@duckmind/dm-linux-x64 0.65.8 → 0.66.2

package/extensions/dm-lens/dist/clients/recent-touches.js

@@ -1,126 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { writeFileAtomicAsync } from "./atomic-write.js";
-import { getProjectDataDir } from "./file-utils.js";
-import { normalizeFilePath } from "./path-utils.js";
-export const RECENT_TOUCHES_MAX_ENTRIES = 50;
-const RECENT_TOUCHES_FRESHNESS_MS = 15 * 60 * 1000;
-function recentTouchesPath(cwd) {
-  return path.join(getProjectDataDir(cwd), "recent-touches.json");
-}
-let _enabledCache;
-function isRecentTouchesEnabled() {
-  if (_enabledCache === undefined) {
-    _enabledCache = process.env.DM_LENS_AGENT_NUDGE !== "0";
-  }
-  return _enabledCache;
-}
-export function _resetRecentTouchesForTests() {
-  _enabledCache = undefined;
-  _lastSeenMtimeMs = undefined;
-  _lastSeenSizeBytes = undefined;
-  _lastConsumedCursor.clear();
-}
-async function readRecentTouchesAsync(cwd) {
-  try {
-    const raw = await fs.promises.readFile(recentTouchesPath(cwd), "utf-8");
-    const parsed = JSON.parse(raw);
-    if (parsed && Array.isArray(parsed.entries)) {
-      return parsed;
-    }
-    return { entries: [] };
-  } catch {
-    return { entries: [] };
-  }
-}
-async function writeRecentTouchesAsync(cwd, file) {
-  const dir = getProjectDataDir(cwd);
-  const target = recentTouchesPath(cwd);
-  try {
-    await fs.promises.mkdir(dir, { recursive: true });
-  } catch {
-    return;
-  }
-  await writeFileAtomicAsync(target, JSON.stringify(file));
-}
-export async function appendRecentTouches(args) {
-  if (!isRecentTouchesEnabled())
-    return;
-  if (args.paths.length === 0)
-    return;
-  const now = Date.now();
-  const pid = process.pid;
-  const newEntries = args.paths.map((p) => ({
-    path: normalizeFilePath(p),
-    reason: args.reason,
-    ts: now,
-    pid,
-    sessionId: args.sessionId
-  }));
-  const file = await readRecentTouchesAsync(args.cwd);
-  const merged = [...file.entries, ...newEntries];
-  const capped = merged.length > RECENT_TOUCHES_MAX_ENTRIES ? merged.slice(merged.length - RECENT_TOUCHES_MAX_ENTRIES) : merged;
-  await writeRecentTouchesAsync(args.cwd, { entries: capped });
-}
-function passesForeignEntryFilter(entry, selfPid, now, freshnessMs) {
-  if (entry.pid === selfPid)
-    return false;
-  if (now - entry.ts > freshnessMs)
-    return false;
-  try {
-    return fs.existsSync(entry.path);
-  } catch {
-    return false;
-  }
-}
-export async function readCrossProcessTouchesForSessionStart(args) {
-  if (!isRecentTouchesEnabled())
-    return [];
-  try {
-    const selfPid = args.selfPid ?? process.pid;
-    const now = args.now ?? Date.now();
-    const freshnessMs = args.freshnessMs ?? RECENT_TOUCHES_FRESHNESS_MS;
-    const file = await readRecentTouchesAsync(args.cwd);
-    return file.entries.filter((e) => passesForeignEntryFilter(e, selfPid, now, freshnessMs));
-  } catch {
-    return [];
-  }
-}
-let _lastSeenMtimeMs;
-let _lastSeenSizeBytes;
-const _lastConsumedCursor = new Map;
