feat(security): flip silent-success masking gate to blocking (#257)

bgagent · cursoragent · bgagent · commit 5a52a88bfffc · 2026-06-12T21:25:59.000-05:00
Triage all 40 baseline AI004 findings with justified inline nosemgrep
allowlists for intentional fail-open and degraded-mode fallbacks, add
--error to security:sast:masking, and remove the advisory baseline doc.

Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;
diff --git a/.semgrep/BASELINE.md b/.semgrep/BASELINE.md
diff --git a/.semgrep/silent-success-masking.yaml b/.semgrep/silent-success-masking.yaml
@@ -18,7 +18,7 @@
 # even though it does not mask the outer failure. Rare in practice; use the
 # nosemgrep allowlist if it occurs.
 #
-# Run:  mise run security:sast:masking        (advisory; emits SARIF)
+# Run:  mise run security:sast:masking        (blocking; emits SARIF)
 # Test: semgrep test .semgrep/
 rules:
   - id: ts-silent-success-masking
diff --git a/AGENTS.md b/AGENTS.md
@@ -111,7 +111,7 @@ Run `mise tasks --all` (with `MISE_EXPERIMENTAL=1`) for the full list. Common co
 - **`mise //docs:build`** — Sync and build docs site.
 - **`mise run security:secrets`** — Gitleaks at repo root.
 - **`mise run security:sast`** — Semgrep on the repo (root; includes **`agent/`** Python among paths).
-- **`mise run security:sast:masking`** — Custom semgrep rules for silent-success masking (`catch`/`except` returning empty defaults, AI004). Advisory while the baseline in **`.semgrep/BASELINE.md`** is open; emits SARIF to `test-reports/`. Allowlist intentional fallbacks with an inline justified `nosemgrep: <rule-id> -- <reason>` comment.
+- **`mise run security:sast:masking`** — Custom semgrep rules for silent-success masking (`catch`/`except` returning empty defaults, AI004). Blocking; emits SARIF to `test-reports/`. Allowlist intentional fallbacks with an inline justified `nosemgrep: <rule-id> -- <reason>` comment.
 - **`mise run security:deps`** — OSV Scanner on **`yarn.lock`** (all JS workspaces) and **`agent/uv.lock`**.
 - **`mise run security`** — Runs **`security:secrets`**, **`security:deps`**, **`security:sast`**, **`security:sast:masking`**, **`security:grype`**, **`security:retire`**, **`security:gh-actions`**, and **`//agent:security`**.
 - **`mise run security:retire`** — Retire.js on CDK, CLI, and docs packages.
diff --git a/agent/src/config.py b/agent/src/config.py
@@ -105,6 +105,7 @@ def resolve_linear_api_token(channel_metadata: dict[str, str] | None = None) ->
         from botocore.exceptions import BotoCoreError, ClientError
     except ImportError as e:
         log("WARN", f"resolve_linear_api_token: boto3 unavailable ({e}); skipping")
+        # nosemgrep: py-silent-success-masking -- optional Linear MCP; boto3 unavailable
         return ""
 
     sm = boto3.client("secretsmanager", region_name=region)
@@ -127,6 +128,7 @@ def _fetch_token() -> dict | None:
                 f"resolve_linear_api_token: secret '{secret_arn}' is not valid JSON "
                 f"({type(e).__name__}: {e}); workspace requires re-onboarding",
             )
+            # nosemgrep: py-silent-success-masking -- corrupt OAuth JSON; None means no token
             return None
 
