@cortexkit/opencode-openai-auth 0.11.1 → 1.0.0

package/src/tui-compiled/runtime/shared/d319517e3ea6ad70-redact.js

@@ -0,0 +1,83 @@
+const SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
+const TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;
+const MASK = '***REDACTED***';
+// How many errors deep a cause chain is followed. A chain this long is
+// already unreadable in a log line, and an unbounded one (each cause a fresh
+// object, so the cycle check never trips) must not grow the line forever.
+const MAX_ERROR_DEPTH = 8;
+// Error's own fields are non-enumerable, so a plain entry walk renders an
+// Error as `{}` and the name, message and stack a plugin logged are lost.
+// The tag check also recognises an Error from another realm (a worker or a
+// vm context), whose prototype is not this realm's Error.
+function isError(value) {
+    return (value instanceof Error ||
+        Object.prototype.toString.call(value) === '[object Error]');
+}
+export function createRedactor(options = {}) {
+    const patterns = [TOKEN_VALUE, ...(options.extraValuePatterns ?? [])].map((pattern) => new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`));
+    function isSecretKey(key) {
+        const normalized = key.toLowerCase().replace(/[-_]/g, '');
+        return (SECRET_KEY_EXACT.test(key) ||
+            normalized.includes('apikey') ||
+            normalized.endsWith('secret') ||
+            normalized.endsWith('password') ||
+            (normalized.endsWith('token') && !normalized.endsWith('tokens')) ||
+            !!options.extraSecretKeys?.(normalized));
+    }
+    // The fields every log reader wants first, then whatever else the error
+    // carries as its own enumerable properties (which is all an Error rendered
+    // as before). Every entry goes through the same key and string scrubbing as
+    // any other object, so a token in a message or stack is still masked.
+    function errorEntries(error) {
+        const fields = error;
+        const entries = [
+            ['name', error.name],
+            ['message', error.message],
+            ['stack', error.stack],
+        ];
+        for (const key of ['code', 'status', 'cause'])
+            if (fields[key] !== undefined)
+                entries.push([key, fields[key]]);
+        const listed = new Set(entries.map(([key]) => key));
+        for (const entry of Object.entries(error))
+            if (!listed.has(entry[0]))
+                entries.push(entry);
+        return entries;
+    }
+    function walk(value, keys, seen, errorDepth = 0) {
+        if (typeof value === 'string') {
+            return patterns.reduce((text, pattern) => text.replace(pattern, MASK), value);
+        }
+        if (!value || typeof value !== 'object')
+            return value;
+        if (seen.has(value))
+            return '[Circular]';
+        seen.add(value);
+        try {
+            if (Array.isArray(value))
+                return value.map((item) => walk(item, keys, seen, errorDepth));
+            const error = isError(value);
+            if (error && errorDepth >= MAX_ERROR_DEPTH)
+                return '[Truncated]';
+            const childDepth = error ? errorDepth + 1 : errorDepth;
+            // Define own properties so a diagnostic __proto__ key cannot change the output prototype.
+            return Object.fromEntries((error ? errorEntries(value) : Object.entries(value)).map(([key, item]) => [
+                key,
+                keys && isSecretKey(key)
+                    ? MASK
+                    : walk(item, keys, seen, childDepth),
+            ]));
+        }
+        finally {
+            seen.delete(value);
+        }
+    }
+    return {
+        redact: (value) => walk(value, true, new WeakSet()),
+        // Schema keys describe arguments, not credentials; only their string values are scrubbed.
+        redactStrings: (value) => walk(value, false, new WeakSet()),
+    };
+}
+const defaultRedactor = createRedactor();
+export const redact = defaultRedactor.redact;
+export const redactStrings = defaultRedactor.redactStrings;

package/src/tui-compiled/runtime/shared/d5a8f1061ee2f114-index.js

@@ -0,0 +1,5 @@
+export { quotaCodec } from "./053cc17b5419261e-codec.js";
+export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, } from "./0332701351b3eeec-format.js";
+export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, emptyQuotaMap, isQuotaMap, } from "./905bffc0220f43d0-map.js";
+export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from "./4f36d333d081d040-merge.js";
+export { budgetExhaustedResetAt, futureResetAt, projectQuota, readsExhausted, } from "./39c3cb05738fcf6d-projection.js";

