@inerrata-corporation/errata 2.0.14-dev.3162 → 2.0.14-dev.3228

package/consolidate-worker.mjs

@@ -15735,6 +15735,13 @@ var init_triage_canon = __esm({
   }
 });
 
+// ../../packages/shared/src/project-wire-attrs.ts
+var init_project_wire_attrs = __esm({
+  "../../packages/shared/src/project-wire-attrs.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/src/index.ts
 var init_src = __esm({
   "../../packages/shared/src/index.ts"() {
@@ -15764,6 +15771,7 @@ var init_src = __esm({
     init_taxonomy();
     init_triage_canon();
     init_history_text();
+    init_project_wire_attrs();
   }
 });
 
@@ -16144,9 +16152,10 @@ init_src();
 
 // ../../packages/local-graph/src/history-cache-floor.ts
 function installHistoryCacheFloor(db) {
-  const key = "history-cache-withdrawal-floor-2";
+  const key = "history-cache-withdrawal-floor-3";
   if (db.prepare("SELECT value FROM store_meta WHERE key = ?").get(key)) return;
   db.transaction(() => {
+    db.exec("DROP TRIGGER IF EXISTS history_cache_nodes_insert; DROP TRIGGER IF EXISTS history_cache_nodes_update;");
     if (db.prepare("SELECT value FROM store_meta WHERE key = ?").get("history-cache-withdrawal-floor-1")) {
       db.exec("DROP INDEX IF EXISTS nodes_cloud_id");
     }
@@ -16164,9 +16173,10 @@ function installHistoryCacheFloor(db) {
     `);
     const lookup = (field) => `(SELECT ${field} FROM history_cache_withdrawals w WHERE w.id = nodes.id)`;
     const privacy = `coalesce(${lookup("privacy")}, 0)`;
-    const description = `CASE WHEN ${privacy} THEN 'History source withdrawn.' ELSE description END`;
+    const source = `coalesce(json_extract(attrs_json, '$.extractionSource'), extraction_source)`;
+    const description = `CASE WHEN ${privacy} THEN CASE WHEN ${source} = 'history-mined' THEN 'History source withdrawn.' ELSE 'Cloud source withdrawn.' END ELSE description END`;
     const attrs = `CASE WHEN ${privacy} THEN json_object(
-      'source', 'cloud', 'cloudNodeId', ${lookup("cloud_id")}, 'extractionSource', 'history-mined',
+      'source', 'cloud', 'cloudNodeId', ${lookup("cloud_id")}, 'extractionSource', ${source},
       'historyQuality', json_object('sourceSupport', 'quarantined', 'applicability', 'unknown'),
       'historyCorrectionSeq', ${lookup("seq")})
       ELSE json_set(json_remove(attrs_json, '$.embeddingVersion'),
@@ -16179,11 +16189,22 @@ function installHistoryCacheFloor(db) {
         OR EXISTS(SELECT 1 FROM history_cache_withdrawals w WHERE w.id = nodes.id))
       AND (embedding_blob IS NOT NULL OR embedding_json <> '[]' OR is_landmark <> 0
         OR description <> ${description} OR attrs_json <> ${attrs});`;
+    const internal = `key IN ('orgId','teamId','groupId','projectId','aliasTexts','aliasCanonicalIds')
+      OR key GLOB 'mergedFrom*' OR key GLOB '*WitnessKeys' OR key GLOB '*Sessions'
+      OR key GLOB 'authoringSession*' OR key GLOB 'contributor*' OR key GLOB 'witnessKeys*'`;
+    const stripMetadata = (scope) => `UPDATE nodes SET attrs_json=(
+      SELECT json_group_object(key, CASE WHEN type IN ('array','object') THEN json(value)
+        WHEN type IN ('true','false') THEN json(type) ELSE value END)
+      FROM json_each(nodes.attrs_json) WHERE NOT (${internal}))
+      WHERE (${scope}) AND json_extract(attrs_json,'$.source')='cloud'
+        AND EXISTS(SELECT 1 FROM store_meta m WHERE m.key='history-correction:' || coalesce(json_extract(nodes.attrs_json,'$.cloudNodeId'),nodes.id) AND json_valid(m.value))
+        AND EXISTS(SELECT 1 FROM json_each(nodes.attrs_json) WHERE ${internal});`;
     for (const operation of ["INSERT", "UPDATE"]) {
       db.exec(`CREATE TRIGGER IF NOT EXISTS history_cache_nodes_${operation.toLowerCase()}
-        AFTER ${operation} ON nodes BEGIN ${repair("id = NEW.id")} END;`);
+        AFTER ${operation} ON nodes BEGIN ${repair("id = NEW.id")} ${stripMetadata("id = NEW.id")} END;`);
     }
     db.exec(repair("json_extract(attrs_json, '$.source') = 'cloud' OR json_extract(attrs_json, '$.historyQuality.sourceSupport') IN ('quarantined','contradicted')"));
+    db.exec(stripMetadata("1=1"));
     db.prepare("INSERT INTO store_meta(key,value) VALUES (?,?)").run(key, "installed");
   });
 }

