@cortexkit/opencode-magic-context 0.49.34 → 0.49.35

package/dist/{index-07vskjn8.js → index-xwwsbsd3.js}

@@ -1,21 +1,14 @@
 import {
   sessionLog2
-} from "./index-h7tgn49j.js";
+} from "./index-jrfre9ah.js";
 import {
   COMPARTMENT_LEASE_RENEWAL_MS,
   acquireCompartmentLease,
   renewCompartmentLease,
   releaseCompartmentLeaseBestEffort,
   getCompartments,
-  getLastCompartmentEndMessage,
-  describeBoundaryDiagnostics,
-  resolveWrapupProtectedTailBoundary,
-  hasRunnableCompartmentWindow,
-  runCompartmentAgent,
-  getActiveCompartmentRun,
-  markActiveCompartmentRunPublished,
-  registerActiveCompartmentRun
-} from "./index-atekmqef.js";
+  getLastCompartmentEndMessage
+} from "./index-f297z1n8.js";
 import {
   inRootAsyncContext2
 } from "./index-gzy5w8ya.js";
@@ -27,17 +20,26 @@ import {
   getHistorianFailureState,
   clearEmergencyRecovery,
   prepareRawSessionOrdinals2
-} from "./index-7g9dr8gy.js";
+} from "./index-brg2w6qc.js";
 import {
   pushNotification2
 } from "./index-x8a7jmkh.js";
+import {
+  describeBoundaryDiagnostics,
+  resolveWrapupProtectedTailBoundary,
+  hasRunnableCompartmentWindow,
+  runCompartmentAgent,
+  getActiveCompartmentRun,
+  markActiveCompartmentRunPublished,
+  registerActiveCompartmentRun
+} from "./index-4bgk5ztz.js";
 import {
   sendStatusNotification2
-} from "./index-waktfbjy.js";
+} from "./index-2v6nvy3k.js";
 import {
   setRecompStarting2,
   setRecompTerminal2
-} from "./index-ftr84kkv.js";
+} from "./index-3d3872c6.js";
 
 // src/hooks/magic-context/wrapup-orchestrator.ts
 import * as crypto from "node:crypto";

