@asterxsk/kiln 0.2.0 → 0.3.0

package/agent.bak.20260905-190020/extensions/pi-web-access/content-find.ts

@@ -0,0 +1,139 @@
+export type FindMode = "exact" | "case-insensitive" | "fuzzy";
+
+const CONTEXT_CHARS = 400;
+const MAX_OUTPUT_CHARS = 20_000;
+
+interface Match {
+	query: string;
+	start: number;
+	end: number;
+}
+
+interface Range {
+	start: number;
+	end: number;
+	matches: Match[];
+}
+
+function normalize(value: string): string {
+	return value.normalize("NFD").replace(/\p{Diacritic}/gu, "").toLocaleLowerCase();
+}
+
+function editDistanceWithin(left: string, right: string, maximum: number): boolean {
+	if (Math.abs(left.length - right.length) > maximum) return false;
+	let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+	for (let i = 1; i <= left.length; i++) {
+		const current = [i];
+		let rowMinimum = i;
+		for (let j = 1; j <= right.length; j++) {
+			const value = Math.min(
+				(previous[j] ?? 0) + 1,
+				(current[j - 1] ?? 0) + 1,
+				(previous[j - 1] ?? 0) + (left[i - 1] === right[j - 1] ? 0 : 1),
+			);
+			current[j] = value;
+			rowMinimum = Math.min(rowMinimum, value);
+		}
+		if (rowMinimum > maximum) return false;
+		previous = current;
+	}
+	return (previous[right.length] ?? maximum + 1) <= maximum;
+}
+
+function literalMatches(text: string, query: string, caseInsensitive: boolean): Match[] {
+	const haystack = caseInsensitive ? text.toLocaleLowerCase() : text;
+	const needle = caseInsensitive ? query.toLocaleLowerCase() : query;
+	const matches: Match[] = [];
+	for (let start = haystack.indexOf(needle); start >= 0; start = haystack.indexOf(needle, start + Math.max(needle.length, 1))) {
+		matches.push({ query, start, end: start + query.length });
+	}
+	return matches;
+}
+
+function fuzzyMatches(text: string, query: string): Match[] {
+	const queryTokens = normalize(query).match(/[\p{L}\p{N}]+/gu) ?? [];
+	if (queryTokens.length === 0) return [];
+	const matches: Match[] = [];
+	const paragraphs = /[^\n]+(?:\n(?!\n)[^\n]+)*/g;
+	for (const paragraph of text.matchAll(paragraphs)) {
+		const paragraphText = paragraph[0];
+		if (paragraphText.trim().length === 0 || paragraph.index === undefined) continue;
+		const tokens = [...paragraphText.matchAll(/[\p{L}\p{N}]+/gu)];
+		const matched = queryTokens.filter(queryToken => tokens.some(token => {
+			const candidate = normalize(token[0]);
+			const maximum = queryToken.length >= 9 ? 2 : queryToken.length >= 5 ? 1 : 0;
+			return editDistanceWithin(queryToken, candidate, maximum);
+		}));
+		const required = queryTokens.length === 1 ? 1 : Math.ceil(queryTokens.length * 0.6);
+		if (matched.length < required) continue;
+		const first = tokens.find(token => matched.some(queryToken => {
+			const maximum = queryToken.length >= 9 ? 2 : queryToken.length >= 5 ? 1 : 0;
+			return editDistanceWithin(queryToken, normalize(token[0]), maximum);
+		}));
+		const start = paragraph.index + (first?.index ?? 0);
+		matches.push({ query, start, end: start + (first?.[0].length ?? query.length) });
+	}
+	return matches;
+}
+
+function mergeRanges(textLength: number, matches: Match[]): Range[] {
+	const ranges: Range[] = [];
+	for (const match of [...matches].sort((left, right) => left.start - right.start)) {
+		const start = Math.max(0, match.start - CONTEXT_CHARS);
+		const end = Math.min(textLength, match.end + CONTEXT_CHARS);
+		const previous = ranges.at(-1);
+		if (previous && start <= previous.end) {
+			previous.end = Math.max(previous.end, end);
+			previous.matches.push(match);
+		} else {
+			ranges.push({ start, end, matches: [match] });
+		}
+	}
+	return ranges;
+}
+
+export function findContent(
+	text: string,
+	queries: string[],
+	mode: FindMode,
+): { text: string; matchCount: number; returnedMatches: number; queryResults: Array<{ query: string; matchCount: number }> } {
+	const normalizedQueries = [...new Set(queries.map(query => query.trim()).filter(Boolean))];
+	const matches = normalizedQueries.flatMap(query => mode === "fuzzy"
+		? fuzzyMatches(text, query)
+		: literalMatches(text, query, mode === "case-insensitive"));
+	const queryResults = normalizedQueries.map(query => ({
