@inerrata-corporation/errata 2.0.14-dev.3081 → 2.0.14-dev.3118

package/errata.mjs

@@ -15495,10 +15495,9 @@ function looksLikeSecretValue(raw2, quoted) {
   if (quoted) return raw2.length > 0;
   const lower = raw2.toLowerCase();
   if (ASSIGNMENT_STOPWORDS.has(lower)) return false;
-  if (!/^[A-Za-z0-9+/=_-]{8,}$/.test(raw2)) return false;
-  if (/\d/.test(raw2)) return true;
-  if (raw2.length >= 12) return true;
-  return /[a-z]/.test(raw2) && /[A-Z]/.test(raw2);
+  if (/^(?:process\.env\.|os\.environ(?:\[|\.)|(?:request|response|config|settings|options)\.)/.test(raw2)) return false;
+  if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(/.test(raw2)) return false;
+  return raw2.length > 0;
 }
 function applyRule(text, rule, removed) {
   let count = 0;
@@ -15564,7 +15563,7 @@ var HISTORY_SCRUBBER_VERSION, REDACTED_CREDENTIAL, REDACTED_EMAIL, cred, ASSIGNM
 var init_history_text = __esm({
   "../../packages/shared/src/history-text.ts"() {
     "use strict";
-    HISTORY_SCRUBBER_VERSION = "history-scrub-3";
+    HISTORY_SCRUBBER_VERSION = "history-scrub-4";
     REDACTED_CREDENTIAL = "[redacted:credential]";
     REDACTED_EMAIL = "[redacted:email]";
     cred = () => REDACTED_CREDENTIAL;
@@ -15639,9 +15638,15 @@ var init_history_text = __esm({
       },
       // Userinfo in connection URLs must be removed before the email rule runs.
       {
-        re: /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+):([^\s/@]+)@/gi,
+        re: /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]*):([^\s/@]+)@/gi,
         replace: (m) => m[2] === "[redacted" && m[3] === "credential]" ? null : `${m[1]}${REDACTED_CREDENTIAL}@`
       },
+      // MySQL's short password option attaches the value directly to -p; other
+      // command flags (such as a port) must not be treated as passwords.
+      {
+        re: /\b((?:mysql|mariadb)(?:\s+[^\s]+)*?\s+-p)([^\s"'`,;)}\]]+)/gi,
+        replace: (m) => m[2]?.startsWith("[redacted:") ? null : `${m[1]}${REDACTED_CREDENTIAL}`
+      },
       // Seeded login prose commonly writes email/password without an assignment.
       {
         re: /(\b[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+|\[redacted:email\])(\s*\/\s*)(["'\x60]?)([^\s"'\x60,;)}\]]+)/gi,
@@ -24860,8 +24865,8 @@ var init_src5 = __esm({
 });
 
 // ../../packages/context-writer/src/render.ts
-function isPassiveInjectable(node2) {
-  if (!historyReadPolicy(node2, { mode: "passive" }).allow) return false;
+function isPassiveInjectable(node2, atCommit) {
+  if (!historyReadPolicy(node2, { mode: "passive", atCommit }).allow) return false;
   if (node2.label === "Pattern" || node2.label === "Technique" || node2.label === "AntiPattern") {
     return true;
   }
@@ -24871,7 +24876,7 @@ function isPassiveInjectable(node2) {
   return false;
 }
 function buildSnapshot(opts) {
-  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive" }).allow);
+  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive", atCommit: opts.atCommit }).allow);
   const stillOpen = problems.filter((p) => p.attrs["resolvedAt"] == null);
   const allProblems = stillOpen.filter((p) => !isConstraintProblem(p));
   allProblems.sort((a, b) => b.lastUpdatedAt - a.lastUpdatedAt);
@@ -24901,11 +24906,11 @@ function buildSnapshot(opts) {
     ...opts.store.findNodesByLabel("Pattern"),
     ...opts.store.findNodesByLabel("Technique"),
     ...opts.store.findNodesByLabel("AntiPattern")
-  ].filter((n) => historyReadPolicy(n, { mode: "passive" }).allow).sort((a, b) => b.pageRank - a.pageRank).slice(0, 10);
