@claudexor/orchestrator 4.8.2 → 5.0.1

package/dist/persistedPatch.js

@@ -1,132 +0,0 @@
-import { parseUnifiedDiff } from "@claudexor/core";
-import { containsSecretLikeToken, redactSecrets, sensitiveResourcePolicy } from "@claudexor/util";
-/**
- * Persistence classifier for candidate patches (INV-062, owner decision 05.10
- * "3. C"): agent bytes are never rolled back, discarded or failed for
- * containing secret-like text. The EXACT diff stays in memory, in the changed
- * files and in the private exact patch object; every SAVED copy goes through
- * `persistedPatchCopy`, and the run discloses paths and counts — never a match.
- */
-/** First line of a saved patch copy whose content differs from the exact
- * patch. Git and the diff parsers skip any preamble before the first file
- * record, so the notice travels with the copy without changing its structure. */
-export const PERSISTED_PATCH_NOTICE = "# Claudexor: secret-like strings are replaced with [redacted] in this saved copy. " +
-    "The real bytes stay in the candidate's changed files and in Claudexor's private exact patch object; " +
-    "a reviewer workspace copy omits files with secret-like content. Apply through Claudexor, never from this copy.";
-const BINARY_PAYLOAD_WITHHELD = "# Claudexor: binary payload withheld from this saved copy (secret-like or uninspectable bytes)";
-const FILE_RECORD_START = /^(?:diff .+|Binary files .+ differ)$/gm;
-/** Lines that carry diff structure, never file content. Inside a multi-line
- * match they stay verbatim, so every file record and hunk of the copy survives. */
-const DIFF_STRUCTURE_LINE = /^(?:diff --git |@@ |\|index [0-9a-f]+\.\.[0-9a-f]+|--- (?:a\/|\/dev\/null)|\+\+\+ (?:b\/|\/dev\/null)|(?:new|deleted) file mode |similarity index |rename (?:from|to) |(?:old|new) mode |Binary files )/;
-/** A match starts inside a line, but subsequent lines include their diff
- * prefix. Keep those prefixes, line endings and structure lines so hunk counts
- * and file records remain valid. */
-function redactPatchMatch(match) {
-    return match
-        .split("\n")
-        .map((line, index) => index > 0 && DIFF_STRUCTURE_LINE.test(line)
-        ? line
-        : `${index > 0 && /^[ +\-]/.test(line) ? line[0] : ""}[redacted]${line.endsWith("\r") ? "\r" : ""}`)
-        .join("\n");
-}
-/**
- * Build the saved copy of an exact candidate diff: withhold the payload of the
- * named binary files, replace every secret-like string, and count per file in
- * the same pass. A copy with nothing to hide is the exact diff itself (no
- * notice, no new fields), so ordinary runs are unchanged. Idempotent.
- */
-export function persistedPatchCopy(diff, withheldBinaries) {
-    if (diff.startsWith(PERSISTED_PATCH_NOTICE) && !containsSecretLikeToken(diff)) {
-        return { text: diff, files: [], unattributedMatches: 0 };
-    }
-    const withheld = new Set(withheldBinaries);
-    const starts = [...diff.matchAll(FILE_RECORD_START)].map((match) => match.index);
-    const files = new Map();
-    let unattributedMatches = 0;
-    const hide = (text, path) => {
-        const decision = sensitiveResourcePolicy.inspectContent(text, "redact", redactPatchMatch);
-        if (decision.matches === 0)
-            return text;
-        if (path === null) {
-            unattributedMatches += decision.matches;
-            return decision.text;
-        }
-        const safePath = redactSecrets(path);
-        const entry = files.get(safePath) ?? { path: safePath, matches: 0, kinds: [] };
-        entry.matches += decision.matches;
-        entry.kinds = [...new Set([...entry.kinds, ...decision.signatures])].sort();
-        files.set(safePath, entry);
-        return decision.text;
-    };
-    let body = hide(diff.slice(0, starts[0] ?? diff.length), null);
-    for (let index = 0; index < starts.length; index += 1) {
-        let record = diff.slice(starts[index], starts[index + 1] ?? diff.length);
-        const parsed = parseUnifiedDiff(record).files[0];
-        const path = parsed?.newPath ?? parsed?.oldPath ?? null;
-        if (path !== null && withheld.has(path)) {
-            const payload = record.search(/^GIT binary patch$/m);
-            if (payload >= 0) {
-                record = `${record.slice(0, payload)}GIT binary patch\n${BINARY_PAYLOAD_WITHHELD}\n`;
-            }
-        }
-        body += hide(record, path);
-    }
-    // A match may straddle two file records (a key block opened in one file and
-    // closed in the next). The whole-text pass is the authority on what a saved
-    // copy may contain; per-file passes only attribute counts.
-    body = hide(body, null);
-    return {
-        text: body === diff ? diff : `${PERSISTED_PATCH_NOTICE}\n${body}`,
-        files: [...files.values()],
-        unattributedMatches,
-    };
-}
-/** Fence on the text that is about to be written. It can only fire on a
- * redaction bug — agent bytes reach a saved file through `persistedPatchCopy`. */
-export function assertPersistableText(label, text) {
-    if (containsSecretLikeToken(text)) {
-        throw new Error(`${label} still matches the secret-like policy after redaction; not written`);
-    }
-}
-export function buildSecretLikeFinding(input) {
-    const clean = (paths) => [...new Set(paths.map((path) => redactSecrets(path)))].sort();
-    const finding = {
-        files: input.copy.files,
-        binary_paths: clean(input.binaryPaths),
-        media_withheld: clean(input.mediaWithheld),
-        answer_matches: input.answerMatches,
-        total_matches: input.copy.files.reduce((sum, file) => sum + file.matches, 0) +
-            input.copy.unattributedMatches +
-            input.answerMatches,
-    };
-    return finding.total_matches > 0 ||
-        finding.binary_paths.length > 0 ||
-        finding.media_withheld.length > 0
-        ? finding
-        : undefined;
-}
-function named(paths) {
-    const shown = paths.slice(0, 5).join(", ");
-    return paths.length > 5 ? `${shown}, +${paths.length - 5} more` : shown;
-}
-/** One human line for `final/summary.md`; null when there is nothing to say. */
-export function secretLikeSummaryLine(finding) {
-    if (!finding)
-        return null;
-    const parts = [];
-    const inPatch = finding.total_matches - finding.answer_matches;
-    if (inPatch > 0) {
-        const paths = finding.files.map((file) => file.path);
-        parts.push(`${inPatch} in ${paths.length} changed file(s)${paths.length > 0 ? ` (${named(paths)})` : ""} — kept in the changed files, hidden in saved copies`);
-    }
-    if (finding.binary_paths.length > 0) {
-        parts.push(`${finding.binary_paths.length} secret-like or uninspectable binary payload(s) withheld from the saved patch (${named(finding.binary_paths)})`);
-    }
-    if (finding.answer_matches > 0)
-        parts.push(`${finding.answer_matches} hidden in the answer`);
-    if (finding.media_withheld.length > 0) {
-        parts.push(`${finding.media_withheld.length} image(s) not saved (${named(finding.media_withheld)})`);
-    }
-    return parts.length > 0 ? `- Secret-like strings: ${parts.join("; ")}` : null;
-}
-//# sourceMappingURL=persistedPatch.js.map