     def _is_expiring(expires_at_iso: str, threshold_seconds: int = 60) -> bool:
@@ -270,6 +272,7 @@ def _refresh(current: dict) -> dict | None:
             fresh = _fetch_token()
         except (ClientError, BotoCoreError) as e:
             log("WARN", f"resolve_linear_api_token: re-read after invalid_grant failed: {e}")
+            # nosemgrep: py-silent-success-masking -- transient SM re-read after invalid_grant
             return None
         if fresh is None:
             # Secret is unreadable (corrupted JSON). Already logged inside
@@ -309,6 +312,7 @@ def _refresh(current: dict) -> dict | None:
         is_hard_failure = code in ("AccessDeniedException", "ResourceNotFoundException")
         severity = "ERROR" if is_hard_failure else "WARN"
         log(severity, f"resolve_linear_api_token failed: {type(e).__name__}: {e}")
+        # nosemgrep: py-silent-success-masking -- SM fetch logged; empty token disables Linear
         return ""
     if token_obj is None:
         # Corrupted secret JSON; already logged inside _fetch_token.
diff --git a/agent/src/hooks.py b/agent/src/hooks.py
@@ -1088,6 +1088,7 @@ def _nudge_between_turns_hook(ctx: dict) -> list[str]:
         pending = nudge_reader.read_pending(task_id)
     except Exception as exc:
         log("WARN", f"nudge read_pending raised: {type(exc).__name__}: {exc}")
+        # nosemgrep: py-silent-success-masking -- fail-open hook; DDB blip must not block agent
         return []
 
     # Filter out any nudges already injected in this process (regardless of
@@ -1102,6 +1103,7 @@ def _nudge_between_turns_hook(ctx: dict) -> list[str]:
         formatted = nudge_reader.format_as_user_message(pending)
     except Exception as exc:
         log("WARN", f"nudge format failed: {type(exc).__name__}: {exc}")
+        # nosemgrep: py-silent-success-masking -- fail-open hook; bad nudge must not block agent
         return []
 
     # Record injection BEFORE mark_consumed so a persistent mark_consumed
@@ -1163,6 +1165,7 @@ def _denial_between_turns_hook(ctx: dict) -> list[str]:
         pending = engine.drain_denial_injections()
     except Exception as exc:  # pragma: no cover — defensive
         log("WARN", f"denial drain raised: {type(exc).__name__}: {exc}")
+        # nosemgrep: py-silent-success-masking -- fail-open hook; denial injection is best-effort
         return []
     if not pending:
         return []
@@ -1217,6 +1220,7 @@ def _cancel_between_turns_hook(ctx: dict) -> list[str]:
         record = task_state.get_task(task_id)
     except task_state.TaskFetchError as exc:
         log("WARN", f"cancel hook get_task raised: {type(exc).__name__}: {exc}")
+        # nosemgrep: py-silent-success-masking -- fail-open cancel; DDB blip delays one turn
         return []
     if record and record.get("status") == "CANCELLED":
         ctx["_cancel_requested"] = True
diff --git a/agent/src/linear_reactions.py b/agent/src/linear_reactions.py
@@ -155,6 +155,7 @@ def _graphql(query: str, variables: dict[str, Any]) -> dict[str, Any] | None:
         )
     except requests.RequestException as e:
         log("WARN", f"linear_reactions: request failed ({type(e).__name__}): {e}")
+        # nosemgrep: py-silent-success-masking -- Linear reactions are best-effort on network blips
         return None
 
     if resp.status_code in (401, 403):
diff --git a/agent/src/nudge_reader.py b/agent/src/nudge_reader.py
@@ -84,6 +84,7 @@ def _get_table() -> Any | None:
         return _TABLE_CACHE
     except Exception as exc:
         log("WARN", f"Failed to init nudge DDB table: {type(exc).__name__}: {exc}")
+        # nosemgrep: py-silent-success-masking -- nudge table init failure; read_pending returns []
         return None
 
