@event4u/agent-config 16.5.0 → 17.0.0

package/src/scripts/_lib/scoped_projection.ts

@@ -42,6 +42,45 @@ export const SCOPED_ACTIVE_WORKSPACES: ReadonlySet<string> = new Set([
     'agent-config-maintainer',
 ]);
 
+/**
+ * The workspace this package's OWN rules carry — the one workspace a consumer
+ * install never receives. ADR-293 step 4.6: the consumer workspace list is
+ * DERIVED from the pack vocabulary rather than written into settings, and this
+ * is the single id that derivation subtracts.
+ */
+export const MAINTAINER_WORKSPACE = 'agent-config-maintainer';
+
+/**
+ * Every workspace a CONSUMER install scopes rules to: the ids `packs.yml`
+ * declares, minus {@link MAINTAINER_WORKSPACE}.
+ *
+ * WHY DERIVED AND NOT CONFIGURED. `projection.rule_workspaces` carried this
+ * list as a settings default — nine ids, re-typed into the template, and
+ * needing a re-type whenever a pack arrived with a new workspace. What the key
+ * actually encoded is a RULE, and the rule is "maintainer-only rules never
+ * project to a consumer". Deriving it from the frontmatter that already decides
+ * the question makes a new workspace reach consumers the day its pack lands,
+ * instead of the day somebody remembers to edit a template.
+ *
+ * Empty when the vocabulary cannot be read, which is the inactive axis — every
+ * rule projects, exactly as an unset key meant. The failure direction is
+ * deliberate: a package that cannot read its own pack list must ship MORE than
+ * it should, never less.
+ */
+export function consumerRuleWorkspaces(packageRoot: string): string[] {
+    const ids = new Set<string>();
+    let records: PackRecord[];
+    try {
+        records = load_packs_registry(packageRoot);
+    } catch {
+        return []; // unreadable vocabulary: the inactive axis, which ships more
+    }
+    for (const rec of records) {
+        for (const ws of rec.workspaces) if (ws !== MAINTAINER_WORKSPACE) ids.add(ws);
+    }
+    return [...ids].sort();
+}
+
 export interface PackRecord {
     id: string;
     workspaces: string[];
@@ -150,8 +189,19 @@ export function compute_active_pack_ids(
  * `scoped`. Untagged artefacts (empty `packs:` frontmatter) are core/shared
  * and always kept; a tagged artefact survives iff its tags intersect the
  * active set.
+ *
+ * `kept` is the declared-dependency closure (`declared_skill_closure`): a
+ * skill a surviving artefact declares is never pruned, whatever its tags
+ * (ADR-289 § Decision 2 — a pruned declared dependency is a broken install).
  */
-export function is_pruned_under_scoped(md_path: string, active_ids: ReadonlySet<string>): boolean {
+export function is_pruned_under_scoped(
+    md_path: string,
+    active_ids: ReadonlySet<string>,
+    kept: ReadonlySet<string> = new Set(),
+): boolean {
+    if (path.basename(md_path) === 'SKILL.md' && kept.has(path.basename(path.dirname(md_path)))) {
+        return false;
+    }
     const packs = surface_tiers.frontmatter_packs(md_path);
     if (packs.size === 0) return false;
     for (const id of packs) {
@@ -160,6 +210,72 @@ export function is_pruned_under_scoped(md_path: string, active_ids: ReadonlySet<
     return true;
 }
 
