release: prepare v2.13.0 security and blocking fixes

.env.example

@@ -4,7 +4,8 @@ ENV=dev                                                         # options: dev|s
 # metadata, and default-model lookups.  Leave unset to default to nv_build.
 # Options: openai | anthropic | anthropic_proxy | bedrock | nv_build |
 #          ollama | azure_openai | openai_compatible | claude_cli |
-#          codex_cli | gemini_cli | opencode_cli
+#          gemini_cli | opencode_cli
+# codex_cli is registered but disabled: its read-only sandbox permits host-file reads.
 SKILLSPECTOR_PROVIDER=
 
 # Aggregate deadline for one complete scan workflow. Defaults to 600 seconds;
@@ -28,7 +29,8 @@ NVIDIA_INFERENCE_KEY=
 OPENAI_API_KEY=
 OPENAI_BASE_URL=
 # Optional provider- and model-dependent reasoning-effort setting. Non-empty values
-# are trimmed and passed through unchanged; unset or blank uses the provider default.
+# are trimmed and passed through unchanged. Unset or blank sends high for nv_build
+# with z-ai/glm-5.3; other provider/model combinations keep their endpoint defaults.
 SKILLSPECTOR_REASONING_EFFORT=
 # Optional language for human-readable LLM finding text. Machine-readable values
 # such as rule IDs and severity values remain unchanged.
@@ -67,7 +69,7 @@ AZURE_OPENAI_ENDPOINT=
 SKILLSPECTOR_COMPAT_API_KEY=
 SKILLSPECTOR_COMPAT_BASE_URL=
 
-# claude_cli, codex_cli, gemini_cli, and opencode_cli use their CLI's existing local
+# claude_cli, gemini_cli, and opencode_cli use their CLI's existing local
 # authentication session and do not need an API key here.
 
 # SkillSpector config

.github/workflows/ci.yml

@@ -17,9 +17,9 @@ name: CI
 
 on:
   pull_request:
-    branches: ["main"]
+    branches: ["main", "yashraj/v2.13.0-base"]
   push:
-    branches: ["main"]
+    branches: ["main", "yashraj/v2.13.0-base"]
 
 # Least privilege: these jobs only read the repo; no write scopes are needed.
 permissions:

.github/workflows/release.yml

@@ -5,7 +5,7 @@ name: Publish GitHub Release
 
 on:
   pull_request:
-    branches: ["main"]
+    branches: ["main", "yashraj/v2.13.0-base"]
     types: [closed]
 
 permissions:
@@ -30,12 +30,13 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
+          persist-credentials: false
       - name: Set up uv
         # Pinned to a full commit SHA (third-party action); comment tracks the tag.
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: "${{ env.UV_VERSION }}"
           enable-cache: true