 
@@ -136,6 +137,7 @@ def read_pending(task_id: str, table: Any | None = None) -> list[PendingNudge]:
                 break
     except Exception as exc:
         log("WARN", f"Nudge DDB query failed: {type(exc).__name__}: {exc}")
+        # nosemgrep: py-silent-success-masking -- DDB query failure yields no pending nudges
         return []
 
     if truncated:
diff --git a/agent/src/pipeline.py b/agent/src/pipeline.py
@@ -120,6 +120,7 @@ def _maybe_upload_trace(
         artifact = trajectory.dump_gzipped_jsonl()
     except Exception as e:
         log("WARN", f"Trace dump_gzipped_jsonl failed: {type(e).__name__}: {e}")
+        # nosemgrep: py-silent-success-masking -- trace upload best-effort; missing artifact ok
         return None
     if not artifact:
         log(
diff --git a/agent/src/post_hooks.py b/agent/src/post_hooks.py
@@ -433,4 +433,5 @@ def _extract_agent_notes(repo_dir: str, branch: str, config: TaskConfig) -> str
         return None
     except Exception as e:
         log("WARN", f"Failed to extract agent notes from PR body: {type(e).__name__}: {e}")
+        # nosemgrep: py-silent-success-masking -- PR body notes optional; extraction failure logged
         return None
diff --git a/agent/src/telemetry.py b/agent/src/telemetry.py
@@ -471,6 +471,7 @@ def upload_trace_to_s3(
         return f"s3://{bucket}/{key}"
     except ImportError:
         print("[trace/upload] boto3 not available — skipping", flush=True)
+        # nosemgrep: py-silent-success-masking -- trace upload optional; missing boto3 skips upload
         return None
     except Exception as e:
         exc_type = type(e).__name__
@@ -484,6 +485,7 @@ def upload_trace_to_s3(
                 "[trace/upload] WARNING: IAM misconfiguration likely — trace artifact is lost.",
                 flush=True,
             )
+        # nosemgrep: py-silent-success-masking -- S3 trace upload best-effort; failure logged
         return None
 
 
diff --git a/cdk/src/handlers/github-webhook-processor.ts b/cdk/src/handlers/github-webhook-processor.ts
@@ -406,7 +406,7 @@ async function findPullRequestForSha(
       timed_out: ac.signal.aborted,
       error: err instanceof Error ? err.message : String(err),
     });
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- GitHub commit-pulls lookup is best-effort; null means "no PR for this SHA"
   } finally {
     clearTimeout(timer);
   }
@@ -432,7 +432,7 @@ async function findPullRequestForSha(
       sha,
       error: err instanceof Error ? err.message : String(err),
     });
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- malformed GitHub body treated as no-PR; prevents processor crash on transient HTML/502
   }
   if (!Array.isArray(parsed)) {
     logger.warn('GitHub commit-pulls did not return an array', { repo, sha });
diff --git a/cdk/src/handlers/shared/context-hydration.ts b/cdk/src/handlers/shared/context-hydration.ts
@@ -424,7 +424,7 @@ export async function fetchGitHubIssue(
     logger.warn('GitHub issue fetch error', {
       repo, issue_number: issueNumber, error: err instanceof Error ? err.message : String(err),
     });
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- GitHub issue fetch is optional hydration; null skips issue context without failing the task
   }
 }
 
@@ -559,7 +559,7 @@ async function fetchReviewCommentsGraphQL(
     logger.warn('GitHub GraphQL review threads fetch error', {
       repo, pr_number: prNumber, error: err instanceof Error ? err.message : String(err),
     });
-    return [];
+    return []; // nosemgrep: ts-silent-success-masking -- review-thread fetch is optional; empty list degrades PR context without failing hydration
   }
 
   return comments;
@@ -685,7 +685,7 @@ export async function fetchGitHubPullRequest(
     logger.warn('GitHub PR fetch error', {
       repo, pr_number: prNumber, error: err instanceof Error ? err.message : String(err),
     });
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- GitHub PR fetch is optional hydration; null skips PR context without failing the task
   }
 }
 
