@kammcs/buildit-mcp 0.8.0 → 0.10.0

package/dist/channel/loop.js

@@ -49,6 +49,8 @@ import { childDoneContent, handoffResolvedContent, Handoffs, targetName } from '
 import { assignedContent, handedContent, mentionContent, plainLinks, repliedContent, unassignedContent, } from './item-events.js';
 import { ackSessionEvents, getSession, listSessionEvents, listSessionThreads, SESSION_ENDED_CODES, sessionHeartbeat, setSessionCapabilities, } from './api.js';
 import { apiApprovalCloser } from './approvals.js';
+import { attachmentsBlock, forwardedFilesLead } from './attachment-blocks.js';
+import { AttachmentStore, filesServed } from './attachments.js';
 import { ToolRing } from './tool-ring.js';
 import { CardWaiters, eventMessageId } from './waiters.js';
 /** The notification Claude Code reads as a channel event. */
@@ -142,6 +144,8 @@ export class ChannelState {
     ring = new ToolRing();
     /** The session's open tool approvals (channel mode, the folder's channel). */
     approvals;
+    /** The session's attachments folder (channel mode, once the session is read). */
+    attachments;
     /** The handoffs this session proposed or was handed, as seen in this process. */
     handoffs = new Handoffs();
     /**
@@ -206,6 +210,22 @@ function forwardedBlock(text, origin) {
         }),
     ].join('\n');
 }
+/**
+ * The attachments block of the event's own message: the owner's files, or
+ * a forwarded message's (the original author's, said in a line before it).
+ * Call inside the content's withBlockId.
+ */
+function filesBlock(messageId, outcomes, forwarded, owner) {
+    const block = attachmentsBlock(messageId, outcomes, forwarded === undefined
+        ? { author: owner, author_kind: 'user', from_owner: true }
+        : {
+            author: forwarded.author,
+            author_kind: forwarded.app ? 'app' : 'user',
+            from_owner: false,
+            forwarded: true,
+        }, owner);
+    return forwarded === undefined ? block : [forwardedFilesLead(forwarded.author), block].join('\n');
+}
 /** The longest pause after repeated failures. */
 export const MAX_BACKOFF_MS = 60_000;
 /** The pause while the session is suspended or sessions are off. */
@@ -324,6 +344,7 @@ export class ChannelLoop {
                 .catch(() => undefined);
         }
         state.waiters.endAll();
+        state.attachments?.stopCleanup();
         if (this.ended || this.yielded || state.session === undefined)
             return;
         await this.options.state.typing?.stopAll().catch(() => undefined);
@@ -365,6 +386,7 @@ export class ChannelLoop {
             return;
         if (!this.stillChannel())
             return;
+        this.openAttachments(info);
         await sessionHeartbeat(this.options.api, 'online', { signal: this.signal }).catch((err) => {
             if (err instanceof ApiError) {
                 this.options.logger.info('channel heartbeat failed', { code: err.code });
@@ -417,6 +439,38 @@ export class ChannelLoop {
                 await this.sleep(wait, this.signal);
         }
     }
+    /**
+     * The session's attachments folder, in the folder it is connected for,
+     * cleaned up now and every hour. Not on a server that doesn't serve files.
+     */
+    openAttachments(info) {
+        const { api, logger, state } = this.options;
+        if (state.attachments !== undefined || filesServed(api) === false)
+            return;
+        try {
+            state.attachments = new AttachmentStore({
+                api,
+                logger: logger.child({ component: 'attachments' }),
+                folder: state.folder ?? process.cwd(),
+                sessionId: info.session.id,
+                budgetLeft: info.files_budget?.down_bytes_left,
+            });
+            state.attachments.startCleanup();
+        }
+        catch (err) {
+            logger.warn('attachments unavailable', { error: err });
+        }
+    }
+    /**
+     * The automatic download of an event's own message's files, before the
+     * event is handed on. Never throws, and takes at most a minute.