+		query,
+		matchCount: matches.filter(match => match.query === query).length,
+	}));
+
+	const heading = matches.length > 0 ? `Text matches (${mode})` : `Text matches (${mode}): no matches`;
+	const sections = [heading];
+	let formattedLength = heading.length;
+	let returnedMatches = 0;
+	for (const range of mergeRanges(text.length, matches)) {
+		const prefix = range.start > 0 ? "…" : "";
+		const suffix = range.end < text.length ? "…" : "";
+		const snippet = `${prefix}${text.slice(range.start, range.end).replace(/\s+/g, " ").trim()}${suffix}`;
+		const counts = [...new Set(range.matches.map(match => match.query))]
+			.map(query => `\"${query}\" ×${range.matches.filter(match => match.query === query).length}`)
+			.join(", ");
+		const section = `${sections.length}. ${counts}\n${snippet}`;
+		if (formattedLength + 2 + section.length > MAX_OUTPUT_CHARS) break;
+		sections.push(section);
+		formattedLength += 2 + section.length;
+		returnedMatches += range.matches.length;
+	}
+
+	const missing = queryResults.filter(result => result.matchCount === 0).map(result => `\"${result.query}\"`);
+	const footer = [
+		...(missing.length > 0 ? [`No matches: ${missing.join(", ")}`] : []),
+		...(returnedMatches < matches.length ? [`Showing ${returnedMatches} of ${matches.length} matches.`] : []),
+	];
+	for (const section of footer) {
+		if (formattedLength + 2 + section.length > MAX_OUTPUT_CHARS) break;
+		sections.push(section);
+		formattedLength += 2 + section.length;
+	}
+
+	return { text: sections.join("\n\n"), matchCount: matches.length, returnedMatches, queryResults };
+}

package/agent.bak.20260905-190020/extensions/pi-web-access/credential-source.ts

@@ -0,0 +1,191 @@
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+
+const execAsync = promisify(exec);
+const COMMAND_TIMEOUT_MS = 5_000;
+const MAX_CREDENTIAL_BYTES = 16_384;
+const ENV_SOURCE = /^\$(?:([A-Za-z_][A-Za-z0-9_]*)|\{([A-Za-z_][A-Za-z0-9_]*)\})$/;
+const OP_SESSION_NAME = /^OP_SESSION_[A-Za-z0-9_]+$/;
+const COMMAND_ENVIRONMENT_NAMES = [
+	"HOME",
+	"USER",
+	"LOGNAME",
+	"PATH",
+	"LANG",
+	"LC_ALL",
+	"LC_CTYPE",
+	"TERM",
+	"TMPDIR",
+	"XDG_CONFIG_HOME",
+	"XDG_RUNTIME_DIR",
+	"DBUS_SESSION_BUS_ADDRESS",
+	"SSH_AUTH_SOCK",
+	"WSL_DISTRO_NAME",
+	"WSL_INTEROP",
+] as const;
+
+export type CredentialFailureCategory =
+	| "invalid-source"
+	| "command-failed"
+	| "command-timeout"
+	| "command-aborted"
+	| "command-empty"
+	| "command-invalid-output"
+	| "command-output-too-large"
+	| "environment-empty"
+	| "oauth-credential-rejected";
+
+export class CredentialResolutionError extends Error {
+	readonly provider: string;
+	readonly category: CredentialFailureCategory;
+
+	constructor(provider: string, category: CredentialFailureCategory) {
+		const suffix =
+			category === "command-aborted" ? "aborted" :
+			category === "oauth-credential-rejected" ? "OAuth token exchange rejected the credentials" :
+			category;
+		super(`${provider} credential resolution failed: ${suffix}`);
+		this.name = "CredentialResolutionError";
+		this.provider = provider;
+		this.category = category;
+	}
+}
+
+export interface CredentialCommandResult {
+	stdout: string | Buffer;
+}
+
+export interface CredentialCommandOptions {
+	signal?: AbortSignal;
+	timeoutMs: number;
+	maxOutputBytes: number;
+	environment: Record<string, string>;
+}
+
+export type CredentialCommandRunner = (
+	command: string,
+	options: CredentialCommandOptions,
+) => Promise<CredentialCommandResult>;
+
+export interface CredentialOptions {
+	provider: string;
+	configuredValue?: unknown;
+	environmentValue?: unknown;
+	environment?: Record<string, string | undefined>;
+	signal?: AbortSignal;
+	runCommand?: CredentialCommandRunner;
+}
+
+export function redactCredential(text: string, credential: string | null | undefined): string {
+	return credential ? text.split(credential).join("[redacted]") : text;
+}
+
+function normalize(value: unknown): string | null {
+	if (typeof value !== "string") return null;
+	const normalized = value.trim();
+	return normalized.length > 0 ? normalized : null;
+}
+