.opencode/tools/skillspector_scan_lib.ts

@@ -44,25 +44,94 @@ export function truncate(text: string, max: number): string {
 export function redact(text: string, env: Env = process.env): string {
   const credentialValues = [...new Set(
     CREDENTIAL_ENV_NAMES.map((name) => env[name]?.trim()).filter(
-      (value): value is string => Boolean(value && value.length >= 4),
+      (value): value is string => Boolean(value),
     ),
   )].sort((left, right) => right.length - left.length)
-  const credentialPattern = credentialValues.length
-    ? new RegExp(
-        credentialValues
-          .map((value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
-          .join("|"),
-        "g",
-      )
+  const valuePatterns = credentialValues.map((value) => {
+    const literal = value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+    // Short values are usually local-provider placeholders. Treat them as
+    // tokens so they cannot change words, JSON fields, or longer credentials.
+    return value.length < 4 ? `(?<![A-Za-z0-9_-])${literal}(?![A-Za-z0-9_-])` : literal
+  })
+  // Look ahead so overlapping configured values are all covered. Matching
+  // still advances through the original text, never through replacement markers.
+  const credentialPattern = valuePatterns.length
+    ? new RegExp(`(?=(${valuePatterns.join("|")}))`, "g")
     : undefined
-  const redacted = credentialPattern ? text.replace(credentialPattern, "[REDACTED]") : text
-  return redacted
-    .replace(/sk-ant-[A-Za-z0-9_-]+/g, "[REDACTED]")
-    .replace(/\bsk-[A-Za-z0-9_-]{6,}\b/g, "[REDACTED]")
-    .replace(
-      /\b([A-Z][A-Z0-9_]*(?:API_KEY|TOKEN|ACCESS_KEY_ID|SECRET_ACCESS_KEY|INFERENCE_KEY))(\s*[:=]\s*["']?)[^"'\s,}]+/g,
-      "$1$2[REDACTED]",
-    )
+  // A full configured credential can act as the separator before another key.
+  // Match on the original text so overlapping values never split that key.
+  // Short values cannot end here unless their existing token boundary allows it.
+  const longValues = valuePatterns.filter((_, index) => credentialValues[index].length >= 4)
+  const keyBoundary = longValues.length ? `(?:\\b|(?<=${longValues.join("|")}))` : "\\b"
+  const keyPattern = new RegExp([
+    "sk-ant-[A-Za-z0-9_-]+",
+    `${keyBoundary}sk-[A-Za-z0-9_-]{6,}\\b`,
+    // Consume each uppercase name once, even when it is not an assignment.
+    // Otherwise a known value like AAAA permits a costly retry at every A.
+    `${keyBoundary}([A-Z][A-Z0-9_]*)`,
+  ].join("|"), "g")
+  const assignmentName = /[A-Z0-9_](?:API_KEY|TOKEN|ACCESS_KEY_ID|SECRET_ACCESS_KEY|INFERENCE_KEY)$/
+  const assignmentValue = /(\s*[:=]\s*["']?)[^"'\s,}]+/y
+  const scrub = (value: string): string => {
+    function* spans(pattern: RegExp | undefined, literal: boolean): Generator<[number, number]> {
+      if (!pattern) return
+      for (const match of value.matchAll(pattern)) {
+        if (!literal && match[1]) {
+          if (!assignmentName.test(match[1])) continue
+          assignmentValue.lastIndex = match.index + match[0].length
+          const assigned = assignmentValue.exec(value)
+          if (assigned) {
+            yield [assigned.index + assigned[1].length, assigned.index + assigned[0].length]
+          }
+        } else {
+          yield [match.index, match.index + (literal ? match[1].length : match[0].length)]
+        }
+      }
+    }
+    const known = spans(credentialPattern, true)
+    const shaped = spans(keyPattern, false)
+    let nextKnown = known.next().value
+    let nextShaped = shaped.next().value
+    let cursor = 0
+    let start = -1
+    let end = -1
+    const parts: string[] = []
+    // Merge two ordered span streams in linear time. A shorter key/assignment
+    // match cannot expose the tail of a longer configured credential.
+    while (nextKnown || nextShaped) {
+      let span: [number, number]
+      if (nextKnown && (!nextShaped || nextKnown[0] <= nextShaped[0])) {
+        span = nextKnown
+        nextKnown = known.next().value
+      } else {
+        span = nextShaped!
+        nextShaped = shaped.next().value
+      }
+      if (span[0] > end) {
+        if (start >= 0) {
+          parts.push(value.slice(cursor, start), "[REDACTED]")
+          cursor = end
+        }
+        start = span[0]
+      }
+      end = Math.max(end, span[1])
+    }
+    if (start >= 0) {
+      parts.push(value.slice(cursor, start), "[REDACTED]")
+      cursor = end
+    }
+    parts.push(value.slice(cursor))
+    return parts.join("")
+  }
+  try {
+    const report = JSON.parse(text)
+    if (report === null || typeof report !== "object") return scrub(text)
+    // Preserve JSON numbers and booleans, including a score equal to a short
+    // placeholder. Credentials inside JSON strings still receive full scrubbing.
+    return text.replace(/"(?:[^"\\]|\\.)*"/g, (token) => JSON.stringify(scrub(JSON.parse(token))))
+  } catch {
+    return scrub(text)
+  }
 }
 