+     */
+    async download(messageId, files) {
+        const store = this.options.state.attachments;
+        if (store === undefined)
+            return files.map((file) => ({ file, reason: 'not_served' }));
+        return store.autoDownload(messageId, files, { signal: this.signal });
+    }
     /** GET /v1/session, retried while it fails for a reason that may pass. */
     async loadSession() {
         while (!this.isStopped()) {
@@ -528,13 +582,27 @@ export class ChannelLoop {
         this.noteLocale(user);
         const threadId = message.thread_id ?? message.id;
         const forwarded = forwardOrigin(message);
+        const files = message.files ?? [];
+        const outcomes = files.length > 0 ? await this.download(message.id, files) : [];
+        if (this.isStopped())
+            return;
+        const owner = sanitizeLabel(info.owner.name, 64);
+        const content = outcomes.length === 0
+            ? forwarded
+                ? forwardedContent(message.text, forwarded)
+                : message.text
+            : withBlockId(() => [
+                forwarded ? forwardedBlock(message.text, forwarded) : message.text,
+                filesBlock(message.id, outcomes, forwarded, owner),
+            ].join('\n\n'));
         await this.send({
-            content: forwarded ? forwardedContent(message.text, forwarded) : message.text,
+            content,
             meta: {
                 thread_id: threadId,
                 message_id: message.id,
                 session: sanitizeLabel(event.session.label, 40),
                 ...(forwarded ? { forwarded: 'true' } : {}),
+                ...(files.length > 0 ? { attachments: String(files.length) } : {}),
             },
         });
         const conversationId = event.data.channel?.id;
@@ -665,7 +733,18 @@ export class ChannelLoop {
             this.seen.add(`m:${message.id}`);
             this.noteLocale(user);
             const forwarded = forwardOrigin(message);
-            const text = () => forwarded ? forwardedBlock(plainLinks(message.text), forwarded) : plainLinks(message.text);
+            const files = message.files ?? [];
+            const outcomes = files.length > 0 ? await this.download(message.id, files) : [];
+            if (this.isStopped())
+                return;
+            const text = () => {
+                const said = forwarded
+                    ? forwardedBlock(plainLinks(message.text), forwarded)
+                    : plainLinks(message.text);
+                return outcomes.length === 0
+                    ? said
+                    : [said, filesBlock(message.id, outcomes, forwarded, owner)].join('\n');
+            };
             const base = { thread_id: threadId, message_id: message.id, item: key, project, session };
             if (event.type === 'app.mentioned') {
                 content = mentionContent(owner, key, text, item, context);
@@ -679,6 +758,8 @@ export class ChannelLoop {
             }
             if (forwarded)
                 meta.forwarded = 'true';
+            if (files.length > 0)
+                meta.attachments = String(files.length);
             shown.push(message.id);
         }
         await this.send({ content, meta });
@@ -805,6 +886,8 @@ export class ChannelLoop {
                     from_owner: message.from_owner,
                     via_agent: message.via_agent,
                     text: message.text,
+                    message_id: message.id,
+                    files: message.files,
                 },
         });
         const threadId = d.item.id;
@@ -994,6 +1077,8 @@ export class ChannelLoop {
         this.stopper.abort();
         if (reason === 'token_revoked' || reason === 'token_expired' || reason === 'token_invalid') {
             this.options.state.ended = reason;
+            // The session is over: its downloaded files go with it.
+            await this.options.state.attachments?.removeSession().catch(() => undefined);
         }
         // Every question waiting for an answer is told the session ended.
         this.options.state.waiters.endAll();

package/dist/channel/mask.js

@@ -21,7 +21,7 @@
  * the soft hyphen, bidi controls, zero-width and invisible joiners and
  * separators, variation selectors, the byte order mark and tag characters.