package/errata.mjs

@@ -15493,8 +15493,6 @@ function looksLikeSecretValue(raw2, quoted) {
   if (raw2.includes("${") || raw2.includes("{{") || raw2.includes("%(")) return false;
   if (raw2.startsWith("[redacted:")) return false;
   if (quoted) return raw2.length > 0;
-  const lower = raw2.toLowerCase();
-  if (ASSIGNMENT_STOPWORDS.has(lower)) return false;
   if (/^(?:process\.env\.|os\.environ(?:\[|\.)|(?:request|response|config|settings|options)\.)/.test(raw2)) return false;
   if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(/.test(raw2)) return false;
   return raw2.length > 0;
@@ -15559,75 +15557,36 @@ function scrubHistoryValue(value) {
   const clear = (input) => typeof input === "string" ? input.replace(literals, REDACTED_CREDENTIAL) : Array.isArray(input) ? input.map(clear) : input && typeof input === "object" ? Object.fromEntries(Object.entries(input).map(([k, v]) => [k, clear(v)])) : input;
   return clear(safe);
 }
-var HISTORY_SCRUBBER_VERSION, REDACTED_CREDENTIAL, REDACTED_EMAIL, cred, ASSIGNMENT_STOPWORDS, CREDENTIAL_RULES, EMAIL_RE;
+var HISTORY_SCRUBBER_VERSION, REDACTED_CREDENTIAL, REDACTED_EMAIL, cred, PASSWORD_PROSE_DESCRIPTORS, CREDENTIAL_RULES, EMAIL_RE;
 var init_history_text = __esm({
   "../../packages/shared/src/history-text.ts"() {
     "use strict";
-    HISTORY_SCRUBBER_VERSION = "history-scrub-4";
+    HISTORY_SCRUBBER_VERSION = "history-scrub-5";
     REDACTED_CREDENTIAL = "[redacted:credential]";
     REDACTED_EMAIL = "[redacted:email]";
     cred = () => REDACTED_CREDENTIAL;
-    ASSIGNMENT_STOPWORDS = /* @__PURE__ */ new Set([
-      "string",
-      "boolean",
-      "number",
+    PASSWORD_PROSE_DESCRIPTORS = /* @__PURE__ */ new Set([
       "required",
       "optional",
       "undefined",
       "unknown",
-      "function",
-      "process",
-      "request",
-      "response",
-      "password",
-      "secret",
-      "token",
-      "tokens",
-      "credential",
-      "credentials",
-      "bearer",
-      "basic",
-      "example",
       "redacted",
       "nullable",
-      "readonly",
-      "override",
-      "abstract",
-      "interface",
-      "constant",
-      "variable",
-      "property",
-      "parameter",
-      "argument",
-      "callback",
-      "promise",
-      "settings",
-      "options",
-      "default",
       "disabled",
       "enabled",
-      "internal",
-      "external",
-      "protected",
       "provided",
-      "resolved",
       "rejected",
-      "expected",
-      "received",
       "salt",
       "hash",
       "hashed",
-      "hashing",
-      "authentication",
-      "field",
-      "format"
+      "hashing"
     ]);
     CREDENTIAL_RULES = [
       // Human-written seed/reset notes omit assignment punctuation: password `…`
       // or password (…). Preserve names of fields and hash components.
       {
         re: /\b((?:password|passwd|passphrase|pwd)\s+)(["'`(])([^\s"'`,;)}\]]+)(["'`)])/gi,
-        replace: (m) => !ASSIGNMENT_STOPWORDS.has((m[3] ?? "").toLowerCase()) && looksLikeSecretValue(m[3] ?? "", true) ? `${m[1]}${m[2]}${REDACTED_CREDENTIAL}${m[4]}` : null