-  const workingFile = opts.workingFile ? sliceForFile(opts.store, opts.workingFile) : void 0;
+  ].filter((n) => historyReadPolicy(n, { mode: "passive", atCommit: opts.atCommit }).allow).sort((a, b) => b.pageRank - a.pageRank).slice(0, 10);
+  const workingFile = opts.workingFile ? sliceForFile(opts.store, opts.workingFile, opts.atCommit) : void 0;
   const byEpisode = /* @__PURE__ */ new Map();
   for (const sol of opts.store.findNodesByLabel("Solution")) {
-    if (!historyReadPolicy(sol, { mode: "passive" }).allow) continue;
+    if (!historyReadPolicy(sol, { mode: "passive", atCommit: opts.atCommit }).allow) continue;
     if (sol.attrs["enrichmentPending"] !== true) continue;
     const ep = sol.attrs["episodeId"] ?? sol.id;
     const list = byEpisode.get(ep) ?? [];
@@ -24977,7 +24982,7 @@ function buildSnapshot(opts) {
     generatedAt: (opts.now ?? /* @__PURE__ */ new Date()).toISOString()
   };
 }
-function sliceForFile(store, relPath) {
+function sliceForFile(store, relPath, atCommit) {
   const candidates = store.findNodesByLabel("File");
   const file2 = candidates.find((n) => n.description === relPath);
   if (!file2) return void 0;
@@ -25016,7 +25021,7 @@ function sliceForFile(store, relPath) {
   }
   const fp = priorsForFile(store, relPath);
   if (fp) {
-    const allowed = (n) => historyReadPolicy(n, { mode: "passive" }).allow;
+    const allowed = (n) => historyReadPolicy(n, { mode: "passive", atCommit }).allow;
     fp.openProblems = fp.openProblems.filter(allowed);
     fp.constraints = fp.constraints.filter(allowed);
     fp.resolvedProblems = fp.resolvedProblems.filter(allowed);
@@ -25426,6 +25431,7 @@ function budgetSnapshot(s, maxChars) {
 function assembleAgentContext(opts) {
   const snapshot = opts.snapshot ?? buildSnapshot({
     store: opts.store,
+    atCommit: opts.atCommit,
     profile: opts.profile,
     reviewCount: opts.reviewCount,
     reviewUiUrl: opts.reviewUiUrl,
@@ -25441,7 +25447,7 @@ function assembleAgentContext(opts) {
   if (opts.remote && opts.remote.length > 0) {
     const seen = /* @__PURE__ */ new Set();
     const remote = opts.remote.filter((n) => {
-      if (!isPassiveInjectable(n)) return false;
+      if (!isPassiveInjectable(n, opts.atCommit)) return false;
       if (opts.store.getNode(n.id)) return false;
       if (seen.has(n.id)) return false;
       seen.add(n.id);
@@ -25643,7 +25649,7 @@ function selectDurableMemory(store, profile, opts = {}) {
   const minContributors = opts.minContributors ?? 1;
   const wsLangs = new Set(profile.languages.map((l) => l.toLowerCase()));
   return store.findNodesByLabel("Claim").filter(
-    (n) => historyReadPolicy(n, { mode: "passive" }).allow && Number(n.attrs["abstractionLevel"] ?? ABSTRACTION_LEVEL.CONCRETE) === ABSTRACTION_LEVEL.PRINCIPLE && n.attrs["provisional"] === false && contributorsOf(n) >= minContributors && // Lang-relevance: universal principles (no scope.lang) bleed everywhere; a
+    (n) => historyReadPolicy(n, { mode: "passive", atCommit: opts.atCommit }).allow && Number(n.attrs["abstractionLevel"] ?? ABSTRACTION_LEVEL.CONCRETE) === ABSTRACTION_LEVEL.PRINCIPLE && n.attrs["provisional"] === false && contributorsOf(n) >= minContributors && // Lang-relevance: universal principles (no scope.lang) bleed everywhere; a
     // language-scoped principle only bleeds into repos that USE that language —
     // so a Python principle never lands a dead `**/*.py` rule in a TS repo.