 export function isScpGitTarget(target: string): boolean {

CHANGELOG.md

@@ -1,3 +1,66 @@
+### 2.13.0 (Unreleased)
+### Security and blocking fixes
+* Selected release based on v2.12.0; includes 55 PRs, with #743 included through #734.
+* Reads SKILL.md metadata correctly when the file starts with an invisible encoding marker. (#471)
+* Detects text-direction control characters that can disguise code in bundled scripts, not just Markdown. (#473)
+* Marks recursive scan coverage as incomplete when linked skill folders are deliberately skipped. (#499)
+* Detects access to sensitive files even when their paths are assembled from fixed strings. (#545)
+* Marks analysis incomplete when custom YARA rules cannot be loaded or compiled. (#557)
+* Preserves dangerous shell-command findings when deeper Python analysis cannot confidently replace them. (#577)
+* Keeps distinct shell-command findings separate, even when their displayed snippets look identical. (#578)
+* Recognizes more executable Python files, including .pyw files and extensionless launchers. (#579)
+* Adds lower-confidence warnings for multiline scripts that appear to open a remote shell, while preserving existing one-line detections. (#593)
+* Shows how many linked skill folders were skipped and includes that count in recursive scan coverage. (#595)
+* Checks complete TypeScript declaration files before treating them as non-executable, so partial or disguised runtime code is not skipped. (#601)
+* Flags bundled settings that run commands, redirect AI traffic, or automatically approve connected tool servers. (#604)
+* Finds Python flows from secret reads to risky uses even when the assignments and uses appear at different nesting depths. (#611)
+* Keeps Python findings when parser location columns are missing, instead of crashing or merging distinct findings together. (#623)
+* Recognizes more ordinary Markdown sentences and lists so their apostrophes do not cause false shell-parsing and incomplete-scan warnings. (#627)
+* Inspects hooks declared in Claude plugin manifests and reports incomplete coverage when those declarations cannot be fully checked. (#632)
+* Parses quoted shell assignments correctly so harmless trailing text does not falsely make a scan incomplete. (#634)
+* Makes saved baselines cover every occurrence of a repeated finding, so later scans suppress them consistently. (#637)
+* Detects bundled Node settings that use the short -r flag to load and run extra code. (#655)
+* Preserves exact findings in baselines and protects existing baseline files during regeneration. (#657)
+* Avoids misleading high-severity warnings on SKILL.md self-references while still reporting missing or ambiguous files. (#661)
+* Accepts ordinary shell variable defaults and assignment values without falsely marking their files as partly scanned. (#686)
+* Improves TP4 responses for the specific OpenAI-provider Opus 5 route and rejects missing, malformed, or contradictory tool results. (#691)
+* Lowers alerts for simple download pipelines that demonstrably parse incoming data rather than execute it. (#700)
+* Attaches AI review decisions to the correct findings and distinguishes disagreement from missing or failed reviews. (#702)
+* Recognizes safely decodable shell printf escapes without incorrectly marking analysis incomplete. (#704)
+* Detects sensitive data passed to urllib opener requests, including inline opener calls. (#721)
+* Displays untrusted names, filenames and findings literally in terminal reports, preventing markup crashes and spoofing. (#725)
+* Rejects scan output that points to the input file, including symbolic or hard links, preventing accidental overwrites. (#729)
+* Prevents untrusted names and findings from inserting fake headings, rows or HTML into batch Markdown reports. (#733)
+* Displays untrusted skill names and errors literally in batch terminals so markup and control characters cannot spoof the output. (#734)
+* Prevents untrusted finding text and filenames from changing Markdown report structure, using shared protection for core and batch reports. (#735)
+* Stops remote MCP scans from using the server’s Git credentials to clone private repositories while preserving trusted local Git access. (#736)
+* Disables the Codex CLI analysis provider because its read-only sandbox still permits host-secret reads, directing users to another provider. (#737)
+* Limits environment variables passed to agent CLI providers so unexpected secret variables are not forwarded to child processes. (#738)
+* Prevents long scanner output from blocking Pi’s secret redaction while still hiding secrets before the displayed output is shortened. (#739)
+* Prevents crafted Python literals and unfinished function headers from causing extremely slow scans. (#740)
+* Enforces per-skill batch timeouts by stopping stuck workers while other scans continue. (#743)
+* Limits unauthenticated MCP HTTP access to the local machine; remote access requires an authenticating proxy. (#744)
+* Redacts short configured secrets from OpenCode’s returned output without corrupting JSON values; separately written report files remain outside this redactor. (#745)
+* Pins the release workflow’s checkout action to a fixed commit so a moving version tag cannot silently change the code it runs. (#746)
+* Switches NVIDIA Build’s default from retired GLM-5.2 to GLM-5.3 while preserving explicit model overrides. (#748)
+* Prevents registry reports from overwriting their input files. (#758)
+* Keeps the release GitHub token out of Git configuration during dependency installation and builds. (#767)
+* Detects encoded shell payloads that are decoded and executed. (#786)
+* Requires approval for external Pi scan inputs and blocks file-reading YARA includes. (#791)
+* Separates local and referenced-content caches so baseline suppression cannot use the wrong file. (#792)
+* Keeps real disk content separate from archive members with colliding paths and reports failed coverage for ambiguous paths. (#793)
+* Inspects readable instructions hidden behind binary prefixes while preserving benign PDF/GIF and XMP handling and explicit limits for referenced or executable binaries. (#794)
+* Inspects untrusted OMS signing metadata and decoded payloads, preserving raw evidence and incomplete coverage on parsing failures. (#795)
+* Reports malformed LLM responses as incomplete analysis instead of successful empty results. (#796)
+* Tracks sensitive-data flow by function scope, avoiding collisions between unrelated variable names. (#799)
+* Keeps intentionally excluded files separate from failed analyzer work in coverage reports. (#802)
+* Preserve atomic baseline updates and refuse updates that cannot retain ownership or group safely.
+* Keep static-only scans independent of inactive LLM provider settings while retaining strict provider checks for LLM-enabled scans.
+* Bound TypeScript declaration matching so malformed files cannot stall scans; timed-out checks leave the files eligible for executable analysis.
+* Counts only the bytecode walk’s own CPU time toward its processing limit, while retaining the overall scan deadline. Waiting for other analyzers no longer makes clean scans incomplete. (#828)
+* Avoids execution warnings for simple decode-to-checksum pipelines and preserves disk-versus-archive error locations when paths collide. (#844)
+* Enable CI and label-gated publishing for the selected v2.13.0 release branch.
+---
 ### 2.12.0 (Unreleased)
 ### Features/Bug Fixes
 * fix(security): retain incomplete coverage for runtime-selected commands and remeasure active Git clones strictly (#514)