-export async function readCrossProcessTouchesForTurnStart(args) {
-  if (!isRecentTouchesEnabled())
-    return [];
-  try {
-    const target = recentTouchesPath(args.cwd);
-    let mtimeMs;
-    let sizeBytes;
-    try {
-      const stat = await fs.promises.stat(target);
-      mtimeMs = stat.mtimeMs;
-      sizeBytes = stat.size;
-    } catch {
-      return [];
-    }
-    if (_lastSeenMtimeMs === mtimeMs && _lastSeenSizeBytes === sizeBytes) {
-      return [];
-    }
-    _lastSeenMtimeMs = mtimeMs;
-    _lastSeenSizeBytes = sizeBytes;
-    const selfPid = args.selfPid ?? process.pid;
-    const now = args.now ?? Date.now();
-    const freshnessMs = args.freshnessMs ?? RECENT_TOUCHES_FRESHNESS_MS;
-    const file = await readRecentTouchesAsync(args.cwd);
-    const cursorKey = normalizeFilePath(args.cwd);
-    const cursor = _lastConsumedCursor.get(cursorKey) ?? 0;
-    const fresh = file.entries.filter((e) => e.ts > cursor && passesForeignEntryFilter(e, selfPid, now, freshnessMs));
-    if (file.entries.length > 0) {
-      const maxTs = Math.max(...file.entries.map((e) => e.ts));
-      _lastConsumedCursor.set(cursorKey, Math.max(cursor, maxTs));
-    }
-    return fresh;
-  } catch {
-    return [];
-  }
-}

package/extensions/dm-lens/dist/clients/redact/secrets.js

@@ -1,386 +0,0 @@
-const PEM_BEGIN = "-----BEGIN ";
-const PEM_DELIMITER = "-----";
-function codePointOf(char) {
-  return char?.codePointAt(0) ?? -1;
-}
-function isAsciiAlphaNumeric(char) {
-  const code = codePointOf(char);
-  return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;
-}
-function isUpperAlphaNumeric(char) {
-  const code = codePointOf(char);
-  return code >= 48 && code <= 57 || code >= 65 && code <= 90;
-}
-function isIdentifierChar(char) {
-  return char === "_" || isAsciiAlphaNumeric(char);
-}
-function isTokenChar(char) {
-  return char === "-" || isIdentifierChar(char);
-}
-const PREFIXED_SECRETS = [
-  {
-    prefix: "ghp_",
-    minSuffixLength: 20,
-    predicate: isAsciiAlphaNumeric,
-    replacement: "[REDACTED:github-token]"
-  },
-  {
-    prefix: "gho_",
-    minSuffixLength: 20,
-    predicate: isAsciiAlphaNumeric,
-    replacement: "[REDACTED:github-token]"
-  },
-  {
-    prefix: "ghu_",
-    minSuffixLength: 20,
-    predicate: isAsciiAlphaNumeric,
-    replacement: "[REDACTED:github-token]"
-  },
-  {
-    prefix: "ghs_",
-    minSuffixLength: 20,
-    predicate: isAsciiAlphaNumeric,
-    replacement: "[REDACTED:github-token]"
-  },
-  {
-    prefix: "ghr_",
-    minSuffixLength: 20,
-    predicate: isAsciiAlphaNumeric,
-    replacement: "[REDACTED:github-token]"
-  },
-  {
-    prefix: "github_pat_",
-    minSuffixLength: 20,
-    predicate: isTokenChar,
-    replacement: "[REDACTED:github-token]"
-  },
-  {
-    prefix: "AKIA",
-    minSuffixLength: 16,
-    predicate: isUpperAlphaNumeric,
-    replacement: "[REDACTED:aws-access-key]"
-  },
-  {
-    prefix: "ASIA",
-    minSuffixLength: 16,
-    predicate: isUpperAlphaNumeric,
-    replacement: "[REDACTED:aws-access-key]"