package/dist/index-z4p0ry94.js

@@ -0,0 +1,222 @@
+// src/shared/redaction.ts
+import { homedir, userInfo } from "node:os";
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var SECRET_WORDS = [
+  "key",
+  "token",
+  "secret",
+  "password",
+  "auth",
+  "authorization",
+  "bearer",
+  "credential"
+];
+var SECRET_SEGMENT_PATTERN = new RegExp(`^(?:${SECRET_WORDS.map((w) => `${w}s?`).join("|")})$`, "i");
+var TRAILING_DESCRIPTORS = new Set(["id", "ids", "value", "values", "header", "headers"]);
+function redactionTypeForKey(key) {
+  const normalized = key.trim().toLowerCase().replace(/[^a-z0-9_.-]+/g, "_");
+  const suffix = normalized.split(".").filter(Boolean).at(-1) ?? normalized;
+  return suffix || "secret";
+}
+function isNonSecretScalarValue(value) {
+  const v = value.trim();
+  if (v === "true" || v === "false" || v === "null" || v === "undefined")
+    return true;
+  return /^[+-]?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(v);
+}
+var SECRET_QUALIFIERS = new Set([
+  "api",
+  "access",
+  "private",
+  "client",
+  "auth",
+  "authorization",
+  "secret",
+  "bearer",
+  "session",
+  "refresh",
+  "service",
+  "x",
+  "openai",
+  "anthropic",
+  "google",
+  "github",
+  "huggingface",
+  "aws",
+  "azure",
+  "id"
+]);
+var UNQUALIFIED_SECRET_SEGMENT_PATTERN = /^(?:password|secret|credential|bearer|authorization)s?$/;
+function isSecretKey(key) {
+  const segments = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[._-]+/).filter(Boolean);
+  if (segments.length === 0)
+    return false;
+  if (segments.length === 1) {
+    const first = segments[0];
+    return Boolean(first && SECRET_SEGMENT_PATTERN.test(first));
+  }
+  for (let i = 0;i < segments.length; i++) {
+    const seg = segments[i];
+    if (!seg || !SECRET_SEGMENT_PATTERN.test(seg))
+      continue;
+    let trailingOk = true;
+    for (let j = i + 1;j < segments.length; j++) {
+      const tail = segments[j];
+      if (!tail)
+        continue;
+      if (TRAILING_DESCRIPTORS.has(tail))
+        continue;
+      if (SECRET_SEGMENT_PATTERN.test(tail))
+        continue;
+      trailingOk = false;
+      break;
+    }
+    if (!trailingOk)
+      continue;
+    if (UNQUALIFIED_SECRET_SEGMENT_PATTERN.test(seg))
+      return true;
+    for (let k = i - 1;k >= 0; k--) {
+      const lead = segments[k];
+      if (lead && SECRET_QUALIFIERS.has(lead))
+        return true;
+    }
+  }
+  return false;
+}
+function sanitizePathString(value) {
+  const home = process.env.HOME || process.env.USERPROFILE || homedir();
+  const username = userInfo().username;
+  let sanitized = value;
+  if (home) {
+    sanitized = sanitized.replace(new RegExp(escapeRegex(home), "g"), "~");
+  }
+  sanitized = sanitized.replace(/\/Users\/[^/]+\//g, "/Users/<USER>/");
+  sanitized = sanitized.replace(/\/home\/[^/]+\//g, "/home/<USER>/");
+  sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/g, "C:\\Users\\<USER>\\");
+  if (username) {
+    sanitized = sanitized.replace(new RegExp(escapeRegex(username), "g"), "<USER>");
+  }
+  return sanitized;
+}
+var SECRET_TEXT_PATTERNS = [
+  {
+    pattern: /\bsk-ant-(?:api03-)?[A-Za-z0-9_-]{32,}/g,
+    replacement: "<ANTHROPIC_API_KEY_REDACTED>"
+  },
+  {
+    pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{12,}/g,
+    replacement: "<OPENAI_API_KEY_REDACTED>"
+  },
+  {
+    pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+    replacement: "<GITHUB_PAT_REDACTED>"
+  },
+  {
+    pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9_-]{30,}/g,
+    replacement: "<GITHUB_TOKEN_REDACTED>"
+  },
+  {
+    pattern: /\bhf_[A-Za-z0-9]{30,}/g,
+    replacement: "<HUGGINGFACE_TOKEN_REDACTED>"
+  },
+  {
+    pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+    replacement: "<AWS_ACCESS_KEY_ID_REDACTED>"
+  },
+  {
