@intentic/claude-plugin 1.331.0 → 1.333.0

package/dist/stats.mjs

@@ -13,8 +13,6 @@ var OPENING_SEARCHES = { name: "openingSearches", of: (turn) => turn.openingSear
 var ROOT_LISTINGS = { name: "openingListings", of: (turn) => turn.openingListings, round: round1 };
 var CALLS_BEFORE_TARGET = { name: "callsBeforeTarget", of: (turn) => turn.callsBeforeTarget, round: round1 };
 var FAILED_CALLS = { name: "failedCalls", of: (turn) => turn.failedCalls, round: round1 };
-var ROUND_TRIPS = { name: "roundTrips", of: (turn) => turn.roundTrips, round: round1 };
-var CONTEXT_PER_CALL = { name: "contextPerCall", of: (turn) => turn.contextPerCall, round: Math.round };
 var armOfValues = (values) => {
   if (values.length === 0) {
     return { turns: 0, mean: 0, variance: 0 };
@@ -74,10 +72,7 @@ var MECHANISMS = {
   // The map is sent once and judged on the turn it was sent to; `callsBeforeTarget` exists only on turns that edited.
   map: { metrics: [ROOT_LISTINGS, CALLS_BEFORE_TARGET], sampleUnit: "opening turns", sample: openingTurn },
   // The brief rides the whole session, so turn 40 is as much evidence as turn 1.
-  notes: { metrics: [FAILED_CALLS, CALLS_BEFORE_TARGET], sampleUnit: "conversations", sample: meanOfTurns },
-  // Judged on what it is for, the prompt each call carries, and on what it could cost: a model that has lost a result
-  // it needed runs the tool again (more round trips) or guesses (more calls that fail).
-  clearing: { metrics: [CONTEXT_PER_CALL, ROUND_TRIPS, FAILED_CALLS], sampleUnit: "conversations", sample: meanOfTurns }
+  notes: { metrics: [FAILED_CALLS, CALLS_BEFORE_TARGET], sampleUnit: "conversations", sample: meanOfTurns }
 };
 var measureExperiment = (turns, design) => {
   const latest = turns.filter((turn) => design.arm(turn) !== void 0 && design.cohort(turn) !== void 0).toSorted((left, right) => right.at - left.at)[0];
@@ -122,6 +117,17 @@ var measureExperiment = (turns, design) => {
 import { readdirSync, readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 
+// ../../_tools/base/src/errors.ts
+var errorMessage = (error) => error instanceof Error ? error.message : String(error);
+var errnoCode = (error) => {
+  const code = typeof error === `object` && error !== null ? error.code : void 0;
+  return typeof code === `string` ? code : void 0;
+};
+var isMissing = (error) => {
+  const code = errnoCode(error);
+  return code === `ENOENT` || code === `ENOTDIR`;
+};
+
 // ../../_search/iq/src/recall/transcript/lines.ts
 var asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 var asString = (value) => typeof value === "string" ? value : void 0;
@@ -383,10 +389,6 @@ var parse = (raw) => {
     return void 0;
   }
 };
-var isMissing = (error) => {
-  const code = typeof error === "object" && error !== null ? error.code : void 0;
-  return code === "ENOENT" || code === "ENOTDIR";
-};
 var promptOf2 = (line) => {
   const prompt = promptOf(line);
   return prompt?.kind === "typed" || prompt?.kind === "command" ? prompt.text : void 0;
@@ -701,14 +703,6 @@ var parseStatsFile = (text) => text.split("\n").filter((line) => line.trim() !==
 // src/features.ts
 import { mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { join as join2 } from "node:path";
-
-// src/runtime.ts
-var isMissing2 = (error) => {
-  const code = typeof error === "object" && error !== null ? error.code : void 0;
-  return code === "ENOENT" || code === "ENOTDIR";
-};
-
-// src/features.ts
 var OPTIONS = {
   output_cleaners: {
     type: "boolean",
@@ -798,7 +792,7 @@ var loadOptions = (data) => {
   try {
     text = readFileSync2(optionsFile(data), "utf8");
   } catch (error) {
-    if (isMissing2(error)) {
+    if (isMissing(error)) {
       return readOptions({});
     }
     throw error;
@@ -820,6 +814,7 @@ import { join as join6 } from "node:path";
 import { createHash } from "node:crypto";
 import { closeSync, fstatSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, join as join3 } from "node:path";
+import * as util from "node:util";
 var ANSI = /\x1b(?:\[[0-9;?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-Z\\-_])/g;
 var collapseCr = (line) => {
   const frames = line.split("\r");