  */
-const STRIP = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F\u00AD\u034F\u061C\u180E\u200B-\u200F\u202A-\u202E\u2060\u2066-\u2069\uFE00-\uFE0F\uFEFF\u{E0000}-\u{E007F}]/gu;
+export const STRIP = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F\u00AD\u034F\u061C\u180E\u200B-\u200F\u202A-\u202E\u2060\u2066-\u2069\uFE00-\uFE0F\uFEFF\u{E0000}-\u{E007F}]/gu;
 /* eslint-enable no-control-regex, no-misleading-character-class */
 /** What replaces a secret. */
 export const REDACTED = '[REDACTED]';
@@ -42,6 +42,20 @@ export function cleanApprovalKey(text) {
         .replace(/[\n\t]/g, ' ')
         .trim();
 }
+/**
+ * What each rule finds, in the rules' order (R1 to R8): the names the agent
+ * API's credential_found error uses in details.kinds.
+ */
+export const CREDENTIAL_KINDS = [
+    'private_key',
+    'authorization_header',
+    'bearer_token',
+    'url_password',
+    'credential_option',
+    'credential_assignment',
+    'api_key',
+    'jwt',
+];
 /**
  * The masking rules, in the order they apply. Each replaces only the secret.
  *
@@ -64,43 +78,51 @@ export function cleanApprovalKey(text) {
 const RULES = [
     // R1: a PEM or PGP private key block whose body is all armor, to its END line or the end.
     {
+        kind: 'private_key',
         pattern: /-----BEGIN [A-Z0-9 ]{0,64}PRIVATE KEY(?: BLOCK)?-----\n(?:(?:[A-Za-z0-9+/=]*|[A-Za-z0-9-]{1,64}: [A-Za-z0-9._~+= -]*)\n)*?(?:-----END [A-Z0-9 ]{0,64}PRIVATE KEY(?: BLOCK)?-----|(?:[A-Za-z0-9+/=]*|[A-Za-z0-9-]{1,64}: [A-Za-z0-9._~+= -]*)$)/g,
         replacement: REDACTED,
     },
     // R2: an Authorization header's credentials (its quotes may be JSON-escaped).
     {
+        kind: 'authorization_header',
         pattern: /(authorization(?:\\?["'])?[ \t\n\v\f\r]{0,16}[:=][ \t\n\v\f\r]{0,16}(?:\\?["'])?(?:bearer|basic|token|bot)[ \t\n\v\f\r]{1,16})[A-Za-z0-9._~+=-]+(?![^ \t\n\v\f\r"'\\&;,])/gi,
         replacement: `$1${REDACTED}`,
     },
     // R3: a bearer token anywhere.
     {
+        kind: 'bearer_token',
         pattern: /(?<![A-Za-z0-9_])(bearer[ \t\n\v\f\r]{1,16})[A-Za-z0-9._~+=-]{16,}(?![^ \t\n\v\f\r"'\\&;,])/gi,
         replacement: `$1${REDACTED}`,
     },
     // R4: the password in a URL's user info (the host after it stays).
     {
+        kind: 'url_password',
         pattern: /(?<![a-z0-9+.-])([a-z][a-z0-9+.-]{0,31}:\/\/[^/ \t\n\v\f\r:@]{1,64}:)[A-Za-z0-9._~+=-]+@/gi,
         replacement: `$1${REDACTED}@`,
     },
     // R5: a password, secret, token or API key option's value (--password x, --token=x),
     // plain or in quotes (which stay).
     {
+        kind: 'credential_option',
         pattern: /(?<![^ \t\n\v\f\r])(--?[A-Za-z0-9-]{0,64}(?:password|passwd|secret|token|api-?key)(?:[ \t\n\v\f\r]{1,16}|=)(?:"(?=[A-Za-z0-9._~+=-]+")|'(?=[A-Za-z0-9._~+=-]+')|(?=[A-Za-z0-9._~+=-]+(?![^ \t\n\v\f\r]))))[A-Za-z0-9._~+=-]+/gi,
         replacement: `$1${REDACTED}`,
     },
     // R6: an assignment or JSON member whose name says it holds a secret: the value
     // plain, in quotes, or in JSON-escaped quotes inside a shell string (the quotes stay).
