@gcunharodrigues/wrxn 0.18.0 → 0.18.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gcunharodrigues/wrxn",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "WRXN Kernel — installable AI operating system. Two profiles (project | workspace), pull-based updates, managed/seeded/state file classes.",
   "bin": {
     "wrxn": "bin/wrxn.cjs"

package/payload/.claude/hooks/sidecar.cjs

@@ -15,21 +15,38 @@ const path = require('path');
 // secretScan — replicated here because each self-contained install-only module imports no shared
 // kernel-lib (node stdlib only), exactly as it is duplicated across dream.cjs / sync.cjs. CASE-SENSITIVE:
 // the token shapes are case-specific. A coalesced sidecar must never harden a credential onto disk.
-const SECRET_PATTERNS = [
-  /AKIA[0-9A-Z]{16}/,                    // AWS access key id
-  /gh[pousr]_[A-Za-z0-9]{36}/,           // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_)
-  /npm_[A-Za-z0-9]{36}/,                 // npm automation token
-  /sk-[A-Za-z0-9]{20,}/,                 // OpenAI-style secret key
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // FULL PEM block (BEGIN…END) — MUST precede the header-only line so redaction consumes the body, not just the header
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,  // PEM private-key header (fallback: a lone/truncated header with no END)
-  /Bearer\s+[A-Za-z0-9\-._~+/]{16,}=*/i, // HTTP bearer / Authorization token (case-insensitive scheme)
+// The CANONICAL secret-shape set (#39) — kept BYTE-IDENTICAL across every copy (dream / sync / harvest /
+// memory-synth + this one), drift-pinned by adapter-drift-guard.test.cjs. Each self-contained module
+// replicates the set (the install-only adapters import no shared module — node stdlib only), so the pin is
+// what keeps the copies honest. CASE-SENSITIVE except where a shape carries its own /i flag.
+const SECRET_PATTERNS_CANON = [
+  /AKIA[0-9A-Z]{16}/, // AWS access key id
+  /gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_); {20,} covers the 36-char + CI forms
+  /github_pat_[A-Za-z0-9_]{22,}/, // GitHub fine-grained PAT
+  /xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack token
+  /sk-[A-Za-z0-9]{20,}/, // OpenAI-style secret key
+  /sk-proj-[A-Za-z0-9_-]{20,}/, // OpenAI project-scoped key (underscore form sk-… misses)
+  /AIza[0-9A-Za-z._-]{10,}/, // Google / Gemini API key
+  /sk_(?:live|test)_[A-Za-z0-9]{20,}/, // Stripe live/test secret key
+  /npm_[A-Za-z0-9]{20,}/, // npm publish / automation token
+  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/, // JWT (incl. Bearer payloads); the eyJ… header gates it
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // PEM block (FULL — must precede the header fallback so redaction eats the body)
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM header (fallback: a lone/truncated header with no END)
+  /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/, // opaque Bearer token (non-JWT)
+  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/i, // KEY/TOKEN/SECRET/PASSWORD = value
+];
+// sidecar-LOCAL extras (#38) the canonical set does not subsume — broader / hooks-layer-specific, so they
+// are NOT part of the drift-pinned core. Kept so sidecar never weakens (no pre-existing match is lost).
+const SIDECAR_EXTRA = [
+  /Bearer\s+[A-Za-z0-9\-._~+/]{16,}=*/i, // case-insensitive bearer scheme, 16-char floor (broader than the canonical Bearer)
   // password=/pwd= assignment (=, :, quoted JSON/YAML). The keyword is EITHER fully quoted ("password":)
   // OR bare (password=) — never a lone trailing quote, so a path ending in "passwd" used as a JSON key
   // (e.g. "../../etc/passwd": …) is NOT misread as an assignment (it would falsely refuse a sidecar write).
   /(?:["'](?:password|passwd|pwd)["']|(?:password|passwd|pwd))\s*[:=]\s*["']?[^\s"',;)&}{]+/i,
   /[a-z][a-z0-9+.\-]+:\/\/[^\s:/@]+:[^\s/@]+@\S+/i, // URI connection string with inline creds (scheme://user:pass@host)
-  /eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/, // JWT: base64url header(eyJ…).payload.signature
+  /eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/, // JWT (eyJ header; shorter min than the canonical JWT)
 ];
+const SECRET_PATTERNS = [...SECRET_PATTERNS_CANON, ...SIDECAR_EXTRA];
 
 function secretScan(text) {
   const s = String(text || ''); // NOT lowercased — the token shapes are case-sensitive.