@@ -1083,27 +1078,90 @@ var SECRET_NAME = String.raw`[A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API[_-
 var ASSIGN = String.raw`["']?\s*[:=](?![=>])\s*`;
 var QUOTED_VALUE = String.raw`(["'\x60])([^"'\x60\n]{6,})\2`;
 var BARE_VALUE = String.raw`[\w+/=~-]{6,}(?![\w+/=~(-])`;
-var ISSUER_PREFIX = /^(?:sk-|pk-|rk-|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|xox[abposr]-|AKIA|ASIA|eyJ|AIza|ya29\.|glpat-|dop_v1_|shpat_|SG\.|npm_)/;
+var CREDENTIAL_ISSUERS = [
+  { prefix: "npm_", body: "[A-Za-z0-9]{30,}" },
+  { prefix: "ghp_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "gho_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "ghu_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "ghs_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "ghr_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "github_pat_", body: "[A-Za-z0-9_]{50,}" },
+  { prefix: "glpat-", body: "[A-Za-z0-9_-]{16,}" },
+  { prefix: "xoxa-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxb-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxo-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxp-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxr-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxs-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "sk-", body: "[A-Za-z0-9_-]{20,}" },
+  { prefix: "pk-", body: "[A-Za-z0-9_-]{20,}" },
+  { prefix: "rk-", body: "[A-Za-z0-9_-]{20,}" },
+  { prefix: "sk_live_", body: "[A-Za-z0-9]{16,}" },
+  { prefix: "rk_live_", body: "[A-Za-z0-9]{16,}" },
+  { prefix: "AKIA", body: String.raw`[0-9A-Z]{16}\b` },
+  { prefix: "ASIA", body: String.raw`[0-9A-Z]{16}\b` },
+  { prefix: "AIza", body: String.raw`[0-9A-Za-z_-]{35}\b` },
+  { prefix: "ya29.", body: "[0-9A-Za-z_-]{20,}" },
+  { prefix: "hf_", body: "[A-Za-z0-9]{30,}" },
+  { prefix: "dop_v1_", body: "[a-f0-9]{60,}" },
+  { prefix: "shpat_", body: "[a-fA-F0-9]{32,}" },
+  // SendGrid: a key id and its secret, dot-separated.
+  { prefix: "SG.", body: String.raw`[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}` },
+  // A JWT: three base64url segments, the first two of which decode from `{"` and so always begin `eyJ` and `ey`.
+  { prefix: "eyJ", body: String.raw`[A-Za-z0-9_-]{9,}\.ey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*` }
+];
+var CREDENTIAL_ISSUER_PREFIXES = CREDENTIAL_ISSUERS.map(({ prefix }) => prefix);
+var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+var ISSUER_PREFIX = new RegExp(`^(?:${CREDENTIAL_ISSUER_PREFIXES.map(escapeRegExp).join("|")})`);
+var ISSUED_TOKENS = CREDENTIAL_ISSUERS.map(({ prefix, body }) => new RegExp(String.raw`(?<![\w-])${escapeRegExp(prefix)}${body}`, "g"));
 var NUMERIC_VALUE = /^[\d_,.]+$/;
 var STRUCTURAL_VALUE = /[\s/\\${}]/;
 var ENV_NAME_VALUE = /^[A-Z0-9_]+$/;
 var ENTROPIC_VALUE = /^(?=[^\n]*\d)(?=[^\n]*[A-Za-z])/;
 var HANDWRITTEN_MAX = 12;
 var looksLikeCredential = (value) => ISSUER_PREFIX.test(value) || value.length > HANDWRITTEN_MAX && ENTROPIC_VALUE.test(value) && !NUMERIC_VALUE.test(value) && !STRUCTURAL_VALUE.test(value) && !ENV_NAME_VALUE.test(value);
+var secretReference = (name) => `{{secret:${name}}}`;
 var SECRET_PATTERNS = [
   [
     new RegExp(`\\b(${SECRET_NAME}${ASSIGN})(?:${QUOTED_VALUE}|(${BARE_VALUE}))`, "gi"),
     // Quoted and bare arrive in different groups because only the quoted one has a quote to put back.
     (match, assignment, quote, quoted, bare) => looksLikeCredential(quoted ?? bare) ? `${assignment}${quote ?? ""}***${quote ?? ""}` : match
   ],
-  [/\bAKIA[0-9A-Z]{16}\b/g, "***"],
+  ...ISSUED_TOKENS.map((token) => [token, "***"]),
   // Same rule for a bearer value: prose about tokens carries no digit, every real bearer token does.
   [/\b(Bearer\s+)(?=[\w.-]*\d)[\w.-]{8,}/gi, "$1***"],
-  [/\b(https?:\/\/[^:@\s/]+:)[^@\s]+@/gi, "$1***@"]
+  // scheme://user:password@host for any scheme (a postgres DSN as much as an https remote). Any length, unlike the
+  // contract's three-character floor: output reaching a model is not a file someone meant to publish. A `/` ends the
+  // password, so `http://host:3000/@scope/pkg` is a port and a path, and a reference already standing in is kept.
+  [/\b([a-z][a-z0-9+.-]*:\/\/[^:@\s/]+:)(?!\{\{secret:)[^@\s/]+@/gi, "$1***@"]
 ];
+var MASKED_NEXT = String.raw`(?!(?:\s|\\[nr])*\*\*\*)`;
+var ARMOR_LINES = String.raw`(?:(?:\s|\\[nr])+(?:[A-Za-z-]+:[^\n\\]*|[A-Za-z0-9+/=]+(?=[ \t]*(?:[\r\n"'\x60<>,;})\]]|\\[nr]|$))))*`;
+var PRIVATE_KEY_BLOCK = new RegExp(
+  String.raw`(-----BEGIN ((?:[A-Z0-9]+ )*)PRIVATE KEY( BLOCK)?-----)${MASKED_NEXT}(?:[\s\S]*?(-----END \2PRIVATE KEY\3-----)|${ARMOR_LINES})`,
+  "g"
+);
+var PUTTY_KEY = new RegExp(String.raw`(PuTTY-User-Key-File-\d:)${MASKED_NEXT}[^\n\\]*${ARMOR_LINES}`, "g");
+var maskKeyBlocks = (text) => (
+  // The cheap test first: almost no output holds a key, and the block patterns scan the whole body.
+  text.includes("PRIVATE KEY") || text.includes("PuTTY-User-Key-File-") ? text.replace(
+    PRIVATE_KEY_BLOCK,
+    (_block, header, _label, _kind, footer) => footer === void 0 ? `${header}
+***` : `${header}
+***
+${footer}`
+  ).replace(PUTTY_KEY, "$1 ***") : text
+);
 var SECRET_VALUE_MIN = 12;
+var SECRET_STORES = [
+  { root: "desiredState", path: ".env", layout: "env", source: "env" },
+  // Pasted on a need's card or the Secrets view (src/secrets/sandbox-secrets.ts).
+  { root: "auth", path: "sandbox-secrets.json", layout: "flat", source: "sandbox" },
+  { root: "desiredState", path: ".secrets.json", layout: "flat", source: "generated" },
+  { root: "auth", path: "capability-secrets.json", layout: "vault", source: "capability" }
+];
 var secretValueCache = /* @__PURE__ */ new Map();
-var readIfChanged = (path, name) => {
+var readIfChanged = (path, layout) => {
   try {
     const descriptor = openSync(path, "r");
     try {
@@ -1113,7 +1171,7 @@ var readIfChanged = (path, name) => {
       if (cached?.stamp === stamp) {
         return cached.values;
       }
-      const values = harvest(readFileSync3(descriptor, "utf8"), path, name);
+      const values = harvest(readFileSync3(descriptor, "utf8"), layout);
       secretValueCache.set(path, { stamp, values });
       return values;
     } finally {
@@ -1138,33 +1196,19 @@ var surfaceForms = (value) => {
   }
   return forms;
 };
-var harvest = (text, path, name) => {
-  const named = [];
-  if (path.endsWith("capability-secrets.json")) {
-    for (const [id, entry] of Object.entries(JSON.parse(text))) {
-      if (entry === null || typeof entry !== "object") {
-        continue;
-      }
-      for (const [field, value] of Object.entries(entry)) {
-        if (typeof value === "string") {
-          named.push([name(id, field), value]);
-        }
-      }
-    }
-  } else if (path.endsWith(".json")) {
-    for (const [key, value] of Object.entries(JSON.parse(text))) {
-      if (typeof value === "string") {
-        named.push([name(key), value]);
-      }
-    }
-  } else {
-    for (const line of text.split("\n")) {
-      const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
-      if (match !== null) {
-        named.push([name(match[1]), (match[2] ?? "").trim().replace(/^(["'])([\s\S]*)\1$/, "$2")]);
-      }
-    }
+var namedValues = (text, layout) => {
+  if (layout === "env") {
+    return Object.entries(util.parseEnv(text));
+  }
+  const parsed = JSON.parse(text);
+  if (layout === "flat") {
+    return Object.entries(parsed).filter(([, value]) => typeof value === "string");
   }
+  return Object.entries(parsed).flatMap(
+    ([id, entry]) => entry === null || typeof entry !== "object" ? [] : Object.entries(entry).flatMap(([field, value]) => typeof value === "string" ? [[`${id}/${field}`, value]] : [])
+  );
+};
+var harvest = (text, layout) => {
   const byTarget = /* @__PURE__ */ new Map();
   const add = (target, replacement) => {
     const trimmed = target.trim();
@@ -1172,9 +1216,9 @@ var harvest = (text, path, name) => {
       byTarget.set(trimmed, { target: trimmed, replacement });
     }
   };
-  for (const [reference, value] of named) {
+  for (const [name, value] of namedValues(text, layout)) {
     for (const form of surfaceForms(value.trim())) {