     {
+        kind: 'credential_assignment',
         pattern: /(?<![A-Za-z0-9_-])([A-Za-z0-9_-]{0,64}(?:password|passwd|secret|token|api[_-]?key|apikey|private[_-]?key|access[_-]?key)(?:\\?["'])?[ \t\n\v\f\r]{0,16}[:=][ \t\n\v\f\r]{0,16}(?:\\"(?=[A-Za-z0-9._~+=-]+\\")|"(?=[A-Za-z0-9._~+=-]+")|'(?=[A-Za-z0-9._~+=-]+')|(?=[A-Za-z0-9._~+=-]+(?![^ \t\n\v\f\r"'\\&;,]))))[A-Za-z0-9._~+=-]+/gi,
         replacement: `$1${REDACTED}`,
     },
     // R7: well-known API key and token prefixes.
     {
+        kind: 'api_key',
         pattern: /(?<![A-Za-z0-9_])(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|xapp-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{30,}|[sr]k_(?:live|test)_[A-Za-z0-9]{10,}|whsec_[A-Za-z0-9]{10,}|buildit_(?:pat|ags|app)_[A-Za-z0-9]{10,}|buildit_whsec_[0-9a-f]{10,})/g,
         replacement: REDACTED,
     },
     // R8: a JSON Web Token.
     {
+        kind: 'jwt',
         pattern: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}(?:\.[A-Za-z0-9_-]*)?/g,
         replacement: REDACTED,
     },
@@ -109,6 +131,44 @@ const RULES = [
 const SECRET_KEY = /^[A-Za-z0-9_-]{0,64}(?:password|passwd|secret|token|api[_-]?key|apikey|private[_-]?key|access[_-]?key|authorization|credentials?)$/i;
 /** The only characters a masked span may hold. */
 const TOKEN_CHARSET = /^[A-Za-z0-9._~+=-]+$/;
+/**
+ * Finds, never masks: the lines (1-based, after CR LF and CR become line
+ * feeds, counted from `firstLine`) where a rule matches, and which rules.
+ * The text is cleaned first (cleanApprovalText), so an invisible character
+ * can't split a key. The same rules the agent API's backstop applies.
+ */
+export function findCredentials(text, firstLine = 1) {
+    const clean = cleanApprovalText(text);
+    const starts = [0];
+    for (let i = clean.indexOf('\n'); i >= 0; i = clean.indexOf('\n', i + 1))
+        starts.push(i + 1);
+    const lineOf = (offset) => {
+        let lo = 0;
+        let hi = starts.length - 1;
+        while (lo < hi) {
+            const mid = (lo + hi + 1) >> 1;
+            if ((starts[mid] ?? 0) <= offset)
+                lo = mid;
+            else
+                hi = mid - 1;
+        }
+        return lo + firstLine;
+    };
+    const lines = new Set();
+    const kinds = [];
+    for (const rule of RULES) {
+        let hit = false;
+        for (const m of clean.matchAll(rule.pattern)) {
+            hit = true;
+            lines.add(lineOf(m.index));
+        }
+        if (hit)
+            kinds.push(rule.kind);
+    }
+    if (kinds.length === 0)
+        return undefined;
+    return { lines: [...lines].sort((a, b) => a - b), kinds };
+}
 /** Replaces every credential-shaped part of a text with `[REDACTED]` (rules R1 to R8). */
 export function maskCredentials(text) {
     let out = text;

package/dist/channel/threads.js

@@ -28,6 +28,27 @@ export async function itemThreadId(ref, ctx) {
     ctx.channel?.rememberItem(item.key, item.id);
     return item.id;
 }
+/**
+ * Whether a thread is a work item's (its id is the item's): one of the
+ * items the session works in, an item the events or get_item named, or the
+ * latest message's item. Anything else (none: a new message) is the direct
+ * message's.
+ */
+export function isItemThread(state, threadId) {
+    if (threadId === undefined)
+        return false;
+    const id = threadId.toLowerCase();
+    const same = (other) => other?.toLowerCase() === id;
+    if (same(state.last?.item?.id))
+        return true;
+    for (const active of state.activeItems.keys())
+        if (same(active))
+            return true;
+    for (const known of state.items.values())
+        if (same(known))
+            return true;
+    return false;
+}
 /** The refusal when several threads are active and none was named. */
 export function threadRequiredMessage(state, tool, how) {
     const listed = state