+function commandEnvironment(source: Record<string, string | undefined>): Record<string, string> {
+	const environment: Record<string, string> = {};
+	for (const name of COMMAND_ENVIRONMENT_NAMES) {
+		const value = source[name];
+		if (value !== undefined) environment[name] = value;
+	}
+	for (const [name, value] of Object.entries(source)) {
+		if (value !== undefined && OP_SESSION_NAME.test(name)) environment[name] = value;
+	}
+	return environment;
+}
+
+function configuredSource(options: CredentialOptions): string | null {
+	return normalize(options.configuredValue);
+}
+
+function explicitEnvironmentName(source: string): string | null {
+	const match = source.match(ENV_SOURCE);
+	return match ? match[1] ?? match[2] : null;
+}
+
+function escapedSource(source: string): string | null {
+	if (source.startsWith("$$") || source.startsWith("$!")) return source.slice(1);
+	return null;
+}
+
+function isMalformedExplicitSource(source: string): boolean {
+	return source.startsWith("$") && escapedSource(source) === null && explicitEnvironmentName(source) === null;
+}
+
+async function defaultRunCommand(
+	command: string,
+	options: CredentialCommandOptions,
+): Promise<CredentialCommandResult> {
+	const result = await execAsync(command, {
+		encoding: "utf8",
+		env: options.environment,
+		maxBuffer: options.maxOutputBytes + 1,
+		signal: options.signal,
+		timeout: options.timeoutMs,
+		windowsHide: true,
+	});
+	return { stdout: result.stdout };
+}
+
+function commandFailureCategory(error: unknown, signal?: AbortSignal): CredentialFailureCategory {
+	if (signal?.aborted) return "command-aborted";
+	if (error && typeof error === "object") {
+		const code = (error as { code?: string }).code;
+		if (code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") return "command-output-too-large";
+		if ((error as { killed?: boolean }).killed || code === "ETIMEDOUT") return "command-timeout";
+	}
+	return "command-failed";
+}
+
+export function hasCredentialSource(options: CredentialOptions): boolean {
+	const source = configuredSource(options);
+	if (source?.startsWith("!")) return true;
+	if (source?.startsWith("$")) return true;
+	return normalize(options.environmentValue) !== null || source !== null;
+}
+
+export async function resolveCredential(options: CredentialOptions): Promise<string | null> {
+	const source = configuredSource(options);
+	const escaped = source ? escapedSource(source) : null;
+	if (escaped !== null) return escaped;
+	if (source?.startsWith("!")) {
+		const command = source.slice(1).trim();
+		if (!command) throw new CredentialResolutionError(options.provider, "invalid-source");
+		let result: CredentialCommandResult;
+		try {
+			result = await (options.runCommand ?? defaultRunCommand)(command, {
+				signal: options.signal,
+				timeoutMs: COMMAND_TIMEOUT_MS,
+				maxOutputBytes: MAX_CREDENTIAL_BYTES,
+				environment: commandEnvironment(options.environment ?? process.env),
+			});
+		} catch (error) {
+			throw new CredentialResolutionError(options.provider, commandFailureCategory(error, options.signal));
+		}
+		const stdout = Buffer.isBuffer(result.stdout) ? result.stdout.toString("utf8") : result.stdout;
+		if (Buffer.byteLength(stdout, "utf8") > MAX_CREDENTIAL_BYTES) {
+			throw new CredentialResolutionError(options.provider, "command-output-too-large");
+		}
+		const value = stdout.trim();
+		if (!value) throw new CredentialResolutionError(options.provider, "command-empty");
+		if (/[\0-\x1f\x7f]/.test(value)) {
+			throw new CredentialResolutionError(options.provider, "command-invalid-output");
+		}
+		return value;
+	}
+	if (source && isMalformedExplicitSource(source)) {
+		throw new CredentialResolutionError(options.provider, "invalid-source");
+	}
+	if (source?.startsWith("$")) {
+		const name = explicitEnvironmentName(source);
+		if (!name) throw new CredentialResolutionError(options.provider, "invalid-source");
+		const value = normalize((options.environment ?? process.env)[name]);
+		if (!value) throw new CredentialResolutionError(options.provider, "environment-empty");
+		return value;
+	}
+	return normalize(options.environmentValue) ?? source;
+}