+        replace: (m) => !(m[2] === "(" && PASSWORD_PROSE_DESCRIPTORS.has((m[3] ?? "").toLowerCase())) && looksLikeSecretValue(m[3] ?? "", true) ? `${m[1]}${m[2]}${REDACTED_CREDENTIAL}${m[4]}` : null
       },
       // "with SeedValue42! credentials" and "with SeedValue42!/seeded account".
       // Require mixed-case letters plus a digit, or a password-like special char;
@@ -15657,7 +15616,7 @@ var init_history_text = __esm({
         re: /\b((?:password|passwd|passphrase|pwd)\s+(?:is|was|of)\s+)(["'\x60]?)([^\s"'\x60,;)}\]]+)/gi,
         replace: (m) => {
           const value = m[3] ?? "";
-          if (ASSIGNMENT_STOPWORDS.has(value.toLowerCase()) || value.startsWith("[redacted:") || /\$\{|\{\{|process\./.test(value)) return null;
+          if (!m[2] && PASSWORD_PROSE_DESCRIPTORS.has(value.toLowerCase()) || value.startsWith("[redacted:") || /\$\{|\{\{|process\./.test(value)) return null;
           return `${m[1]}${m[2]}${REDACTED_CREDENTIAL}`;
         }
       },
@@ -15693,8 +15652,9 @@ var init_history_text = __esm({
       },
       // Assignments after key-ish names: `password=...`, `API_KEY: "..."`,
       // `"client_secret": "..."`, `AWS_SECRET_ACCESS_KEY=...`, 32+ hex/base64 after
-      // any of them. The value heuristic keeps `token: string` and
-      // `password = process.env.X` intact.
+      // any of them. Recognizable expressions such as `process.env.X` survive.
+      // Bare `password: string` is ambiguous with YAML containing a literal weak
+      // password, so it is redacted. A stopword is never proof of safe code.
       {
         re: /((?:[A-Za-z0-9_.-]*?)(?:password|passwd|passphrase|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|auth[_-]?key|credential)(?:[A-Za-z0-9_-]*))(["']?\s*(?:=>|=|:)\s*)(["'`]?)([^\s"'`,;)}\]]+)/gi,
         replace: (m) => {
@@ -17318,6 +17278,18 @@ var init_triage_canon = __esm({
   }
 });
 
+// ../../packages/shared/src/project-wire-attrs.ts
+function projectWireAttrs(obj) {
+  return Object.fromEntries(Object.entries(obj).filter(
+    ([key]) => !/^(?:orgId|teamId|groupId|projectId|aliasTexts|aliasCanonicalIds|mergedFrom.*|.*WitnessKeys|.*Sessions|authoringSession.*|contributor.*|witnessKeys.*)$/.test(key)
+  ));
+}
+var init_project_wire_attrs = __esm({
+  "../../packages/shared/src/project-wire-attrs.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/src/index.ts
 var src_exports = {};
 __export(src_exports, {
@@ -17477,6 +17449,7 @@ __export(src_exports, {
   problemIdFromError: () => problemIdFromError,
   projectSaltedNodeId: () => projectSaltedNodeId,
   projectSymbolId: () => projectSymbolId,
+  projectWireAttrs: () => projectWireAttrs,
   provenanceBand: () => provenanceBand,
   resolveCanonical: () => resolveCanonical,
   resolveCanonicalId: () => resolveCanonicalId,
@@ -17531,6 +17504,7 @@ var init_src = __esm({
     init_taxonomy();
     init_triage_canon();
     init_history_text();
+    init_project_wire_attrs();
   }
 });
 