package/payload/.wrxn/dream.cjs

@@ -421,11 +421,20 @@ function negativeFilter(text) {
 // token shapes are case-specific). Evidence quotes are audit-only (never written to a page) so they
 // stay out of scope here, like the negative filters.
 const SECRET_PATTERNS = [
-  /AKIA[0-9A-Z]{16}/,                    // AWS access key id
-  /gh[pousr]_[A-Za-z0-9]{36}/,           // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_)
-  /npm_[A-Za-z0-9]{36}/,                 // npm automation token
-  /sk-[A-Za-z0-9]{20,}/,                 // OpenAI-style secret key
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,  // PEM private-key header
+  /AKIA[0-9A-Z]{16}/, // AWS access key id
+  /gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_); {20,} covers the 36-char + CI forms
+  /github_pat_[A-Za-z0-9_]{22,}/, // GitHub fine-grained PAT
+  /xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack token
+  /sk-[A-Za-z0-9]{20,}/, // OpenAI-style secret key
+  /sk-proj-[A-Za-z0-9_-]{20,}/, // OpenAI project-scoped key (underscore form sk-… misses)
+  /AIza[0-9A-Za-z._-]{10,}/, // Google / Gemini API key
+  /sk_(?:live|test)_[A-Za-z0-9]{20,}/, // Stripe live/test secret key
+  /npm_[A-Za-z0-9]{20,}/, // npm publish / automation token
+  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/, // JWT (incl. Bearer payloads); the eyJ… header gates it
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // PEM block (FULL — must precede the header fallback so redaction eats the body)
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM header (fallback: a lone/truncated header with no END)
+  /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/, // opaque Bearer token (non-JWT)
+  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/i, // KEY/TOKEN/SECRET/PASSWORD = value
 ];
 
 function secretScan(text) {

package/payload/.wrxn/harvest.cjs

@@ -653,11 +653,20 @@ function isKebab(s) {
 // A merged survivor must never harden a session secret into recalled prose. Same patterns + case-sensitive
 // scope as dream/sync — replicated because each install-only adapter is self-contained (node stdlib only).
 const SECRET_PATTERNS = [
-  /AKIA[0-9A-Z]{16}/,                    // AWS access key id
-  /gh[pousr]_[A-Za-z0-9]{36}/,           // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_)
-  /npm_[A-Za-z0-9]{36}/,                 // npm automation token
-  /sk-[A-Za-z0-9]{20,}/,                 // OpenAI-style secret key
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,  // PEM private-key header
+  /AKIA[0-9A-Z]{16}/, // AWS access key id
+  /gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_); {20,} covers the 36-char + CI forms
+  /github_pat_[A-Za-z0-9_]{22,}/, // GitHub fine-grained PAT
+  /xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack token
+  /sk-[A-Za-z0-9]{20,}/, // OpenAI-style secret key
+  /sk-proj-[A-Za-z0-9_-]{20,}/, // OpenAI project-scoped key (underscore form sk-… misses)
+  /AIza[0-9A-Za-z._-]{10,}/, // Google / Gemini API key
+  /sk_(?:live|test)_[A-Za-z0-9]{20,}/, // Stripe live/test secret key
+  /npm_[A-Za-z0-9]{20,}/, // npm publish / automation token
+  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/, // JWT (incl. Bearer payloads); the eyJ… header gates it
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // PEM block (FULL — must precede the header fallback so redaction eats the body)
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM header (fallback: a lone/truncated header with no END)
+  /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/, // opaque Bearer token (non-JWT)
+  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/i, // KEY/TOKEN/SECRET/PASSWORD = value
 ];
 
 function secretScan(text) {

package/payload/.wrxn/memory-synth.cjs

@@ -187,6 +187,51 @@ const THINK_MAX = 600;
 const TOOL_USE_MAX = 300;
 const TOOL_RESULT_MAX = 200;
 