+/** Names in an artefact's `skills:` and `requires_skills:` frontmatter lists. */
+export function declared_skills(md_path: string): string[] {
+    let text: string;
+    try {
+        text = fs.readFileSync(md_path, 'utf-8');
+    } catch {
+        return [];
+    }
+    if (!text.startsWith('---')) return [];
+    const end = text.indexOf('\n---', 3);
+    const fm = yamlSafeLoad(end !== -1 ? text.slice(3, end) : text.slice(3));
+    if (!isPlainObject(fm)) return [];
+    const out: string[] = [];
+    for (const key of ['skills', 'requires_skills']) {
+        const v = fm[key];
+        if (Array.isArray(v)) out.push(...v.filter((s): s is string => typeof s === 'string'));
+    }
+    return out;
+}
+
+/**
+ * Every skill name a surviving artefact declares, transitively: a declared
+ * skill the pack prune would drop survives, and its own declarations count.
+ * `artefacts` is the SKILL.md and command `.md` population being pruned.
+ */
+export function declared_skill_closure(
+    artefacts: Iterable<string>,
+    active_ids: ReadonlySet<string>,
+): Set<string> {
+    const all = [...artefacts];
+    const skill_md = new Map<string, string>();
+    for (const p of all) {
+        if (path.basename(p) === 'SKILL.md') skill_md.set(path.basename(path.dirname(p)), p);
+    }
+    const kept = new Set<string>();
+    let frontier = all.filter((p) => !is_pruned_under_scoped(p, active_ids));
+    while (frontier.length > 0) {
+        const next: string[] = [];
+        for (const p of frontier) {
+            for (const name of declared_skills(p)) {
+                if (kept.has(name)) continue;
+                kept.add(name);
+                const target = skill_md.get(name);
+                if (target !== undefined && is_pruned_under_scoped(target, active_ids)) next.push(target);
+            }
+        }
+        frontier = next;
+    }
+    return kept;
+}
+
+/** Every command `.md` the package projects — the declarers beside the skills. */
+export function projected_command_files(package_root: string): string[] {
+    const out: string[] = [];
+    const walk = (dir: string): void => {
+        if (!fs.existsSync(dir)) return;
+        for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : 1))) {
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) walk(full);
+            else if (e.name.endsWith('.md') && e.name !== 'AGENTS.md') out.push(full);
+        }
+    };
+    walk(path.join(package_root, 'dist', 'agent-src', 'commands'));
+    return out;
+}
+
 /**
  * Sentinel value for `projection.rule_packs`: derive the pack scope from the
  * active-pack set instead of listing ids by hand.
@@ -242,12 +358,14 @@ export function scoped_projection_stats(
     runtime_active_packs: readonly string[] = [],
 ): ScopedProjectionStats {
     const active = compute_active_pack_ids(load_packs_registry(package_root), runtime_active_packs);
+    const skill_list = [...skills];
+    const kept = declared_skill_closure([...skill_list, ...projected_command_files(package_root)], active);
 
     let projected = 0;
     let total = 0;
-    for (const skill of skills) {
+    for (const skill of skill_list) {
         total += 1;
-        if (!is_pruned_under_scoped(skill, active)) {
+        if (!is_pruned_under_scoped(skill, active, kept)) {
             projected += 1;
         }
     }
@@ -344,6 +462,21 @@ export function prune_modules_by(
     return [pruned, adjusted];
 }
 
+/**
+ * The scoped prune over a completed deploy: pack-pruned skills/commands go,
+ * except the skills a surviving deployed artefact declares.
+ */
+export function prune_scoped_modules(
+    deploy_results: Record<string, DeployTuple>,
+    active_ids: ReadonlySet<string>,
+): [number, Record<string, DeployTuple>] {
+    const artefacts = Object.values(deploy_results)
+        .flatMap(([, , , paths]) => paths)
+        .filter((p) => path.basename(p) === 'SKILL.md' || (p.split(path.sep).includes('commands') && path.extname(p) === '.md'));
+    const kept = declared_skill_closure(artefacts, active_ids);
+    return prune_modules_by(deploy_results, (p) => is_pruned_under_scoped(p, active_ids, kept));
+}
+
 /**
  * Remove lab-tier skills/commands from a completed deploy (core-only).
  *

package/src/scripts/_lib/secret_detector.ts

@@ -21,6 +21,8 @@
 // returned so callers can choose), and the masked preview never reproduces the
 // full secret.
 