@@ -17958,9 +17932,10 @@ var init_src2 = __esm({
 
 // ../../packages/local-graph/src/history-cache-floor.ts
 function installHistoryCacheFloor(db) {
-  const key = "history-cache-withdrawal-floor-2";
+  const key = "history-cache-withdrawal-floor-3";
   if (db.prepare("SELECT value FROM store_meta WHERE key = ?").get(key)) return;
   db.transaction(() => {
+    db.exec("DROP TRIGGER IF EXISTS history_cache_nodes_insert; DROP TRIGGER IF EXISTS history_cache_nodes_update;");
     if (db.prepare("SELECT value FROM store_meta WHERE key = ?").get("history-cache-withdrawal-floor-1")) {
       db.exec("DROP INDEX IF EXISTS nodes_cloud_id");
     }
@@ -17978,9 +17953,10 @@ function installHistoryCacheFloor(db) {
     `);
     const lookup = (field) => `(SELECT ${field} FROM history_cache_withdrawals w WHERE w.id = nodes.id)`;
     const privacy = `coalesce(${lookup("privacy")}, 0)`;
-    const description = `CASE WHEN ${privacy} THEN 'History source withdrawn.' ELSE description END`;
+    const source = `coalesce(json_extract(attrs_json, '$.extractionSource'), extraction_source)`;
+    const description = `CASE WHEN ${privacy} THEN CASE WHEN ${source} = 'history-mined' THEN 'History source withdrawn.' ELSE 'Cloud source withdrawn.' END ELSE description END`;
     const attrs = `CASE WHEN ${privacy} THEN json_object(
-      'source', 'cloud', 'cloudNodeId', ${lookup("cloud_id")}, 'extractionSource', 'history-mined',
+      'source', 'cloud', 'cloudNodeId', ${lookup("cloud_id")}, 'extractionSource', ${source},
       'historyQuality', json_object('sourceSupport', 'quarantined', 'applicability', 'unknown'),
       'historyCorrectionSeq', ${lookup("seq")})
       ELSE json_set(json_remove(attrs_json, '$.embeddingVersion'),
@@ -17993,11 +17969,22 @@ function installHistoryCacheFloor(db) {
         OR EXISTS(SELECT 1 FROM history_cache_withdrawals w WHERE w.id = nodes.id))
       AND (embedding_blob IS NOT NULL OR embedding_json <> '[]' OR is_landmark <> 0
         OR description <> ${description} OR attrs_json <> ${attrs});`;
+    const internal = `key IN ('orgId','teamId','groupId','projectId','aliasTexts','aliasCanonicalIds')
+      OR key GLOB 'mergedFrom*' OR key GLOB '*WitnessKeys' OR key GLOB '*Sessions'
+      OR key GLOB 'authoringSession*' OR key GLOB 'contributor*' OR key GLOB 'witnessKeys*'`;
+    const stripMetadata = (scope) => `UPDATE nodes SET attrs_json=(
+      SELECT json_group_object(key, CASE WHEN type IN ('array','object') THEN json(value)
+        WHEN type IN ('true','false') THEN json(type) ELSE value END)
+      FROM json_each(nodes.attrs_json) WHERE NOT (${internal}))
+      WHERE (${scope}) AND json_extract(attrs_json,'$.source')='cloud'
+        AND EXISTS(SELECT 1 FROM store_meta m WHERE m.key='history-correction:' || coalesce(json_extract(nodes.attrs_json,'$.cloudNodeId'),nodes.id) AND json_valid(m.value))
+        AND EXISTS(SELECT 1 FROM json_each(nodes.attrs_json) WHERE ${internal});`;
     for (const operation of ["INSERT", "UPDATE"]) {
       db.exec(`CREATE TRIGGER IF NOT EXISTS history_cache_nodes_${operation.toLowerCase()}
-        AFTER ${operation} ON nodes BEGIN ${repair("id = NEW.id")} END;`);
+        AFTER ${operation} ON nodes BEGIN ${repair("id = NEW.id")} ${stripMetadata("id = NEW.id")} END;`);
     }
     db.exec(repair("json_extract(attrs_json, '$.source') = 'cloud' OR json_extract(attrs_json, '$.historyQuality.sourceSupport') IN ('quarantined','contradicted')"));
+    db.exec(stripMetadata("1=1"));
     db.prepare("INSERT INTO store_meta(key,value) VALUES (?,?)").run(key, "installed");
   });
 }
@@ -81266,7 +81253,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.14-dev.3162" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.14-dev.3228" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -85307,6 +85294,7 @@ init_src11();
 init_profile2();
 
 // src/history-corrections.ts
+init_src();
 init_profile2();
 function applyHistoryCorrections(store, page) {
   let changed = 0;
@@ -85321,15 +85309,16 @@ function applyHistoryCorrections(store, page) {
     for (const node2 of copies) {
       if (node2.attrs["source"] !== "cloud" || node2.attrs["cloudNodeId"] && node2.attrs["cloudNodeId"] !== correction.nodeId || Number(node2.attrs["historyCorrectionSeq"] ?? 0) >= correction.seq) continue;
       const quality = { sourceSupport: correction.sourceSupport ?? (privacy ? "quarantined" : "unreviewed"), applicability: "unknown" };
+      const historical = node2.extractionSource === "history-mined" || node2.attrs["extractionSource"] === "history-mined";
       store.mergeNode({
         ...node2,
         lastUpdatedAt: Date.now(),
-        ...privacy ? { description: "History source withdrawn.", embedding: [], isLandmark: false } : {},
+        ...privacy ? { description: historical ? "History source withdrawn." : "Cloud source withdrawn.", embedding: [], isLandmark: false } : {},
         attrs: {
-          ...privacy ? {} : node2.attrs,
+          ...privacy ? {} : projectWireAttrs(node2.attrs),
           source: "cloud",
           cloudNodeId: correction.nodeId,
-          extractionSource: "history-mined",
+          extractionSource: node2.extractionSource,
           historyQuality: quality,
           historyCorrectionSeq: correction.seq
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.14-dev.3162",
+  "version": "2.0.14-dev.3228",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/pass-worker.mjs

@@ -15537,6 +15537,13 @@ var init_triage_canon = __esm({
   }
 });
 
+// ../../packages/shared/src/project-wire-attrs.ts
+var init_project_wire_attrs = __esm({
+  "../../packages/shared/src/project-wire-attrs.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/src/index.ts
 var init_src = __esm({
   "../../packages/shared/src/index.ts"() {
@@ -15566,6 +15573,7 @@ var init_src = __esm({
     init_taxonomy();
     init_triage_canon();
     init_history_text();
+    init_project_wire_attrs();
   }
 });
 
@@ -24561,9 +24569,10 @@ init_src();
 
 // ../../packages/local-graph/src/history-cache-floor.ts
 function installHistoryCacheFloor(db) {
-  const key = "history-cache-withdrawal-floor-2";
+  const key = "history-cache-withdrawal-floor-3";
   if (db.prepare("SELECT value FROM store_meta WHERE key = ?").get(key)) return;
   db.transaction(() => {
+    db.exec("DROP TRIGGER IF EXISTS history_cache_nodes_insert; DROP TRIGGER IF EXISTS history_cache_nodes_update;");
     if (db.prepare("SELECT value FROM store_meta WHERE key = ?").get("history-cache-withdrawal-floor-1")) {
       db.exec("DROP INDEX IF EXISTS nodes_cloud_id");
     }
@@ -24581,9 +24590,10 @@ function installHistoryCacheFloor(db) {
     `);
     const lookup = (field) => `(SELECT ${field} FROM history_cache_withdrawals w WHERE w.id = nodes.id)`;
     const privacy = `coalesce(${lookup("privacy")}, 0)`;
-    const description = `CASE WHEN ${privacy} THEN 'History source withdrawn.' ELSE description END`;
+    const source = `coalesce(json_extract(attrs_json, '$.extractionSource'), extraction_source)`;
+    const description = `CASE WHEN ${privacy} THEN CASE WHEN ${source} = 'history-mined' THEN 'History source withdrawn.' ELSE 'Cloud source withdrawn.' END ELSE description END`;
     const attrs = `CASE WHEN ${privacy} THEN json_object(
-      'source', 'cloud', 'cloudNodeId', ${lookup("cloud_id")}, 'extractionSource', 'history-mined',
+      'source', 'cloud', 'cloudNodeId', ${lookup("cloud_id")}, 'extractionSource', ${source},
       'historyQuality', json_object('sourceSupport', 'quarantined', 'applicability', 'unknown'),
       'historyCorrectionSeq', ${lookup("seq")})
       ELSE json_set(json_remove(attrs_json, '$.embeddingVersion'),
@@ -24596,11 +24606,22 @@ function installHistoryCacheFloor(db) {
         OR EXISTS(SELECT 1 FROM history_cache_withdrawals w WHERE w.id = nodes.id))
       AND (embedding_blob IS NOT NULL OR embedding_json <> '[]' OR is_landmark <> 0
         OR description <> ${description} OR attrs_json <> ${attrs});`;
+    const internal = `key IN ('orgId','teamId','groupId','projectId','aliasTexts','aliasCanonicalIds')
+      OR key GLOB 'mergedFrom*' OR key GLOB '*WitnessKeys' OR key GLOB '*Sessions'
+      OR key GLOB 'authoringSession*' OR key GLOB 'contributor*' OR key GLOB 'witnessKeys*'`;
+    const stripMetadata = (scope) => `UPDATE nodes SET attrs_json=(
+      SELECT json_group_object(key, CASE WHEN type IN ('array','object') THEN json(value)
+        WHEN type IN ('true','false') THEN json(type) ELSE value END)
+      FROM json_each(nodes.attrs_json) WHERE NOT (${internal}))
+      WHERE (${scope}) AND json_extract(attrs_json,'$.source')='cloud'
+        AND EXISTS(SELECT 1 FROM store_meta m WHERE m.key='history-correction:' || coalesce(json_extract(nodes.attrs_json,'$.cloudNodeId'),nodes.id) AND json_valid(m.value))
+        AND EXISTS(SELECT 1 FROM json_each(nodes.attrs_json) WHERE ${internal});`;
     for (const operation of ["INSERT", "UPDATE"]) {
       db.exec(`CREATE TRIGGER IF NOT EXISTS history_cache_nodes_${operation.toLowerCase()}
-        AFTER ${operation} ON nodes BEGIN ${repair("id = NEW.id")} END;`);
+        AFTER ${operation} ON nodes BEGIN ${repair("id = NEW.id")} ${stripMetadata("id = NEW.id")} END;`);
     }
     db.exec(repair("json_extract(attrs_json, '$.source') = 'cloud' OR json_extract(attrs_json, '$.historyQuality.sourceSupport') IN ('quarantined','contradicted')"));
+    db.exec(stripMetadata("1=1"));
     db.prepare("INSERT INTO store_meta(key,value) VALUES (?,?)").run(key, "installed");
   });
 }