From 4126da65ae80643618c067ea5aca023561af8c6d Mon Sep 17 00:00:00 2001 From: AhmetArif0 <147827411+AhmetArif0@users.noreply.github.com> Date: Mon, 25 May 2026 16:29:14 +0300 Subject: [PATCH] fix(security): add bws_cache.json to file_safety read guard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Bitwarden Secrets Manager disk cache introduced in #31968 stores plaintext secret values at /cache/bws_cache.json to avoid re-fetching across back-to-back CLI invocations. The file was not added to get_read_block_error()'s credential_file_names list, leaving the agent able to read it directly via the read_file tool. Add os.path.join("cache", "bws_cache.json") to credential_file_names so both HERMES_HOME and the global root are covered, matching the existing pattern used for auth.json, .anthropic_oauth.json, etc. Other files under cache/ (images, documents, audio) are unaffected — the check is an exact-file match, not a prefix match. Verified: 11/11 exploit/regression scenarios pass; 38/38 existing file_safety tests pass. --- agent/file_safety.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/agent/file_safety.py b/agent/file_safety.py index 22b190c3a..e317b3439 100644 --- a/agent/file_safety.py +++ b/agent/file_safety.py @@ -249,6 +249,10 @@ def get_read_block_error(path: str) -> Optional[str]: ".env", "webhook_subscriptions.json", os.path.join("auth", "google_oauth.json"), + # Bitwarden Secrets Manager disk cache: stores plaintext secret values + # to avoid re-fetching across back-to-back CLI invocations. The file + # was introduced by #31968 but not added to this guard. + os.path.join("cache", "bws_cache.json"), ) for hd in hermes_dirs: for name in credential_file_names: