@inixiative/foundry-core 0.5.10 → 0.5.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/foundry-core",
-  "version": "0.5.10",
+  "version": "0.5.11",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -33,7 +33,7 @@
     "bun": ">=1.4.4"
   },
   "peerDependencies": {
-    "@inixiative/archive": "^0.32.0"
+    "@inixiative/archive": "^0.33.0"
   },
   "peerDependenciesMeta": {
     "@inixiative/archive": {
@@ -41,6 +41,6 @@
     }
   },
   "devDependencies": {
-    "@inixiative/archive": "^0.32.0"
+    "@inixiative/archive": "^0.33.1"
   }
 }

package/src/adapters/markdown-docs.ts

@@ -293,7 +293,13 @@ export function secretInstructionPath(path: string, trusted: readonly string[] =
     name.startsWith('.') ||
     /^id_[a-z0-9]+/i.test(name) ||
     /\.(pem|key|p12|pfx|keystore|jks)$/i.test(name) ||
-    rest.split(sep).some((part) => CREDENTIAL_DIRECTORIES.has(part))
+    rest.split(sep).some((part) => CREDENTIAL_DIRECTORIES.has(part)) ||
+    // A `.private` path is never read (FEAT-005): a segment named or ending `.private`, or holding `.private.`.
+    path
+      .split(sep)
+      .some(
+        (part) => part === '.private' || part.endsWith('.private') || part.includes('.private.'),
+      )
   );
 }
 

package/src/feedback/correction.ts

@@ -221,7 +221,11 @@ export function extractCorrections(
   return { corrections, secretsScrubbed };
 }
 
-const SECRET_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
+/**
+ * Credentials by their own shape (a provider's token prefix, a key block): specific enough that a
+ * match is a secret. Foundry lifts these from a message even when the person forgot `$$` (FEAT-005).
+ */
+const SHAPED_SECRETS: ReadonlyArray<readonly [RegExp, string]> = [
   [/sk-ant-[A-Za-z0-9_-]{20,}/g, '[REDACTED:anthropic-key]'],
   [/sk-[A-Za-z0-9_-]{20,}/g, '[REDACTED:api-key]'],
   [/gh[pousr]_[A-Za-z0-9]{20,}/g, '[REDACTED:github-token]'],
@@ -245,6 +249,10 @@ const SECRET_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
   ],
   [/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/g, '[REDACTED:slack-webhook]'],
   [/\bASIA[A-Z0-9]{16}/g, '[REDACTED:aws-key]'],
+];
+
+/** Credentials by context (an assignment, a header, a URL): a match may be a secret, so it is scrubbed but never lifted. */
+const CONTEXT_SECRETS: ReadonlyArray<readonly [RegExp, string]> = [
   [/\b(Bearer|Basic|DPoP)\s+[A-Za-z0-9._~+/=-]{16,}/g, '$1 [REDACTED:credential]'],
   [/\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s@/]+@/gi, '$1[REDACTED:password]@'],
   [
@@ -257,6 +265,32 @@ const SECRET_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
   ],
 ];
 
+const SECRET_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
+  ...SHAPED_SECRETS,
+  ...CONTEXT_SECRETS,
+];
+
+/**
+ * The shaped credentials safe to lift from a message the person forgot to mark: each never starts
+ * inside a word (`task-runner-…` holds `sk-…`), and the two loosest shapes (`sk-…` and
+ * `<word>_live_<…>`, which long hyphenated or snake_case names also fit) must carry a digit. Fresh
+ * regex objects, so lifting never shares match state with `scrubSecrets`. Scrubbing a false match is
+ * harmless; lifting one would take words out of the person's message.
+ */
+export const SHAPED_SECRET_PATTERNS: readonly RegExp[] = SHAPED_SECRETS.map(([pattern]) => {
+  const loose =
+    pattern.source.startsWith('sk-[') || pattern.source.includes('(?:live|test|prod|runtime)');
+  const digit = loose ? '(?=[A-Za-z0-9_-]*\\d)' : '';
+  return new RegExp(`(?<![A-Za-z0-9_-])${digit}(?:${pattern.source})`, pattern.flags);
+});
+
+/** How many credentials known only by context (`PASSWORD=…`, `Bearer …`, a URL password) the text holds. */
+export function contextSecretHits(text: string): number {
+  let hits = 0;
+  for (const [pattern] of CONTEXT_SECRETS) hits += [...text.matchAll(pattern)].length;
+  return hits;
+}
+
 /** Replace credential-shaped substrings. Transcripts are exactly where leaked keys live. */
 export function scrubSecrets(text: string): { text: string; hits: number } {
   let hits = 0;

package/src/index.ts

@@ -186,6 +186,7 @@ export {
   type CorrectionDetection,
   type CorrectionEvent,
   type CorrectionSignal,
+  contextSecretHits,
   correctionClassifyMessages,
   correctionId,
   detectCorrection,
@@ -194,6 +195,7 @@ export {
   type FeedbackTag,
   parseCorrectionClassifications,
   proseOf,
+  SHAPED_SECRET_PATTERNS,
   scrubSecrets,
   type TranscriptTurn,
 } from './feedback/correction';
@@ -423,7 +425,6 @@ export {
   type ThreadPlan,
   type ThreadPlanItem,
   type ThreadReference,
-  type ThreadSetup,
   type ThreadSnooze,
   type ThreadSpawn,
   type ThreadStatus,

package/src/thread.ts

@@ -276,12 +276,6 @@ export interface ThreadMeta {
   /** 1 for a child of a main thread. */
   depth?: number;
 
-  /**
-   * Start-up of a thread whose Wardens are held in its own process (docs/THREAD-TREE.md spec C):
-   * turns typed meanwhile wait as `queued` until it is `ready` (or `degraded`).
-   */
-  setup?: ThreadSetup;
-
   /** Project that owns this thread. Scopes memory sources and tool calls. */
   projectId?: string;
 
@@ -298,15 +292,6 @@ export interface ThreadMeta {
   archivedAt?: number;
 }
 
-export interface ThreadSetup {
-  status: 'starting' | 'ready' | 'degraded';
-  startedAt: number;
-  readyAt?: number;
-  /** Every configured Warden, those holding a spare, and those that did not by the deadline. */
-  wardens: { expected: number; held: number; failed: string[] };
-  runtime: 'claude-in-session' | 'codex-in-process' | 'side-session';
-}
-
 export interface Dispatch<T = unknown> {
   readonly agentId: string;
   readonly timestamp: number;

package/src/types.ts

@@ -217,8 +217,6 @@ export interface LLMProvider {
    * `threadPrefix` starts at once. `messages` end at those prefixes; no decision is made. Optional.
    */
   prestart?(messages: LLMMessage[], opts: CompletionOpts): void;
-  /** A thread closed: release whatever the provider holds for it. Optional. */
-  releaseThread?(threadId: string): Promise<void>;
 }
 
 export interface EmbeddingProvider {