     (scopeLangOf(n) == null || wsLangs.has(scopeLangOf(n)))
@@ -80912,7 +80918,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.14-dev.3081" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.14-dev.3118" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -81368,6 +81374,7 @@ function createWorkspaceEngine(opts) {
     const elicit = isEdgeElicitationEnabled();
     const snapOpts = {
       profile,
+      atCommit: readGitRefState(join34(opts.workspaceRoot, ".git")).sha ?? void 0,
       reviewCount: pendingCount(paths),
       reviewUiUrl: opts.reviewUrl(),
       workingFile: workingFiles.mostRecent() ?? void 0,
@@ -81381,6 +81388,10 @@ function createWorkspaceEngine(opts) {
       );
       return null;
     }) : null;
+    if (snapOpts.atCommit !== (readGitRefState(join34(opts.workspaceRoot, ".git")).sha ?? void 0)) {
+      contextDirty = true;
+      return;
+    }
     const doneRender = markPass(`${prebuilt ? "context-render" : "context-render-inline"}:${profile.name}`);
     const pendingUpdate = opts.pendingUpdate?.() ?? null;
     const daemonDistress = opts.daemonDistress?.() ?? null;
@@ -92739,7 +92750,9 @@ async function cmdDash(args2) {
     for (const r of handle2.records) {
       await yieldToLoop2();
       try {
-        const items = selectDurableMemory(handle2.sharedStore, r.engine.profile);
+        const items = selectDurableMemory(handle2.sharedStore, r.engine.profile, {
+          atCommit: readGitRefState(join43(r.root, ".git")).sha ?? void 0
+        });
         const res = bleedRules(join43(r.root, ".claude", "rules"), items);
         if (res.written || res.pruned) {
           console.log(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.14-dev.3081",
+  "version": "2.0.14-dev.3118",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/pass-worker.mjs

@@ -27543,7 +27543,7 @@ var AGENTS_POINTER_BODY = [
 init_src2();
 init_src();
 function buildSnapshot(opts) {
-  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive" }).allow);
+  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive", atCommit: opts.atCommit }).allow);
   const stillOpen = problems.filter((p) => p.attrs["resolvedAt"] == null);
   const allProblems = stillOpen.filter((p) => !isConstraintProblem(p));
   allProblems.sort((a, b) => b.lastUpdatedAt - a.lastUpdatedAt);
@@ -27573,11 +27573,11 @@ function buildSnapshot(opts) {
     ...opts.store.findNodesByLabel("Pattern"),
     ...opts.store.findNodesByLabel("Technique"),
     ...opts.store.findNodesByLabel("AntiPattern")
-  ].filter((n) => historyReadPolicy(n, { mode: "passive" }).allow).sort((a, b) => b.pageRank - a.pageRank).slice(0, 10);
-  const workingFile = opts.workingFile ? sliceForFile(opts.store, opts.workingFile) : void 0;
+  ].filter((n) => historyReadPolicy(n, { mode: "passive", atCommit: opts.atCommit }).allow).sort((a, b) => b.pageRank - a.pageRank).slice(0, 10);
+  const workingFile = opts.workingFile ? sliceForFile(opts.store, opts.workingFile, opts.atCommit) : void 0;
   const byEpisode = /* @__PURE__ */ new Map();
   for (const sol of opts.store.findNodesByLabel("Solution")) {
-    if (!historyReadPolicy(sol, { mode: "passive" }).allow) continue;
+    if (!historyReadPolicy(sol, { mode: "passive", atCommit: opts.atCommit }).allow) continue;
     if (sol.attrs["enrichmentPending"] !== true) continue;
     const ep = sol.attrs["episodeId"] ?? sol.id;
     const list = byEpisode.get(ep) ?? [];
@@ -27649,7 +27649,7 @@ function buildSnapshot(opts) {
     generatedAt: (opts.now ?? /* @__PURE__ */ new Date()).toISOString()
   };
 }
-function sliceForFile(store2, relPath) {
+function sliceForFile(store2, relPath, atCommit) {
   const candidates = store2.findNodesByLabel("File");
   const file2 = candidates.find((n) => n.description === relPath);
   if (!file2) return void 0;
@@ -27688,7 +27688,7 @@ function sliceForFile(store2, relPath) {
   }
   const fp = priorsForFile(store2, relPath);
   if (fp) {
-    const allowed = (n) => historyReadPolicy(n, { mode: "passive" }).allow;
+    const allowed = (n) => historyReadPolicy(n, { mode: "passive", atCommit }).allow;
     fp.openProblems = fp.openProblems.filter(allowed);
     fp.constraints = fp.constraints.filter(allowed);
     fp.resolvedProblems = fp.resolvedProblems.filter(allowed);
@@ -27913,6 +27913,7 @@ function runPass(msg) {
       const p = msg.payload;
       return buildSnapshot({
         store,
+        atCommit: p.atCommit,
         profile: p.profile,
         reviewCount: p.reviewCount,
         reviewUiUrl: p.reviewUiUrl,