Resolve symlinks before the shell secret denylist

A benign-named symlink into a secret file asks exactly like the secret name itself, while pure name-listings still list freely.

Author: TheGreatAxios

src/permission/auto-shell-policy.ts

@@ -523,7 +523,7 @@ export function autoShellRuleForCall(
   }
 
   for (const subject of subjects) {
-    if (commandReferencesSensitivePath(subject) !== undefined)
+    if (commandReferencesSensitivePath(subject, cwd) !== undefined)
       return SENSITIVE_PATH_ASK_RULE;
   }
 

src/permission/classify.ts

@@ -15,7 +15,8 @@ import {
 import type { McpToolPermissionRegistry } from "../mcp/tool-permissions.js";
 import {
   commandReferencesSensitivePath,
-  isSensitivePath,
+  isSensitiveShellToken,
+  PURE_DIRECTORY_LISTING_PROGRAMS,
 } from "../plugins/secret-guard-plugin.js";
 import {
   runShellAuthzBlockReason,
@@ -113,10 +114,10 @@ export function restrictedPathArg(
   return isRestricted(path, isWriteTool(call.name)) ? path : undefined;
 }
 
-// Programs that only print directory names / metadata. Outside-workspace path
-// arguments are fine for these — listing is not a content read. Content readers
-// (cat, head, xxd, …) still fail the restricted-path check below.
-const PURE_DIRECTORY_LISTING_PROGRAMS = new Set(["ls", "tree"]);
+// Outside-workspace path arguments are fine for pure-listing programs — listing
+// is not a content read. Content readers (cat, head, xxd, …) still fail the
+// restricted-path check below. The program set itself is owned by
+// secret-guard-plugin.ts (shared with the CL-7790 resolve-leg skip).
 
 // Cap accepted tree depth so `tree -L 999999 /` cannot auto-allow an OOM walk.
 const MAX_PURE_TREE_DEPTH = 10;
@@ -405,7 +406,7 @@ function isAutoAllowedSegment(
   const trimmed = segment.trim();
   if (trimmed.length === 0) return false;
   if (isShellCommentOnly(trimmed) || isShellNoOp(trimmed)) return true;
-  if (commandReferencesSensitivePath(trimmed)) return false;
+  if (commandReferencesSensitivePath(trimmed, cwd)) return false;
   // Same metacharacter gate as isAutoAllowedShellCommand: this classifier also
   // runs standalone per pipeline/chain segment (see isAutoAllowedShellSegment),
   // so a segment carrying its own command substitution or redirect must not
@@ -429,7 +430,12 @@ function isAutoAllowedSegment(
     if (args.some((token) => WRITE_FLAG.test(token))) return false;
     if (args.some((token) => EXEC_FLAG.test(token))) return false;
   }
-  if (args.some((token) => isSensitivePath(token))) return false;
+  // CL-7790: resolve symlinks before the secret denylist — a benign-named
+  // symlink into a secret file (notes.txt -> .env) asks exactly like the
+  // secret name itself. Pure name-listings skip the resolve leg: `ls
+  // notes.txt` lists freely (CL-5420), and an impure listing fails above.
+  if (args.some((token) => isSensitiveShellToken(token, cwd, !pureListing)))
+    return false;
   // Pure directory listing may target outside-workspace paths (names only).
   // Content readers must stay inside the workspace.
   if (
@@ -457,7 +463,7 @@ export function isAutoAllowedShellCommand(
     (isShellCommentOnly(trimmed) || isShellNoOp(trimmed))
   )
     return true;
-  if (commandReferencesSensitivePath(trimmed)) return false;
+  if (commandReferencesSensitivePath(trimmed, cwd)) return false;
   // Never auto-allow a command the authz layer would hard-deny at execution.
   if (runShellAuthzBlockReason(trimmed) !== undefined) return false;
   // Reject anything with metacharacters that compose or redirect (& ; < > ` $ etc).