+import { EGRESS_RULES, type EgressRule, evaluateMatch, shannonEntropy } from './egress_rules.js';
+
 /** One detected secret. Never carries the raw value — see `masked`. */
 export interface SecretFinding {
     rule: string;
@@ -34,6 +36,8 @@ export interface SecretFinding {
 /** Options for a scan. `path` lets `.example` / `.sample` files demote hits. */
 export interface ScanOptions {
     path?: string;
+    /** Rule rows to scan with; defaults to the table's credential rows. */
+    rules?: readonly EgressRule[];
 }
 
 // ---------------------------------------------------------------------
@@ -48,48 +52,11 @@ export const BASE64_ENTROPY_THRESHOLD = 4.5;
 export const HEX_ENTROPY_THRESHOLD = 3.0;
 
 // ---------------------------------------------------------------------
-// Regex rule pack (HIGH-confidence).
+// Regex rule pack (HIGH-confidence) — the credential rows of the one rule
+// table in egress_rules.ts, which owns every pattern literal.
 // ---------------------------------------------------------------------
 
-interface Rule {
-    rule: string;
-    kind: string;
-    regex: RegExp; // MUST carry the global flag
-    valueGroup?: number; // capture group holding the sensitive value (default 0)
-}
-
-// Reused verbatim from lint_mcp_config_security.ts `_SECRET` (do NOT weaken),
-// split into individually-kinded rules, plus the extension set from the spec.
-const RULES: readonly Rule[] = [
-    { rule: 'anthropic-api-key', kind: 'anthropic-api-key', regex: /sk-ant-[A-Za-z0-9_-]{20,}/g },
-    { rule: 'anthropic-project-key', kind: 'anthropic-api-key', regex: /sk-proj-[A-Za-z0-9_-]{20,}/g },
-    { rule: 'aws-access-key', kind: 'aws-access-key', regex: /AKIA[0-9A-Z]{16}/g },
-    { rule: 'google-api-key', kind: 'google-api-key', regex: /AIza[0-9A-Za-z_-]{35}/g },
-    { rule: 'github-pat', kind: 'github-pat', regex: /ghp_[0-9A-Za-z]{36}/g },
-    // Fine-grained PATs (github_pat_…) were a measured detector gap: the
-    // 2026-07-28 adversarial corpus pass flagged them as missed positives.
-    { rule: 'github-fine-grained-pat', kind: 'github-pat', regex: /github_pat_[0-9A-Za-z_]{22,}/g },
-    {
-        rule: 'jwt',
-        kind: 'jwt',
-        regex: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-    },
-    // Extensions.
-    { rule: 'stripe-secret-key', kind: 'stripe-secret-key', regex: /sk_(?:live|test)_[0-9A-Za-z]{16,}/g },
-    { rule: 'slack-token', kind: 'slack-token', regex: /xox[baprs]-[0-9A-Za-z-]{10,}/g },
-    { rule: 'pem-private-key', kind: 'pem-private-key', regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
-    {
-        rule: 'db-connection-uri',
-        kind: 'db-connection-uri',
-        regex: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@/g,
-    },
-    {
-        rule: 'generic-assignment',
-        kind: 'generic-assignment',
-        regex: /(?:password|passwd|pwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token)\s*[:=]\s*['"]?([^'"\s]{8,})['"]?/gi,
-        valueGroup: 1,
-    },
-];
+const RULES = EGRESS_RULES.filter((r) => r.class === 'credential');
 
 // ---------------------------------------------------------------------
 // Suppression + placeholder detection.
@@ -133,36 +100,6 @@ function isAllSameChar(value: string): boolean {
     return value.length > 0 && /^(.)\1*$/.test(value);
 }
 