diff --git a/cdk/src/handlers/shared/github-comment.ts b/cdk/src/handlers/shared/github-comment.ts
@@ -320,7 +320,7 @@ export function sanitizeMarkdownLinkTarget(url: string | null | undefined): stri
   try {
     parsed = new URL(url);
   } catch {
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- malformed URL input is rejected; null is the validation contract, not a masked infra error
   }
   if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return null;
   return url;
diff --git a/cdk/src/handlers/shared/github-webhook-verify.ts b/cdk/src/handlers/shared/github-webhook-verify.ts
@@ -71,7 +71,7 @@ export async function getGitHubWebhookSecret(secretId: string, forceRefresh = fa
     if (errorName === 'ResourceNotFoundException') {
       logger.error('GitHub webhook secret not found', { secret_id: secretId });
       secretCache.delete(secretId);
-      return null;
+      return null; // nosemgrep: ts-silent-success-masking -- missing webhook secret means "cannot verify"; ResourceNotFound is an expected config state
     }
     logger.error('Failed to fetch GitHub webhook secret', {
       secret_id: secretId,
diff --git a/cdk/src/handlers/shared/linear-feedback.ts b/cdk/src/handlers/shared/linear-feedback.ts
@@ -137,7 +137,7 @@ async function resolveToken(ctx: LinearFeedbackContext): Promise<string | null>
       linear_workspace_id: ctx.linearWorkspaceId,
       error: err instanceof Error ? err.message : String(err),
     });
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- Linear feedback is best-effort; null token skips the comment without failing the caller
   }
 }
 
diff --git a/cdk/src/handlers/shared/linear-issue-lookup.ts b/cdk/src/handlers/shared/linear-issue-lookup.ts
@@ -114,7 +114,7 @@ export async function findLinearIssueByIdentifier(
     logger.warn('Linear issue lookup: failed to scan workspace registry', {
       error: err instanceof Error ? err.message : String(err),
     });
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- registry scan failure degrades to "issue not found"; logged WARN, caller iterates safely
   }
 
   if (active.length === 0) {
@@ -193,7 +193,7 @@ async function queryIssueByIdentifier(accessToken: string, identifier: string):
       identifier,
       error: err instanceof Error ? err.message : String(err),
     });
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- per-workspace GraphQL blip returns miss; caller tries the next workspace
   }
 
   if (!resp.ok) {
diff --git a/cdk/src/handlers/shared/linear-oauth-resolver.ts b/cdk/src/handlers/shared/linear-oauth-resolver.ts
@@ -266,7 +266,7 @@ export async function getRegistryRow(
       linear_workspace_id: linearWorkspaceId,
       error: err instanceof Error ? err.message : String(err),
     });
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- transient DDB throttle degrades to "workspace not in registry"; avoids webhook retry storm
   }
 
   return parseRegistryRow(result.Item, linearWorkspaceId);
@@ -344,7 +344,7 @@ export async function getOauthSecret(
       secret_arn: secretArn,
       error: err instanceof Error ? err.message : String(err),
     });
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- lenient OAuth fetch for task hydration; strict variant getOauthSecretStrict rethrows SM errors
   }
 }
 
@@ -377,7 +377,7 @@ function parseOauthSecret(secretString: string, secretArn: string): StoredOauthT
       secret_arn: secretArn,
       error: err instanceof Error ? err.message : String(err),
     });
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- corrupt secret JSON is logged ERROR; null triggers re-onboard path, not a masked infra failure
   }
   const missing = STORED_OAUTH_TOKEN_REQUIRED_FIELDS.filter(
     (f) => typeof parsed[f] !== 'string' || (parsed[f] as string).length === 0,
diff --git a/cdk/src/handlers/shared/linear-verify.ts b/cdk/src/handlers/shared/linear-verify.ts
@@ -71,7 +71,7 @@ export async function getLinearSecret(secretId: string, forceRefresh = false): P
     if (errorName === 'ResourceNotFoundException') {
       logger.error('Linear secret not found in Secrets Manager', { secret_id: secretId });
       secretCache.delete(secretId);
-      return null;
+      return null; // nosemgrep: ts-silent-success-masking -- missing Linear signing secret means "cannot verify"; ResourceNotFound is expected before setup
     }
     logger.error('Failed to fetch Linear secret from Secrets Manager', {
       secret_id: secretId,
diff --git a/cdk/src/handlers/shared/memory.ts b/cdk/src/handlers/shared/memory.ts
@@ -286,7 +286,7 @@ export async function loadMemoryContext(
       error_type: err instanceof Error ? err.constructor.name : typeof err,
       metric_type: isProgrammingError ? 'memory_load_bug' : 'memory_load_infra_failure',
     });
-    return undefined;
+    return undefined; // nosemgrep: ts-silent-success-masking -- memory hydration is fail-open; task proceeds without past episodes when load fails
   }
 }
 