+// Hook-injected framework-context sentinels. SessionStart emits <wrxn-orientation> (which embeds the
+// ENTIRE prior baton as the resume surface); UserPromptSubmit emits <synapse-rules>/<recall-surface>/
+// <reference-candidate> each turn; <system-reminder> wraps harness notes. All land verbatim in the
+// transcript. Left in, they out-mass a light session's real turns → the synth re-emits the embedded
+// prior baton (fresh `wrote`, frozen content) — the content-channel rot of #62. Strip them BEFORE
+// chunking. The blob builder is the ONE shared surface, so the claude and gemini paths both benefit.
+const INJECTED_SENTINELS = ['wrxn-orientation', 'synapse-rules', 'recall-surface', 'reference-candidate', 'system-reminder'];
+// ReDoS bound (#62): the phase-1 closed-block strip is ~quadratic on a pathological part (many opens, no
+// closes). A real injected block (orientation embeds a ≤400-word baton) is a few KB; this cap sits far
+// above that yet below the multi-second regex range, so the strip stays effectively linear.
+const INJECTED_STRIP_MAX = 65536;
+
+/**
+ * Strip hook-injected framework-context blocks from one transcript text part BEFORE chunking. Two phases:
+ *   1. every well-delimited `<tag>…</tag>` block, anywhere (multi-line via [\s\S]; nested/sequential safe);
+ *   2. a part-LEADING unclosed `<tag>…` (transcript truncated mid-block) → stripped to end-of-part.
+ * The phase-2 strip is ANCHORED to part-leading (`^\s*` — after optional whitespace, incl. the newline a
+ * phase-1 removal leaves) because real framework injections are always part-leading. A sentinel merely
+ * MENTIONED mid-prose is therefore NOT a leading match, so its trailing text survives (Finding A). PURE
+ * and FAIL-OPEN: any fault returns the input unchanged — a filter fault must NEVER break the blob. Node
+ * stdlib only. Mirrors the redactSecrets scrub discipline. (#62)
+ * @param {string} text
+ * @returns {string}
+ */
+function stripInjectedContext(text) {
+  try {
+    let out = String(text || '');
+    // ReDoS guard (Finding B): skip a part far larger than any real injected block — it is ordinary content
+    // (a pasted file/log) with nothing part-leading to strip, so returning it as-is can never hang.
+    if (out.length > INJECTED_STRIP_MAX) return out;
+    // Phase 1 — remove every well-delimited block anywhere (low risk; sequential + nested blocks collapse).
+    for (const tag of INJECTED_SENTINELS) {
+      out = out.replace(new RegExp(`<${tag}>[\\s\\S]*?</${tag}>`, 'g'), '');
+    }
+    // Phase 2 — remove a part-LEADING unclosed remainder to end-of-part (after phase 1, any leading injected
+    // block left dangling by truncation is part-leading). Anchored so a mid-prose mention keeps its tail.
+    for (const tag of INJECTED_SENTINELS) {
+      out = out.replace(new RegExp(`^\\s*<${tag}>[\\s\\S]*$`), '');
+    }
+    return out;
+  } catch {
+    return String(text || ''); // a filter fault never breaks the blob
+  }
+}
+
 /**
  * Build a bounded plain-text blob from a Claude Code transcript (JSONL string).
  * @param {string} jsonlText the raw transcript file contents
@@ -208,12 +253,12 @@ function buildTranscriptBlob(jsonlText) {
     const c = m.content;
     const parts = [];
     if (typeof c === 'string') {
-      parts.push(c);
+      parts.push(stripInjectedContext(c)); // a SessionStart-injected orientation often arrives as string content
     } else if (Array.isArray(c)) {
       for (const p of c) {
         if (!p || typeof p !== 'object') continue;
         if (p.type === 'text') {
-          parts.push(p.text || '');
+          parts.push(stripInjectedContext(p.text || '')); // UserPromptSubmit sentinels prepend the user's text part
         } else if (p.type === 'thinking') {
           parts.push('[thinking] ' + String(p.thinking || '').slice(0, THINK_MAX));
         } else if (p.type === 'tool_use') {
@@ -627,22 +672,31 @@ function stripPreamble(text) {
 // becomes the durable baton. Pattern-based (high-signal vendor token shapes, JWTs incl. Bearer
 // payloads, and `KEY/TOKEN/SECRET/PASSWORD=value` assignments); each match → `[REDACTED]`. Conservative
 // by design: it never rewrites ordinary prose, only well-known credential shapes.
-const REDACTIONS = [
-  /\bAKIA[0-9A-Z]{16}\b/g, // AWS access key id
-  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, // GitHub PAT / OAuth / refresh / server tokens
-  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, // Slack tokens
-  /\bsk-[A-Za-z0-9]{20,}\b/g, // OpenAI-style secret keys
-  /\bAIza[0-9A-Za-z._-]{10,}\b/g, // Google / Gemini API keys
-  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/g, // JWTs (incl. Bearer payloads): the discriminating `eyJ…` header gates it
-  /\bnpm_[A-Za-z0-9]{20,}\b/g, // npm publish / automation tokens (≥20 covers the 36-char granular form + variable-length CI tokens)
-  /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, // GitHub fine-grained PATs
-  /\bsk_(?:live|test)_[A-Za-z0-9]{20,}\b/g, // Stripe live/test secret keys
-  /\bsk-proj-[A-Za-z0-9_-]{20,}\b/g, // OpenAI project-scoped keys (underscore form not caught by sk-…)
-  /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z ]+ )?PRIVATE KEY-----/g, // PEM private-key blocks
-  /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/g, // opaque Bearer tokens (non-JWT)
-  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/gi, // KEY/TOKEN/SECRET = value
+// The ONE canonical secret-shape set — drift-pinned byte-identical to the dream / sync / harvest copies
+// by adapter-drift-guard.test.cjs. Non-global base: redaction derives a g-flagged clone below. (Dropping
+// the older inline \b boundaries is deliberate and fail-safe — a redactor erring broader never under-scrubs.)
+const SECRET_PATTERNS = [
+  /AKIA[0-9A-Z]{16}/, // AWS access key id
+  /gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_); {20,} covers the 36-char + CI forms
+  /github_pat_[A-Za-z0-9_]{22,}/, // GitHub fine-grained PAT
+  /xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack token
+  /sk-[A-Za-z0-9]{20,}/, // OpenAI-style secret key
+  /sk-proj-[A-Za-z0-9_-]{20,}/, // OpenAI project-scoped key (underscore form sk-… misses)
+  /AIza[0-9A-Za-z._-]{10,}/, // Google / Gemini API key
+  /sk_(?:live|test)_[A-Za-z0-9]{20,}/, // Stripe live/test secret key
+  /npm_[A-Za-z0-9]{20,}/, // npm publish / automation token
+  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/, // JWT (incl. Bearer payloads); the eyJ… header gates it
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // PEM block (FULL — must precede the header fallback so redaction eats the body)
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM header (fallback: a lone/truncated header with no END)
+  /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/, // opaque Bearer token (non-JWT)
+  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/i, // KEY/TOKEN/SECRET/PASSWORD = value
 ];
 
