@evo-dev/core 0.0.1-alpha.1 → 0.0.1-alpha.10

package/src/evolution/evidence/session-memory/sensitivity.ts

@@ -0,0 +1,335 @@
+import type {
+  SessionEvidenceSegmentV1,
+  SessionMemoryRawEventV1,
+  SessionMemorySensitivity,
+  SessionMemorySensitivityReason,
+} from "./types.ts";
+
+export interface SessionMemorySensitivityDetection {
+  classification: SessionMemorySensitivity;
+  reasons: SessionMemorySensitivityReason[];
+}
+
+export interface SessionMemoryCredentialRedaction<T> {
+  value: T;
+  redacted: boolean;
+}
+
+export const SESSION_MEMORY_CREDENTIAL_REDACTION = "[credential-redacted]";
+
+const CREDENTIAL_FIELD_KEYS = new Set([
+  "accesstoken",
+  "apikey",
+  "auth",
+  "authtoken",
+  "authorization",
+  "clientsecret",
+  "cookie",
+  "credential",
+  "credentials",
+  "idtoken",
+  "password",
+  "passwd",
+  "privatekey",
+  "proxyauthorization",
+  "refreshtoken",
+  "secret",
+  "secretvalue",
+  "sessiontoken",
+  "setcookie",
+  "signingkey",
+  "token",
+]);
+
+const PRIVATE_MARKER_PATTERN = /\b(?:internal|private)\b|(?:^|[\\/])\.env(?:\.|$|[\\/])/i;
+const URL_PATTERN = /https?:\/\/[^\s"'<>\\]+/gi;
+const CREDENTIAL_KEY_PATTERN = String.raw`(?:access[_-]?token|api[_-]?key|auth(?:orization)?|client[_-]?secret|cookie|credential(?:s)?|id[_-]?token|password|passwd|private[_-]?key|proxy[_-]?authorization|refresh[_-]?token|secret(?:[_-]?value)?|session[_-]?token|set[_-]?cookie|signing[_-]?key|token)`;
+const CREDENTIAL_SHAPE_PATTERNS = [
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/i,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/,
+  /\bxox[baprs]-[A-Za-z0-9-]{16,}\b/,
+  /\bBearer\s+[A-Za-z0-9._~+/=-]+/i,
+  /\bBasic\s+[A-Za-z0-9+/]+={0,2}/i,
+  new RegExp(
+    String.raw`(?:^|[^A-Za-z0-9_])["']?${CREDENTIAL_KEY_PATTERN}["']?\s*[:=]\s*["']?[A-Za-z0-9][A-Za-z0-9._~+/=-]*`,
+    "i",
+  ),
+  new RegExp(
+    String.raw`(?:^|[^A-Za-z0-9_])["']?${CREDENTIAL_KEY_PATTERN}["']?\s*[:=]\s*["'](?!\[credential-redacted\]["'])[^"'\r\n]+["']`,
+    "i",
+  ),
+];
+const PRIVATE_KEY_BLOCK_PATTERN =
+  /-----BEGIN ([A-Z0-9 ]*PRIVATE KEY)-----[\s\S]*?-----END \1-----/giu;
+const AUTHORIZATION_HEADER_PATTERN =
+  /(^|[\r\n])(\s*(?:authorization|proxy-authorization)\s*:\s*)(?:Bearer|Basic)\s+[^\r\n]+/gimu;
+const COOKIE_HEADER_PATTERN = /(^|[\r\n])(\s*(?:cookie|set-cookie)\s*:\s*)[^\r\n]+/gimu;
+const BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/giu;
+const BASIC_PATTERN = /\bBasic\s+[A-Za-z0-9+/]+={0,2}/giu;
+const AWS_ACCESS_KEY_PATTERN = /\bAKIA[0-9A-Z]{16}\b/gu;
+const GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{20,}\b/gu;
+const SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{16,}\b/gu;
+const QUOTED_SERIALIZED_CREDENTIAL_PATTERN = new RegExp(
+  String.raw`(^|[^A-Za-z0-9_])(["']?${CREDENTIAL_KEY_PATTERN}["']?\s*[:=]\s*)(["'])([^"'\r\n]+)(\3)`,
+  "gimu",
+);
+const SERIALIZED_CREDENTIAL_PATTERN = new RegExp(
+  String.raw`(^|[^A-Za-z0-9_])(["']?${CREDENTIAL_KEY_PATTERN}["']?\s*[:=]\s*)(["']?)([A-Za-z0-9][A-Za-z0-9._~+/=-]*)(\3)`,
+  "gimu",
+);
+const URL_USERINFO_PATTERN = /(https?:\/\/)[^@\s/"']+@/giu;