+    pattern: /\bxox[abprsuvc]-[A-Za-z0-9-]{10,}/g,
+    replacement: "<SLACK_TOKEN_REDACTED>"
+  },
+  {
+    pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g,
+    replacement: "<GOOGLE_API_KEY_REDACTED>"
+  },
+  {
+    pattern: /\b(Authorization\s*:\s*Bearer\s+)([A-Za-z0-9._~+/=-]{8,})/gi,
+    replacement: (_full, prefix) => `${prefix}<REDACTED:bearer>`
+  },
+  {
+    pattern: /\b((?:Proxy-)?Authorization\s*:\s*(?:Basic|Digest|Token|Negotiate|NTLM)\s+)([A-Za-z0-9._~+/=-]{4,})/gi,
+    replacement: (_full, prefix) => `${prefix}<REDACTED:authorization>`
+  },
+  {
+    pattern: /\b((?:x-)?(?:api-?key|api-?token|auth-?token|access-?token)\s*:\s*)([^\s'"`,;<>]{6,})/gi,
+    replacement: (full, prefix, value) => isNonSecretScalarValue(value) ? full : `${prefix}<REDACTED:api_key>`
+  },
+  {
+    pattern: /\b((?:api[_-]?key|client[_-]?secret|access[_-]?token|token|secret|password|passwd|pwd)\s*:\s*)([^\s'"`,;<>]{6,})/gi,
+    replacement: (full, prefix, value) => isNonSecretScalarValue(value) ? full : `${prefix}<REDACTED:credential>`
+  },
+  {
+    pattern: /\b([a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:)([^\s/@]+)(@)/gi,
+    replacement: (_full, prefix, _password, at) => `${prefix}<REDACTED:password>${at}`
+  },
+  {
+    pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+    replacement: "<JWT_REDACTED>"
+  },
+  {
+    pattern: /(["'])([^"']*(?:key|token|secret|password|auth|bearer|credential)[^"']*)\1(\s*:\s*)(["'])([^"']*)\4/gi,
+    replacement: (full, quote, key, separator, valueQuote, value) => isNonSecretScalarValue(value) ? full : `${quote}${key}${quote}${separator}${valueQuote}<REDACTED:${redactionTypeForKey(key)}>${valueQuote}`
+  },
+  {
+    pattern: /\b([A-Za-z0-9_.-]*(?:key|token|secret|password|auth|bearer|credential)[A-Za-z0-9_.-]*)\s*=\s*([^\s'"`]+)/gi,
+    replacement: (full, key, value) => isNonSecretScalarValue(value) ? full : `${key}=<REDACTED:${redactionTypeForKey(key)}>`
+  }
+];
+function redactSecretText(value) {
+  let redacted = value;
+  for (const { pattern, replacement } of SECRET_TEXT_PATTERNS) {
+    if (typeof replacement === "string") {
+      redacted = redacted.replace(pattern, replacement);
+    } else {
+      redacted = redacted.replace(pattern, replacement);
+    }
+  }
+  return redacted;
+}
+function sanitizeDiagnosticText(value) {
+  return redactSecretText(sanitizePathString(value));
+}
+var SHAREABILITY_SENSITIVE_PATTERNS = [
+  /\bC:\/Users\/[^/\s]+/i,
+  /(?:^|\s)~\/[^\s]+/,
+  /\b(?:api[_-]?key|secret|token|password|passwd|pwd|client[_-]?secret|access[_-]?key)\b\s*[:=]\s*\S+/i,
+  /\b(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::\d+)?\b/i,
+  /\b(?:10|127)\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/,
+  /\b192\.168\.\d{1,3}\.\d{1,3}\b/,
+  /\b172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}\b/
+];
+function hasShareabilitySensitiveText(text) {
+  try {
+    if (sanitizeDiagnosticText(text) !== text)
+      return true;
+    return SHAREABILITY_SENSITIVE_PATTERNS.some((pattern) => pattern.test(text));
+  } catch {
+    return true;
+  }
+}
+function sanitizeConfigValue(value, keyPath = []) {
+  if (value === null || typeof value === "number" || typeof value === "boolean")
+    return value;
+  const key = keyPath.at(-1) ?? "";
+  if (key && isSecretKey(key)) {
+    return `<REDACTED:${redactionTypeForKey(key)}>`;
+  }
+  if (typeof value === "string")
+    return sanitizeDiagnosticText(value);
+  if (Array.isArray(value)) {
+    return value.map((entry, index) => sanitizeConfigValue(entry, [...keyPath, String(index)]));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [
+      entryKey,
+      sanitizeConfigValue(entry, [...keyPath, entryKey])
+    ]));
+  }
+  return value;
+}
+
+export { sanitizeDiagnosticText, hasShareabilitySensitiveText, sanitizeConfigValue };

