTERNS), true);
+  assert.equal(Object.isFrozen(REPO_IDENTIFIER_PATTERNS), true);
+  assert.equal(Object.isFrozen(SECRET_SHAPED_PATTERNS), true);
+});
+
+// ---- CLI shim -----------------------------------------------------------------
+
+test('CLI shim — benign query exits 0 with valid:true', () => {
+  const r = runShim(['harmless generic question about caching strategies']);
+  assert.equal(r.code, 0);
+  const parsed = JSON.parse(r.out.trim());
+  assert.equal(parsed.valid, true);
+});
+
+test('CLI shim — secret-shaped query exits 1 even with --soft', () => {
+  const r = runShim(['--soft', `leaked ${FAKE_OPENAI_KEY}`]);
+  assert.equal(r.code, 1);
+  const parsed = JSON.parse(r.out.trim());
+  assert.equal(parsed.valid, false);
+  assert.ok(parsed.errors.find(e => e.code === 'PRIVACY_SECRET_SHAPED'));
+});
+
+test('CLI shim — missing query argument exits 2 (usage error)', () => {
+  const r = runShim([]);
+  assert.equal(r.code, 2);
+});