+const URL_CREDENTIAL_PARAMETER_PATTERN = new RegExp(
+  String.raw`([?&#]["']?${CREDENTIAL_KEY_PATTERN}["']?=)[^&#\s"'<>]+`,
+  "giu",
+);
+
+export function detectSessionMemorySensitivity(value: unknown): SessionMemorySensitivityDetection {
+  const reasons = new Set<SessionMemorySensitivityReason>();
+  inspectValue(value, null, reasons, new WeakSet<object>());
+  return createDetection(reasons);
+}
+
+export function redactSessionMemoryCredentialText(
+  value: string,
+): SessionMemoryCredentialRedaction<string> {
+  let redacted = value
+    .replace(PRIVATE_KEY_BLOCK_PATTERN, SESSION_MEMORY_CREDENTIAL_REDACTION)
+    .replace(AUTHORIZATION_HEADER_PATTERN, (_, boundary: string, prefix: string) => {
+      return `${boundary}${prefix}${SESSION_MEMORY_CREDENTIAL_REDACTION}`;
+    })
+    .replace(COOKIE_HEADER_PATTERN, (_, boundary: string, prefix: string) => {
+      return `${boundary}${prefix}${SESSION_MEMORY_CREDENTIAL_REDACTION}`;
+    })
+    .replace(BEARER_PATTERN, `Bearer ${SESSION_MEMORY_CREDENTIAL_REDACTION}`)
+    .replace(BASIC_PATTERN, `Basic ${SESSION_MEMORY_CREDENTIAL_REDACTION}`)
+    .replace(AWS_ACCESS_KEY_PATTERN, SESSION_MEMORY_CREDENTIAL_REDACTION)
+    .replace(GITHUB_TOKEN_PATTERN, SESSION_MEMORY_CREDENTIAL_REDACTION)
+    .replace(SLACK_TOKEN_PATTERN, SESSION_MEMORY_CREDENTIAL_REDACTION)
+    .replace(
+      QUOTED_SERIALIZED_CREDENTIAL_PATTERN,
+      (_, boundary: string, prefix: string, quote: string) =>
+        `${boundary}${prefix}${quote}${SESSION_MEMORY_CREDENTIAL_REDACTION}${quote}`,
+    )
+    .replace(
+      SERIALIZED_CREDENTIAL_PATTERN,
+      (_, boundary: string, prefix: string, quote: string, credentialValue: string) => {
+        const trailingPunctuation =
+          quote === "" ? (credentialValue.match(/[.,;!?]+$/u)?.[0] ?? "") : "";
+        return `${boundary}${prefix}${quote}${SESSION_MEMORY_CREDENTIAL_REDACTION}${quote}${trailingPunctuation}`;
+      },
+    )
+    .replace(
+      URL_CREDENTIAL_PARAMETER_PATTERN,
+      (_, prefix: string) => `${prefix}${SESSION_MEMORY_CREDENTIAL_REDACTION}`,
+    )
+    .replace(URL_USERINFO_PATTERN, (_, protocol: string) => protocol);
+  if (redacted === "") redacted = value;
+  return { value: redacted, redacted: redacted !== value };
+}
+
+export function redactSessionMemoryCredentials<T>(value: T): SessionMemoryCredentialRedaction<T> {
+  const result = redactCredentialValue(value, null, new WeakSet<object>());
+  return result as SessionMemoryCredentialRedaction<T>;
+}
+
+export function mergeSessionMemorySensitivity(
+  detections: SessionMemorySensitivityDetection[],
+): SessionMemorySensitivityDetection {
+  const reasons = new Set<SessionMemorySensitivityReason>();
+  for (const detection of detections) {
+    for (const reason of detection.reasons) reasons.add(reason);
+  }
+  return createDetection(reasons);
+}
+
+/**
+ * Resolves both newly classified segments and legacy segments whose `secretsDetected` flag used
+ * the older keyword-only matcher. Legacy raw events are reclassified without changing their
+ * stored evidence so ordinary URLs or words such as "internal" do not remain credential blocks.