-  },
-  {
-    prefix: "sk_live_",
-    minSuffixLength: 16,
-    predicate: isAsciiAlphaNumeric,
-    replacement: "[REDACTED:stripe-key]"
-  },
-  {
-    prefix: "sk_test_",
-    minSuffixLength: 16,
-    predicate: isAsciiAlphaNumeric,
-    replacement: "[REDACTED:stripe-key]"
-  },
-  {
-    prefix: "rk_live_",
-    minSuffixLength: 16,
-    predicate: isAsciiAlphaNumeric,
-    replacement: "[REDACTED:stripe-key]"
-  },
-  {
-    prefix: "rk_test_",
-    minSuffixLength: 16,
-    predicate: isAsciiAlphaNumeric,
-    replacement: "[REDACTED:stripe-key]"
-  },
-  {
-    prefix: "glpat-",
-    minSuffixLength: 20,
-    predicate: isTokenChar,
-    replacement: "[REDACTED:gitlab-token]"
-  },
-  {
-    prefix: "AIza",
-    minSuffixLength: 35,
-    predicate: isTokenChar,
-    replacement: "[REDACTED:google-api-key]"
-  },
-  {
-    prefix: "GOCSPX-",
-    minSuffixLength: 20,
-    predicate: isTokenChar,
-    replacement: "[REDACTED:google-oauth-secret]"
-  },
-  {
-    prefix: "sk-proj-",
-    minSuffixLength: 20,
-    predicate: isTokenChar,
-    replacement: "[REDACTED:openai-key]"
-  },
-  {
-    prefix: "sk-svcacct-",
-    minSuffixLength: 20,
-    predicate: isTokenChar,
-    replacement: "[REDACTED:openai-key]"
-  }
-];
-const OPENAI_LEGACY_MIN_SUFFIX = 40;
-function consumeWhile(options) {
-  let end = options.start;
-  while (end < options.text.length && options.predicate(options.text[end])) {
-    end++;
-  }
-  return end;
-}
-function scanPrefixedSecret(position) {
-  for (const secret of PREFIXED_SECRETS) {
-    if (position.text[position.start] !== secret.prefix[0] || !position.text.startsWith(secret.prefix, position.start)) {
-      continue;
-    }
-    const suffixStart = position.start + secret.prefix.length;
-    const end = consumeWhile({
-      text: position.text,
-      start: suffixStart,
-      predicate: secret.predicate
-    });
-    return end - suffixStart >= secret.minSuffixLength ? { end, replacement: secret.replacement } : { end: Math.max(end, suffixStart) };
-  }
-  return;
-}
-function scanSlackToken(position) {
-  const variant = position.text[position.start + 3];
-  if (!position.text.startsWith("xox", position.start) || variant === undefined || variant < "a" || variant > "z" || position.text[position.start + 4] !== "-") {
-    return;
-  }
-  const suffixStart = position.start + 5;
-  const end = consumeWhile({
-    text: position.text,
-    start: suffixStart,
-    predicate: isTokenChar
-  });
-  return end - suffixStart >= 10 ? { end, replacement: "[REDACTED:slack-token]" } : { end: Math.max(end, suffixStart) };
-}
-function scanSendGridKey(position) {
-  if (!position.text.startsWith("SG.", position.start))
-    return;
-  const retryAt = position.start + 1;
-  const firstStart = position.start + 3;
-  const firstEnd = firstStart + 22;
-  for (let index = firstStart;index < firstEnd; index++) {
-    if (!isTokenChar(position.text[index]))
-      return { end: retryAt };
-  }
-  if (position.text[firstEnd] !== ".")