diff --git a/cdk/src/handlers/shared/preflight.ts b/cdk/src/handlers/shared/preflight.ts
@@ -105,7 +105,7 @@ async function fetchViewerPermission(repo: string, token: string): Promise<strin
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     logger.warn('GitHub GraphQL viewerPermission lookup failed', { repo, error: detail });
-    return undefined;
+    return undefined; // nosemgrep: ts-silent-success-masking -- permission preflight is fail-open; undefined skips the check without blocking task creation
   }
 }
 
diff --git a/cdk/src/handlers/shared/slack-verify.ts b/cdk/src/handlers/shared/slack-verify.ts
@@ -67,7 +67,7 @@ export async function getSlackSecret(secretId: string, forceRefresh = false): Pr
     if (errorName === 'ResourceNotFoundException') {
       logger.error('Slack secret not found in Secrets Manager', { secret_id: secretId });
       secretCache.delete(secretId);
-      return null;
+      return null; // nosemgrep: ts-silent-success-masking -- missing Slack signing secret means "cannot verify"; ResourceNotFound is expected before setup
     }
     logger.error('Failed to fetch Slack secret from Secrets Manager', {
       secret_id: secretId,
diff --git a/cdk/src/handlers/shared/validation.ts b/cdk/src/handlers/shared/validation.ts
@@ -60,7 +60,7 @@ export function parseBody<T>(body: string | null): T | null {
   try {
     return JSON.parse(body) as T;
   } catch {
-    return null;
+    return null; // nosemgrep: ts-silent-success-masking -- parseBody contract: invalid JSON yields null, same as a missing body
   }
 }
 
@@ -164,7 +164,7 @@ export function decodePaginationToken(token: string | undefined): Record<string,
     const json = Buffer.from(token, 'base64').toString('utf-8');
     return JSON.parse(json) as Record<string, unknown>;
   } catch {
-    return undefined;
+    return undefined; // nosemgrep: ts-silent-success-masking -- invalid pagination token is rejected; undefined is the decode contract, not masked infra failure
   }
 }
 
diff --git a/cdk/src/handlers/webhook-create-task.ts b/cdk/src/handlers/webhook-create-task.ts
diff --git a/cli/src/commands/linear.ts b/cli/src/commands/linear.ts
diff --git a/cli/src/commands/slack.ts b/cli/src/commands/slack.ts
diff --git a/cli/src/config.ts b/cli/src/config.ts
diff --git a/mise.toml b/mise.toml

Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@`
`18`	`18`	`# even though it does not mask the outer failure. Rare in practice; use the`
`19`	`19`	`# nosemgrep allowlist if it occurs.`
`20`	`20`	`#`
`21`		`-# Run: mise run security:sast:masking (advisory; emits SARIF)`
	`21`	`+# Run: mise run security:sast:masking (blocking; emits SARIF)`
`22`	`22`	`# Test: semgrep test .semgrep/`
`23`	`23`	`rules:`
`24`	`24`	`- id: ts-silent-success-masking`
Original file line number	Diff line number	Diff line change
`@@ -155,6 +155,7 @@ def _graphql(query: str, variables: dict[str, Any]) -> dict[str, Any] \| None:`
`155`	`155`	`)`
`156`	`156`	`except requests.RequestException as e:`
`157`	`157`	`log("WARN", f"linear_reactions: request failed ({type(e).__name__}): {e}")`
	`158`	`+ # nosemgrep: py-silent-success-masking -- Linear reactions are best-effort on network blips`
`158`	`159`	`return None`
`159`	`160`
`160`	`161`	`if resp.status_code in (401, 403):`