+ */
+export function classifySessionEvidenceSegment(
+  segment: SessionEvidenceSegmentV1,
+): SessionMemorySensitivityDetection {
+  if (segment.privacy.sensitivity !== undefined) {
+    return {
+      classification: segment.privacy.sensitivity,
+      reasons: [...(segment.privacy.sensitivityReasons ?? [])],
+    };
+  }
+
+  const detections: SessionMemorySensitivityDetection[] = [];
+  let reclassifiedStoredPayload = false;
+  for (const line of segment.rawExcerpt.content.split("\n")) {
+    if (line.trim() === "") continue;
+    try {
+      const event = JSON.parse(line) as Partial<SessionMemoryRawEventV1>;
+      if (event.sensitivity !== undefined) {
+        detections.push({
+          classification: event.sensitivity,
+          reasons: [...(event.sensitivityReasons ?? [])],
+        });
+        continue;
+      }
+      if (typeof event.rawPayloadJson === "string") {
+        detections.push(detectSerializedPayload(event.rawPayloadJson));
+        reclassifiedStoredPayload = true;
+        continue;
+      }
+    } catch {
+      // A bounded raw line may be truncated. The fallback still recognizes credential shapes.
+    }
+    detections.push(detectSessionMemorySensitivity(line));
+  }
+
+  const merged = mergeSessionMemorySensitivity(detections);
+  if (merged.classification !== "safe-metadata") return merged;
+  return segment.privacy.secretsDetected && !reclassifiedStoredPayload
+    ? { classification: "credential", reasons: ["legacy-sensitive-flag"] }
+    : merged;
+}
+
+function detectSerializedPayload(value: string): SessionMemorySensitivityDetection {
+  try {
+    return detectSessionMemorySensitivity(JSON.parse(value) as unknown);
+  } catch {
+    return detectSessionMemorySensitivity(value);
+  }
+}
+
+function inspectValue(
+  value: unknown,
+  key: string | null,
+  reasons: Set<SessionMemorySensitivityReason>,
+  seen: WeakSet<object>,
+): void {
+  if (typeof value === "string") {
+    inspectText(value, key, reasons);
+    return;
+  }
+  if (value === null || typeof value !== "object") return;
+  if (seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    for (const item of value) inspectValue(item, key, reasons, seen);
+    return;
+  }
+  for (const [childKey, child] of Object.entries(value as Record<string, unknown>)) {
+    inspectValue(child, childKey, reasons, seen);
+  }
+}
+
+function inspectText(
+  value: string,
+  key: string | null,
+  reasons: Set<SessionMemorySensitivityReason>,
+): void {
+  const trimmed = value.trim();
+  if (trimmed === "") return;
+  if (
+    key !== null &&
+    CREDENTIAL_FIELD_KEYS.has(normalizeKey(key)) &&
+    trimmed !== SESSION_MEMORY_CREDENTIAL_REDACTION
+  ) {
+    reasons.add("credential-field");
+  }
+  if (CREDENTIAL_SHAPE_PATTERNS.some((pattern) => pattern.test(value))) {
+    reasons.add("credential-shape");
+  }
+  if (PRIVATE_MARKER_PATTERN.test(value)) reasons.add("private-marker");
+
+  for (const match of value.matchAll(URL_PATTERN)) {
+    const rawUrl = match[0];
+    if (rawUrl === undefined) continue;
+    reasons.add("url");
+    try {
+      const url = new URL(rawUrl.replace(/[),.;]+$/u, ""));
+      if (
+        (url.username !== "" || url.password !== "") &&
+        decodeURIComponent(url.username) !== SESSION_MEMORY_CREDENTIAL_REDACTION
+      ) {
+        reasons.add("credential-url-userinfo");
+      }
+      const parameterSets = [
+        url.searchParams,
+        new URLSearchParams(url.hash.startsWith("#") ? url.hash.slice(1) : url.hash),
+      ];
+      for (const parameters of parameterSets) {
+        for (const [parameter, parameterValue] of parameters) {
+          if (
+            parameterValue.trim() !== "" &&
+            parameterValue !== SESSION_MEMORY_CREDENTIAL_REDACTION &&
+            CREDENTIAL_FIELD_KEYS.has(normalizeKey(parameter))
+          ) {
+            reasons.add("credential-url-parameter");
+          }
+        }
+      }
+    } catch {
+      // The URL marker is still private content even when the bounded value is incomplete.