+// Redaction form: every shape made global so EVERY occurrence on a line is scrubbed (not just the first).
+// Each clone PRESERVES its own flags (e.g. the /i assignment shape) and only ADDS g — so detection and
+// redaction never diverge. String#replace resets a global regex's lastIndex per call → reuse is safe.
+const REDACTIONS = SECRET_PATTERNS.map((re) => new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g'));
+
 /**
  * Redact common secret shapes from `text`, replacing each match with `[REDACTED]`. PURE. Ordinary prose
  * is preserved verbatim — only credential-looking substrings are scrubbed.
@@ -969,7 +1023,7 @@ async function run(args, { invoke = defaultInvoke, out = process.stdout, err = p
     return 2;
   }
   const root = rootArg || findInstallRoot(path.dirname(path.resolve(file))) || process.cwd();
-  const blob = readTranscriptBlob(file);
+  const blob = redactSecrets(readTranscriptBlob(file)); // scrub BEFORE the blob egresses to the external model — parity with runHandoff:729 / runDream:866 (#63).
   const config = loadConfig(root);
   const apiKey = loadEnv(root).GEMINI_API_KEY;
   const text = await synthesize({ task, prompt, blob, config, apiKey, invoke });

package/payload/.wrxn/sync.cjs

@@ -264,11 +264,20 @@ async function driftFromDoor(root, { transport, timeoutMs } = {}) {
 // no shared kernel-lib import), exactly as findInstallRoot/flag/fail are duplicated across these files.
 // CASE-SENSITIVE: the token shapes are case-specific.
 const SECRET_PATTERNS = [
-  /AKIA[0-9A-Z]{16}/,                    // AWS access key id
-  /gh[pousr]_[A-Za-z0-9]{36}/,           // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_)
-  /npm_[A-Za-z0-9]{36}/,                 // npm automation token
-  /sk-[A-Za-z0-9]{20,}/,                 // OpenAI-style secret key
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,  // PEM private-key header
+  /AKIA[0-9A-Z]{16}/, // AWS access key id
+  /gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_); {20,} covers the 36-char + CI forms
+  /github_pat_[A-Za-z0-9_]{22,}/, // GitHub fine-grained PAT
+  /xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack token
+  /sk-[A-Za-z0-9]{20,}/, // OpenAI-style secret key
+  /sk-proj-[A-Za-z0-9_-]{20,}/, // OpenAI project-scoped key (underscore form sk-… misses)
+  /AIza[0-9A-Za-z._-]{10,}/, // Google / Gemini API key
+  /sk_(?:live|test)_[A-Za-z0-9]{20,}/, // Stripe live/test secret key
+  /npm_[A-Za-z0-9]{20,}/, // npm publish / automation token
+  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/, // JWT (incl. Bearer payloads); the eyJ… header gates it
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // PEM block (FULL — must precede the header fallback so redaction eats the body)
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM header (fallback: a lone/truncated header with no END)
+  /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/, // opaque Bearer token (non-JWT)
+  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/i, // KEY/TOKEN/SECRET/PASSWORD = value
 ];
 
 function secretScan(text) {