package/dist/index-z9zygwse.js

@@ -0,0 +1,89 @@
+// src/hooks/magic-context/host-served-rows.ts
+var HOST_UNSERVED_ROW = "hostUnservedRow";
+function markHostUnservedRow(target) {
+  Object.defineProperty(target, HOST_UNSERVED_ROW, {
+    value: true,
+    enumerable: false,
+    configurable: true
+  });
+  return target;
+}
+function isHostUnservedRow(value) {
+  return typeof value === "object" && value !== null && value[HOST_UNSERVED_ROW] === true;
+}
+function retreatPastHostUnservedRows(messages, exclusiveEnd, floor) {
+  if (!messages.some(isHostUnservedRow))
+    return exclusiveEnd;
+  const byOrdinal = new Map(messages.map((message) => [message.ordinal, message]));
+  let end = exclusiveEnd;
+  while (end - 1 >= floor && isHostUnservedRow(byOrdinal.get(end - 1)))
+    end -= 1;
+  return end;
+}
+function snapTerminalCompartmentToServedRow(compartments, lines) {
+  if (!lines.some(isHostUnservedRow))
+    return { compartments: [...compartments], snapped: false };
+  const byOrdinal = new Map(lines.map((line) => [line.ordinal, line]));
+  const result = [...compartments];
+  let snapped = false;
+  while (result.length > 0) {
+    const last = result[result.length - 1];
+    if (!isHostUnservedRow(byOrdinal.get(last.endMessage)))
+      break;
+    snapped = true;
+    let served;
+    for (let ordinal = last.endMessage - 1;ordinal >= last.startMessage; ordinal -= 1) {
+      const line = byOrdinal.get(ordinal);
+      if (line && !isHostUnservedRow(line)) {
+        served = line;
+        break;
+      }
+    }
+    if (!served) {
+      result.pop();
+      continue;
+    }
+    result[result.length - 1] = {
+      ...last,
+      endMessage: served.ordinal,
+      endMessageId: served.messageId
+    };
+    break;
+  }
+  return { compartments: result, snapped };
+}
+function isHostRenderedSystemMessage(message) {
+  const id = message.info.id;
+  return (typeof id !== "string" || id.length === 0) && message.info.role === "system";
+}
+var COVERED_INSTRUCTION_ROW = "coveredInstructionRow";
+function markCoveredInstructionRow(target) {
+  Object.defineProperty(target, COVERED_INSTRUCTION_ROW, {
+    value: true,
+    enumerable: false,
+    configurable: true
+  });
+  return target;
+}
+function isCoveredInstructionRow(value) {
+  return typeof value === "object" && value !== null && value[COVERED_INSTRUCTION_ROW] === true;
+}
+function takeCoveredInstructionRows(messages) {
+  const taken = messages.filter((message) => isCoveredInstructionRow(message.info));
+  if (taken.length > 0) {
+    const kept = messages.filter((message) => !isCoveredInstructionRow(message.info));
+    messages.splice(0, messages.length, ...kept);
+  }
+  return taken;
+}
+function cloneKeepingCoveredInstructionMarks(messages) {
+  const copy = structuredClone(messages);
+  messages.forEach((message, index) => {
+    const copied = copy[index];
+    if (copied && isCoveredInstructionRow(message.info))
+      markCoveredInstructionRow(copied.info);
+  });
+  return copy;
+}
+
+export { markHostUnservedRow, isHostUnservedRow, retreatPastHostUnservedRows, snapTerminalCompartmentToServedRow, isHostRenderedSystemMessage, markCoveredInstructionRow, isCoveredInstructionRow, takeCoveredInstructionRows, cloneKeepingCoveredInstructionMarks };

package/dist/{index-v7287tzq.js → index-zhqwda72.js}

@@ -1,19 +1,19 @@
 import {
   getTokenEstimatorFingerprint,
   estimateTokens
-} from "./index-b88dwwrh.js";
+} from "./index-4xyjr62e.js";
 import {
   getHarness2
 } from "./index-pavzsdc6.js";
 import {
   log2
-} from "./index-h7tgn49j.js";
+} from "./index-jrfre9ah.js";
 import {
   isSynapseEmbeddingTruncated
-} from "./index-wfybj1dw.js";
+} from "./index-g4t7850m.js";
 import {
   messageFtsOrdinalRangeIsMapped2
-} from "./index-v15ne3a3.js";
+} from "./index-faxb7mck.js";
 import {
   isKnownAutocommit
 } from "./index-8ajstryz.js";
@@ -975,15 +975,26 @@ var unretainedSearchPools = new WeakMap;
 function getLastCompartmentChunkPoolWarm2() {
   return lastChunkPoolWarm;
 }
-function peekCompartmentChunkSearchPool2(db, sessionId, projectPath, modelId, dateRange = null) {
-  if (!modelId)
+function peekCompartmentChunkSearchPool2(db, sessionId, projectPath, modelId, dateRange = null, diagnostic) {
+  if (!modelId) {
+    if (diagnostic)
+      diagnostic.peek = "no-model";
     return null;
+  }
   trackSearchPool(db, sessionId, projectPath, modelId);
   const entry = getDecodedSearchPool(db).get(searchPoolKey(sessionId, projectPath, modelId));
-  if (!entry || searchPoolInTransaction(db))
+  if (!entry || searchPoolInTransaction(db)) {
+    if (diagnostic)
+      diagnostic.peek = entry ? "transaction" : "missing";
     return null;
-  if (!sameSessionSignature(readSessionChunkSignature(db, sessionId), entry.sessionSignature))
+  }
+  if (!sameSessionSignature(readSessionChunkSignature(db, sessionId), entry.sessionSignature)) {
+    if (diagnostic)
+      diagnostic.peek = "signature-changed";
     return null;
+  }
+  if (diagnostic)
+    diagnostic.peek = "hit";
   touchDecodedSearchPoolEntry(entry);
   return filterSearchPoolDates(entry.rows, dateRange);
 }