+    }
+  }
+}
+
+function createDetection(
+  reasons: Set<SessionMemorySensitivityReason>,
+): SessionMemorySensitivityDetection {
+  const values = [...reasons].sort();
+  if (
+    reasons.has("credential-field") ||
+    reasons.has("credential-shape") ||
+    reasons.has("credential-url-parameter") ||
+    reasons.has("credential-url-userinfo") ||
+    reasons.has("legacy-sensitive-flag")
+  ) {
+    return { classification: "credential", reasons: values };
+  }
+  if (reasons.has("url") || reasons.has("private-marker")) {
+    return { classification: "private-content", reasons: values };
+  }
+  return { classification: "safe-metadata", reasons: values };
+}
+
+function normalizeKey(value: string): string {
+  return value.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+
+function redactCredentialValue(
+  value: unknown,
+  key: string | null,
+  seen: WeakSet<object>,
+): SessionMemoryCredentialRedaction<unknown> {
+  if (key !== null && CREDENTIAL_FIELD_KEYS.has(normalizeKey(key))) {
+    if (
+      value === null ||
+      value === undefined ||
+      (typeof value === "string" &&
+        (value.trim() === "" || value.trim() === SESSION_MEMORY_CREDENTIAL_REDACTION))
+    ) {
+      return { value, redacted: false };
+    }
+    return { value: SESSION_MEMORY_CREDENTIAL_REDACTION, redacted: true };
+  }
+  if (typeof value === "string") return redactSessionMemoryCredentialText(value);
+  if (value === null || typeof value !== "object") return { value, redacted: false };
+  if (seen.has(value)) {
+    return { value: "[circular-reference]", redacted: true };
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    let redacted = false;
+    const items = value.map((item) => {
+      const child = redactCredentialValue(item, key, seen);
+      redacted ||= child.redacted;
+      return child.value;
+    });
+    return { value: items, redacted };
+  }
+  let redacted = false;
+  const entries = Object.entries(value as Record<string, unknown>).map(([childKey, childValue]) => {
+    const child = redactCredentialValue(childValue, childKey, seen);
+    redacted ||= child.redacted;
+    return [childKey, child.value];
+  });
+  return { value: Object.fromEntries(entries), redacted };
+}

package/src/evolution/evidence/session-memory/state-machine.ts

@@ -0,0 +1,249 @@
+import { createStableId, optionalString } from "../../../utils/index.ts";
+import { EXPLICIT_MEMORY_PATTERN, FAILURE_PATTERN, VERIFICATION_PATTERN } from "./constants.ts";
+import type {
+  SessionMemoryPolicySnapshot,
+  SessionMemoryRawEventV1,
+  SessionMemorySegmentReason,
+  SessionMemorySignal,
+  SessionMemorySignalStrength,
+  SessionMemoryStateV1,
+  SessionMemoryTarget,
+  UpdateSessionMemoryInput,
+} from "./types.ts";
+
+export function createInitialState(input: {
+  projectKey: string;
+  sessionKey: string;
+  target: SessionMemoryTarget;
+  runId: string | null;
+  roleId: string | null;
+  now: string;
+  policy: SessionMemoryPolicySnapshot;
+  eventId: string;
+  tokenEstimate: number;
+}): SessionMemoryStateV1 {
+  return {
+    schemaVersion: 1,
+    kind: "session-memory-state",
+    projectKey: input.projectKey,
+    sessionKey: input.sessionKey,
+    target: input.target,
+    runId: input.runId,
+    roleId: input.roleId,
+    initialized: true,
+    createdAt: input.now,
+    updatedAt: input.now,
+    counters: {
+      messageTokenEstimate: 0,
+      tokensSinceLastUpdate: 0,