-// Minimum length + entropy for a `generic-assignment` value to count as a real
-// credential. A bare `secret: moderate` / `token: modelName` / `key: request()`
-// is a keyword-shaped assignment of a low-entropy WORD — not a secret. Real
-// credentials assigned this way are long and high-entropy. Without this gate the
-// generic rule floods on prose, config, and test data (the FP class the council
-// warned about — precision over allowlist growth).
-const GENERIC_MIN_LENGTH = 16;
-const GENERIC_MIN_ENTROPY = 3.3;
-// Code-expression shapes: an assignment RHS that is a reference / call /
-// interpolation, not a literal credential (`opts.apiKey`, `${API_KEY}`,
-// `load()`, `process.env.X`, `$this->get()`). Never a real inline secret.
-const CODE_EXPR = /[()$`{}<>[\];,]|->|=>|\.\w/;
-
-function looksLikeSecretValue(value: string): boolean {
-    if (value.length < GENERIC_MIN_LENGTH) {
-        return false;
-    }
-    if (CODE_EXPR.test(value)) {
-        return false;
-    }
-    // A real credential carries entropy AND is not a plain lowercase word —
-    // it has a digit or mixed case.
-    const hasDigit = /[0-9]/.test(value);
-    const mixedCase = /[a-z]/.test(value) && /[A-Z]/.test(value);
-    if (!hasDigit && !mixedCase) {
-        return false;
-    }
-    return shannonEntropy(value) >= GENERIC_MIN_ENTROPY;
-}
-
 function isPlaceholderValue(value: string, pathHint?: string): boolean {
     if (pathHint !== undefined) {
         if (
@@ -190,20 +127,6 @@ function maskSecret(value: string): string {
     return `${front}…${back}`;
 }
 
-function shannonEntropy(value: string): number {
-    const freq = new Map<string, number>();
-    for (const ch of value) {
-        freq.set(ch, (freq.get(ch) ?? 0) + 1);
-    }
-    const n = value.length;
-    let entropy = 0;
-    for (const count of freq.values()) {
-        const p = count / n;
-        entropy -= p * Math.log2(p);
-    }
-    return entropy;
-}
-
 function overlaps(spans: ReadonlyArray<[number, number]>, start: number, end: number): boolean {
     return spans.some(([s, e]) => start < e && s < end);
 }
@@ -229,40 +152,38 @@ export function scanText(text: string, opts: ScanOptions = {}): SecretFinding[]
         const covered: Array<[number, number]> = [];
 
         // Layer 1 — regex rule pack (HIGH, demoted to LOW for placeholders).
-        for (const rule of RULES) {
-            rule.regex.lastIndex = 0;
+        for (const rule of opts.rules ?? RULES) {
+            // The loop advances through lastIndex, which a non-global pattern
+            // never moves: a caller-supplied row without `g` would match forever.
+            const pattern = rule.pattern.global ? rule.pattern : new RegExp(rule.pattern.source, `${rule.pattern.flags}g`);
+            pattern.lastIndex = 0;
             let m: RegExpExecArray | null;
-            while ((m = rule.regex.exec(line)) !== null) {
-                const value = rule.valueGroup !== undefined ? m[rule.valueGroup] : m[0];
-                if (value === undefined) {
-                    if (m.index === rule.regex.lastIndex) {
-                        rule.regex.lastIndex += 1;
-                    }
-                    continue;
-                }
-                // The keyword-anchored generic rule needs a value-likeness gate:
-                // a low-entropy word after `secret:`/`token:` is not a credential.
-                if (rule.rule === 'generic-assignment' && !looksLikeSecretValue(value)) {
-                    if (m.index === rule.regex.lastIndex) {
-                        rule.regex.lastIndex += 1;
+            while ((m = pattern.exec(line)) !== null) {
+                // Every field of the row — capture offsets, exclusions, context,
+                // validator — is applied by the table, the same way for both readers.
+                const c = evaluateMatch(rule, line, m);
+                if (c === null) {
+                    if (m.index === pattern.lastIndex) {
+                        pattern.lastIndex += 1;
                     }
                     continue;
                 }
-                const valueStart = m.index + m[0].indexOf(value);
+                const valueStart = c.start;
+                const value = line.slice(c.start, c.end);
                 const confidence: SecretFinding['confidence'] = isPlaceholderValue(value, pathHint)
                     ? 'low'
                     : 'high';
                 findings.push({
                     rule: rule.rule,
-                    kind: rule.kind,
+                    kind: rule.kind ?? rule.rule,
                     line: lineNo,
                     column: valueStart + 1,
                     masked: maskSecret(value),
                     confidence,
                 });
                 covered.push([valueStart, valueStart + value.length]);
-                if (m.index === rule.regex.lastIndex) {
-                    rule.regex.lastIndex += 1;
+                if (m.index === pattern.lastIndex) {
+                    pattern.lastIndex += 1;
                 }
             }
         }