-    return { end: retryAt };
-  const secondStart = firstEnd + 1;
-  const end = secondStart + 43;
-  for (let index = secondStart;index < end; index++) {
-    if (!isTokenChar(position.text[index]))
-      return { end: retryAt };
-  }
-  return isTokenChar(position.text[end]) ? { end: retryAt } : { end, replacement: "[REDACTED:sendgrid-key]" };
-}
-function createJwtSegment(options) {
-  const possibleCandidate = options.text.indexOf("eyJ", options.start);
-  const candidate = possibleCandidate !== -1 && possibleCandidate < options.end && options.end - (possibleCandidate + 3) >= 5 ? possibleCandidate : -1;
-  return {
-    candidate,
-    length: options.end - options.start,
-    end: options.end
-  };
-}
-function chooseSecretRange(options) {
-  if (!options.candidate)
-    return options.current;
-  if (!options.current)
-    return options.candidate;
-  return options.candidate.start < options.current.start || options.candidate.start === options.current.start && options.candidate.end > options.current.end ? options.candidate : options.current;
-}
-function findNestedJwtRange(segments) {
-  let result;
-  const jweStart = segments.length - 5;
-  if (jweStart >= 0 && segments[jweStart].candidate !== -1 && segments[jweStart + 2].length > 0 && segments[jweStart + 3].length > 0 && segments[jweStart + 4].length > 0) {
-    result = {
-      start: segments[jweStart].candidate,
-      end: segments[jweStart + 4].end
-    };
-  }
-  const jwtStart = segments.length - 3;
-  const isJwt = jwtStart >= 0 && segments[jwtStart].candidate !== -1 && segments[jwtStart + 1].length > 0 && segments[jwtStart + 2].length > 0;
-  return isJwt ? chooseSecretRange({
-    current: result,
-    candidate: {
-      start: segments[jwtStart].candidate,
-      end: segments[jwtStart + 2].end
-    }
-  }) : result;
-}
-function topLevelJwtEnd(options) {
-  if (options.segmentCount >= 5 && options.segmentLengths[2] > 0 && options.segmentLengths[3] > 0 && options.segmentLengths[4] > 0) {
-    return options.segmentEnds[4];
-  }
-  return options.segmentCount >= 3 && options.segmentLengths[1] > 0 && options.segmentLengths[2] > 0 ? options.segmentEnds[2] : undefined;
-}
-function scanJwt(position) {
-  if (!position.text.startsWith("eyJ", position.start))
-    return;
-  let segmentStart = position.start + 3;
-  let cursor = consumeWhile({
-    text: position.text,
-    start: segmentStart,
-    predicate: isTokenChar
-  });
-  if (cursor - segmentStart < 5)
-    return { end: cursor };
-  const segmentLengths = [cursor - segmentStart];
-  const segmentEnds = [cursor];
-  const recentSegments = [
-    createJwtSegment({ text: position.text, start: segmentStart, end: cursor })
-  ];
-  let segmentCount = 1;
-  let nestedRange;
-  while (position.text[cursor] === ".") {
-    segmentStart = cursor + 1;
-    cursor = consumeWhile({
-      text: position.text,
-      start: segmentStart,
-      predicate: isTokenChar
-    });
-    segmentCount++;
-    recentSegments.push(createJwtSegment({
-      text: position.text,
-      start: segmentStart,
-      end: cursor
-    }));
-    if (recentSegments.length > 5)
-      recentSegments.shift();
-    nestedRange = chooseSecretRange({
-      current: nestedRange,
-      candidate: findNestedJwtRange(recentSegments)
-    });
-    if (segmentLengths.length < 5) {
-      segmentLengths.push(cursor - segmentStart);
-      segmentEnds.push(cursor);
-    }
-  }
-  const topLevelEnd = topLevelJwtEnd({
-    segmentCount,
-    segmentLengths,
-    segmentEnds
-  });
-  if (topLevelEnd !== undefined) {
-    return { end: topLevelEnd, replacement: "[REDACTED:jwt]" };
-  }
-  return nestedRange ? { ...nestedRange, replacement: "[REDACTED:jwt]" } : { end: cursor };
-}
-function scanOpenAiLegacyKey(position) {