+      toolCallsSinceLastUpdate: 0,
+      userPromptCount: 0,
+      assistantTurnCount: 0,
+      toolCallCount: 0,
+      failureSignalCount: 0,
+      verificationSignalCount: 0,
+    },
+    activeSpan: {
+      spanId: createStableId("span", [input.projectKey, input.sessionKey, input.eventId]),
+      status: "open",
+      openedAt: input.now,
+      closedAt: null,
+      openedByEventId: input.eventId,
+      lastEventId: input.eventId,
+      userPromptCount: 0,
+      toolCallCount: 0,
+      workStarted: false,
+      tokenEstimate: input.tokenEstimate,
+    },
+    pendingSignals: [],
+    lastSegmentId: null,
+    lastMemoryUpdateAt: null,
+    policy: input.policy,
+  };
+}
+
+export function applyEventToState(
+  state: SessionMemoryStateV1,
+  input: {
+    input: UpdateSessionMemoryInput;
+    now: string;
+    tokenEstimate: number;
+    policy: SessionMemoryPolicySnapshot;
+    teamRunId: string | null;
+    teamRoleId: string | null;
+  },
+): void {
+  state.policy = input.policy;
+  state.runId = input.teamRunId ?? state.runId;
+  state.roleId = input.teamRoleId ?? state.roleId;
+  state.target = input.input.target;
+  state.counters.messageTokenEstimate += input.tokenEstimate;
+  state.counters.tokensSinceLastUpdate += input.tokenEstimate;
+  if (input.input.event.type === "UserPromptSubmit") {
+    state.counters.userPromptCount += 1;
+  }
+  if (isToolCallCompletion(input.input.event.type)) {
+    state.counters.toolCallCount += 1;
+    state.counters.toolCallsSinceLastUpdate += 1;
+  }
+  if (isAssistantTurn(input.input.event.type)) {
+    state.counters.assistantTurnCount += 1;
+  }
+  if (isFailureSignal(input.input.event.type, input.input.event.payload.summary)) {
+    state.counters.failureSignalCount += 1;
+  }
+  if (isVerificationSignal(input.input.event.payload.summary)) {
+    state.counters.verificationSignalCount += 1;
+  }
+
+  if (state.activeSpan !== null) {
+    state.activeSpan.lastEventId = input.input.event.eventId;
+    state.activeSpan.tokenEstimate += input.tokenEstimate;
+    if (input.input.event.type === "UserPromptSubmit") {
+      state.activeSpan.userPromptCount += 1;
+    }
+    if (isWorkStartedEvent(input.input.event.type)) {
+      state.activeSpan.workStarted = true;
+    }
+    if (isToolCallCompletion(input.input.event.type)) {
+      state.activeSpan.toolCallCount += 1;
+    }
+    if (isSpanCloseEvent(input.input.event.type)) {
+      state.activeSpan.status = "closed";
+      state.activeSpan.closedAt = input.now;
+    }
+  }
+}
+
+export function decideSegment(input: {
+  previous: SessionMemoryStateV1;
+  next: SessionMemoryStateV1;
+  input: UpdateSessionMemoryInput;
+  rawEvent: SessionMemoryRawEventV1;
+  currentSignal: SessionMemorySignal;
+  tokenEstimate: number;
+}): { reason: SessionMemorySegmentReason; strength: SessionMemorySignalStrength } | null {
+  const eventType = input.input.event.type;
+  const promptText = extractPromptText(input.input.rawPayload);
+  if (eventType === "UserPromptSubmit") {
+    if (input.previous.counters.userPromptCount === 0) return null;
+    if (EXPLICIT_MEMORY_PATTERN.test(promptText)) {
+      return { reason: "explicit-memory-intent", strength: "strong" };
+    }
+    if (input.previous.activeSpan?.workStarted === true) {
+      reopenInterruptedSpan(
+        input.next,
+        input.input.event.eventId,
+        input.input.receivedAt ?? input.rawEvent.receivedAt,
+      );