src/permission/gate.ts

@@ -131,7 +131,7 @@ function segmentGuard(
   cwd?: string,
   rootsProvider?: RootsProvider,
 ): SegmentGuard | undefined {
-  if (commandReferencesSensitivePath(segment) !== undefined)
+  if (commandReferencesSensitivePath(segment, cwd) !== undefined)
     return { kind: "secret" };
   if (
     cwd !== undefined &&
@@ -654,7 +654,7 @@ export function createPermissionGate(
     // segment mentions a secret path.
     const shellReferencesSecret =
       shellCmd !== undefined &&
-      commandReferencesSensitivePath(shellCmd) !== undefined;
+      commandReferencesSensitivePath(shellCmd, effectiveCwd) !== undefined;
     if (!restricted && classifyTool(call.name, mcpTiers) === "allow") {
       return { kind: "allow" };
     }
@@ -949,7 +949,8 @@ export function createPermissionGate(
   ) => {
     const anySecret =
       request.tool === "run_shell" &&
-      commandReferencesSensitivePath(request.subject) !== undefined;
+      commandReferencesSensitivePath(request.subject, request.cwd) !==
+        undefined;
     return resolveInteractiveAsk(
       {
         kind: "ask",

src/plugins/secret-guard-plugin.ts

@@ -1,4 +1,4 @@
-import { isAbsolute } from "node:path";
+import { isAbsolute, resolve as resolvePath } from "node:path";
 import type { ToolPlugin } from "@intx/tools-posix";
 import {
   realpathNearestOr,
@@ -135,11 +135,68 @@ function shellPathTokens(command: string): string[] {
 // name at runtime. Perfect shell sandboxing is out of scope; the goal is to
 // force a prompt for the trivial, single-token references that make exfiltration
 // easy. Tool-result secret scrub still redacts credential-shaped output.
+// Programs that only print directory names / metadata — listing a name never
+// dumps file contents. Single owner for this set: the resolve-leg skip below
+// and classify.ts's pure-listing exemption both read it, so a new names-only
+// program cannot drift into one list without the other.
+export const PURE_DIRECTORY_LISTING_PROGRAMS = new Set(["ls", "tree"]);
+
+// Worth spending a realpath on: shaped like a path the shell could open
+// (a slash, an extension dot, or absolute), not a flag, variable, glob, or
+// fd number — those can never resolve into a secret file, so they skip the
+// stat and the hot auto-allow path stays syscall-free for them.
+function isPathLikeShellToken(token: string): boolean {
+  if (
+    token.startsWith("-") ||
+    token.includes("$") ||
+    token.includes("*") ||
+    token.includes("`")
+  )
+    return false;
+  return (
+    isAbsolute(token) ||
+    token.includes("/") ||
+    token.includes("\\") ||
+    token.includes(".")
+  );
+}
+
+// CL-7790: the ONE shell-token matcher both secret-guard call sites share —
+// commandReferencesSensitivePath below and classify.ts's per-arg sensitive
+// check. The cheap lexical denylist runs first so the hot auto-allow path
+// never touches the filesystem; only path-like survivors pay for a realpath
+// via the CL-6971 helper, which catches a benign-named symlink into a secret
+// file (notes.txt -> .env) exactly like the secret name itself. Relative
+// tokens resolve against cwd first because the helper takes absolute paths.
+// Pass resolveSymlinks=false for pure name-listings: listing a name is not
+// dumping its contents (CL-5420), so `ls notes.txt` still lists freely while
+// `cat notes.txt` asks.
+export function isSensitiveShellToken(
+  token: string,
+  cwd: string = process.cwd(),
+  resolveSymlinks = true,
+): boolean {
+  if (isSensitivePath(token)) return true;
+  if (!resolveSymlinks || !isPathLikeShellToken(token)) return false;
+  if (isAbsolute(token)) return isSensitivePathResolved(token);
+  return isSensitivePathResolved(resolvePath(cwd, token));
+}
+
 export function commandReferencesSensitivePath(
   command: string,
+  cwd: string = process.cwd(),
 ): string | undefined {
-  for (const token of shellPathTokens(command)) {
-    if (isSensitivePath(token)) return token;
+  const tokens = shellPathTokens(command);
+  // Dump vs list: a lone name-listing never dumps file contents, so only the
+  // cheap lexical leg applies and `ls notes.txt` still lists freely. Anything
+  // composed (pipes, chains, redirects, subshells) takes the resolve leg —
+  // `ls && cat notes.txt` must not ride the listing exemption.
+  const program = tokens[0] ?? "";
+  const listingOnly =
+    PURE_DIRECTORY_LISTING_PROGRAMS.has(program) &&
+    !/[;&|()<>\n]/.test(command);
+  for (const token of tokens) {
+    if (isSensitiveShellToken(token, cwd, !listingOnly)) return token;
   }
   return undefined;
 }