-      add(form, `{{secret:${reference}}}`);
+      add(form, secretReference(name));
     }
     if (value.includes("\n")) {
       for (const line of value.split("\n")) {
@@ -1185,16 +1229,21 @@ var harvest = (text, path, name) => {
   return [...byTarget.values()].toSorted((a, b) => b.target.length - a.target.length);
 };
 var secretValues = (env = process.env) => {
-  const authRoot = env.AGENT_AUTH_DIR !== void 0 && env.AGENT_AUTH_DIR !== "" ? env.AGENT_AUTH_DIR : join3(env.WORKSPACE_ROOT ?? "/work", ".intentic/secrets/auth");
-  const repo = join3(env.WORKSPACE_ROOT ?? "/work", "desired-state");
-  return [
-    ...readIfChanged(join3(authRoot, "capability-secrets.json"), (id, field) => `${id}/${field}`),
-    ...readIfChanged(join3(repo, ".env"), (key) => key),
-    ...readIfChanged(join3(repo, ".secrets.json"), (key) => key)
-  ].toSorted((a, b) => b.target.length - a.target.length);
+  const roots = {
+    auth: env.AGENT_AUTH_DIR !== void 0 && env.AGENT_AUTH_DIR !== "" ? env.AGENT_AUTH_DIR : join3(env.WORKSPACE_ROOT ?? "/work", ".intentic/secrets/auth"),
+    desiredState: join3(env.WORKSPACE_ROOT ?? "/work", "desired-state")
+  };
+  return SECRET_STORES.flatMap(({ root, path, layout }) => readIfChanged(join3(roots[root], path), layout)).toSorted(
+    (a, b) => b.target.length - a.target.length
+  );
+};
+var redactLines = (lines, values = []) => {
+  const joined = lines.join("\n");
+  const keyed = maskKeyBlocks(joined);
+  return (keyed === joined ? lines : keyed.split("\n")).map((line) => redactLine(line, values));
 };
-var redactText = (text, values = []) => text.split("\n").map((line) => redactLine(line, values)).join("\n");
-var redactLine = (line, values = []) => {
+var redactText = (text, values = []) => redactLines(text.split("\n"), values).join("\n");
+var redactLine = (line, values) => {
   let masked = line;
   for (const { target, replacement } of values) {
     if (masked.includes(target)) {
@@ -1305,7 +1354,7 @@ var cleanLines = (lines, { command, exitCode, enabled, values = [] }) => {
   if (enabled.has("redact")) {
     out = ran(
       "redact",
-      out.map((line) => redactLine(line, values))
+      redactLines(out, values)
     );
   }
   return { lines: out, stages };
@@ -1593,7 +1642,7 @@ var runHook = async (handle) => {
 `);
     }
   } catch (error) {
-    process.stderr.write(`intentic: ${error instanceof Error ? error.message : String(error)}
+    process.stderr.write(`intentic: ${errorMessage(error)}
 `);
   }
 };
@@ -1653,7 +1702,7 @@ var readSessions = (data) => {
   try {
     text = readFileSync4(sessionsFile(data), "utf8");
   } catch (error) {
-    if (isMissing2(error)) {
+    if (isMissing(error)) {
       return [];
     }
     throw error;
@@ -1691,7 +1740,7 @@ var readText = (path) => {
   try {
     return readFileSync5(path, "utf8");
   } catch (error) {
-    if (isMissing2(error)) {
+    if (isMissing(error)) {
       return void 0;
     }
     throw error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/claude-plugin",
-  "version": "1.331.0",
+  "version": "1.333.0",
   "description": "The intentic Claude Code plugin: trimmed Bash output, a project map and field notes at session start, iq search and fileq teaching, and a /intentic:stats report of what each saved",
   "license": "MIT",
   "type": "module",
@@ -40,8 +40,9 @@
   },
   "devDependencies": {
     "@intentic/agent-context": "0.0.0",
-    "@intentic/fileq": "1.331.0",
-    "@intentic/iq": "1.331.0",
+    "@intentic/base": "1.333.0",
+    "@intentic/fileq": "1.333.0",
+    "@intentic/iq": "1.333.0",
     "@intentic/output-cleaners": "0.0.0",
     "@intentic/testing": "0.0.0",
     "@intentic/tsconfig": "0.0.0",
@@ -52,7 +53,7 @@
   },
   "scripts": {
     "build": "tsgo --noEmit && node build.mjs",
-    "typecheck": "tsgo --noEmit -p tsconfig.test.json",
+    "typecheck": "bun check -p tsconfig.test.json",
     "test": "suites",
     "test:watch": "suites --watch",
     "test:mod": "node test-mod.mjs",