+      return { reason: "user-interruption", strength: "strong" };
+    }
+    return { reason: "intent-refinement", strength: "strong" };
+  }
+
+  if (eventType === "PermissionDenied") return { reason: "permission-denied", strength: "strong" };
+  if (isFailureSignal(eventType, input.input.event.payload.summary)) {
+    return { reason: "failure-signal", strength: "strong" };
+  }
+  if (
+    input.previous.counters.failureSignalCount > 0 &&
+    isVerificationSignal(input.input.event.payload.summary)
+  ) {
+    return { reason: "verification-after-fix", strength: "strong" };
+  }
+
+  if (
+    input.next.lastMemoryUpdateAt === null &&
+    input.next.counters.messageTokenEstimate >= input.next.policy.minimumMessageTokensToInit
+  ) {
+    return { reason: "session-memory-threshold", strength: "normal" };
+  }
+  if (
+    input.next.lastMemoryUpdateAt !== null &&
+    (input.next.counters.tokensSinceLastUpdate >= input.next.policy.minimumTokensBetweenUpdate ||
+      input.next.counters.toolCallsSinceLastUpdate >= input.next.policy.toolCallsBetweenUpdates)
+  ) {
+    return { reason: "session-memory-threshold", strength: "normal" };
+  }
+  return null;
+}
+
+export function cloneState(state: SessionMemoryStateV1): SessionMemoryStateV1 {
+  return JSON.parse(JSON.stringify(state)) as SessionMemoryStateV1;
+}
+
+export function appendBoundedSignal(
+  signals: SessionMemorySignal[],
+  signal: SessionMemorySignal,
+): SessionMemorySignal[] {
+  return [...signals, signal].slice(-50);
+}
+
+function reopenInterruptedSpan(state: SessionMemoryStateV1, eventId: string, now: string): void {
+  if (state.activeSpan !== null) {
+    state.activeSpan.status = "interrupted";
+    state.activeSpan.closedAt = now;
+  }
+  state.activeSpan = {
+    spanId: createStableId("span", [state.projectKey, state.sessionKey, eventId, now]),
+    status: "open",
+    openedAt: now,
+    closedAt: null,
+    openedByEventId: eventId,
+    lastEventId: eventId,
+    userPromptCount: 1,
+    toolCallCount: 0,
+    workStarted: false,
+    tokenEstimate: 0,
+  };
+}
+
+function isWorkStartedEvent(eventType: string): boolean {
+  return [
+    "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "PostToolUseFailure",
+    "PostToolBatch",
+    "TaskCreated",
+    "SubagentStart",
+  ].includes(eventType);
+}
+
+function isToolCallCompletion(eventType: string): boolean {
+  return eventType === "PostToolUse" || eventType === "PostToolUseFailure";
+}
+
+function isAssistantTurn(eventType: string): boolean {
+  return ["PostToolUse", "PostToolUseFailure", "PostToolBatch", "Stop", "StopFailure"].includes(
+    eventType,
+  );
+}
+
+function isSpanCloseEvent(eventType: string): boolean {
+  return ["TaskCompleted", "Stop", "SessionEnd", "SubagentStop"].includes(eventType);
+}
+
+function isFailureSignal(eventType: string, summary: string): boolean {
+  return (
+    eventType === "PostToolUseFailure" ||
+    eventType === "StopFailure" ||
+    FAILURE_PATTERN.test(summary)
+  );
+}
+
+function isVerificationSignal(summary: string): boolean {
+  return VERIFICATION_PATTERN.test(summary);
+}
+
+function extractPromptText(payload: Record<string, unknown>): string {
+  return (
+    optionalString(payload.prompt) ??
+    optionalString(payload.user_prompt) ??
+    optionalString(payload.userPrompt) ??
+    optionalString(payload.query) ??
+    optionalString(payload.message) ??
+    optionalString(payload.text) ??
+    ""
+  );
+}