package/src/tui-compiled/runtime/shared/d669d72c40e9e116-logger.js

@@ -0,0 +1,19 @@
+import {
+  initLogger as commonInitLogger,
+  createRedactor
+} from "./cc9e0702a752cea7-index.js";
+export {
+  createLogger,
+  flushForTest,
+  flushLogs,
+  resetLoggerForTest,
+  setLogLevel
+} from "./cc9e0702a752cea7-index.js";
+function isOpenaiIdentityKey(normalizedKey) {
+  return normalizedKey === "chatgptaccountid" || normalizedKey === "email" || normalizedKey === "orgname" || normalizedKey === "organizationname";
+}
+const openaiRedactor = createRedactor({ extraSecretKeys: isOpenaiIdentityKey });
+export const { redact, redactStrings } = openaiRedactor;
+export function initLogger(options) {
+  commonInitLogger({ ...options, extraSecretKeys: isOpenaiIdentityKey });
+}

package/src/tui-compiled/runtime/shared/d7dcba96fea1685c-engine.js

@@ -0,0 +1,246 @@
+import { appendFileSync, chmodSync, existsSync, renameSync, statSync, } from "node:fs";
+import { createRedactor } from "./d319517e3ea6ad70-redact.js";
+const ORDER = {
+    error: 0,
+    warn: 1,
+    info: 2,
+    debug: 3,
+    trace: 4,
+};
+const MAX_BYTES = 5 * 1024 * 1024;
+const ROTATE_KEEP = 3;
+function chmodPrivate(path) {
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        /* never throw */
+    }
+}
+function rotateIfNeeded(f) {
+    try {
+        if (!(existsSync(f) && statSync(f).size >= MAX_BYTES))
+            return;
+        for (let i = ROTATE_KEEP - 1; i >= 1; i--) {
+            if (existsSync(`${f}.${i}`)) {
+                const rotated = `${f}.${i + 1}`;
+                renameSync(`${f}.${i}`, rotated);
+                chmodPrivate(rotated);
+            }
+        }
+        const rotated = `${f}.1`;
+        renameSync(f, rotated);
+        chmodPrivate(rotated);
+    }
+    catch {
+        /* never throw */
+    }
+}
+function safeSerialize(data) {
+    try {
+        return ` ${JSON.stringify(data)}`;
+    }
+    catch {
+        return ' [unserializable]';
+    }
+}
+/**
+ * One logger's settings and buffer.
+ *
+ * Where lines are written and the level floor start unset unless `options`
+ * supplies them. A host decides where its log lives (that decision reads host
+ * environment variables and host directories, neither of which belongs in
+ * shared code) and configures the logger before it runs any command. Until
+ * then every `log.*` call is a silent no-op: throwing would turn the first
+ * command a host forgot to wire into a crash, and buffering would hold
+ * credential-bearing lines for a configuration that may never arrive.
+ */
+function createEngine(options) {
+    let logFileSource;
+    let initLevelSource;
+    let runtimeLevel;
+    let redactor = createRedactor();
+    let captureSink;
+    let buffer = [];
+    let timer;
+    function configure(next) {
+        logFileSource = next.file;
+        initLevelSource = next.level;
+        redactor = createRedactor(next);
+        captureSink = next.captureSink;
+    }
+    function setLogLevel(l) {
+        if (l === undefined || l in ORDER)
+            runtimeLevel = l;
+    }
+    function logFilePath() {
+        if (logFileSource === undefined)
+            return undefined;
+        const resolved = typeof logFileSource === 'function' ? logFileSource() : logFileSource;
+        return resolved || undefined;
+    }
+    function configuredLevel() {
+        if (runtimeLevel)
+            return runtimeLevel;
+        const floor = typeof initLevelSource === 'function'
+            ? initLevelSource()
+            : initLevelSource;
+        if (floor && floor in ORDER)
+            return floor;
+        return 'info';
+    }
+    function flushLogs() {
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        if (!buffer.length)
+            return;
+        let file;
+        try {
+            file = logFilePath();
+        }
+        catch {
+            buffer = [];
+            return;
+        }
+        const text = buffer.join('');
+        buffer = [];
+        if (!file)
+            return;
+        try {
+            rotateIfNeeded(file);
+            if (existsSync(file))
+                chmodPrivate(file);
+            appendFileSync(file, text, { encoding: 'utf8', mode: 0o600 });
+        }
+        catch {
+            /* never throw */
+        }
+    }
+    function schedule() {
+        if (!timer)
+            timer = setTimeout(() => {
+                timer = undefined;
+                flushLogs();
+            }, 500);
+    }
+    function emit(channel, level, message, data) {
+        // Unconfigured (neither a file nor a sink) stays a silent no-op.
+        if (logFileSource === undefined && captureSink === undefined)
+            return;
+        try {
+            if (ORDER[level] > ORDER[configuredLevel()])