-  if (!position.text.startsWith("sk-", position.start))
-    return;
-  const suffixStart = position.start + 3;
-  let end = suffixStart;
-  let hasDigit = false;
-  while (end < position.text.length && isAsciiAlphaNumeric(position.text[end])) {
-    const code = codePointOf(position.text[end]);
-    if (code >= 48 && code <= 57)
-      hasDigit = true;
-    end++;
-  }
-  return end - suffixStart >= OPENAI_LEGACY_MIN_SUFFIX && hasDigit ? { end, replacement: "[REDACTED:openai-key]" } : { end: Math.max(end, suffixStart) };
-}
-function scanSecretAt(position) {
-  const initial = position.text[position.start];
-  if (initial === "S")
-    return scanSendGridKey(position);
-  if (initial === "x")
-    return scanSlackToken(position);
-  if (initial === "s") {
-    return scanPrefixedSecret(position) ?? scanOpenAiLegacyKey(position);
-  }
-  if (initial === "A" || initial === "G" || initial === "g" || initial === "r") {
-    return scanPrefixedSecret(position);
-  }
-  return;
-}
-function redactScannedSecrets(options) {
-  let cursor = 0;
-  let copyFrom = 0;
-  let result = "";
-  const position = { text: options.text, start: 0 };
-  while (cursor < options.text.length) {
-    position.start = cursor;
-    const scan = options.scanner(position);
-    if (!scan) {
-      cursor++;
-      continue;
-    }
-    if (scan.replacement) {
-      const replacementStart = scan.start ?? cursor;
-      result += options.text.slice(copyFrom, replacementStart) + scan.replacement;
-      copyFrom = scan.end;
-    }
-    cursor = Math.max(cursor + 1, scan.end);
-  }
-  return copyFrom === 0 ? options.text : result + options.text.slice(copyFrom);
-}
-function redactTokenSecrets(text) {
-  return redactScannedSecrets({ text, scanner: scanSecretAt });
-}
-function redactJwtSecrets(text) {
-  return redactScannedSecrets({ text, scanner: scanJwt });
-}
-function isPrivateKeyLabel(label) {
-  if (label.length === 0 || label.length > 64 || !label.includes("PRIVATE KEY")) {
-    return false;
-  }
-  for (const char of label) {
-    const code = codePointOf(char);
-    if (char !== " " && (code < 48 || code > 57) && (code < 65 || code > 90)) {
-      return false;
-    }
-  }
-  return true;
-}
-function findUnescapedQuote(position) {
-  let escaped = false;
-  for (let index = position.start;index < position.text.length; index++) {
-    const char = position.text[index];
-    if (char === "\\") {
-      escaped = !escaped;
-      continue;
-    }
-    if (char === '"' && !escaped)
-      return index;
-    escaped = false;
-  }
-  return position.text.length;
-}
-function redactPrivateKeyBlocks(text) {
-  let cursor = 0;
-  let result = "";
-  while (cursor < text.length) {
-    const begin = text.indexOf(PEM_BEGIN, cursor);
-    if (begin === -1)
-      return result + text.slice(cursor);
-    const labelStart = begin + PEM_BEGIN.length;
-    const labelEnd = text.indexOf(PEM_DELIMITER, labelStart);
-    if (labelEnd === -1)
-      return result + text.slice(cursor);
-    const label = text.slice(labelStart, labelEnd);
-    if (!isPrivateKeyLabel(label)) {
-      const next = labelEnd + PEM_DELIMITER.length;
-      result += text.slice(cursor, next);
-      cursor = next;
-      continue;
-    }
-    const contentStart = labelEnd + PEM_DELIMITER.length;
-    const endMarker = `-----END ${label}-----`;
-    const end = text.indexOf(endMarker, contentStart);
-    result += text.slice(cursor, begin) + "[REDACTED:private-key]";
-    if (end === -1) {
-      cursor = findUnescapedQuote({ text, start: contentStart });
-      continue;
-    }
-    cursor = end + endMarker.length;
-  }
-  return result;
-}
-export function redactSecrets(text) {
-  return redactJwtSecrets(redactTokenSecrets(redactPrivateKeyBlocks(text)));
-}