package/dist/persistedPatch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"persistedPatch.js","sourceRoot":"","sources":["../src/persistedPatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAElG;;;;;;GAMG;AAEH;;iFAEiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GACjC,oFAAoF;IACpF,sGAAsG;IACtG,gHAAgH,CAAC;AAEnH,MAAM,uBAAuB,GAC3B,gGAAgG,CAAC;AA8BnG,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AAEnE;mFACmF;AACnF,MAAM,mBAAmB,GACvB,oOAAoO,CAAC;AAEvO;;oCAEoC;AACpC,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACnB,KAAK,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,gBAAmC;IAEnC,IAAI,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAmB,EAAU,EAAE;QACzD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC1F,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,mBAAmB,IAAI,QAAQ,CAAC,OAAO,CAAC;YACxC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC/E,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC;QAClC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC,CAAC;IACF,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC;QACxD,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACrD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,qBAAqB,uBAAuB,IAAI,CAAC;YACvF,CAAC;QACH,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,2DAA2D;IAC3D,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO;QACL,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,sBAAsB,KAAK,IAAI,EAAE;QACjE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,IAAY;IAC/D,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oEAAoE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACC,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAY,EAAE,CACnD,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,OAAO,GAAsB;QACjC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;QACvB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC;QACtC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,aAAa,EACX,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,mBAAmB;YAC9B,KAAK,CAAC,aAAa;KACtB,CAAC;IACF,OAAO,OAAO,CAAC,aAAa,GAAG,CAAC;QAC9B,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC/B,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAwB;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,OAAsC;IAC1E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAC/D,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,OAAO,KAAK,CAAC,MAAM,mBAAmB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD,CACnJ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,kFAAkF,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAC/I,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,cAAc,uBAAuB,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,wBAAwB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC"}