+                return;
+            const scrubbedMessage = redactor.redactStrings(message);
+            let scrubbedData;
+            try {
+                scrubbedData = redactor.redact(data);
+            }
+            catch {
+                scrubbedData = '[unserializable]';
+            }
+            const line = `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${scrubbedMessage}` +
+                (data === undefined ? '' : safeSerialize(scrubbedData)) +
+                '\n';
+            // A failing observer must not prevent file logging or escape into the host.
+            try {
+                captureSink?.({
+                    channel,
+                    level,
+                    message: scrubbedMessage,
+                    data: scrubbedData,
+                });
+            }
+            catch { }
+            // A sink-only logger has no file to buffer lines for.
+            if (logFileSource === undefined)
+                return;
+            buffer.push(line);
+            if (buffer.length >= 50)
+                flushLogs();
+            else
+                schedule();
+        }
+        catch {
+            // Provider and redaction failures must never turn diagnostics into a host crash.
+        }
+    }
+    function createLogger(channel) {
+        return {
+            error: (m, d) => emit(channel, 'error', m, d),
+            warn: (m, d) => emit(channel, 'warn', m, d),
+            info: (m, d) => emit(channel, 'info', m, d),
+            debug: (m, d) => emit(channel, 'debug', m, d),
+            trace: (m, d) => emit(channel, 'trace', m, d),
+        };
+    }
+    function reset() {
+        buffer = [];
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        logFileSource = undefined;
+        initLevelSource = undefined;
+        runtimeLevel = undefined;
+        redactor = createRedactor();
+        captureSink = undefined;
+    }
+    if (options)
+        configure(options);
+    return { configure, createLogger, setLogLevel, flushLogs, reset };
+}
+/**
+ * A logger instance of its own, configured with `options`. A plugin whose
+ * copy of this module may be shared with another plugin in the same process
+ * uses this instead of `initLogger`, so neither replaces the other's file,
+ * level, redaction or capture sink.
+ */
+export function createLoggerInstance(options) {
+    const { configure, createLogger, setLogLevel, flushLogs } = createEngine(options);
+    return { configure, createLogger, setLogLevel, flushLogs };
+}
+/**
+ * The instance behind the module-level functions below, which keep the
+ * single-plugin API: one plugin per copy of this module calls `initLogger`
+ * and `createLogger` without holding an instance.
+ */
+const defaultEngine = createEngine();
+/**
+ * Point the module's default logger at a host's file and level, and return
+ * it. Idempotent: calling it again replaces both. A runtime level installed
+ * by `setLogLevel` is deliberately left alone, because it is the operator's
+ * explicit choice and outranks the floor a host computed at start-up.
+ */
+export function initLogger(options) {
+    defaultEngine.configure(options);
+    const { configure, createLogger, setLogLevel, flushLogs } = defaultEngine;
+    return { configure, createLogger, setLogLevel, flushLogs };
+}
+export function setLogLevel(l) {
+    defaultEngine.setLogLevel(l);
+}
+/**
+ * Write whatever the default logger has buffered. Safe to call synchronously
+ * from a process-exit handler, which is how each host drains the buffer on
+ * shutdown.
+ */
+export function flushLogs() {
+    defaultEngine.flushLogs();
+}
+export function createLogger(channel) {
+    return defaultEngine.createLogger(channel);
+}
+export async function flushForTest() {
+    defaultEngine.flushLogs();
+}
+/**
+ * Return the default logger to its uninitialised state. Only a test needs
+ * this: a single process runs every test file, so a file path left over from
+ * one test would keep a later "logger was never initialised" case writing
+ * lines.
+ */
+export function resetLoggerForTest() {
+    defaultEngine.reset();
+}

package/src/tui-compiled/runtime/shared/dbef697d1df1cd84-index.js

@@ -0,0 +1,5 @@
+export { MENU_DISABLED_REASON } from "./754d6017f8e419cf-builtins.js";
+export { createCommandMenu, parseApplyRequest } from "./8a18abe4fa2977c8-menu.js";
+export { SECTION_SLOTS } from "./826342a4b6a8b89b-model.js";
+export { runPiCommandMenu } from "./c7d252bedee01600-pi.js";
+export { ACTION_FAILED, CommandError, createTextRedactor, DEFAULT_IRREVERSIBLE_CONFIRMATION, projectFailure, } from "./94820e324f2b4c09-seam.js";

package/src/tui-compiled/runtime/shared/e4acc4cb713f300c-protocol.js

@@ -0,0 +1,3 @@
+export function isNotifyPayload(payload) {
+  return "notify" in payload;
+}