Close the leaks the store review found (#30454) - #41
Merged
Conversation
Four findings from the store review of the AI tools, three of them ways a secret reaches the model: probe-api tested its credential guard against the raw path, but Forge decodes the path when it routes, so environ%6dent slipped past the literal denylist and came back with the environment file's content. Reproduced live. The guard now decodes before it tests. get-site returned deployment_script verbatim on an ordinary lookup, and a deployment script is free-form — a password or token pasted into it went straight to the model. Dropped from get-site, and added to probe-api's redaction so the same field is masked in the site collection it can still reach. @raycast/utils was declared but imported nowhere. Removed from the manifest and the lockfile. The confirmation dialogs showed a clean generic prompt when a name could not be resolved, so a transient failure let the user approve without seeing the target or, for reboots, the sites it takes down. The fallback message now says the details are unverified. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The store-review fix for this had the confirmation show a generic prompt when a name could not be resolved. A cleaner answer, per Kevin: don't confirm at all — fail the call and let the agent retry with a resolvable target. The confirmation now resolves the site or server directly, so an unresolved name throws findSite's own error — the candidate list and their ids — before any dialog. The agent gets that error and calls again with an id; nothing is approved in the meantime. Returning undefined to skip the dialog was the other option and is unsafe: it would let a transient lookup blip through to an unconfirmed reboot. A resolvable target still shows the full impact panel. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the four findings from the store review of PR #30454. Verified each against the live Forge API before fixing.
1. Encoded paths bypassed the probe secret guard (confirmed live).
FORBIDDENtested the raw path, but Forge decodes it when routing —environ%6dentslipped past and returned the environment file'scontent. The guard now decodes before testing. Both the encoded and literal env paths are refused.2. Deployment scripts leaked secrets.
get-sitereturneddeployment_scriptverbatim; the field is free-form and can hold a pasted token. Dropped fromget-site, and added toprobe-api's redaction so it's masked in the site collection the probe can still reach.3. Confirmation lost the resolved target. When a name couldn't be resolved at confirm time, the dialog showed a clean generic prompt, so a transient failure let the user approve without seeing the target — or, for reboots, the sites taken down. The fallback message now states the details are unverified. (Not a wrong-target deploy: the target still resolves from the same input at execute time.)
4. Unused dependency.
@raycast/utilswas declared but imported nowhere. Removed from the manifest and lockfile.tsc,eslint,prettierclean.🤖 Generated with Claude Code