src/plugins/secret-guard-shell-symlink.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  commandReferencesSensitivePath,
+  isSensitiveShellToken,
+} from "./secret-guard-plugin.js";
+import { isAutoAllowedShellCommand } from "../permission/classify.js";
+import { autoShellRuleForCall } from "../permission/auto-shell-policy.js";
+
+/**
+ * CL-7790: shell token matching ignores symlinks. A benign-named symlink
+ * into a secret file (notes.txt -> .env) must not auto-allow a content dump
+ * (`cat notes.txt`), identically to the direct name (`cat .env`). Pure
+ * name-listing (`ls notes.txt`) still lists freely — dumping contents is the
+ * threat, listing a name is not (dump-vs-list distinction, CL-5420).
+ */
+
+async function withFixture<T>(
+  run: (paths: { cwd: string }) => Promise<T>,
+): Promise<T> {
+  const cwd = await mkdtemp(join(tmpdir(), "cl7790-shell-symlink-"));
+  try {
+    await writeFile(join(cwd, ".env"), "SECRET=fixture-env\n");
+    await writeFile(join(cwd, "README.md"), "# fixture\n");
+    await symlink(join(cwd, ".env"), join(cwd, "notes.txt"));
+    return await run({ cwd });
+  } finally {
+    await rm(cwd, { recursive: true, force: true });
+  }
+}
+
+const shellCall = (command: string) => ({
+  id: "c",
+  name: "run_shell",
+  arguments: { command },
+});
+
+describe("CL-7790 shell tokens resolve symlinks before the secret denylist", () => {
+  test("cat through a benign-named symlink does not auto-allow", async () => {
+    await withFixture(async ({ cwd }) => {
+      expect(isAutoAllowedShellCommand("cat notes.txt", cwd)).toBe(false);
+    });
+  });
+
+  test("cat of the direct secret name still does not auto-allow", async () => {
+    await withFixture(async ({ cwd }) => {
+      expect(isAutoAllowedShellCommand("cat .env", cwd)).toBe(false);
+    });
+  });
+
+  test("pure listing of the symlink still lists freely", async () => {
+    await withFixture(async ({ cwd }) => {
+      expect(isAutoAllowedShellCommand("ls notes.txt", cwd)).toBe(true);
+      expect(isAutoAllowedShellCommand("ls -la", cwd)).toBe(true);
+    });
+  });
+
+  test("pure listing of the direct secret name still asks (CL-5420)", async () => {
+    await withFixture(async ({ cwd }) => {
+      expect(isAutoAllowedShellCommand("ls .env", cwd)).toBe(false);
+    });
+  });
+
+  test("plugin flags the symlinked dump but not the listing", async () => {
+    await withFixture(async ({ cwd }) => {
+      expect(commandReferencesSensitivePath("cat notes.txt", cwd)).toBe(
+        "notes.txt",
+      );
+      expect(
+        commandReferencesSensitivePath("ls notes.txt", cwd),
+      ).toBeUndefined();
+    });
+  });
+
+  test("shared helper matches the resolved target, not just the lexical name", async () => {
+    await withFixture(async ({ cwd }) => {
+      expect(isSensitiveShellToken("notes.txt", cwd)).toBe(true);
+      // The listing leg never resolves: names are not contents.
+      expect(isSensitiveShellToken("notes.txt", cwd, false)).toBe(false);
+      expect(isSensitiveShellToken("README.md", cwd)).toBe(false);
+    });
+  });
+
+  test("auto mode asks for the symlinked dump, not the listing", async () => {
+    await withFixture(async ({ cwd }) => {
+      expect(
+        autoShellRuleForCall(shellCall("cat notes.txt"), () => false, cwd)
+          ?.name,
+      ).toBe("sensitive-path");
+      expect(
+        autoShellRuleForCall(shellCall("ls notes.txt"), () => false, cwd),
+      ).toBeUndefined();
+    });
+  });
+});

src/plugins/tool-result-secret-scrub.ts

@@ -27,6 +27,11 @@ const JSON_CREDENTIAL_FIELD =
 // Grep/shell lines often look like path:line:KEY=value
 const ENV_ASSIGNMENT = /(?:^|:)([A-Z][A-Z0-9_]+)=([^\n]+)/gm;
 
+// CL-7790 decision: connection-string keys (DATABASE_URL and friends) are
+// deliberately NOT matched here. Widening this shape-classifier would redact
+// every benign connection string in tool output — a false-positive blast
+// radius on a scrub path, not a prompt path. That needs its own measured
+// ticket; the gap stays documented, not silently fixed.
 function isSecretEnvKey(key: string): boolean {
   return (
     key === "API_KEY" ||