@kaydash9999/banker-plugins 0.20.2 → 0.20.5

package/skills/ralph-qa/references/gemini-seat.mjs

@@ -109,12 +109,18 @@ function projectRoot(dir) {
 }
 
 // <g>/projects.json, gemini's map from a project folder to its folder name under tmp/ and
-// history/, read the other way round: folder name to project folder.
+// history/, read the other way round: folder name to the project folders that claim it.
 function registered(g) {
   try {
     const { projects } = JSON.parse(readFileSync(join(g, "projects.json"), "utf8"));
     if (!projects || typeof projects !== "object" || Array.isArray(projects)) return new Map();
-    return new Map(Object.entries(projects).filter(([, name]) => typeof name === "string").map(([owner, name]) => [name, owner]));
+    const owners = new Map();
+    for (const [owner, name] of Object.entries(projects)) {
+      if (typeof name !== "string") continue;
+      if (!owners.has(name)) owners.set(name, new Set());
+      owners.get(name).add(resolve(owner));
+    }
+    return owners;
   } catch {
     return new Map();
   }
@@ -122,8 +128,10 @@ function registered(g) {
 
 // Each folder gemini keeps under tmp/ or history/, here and under .cache/.gemini, with the
 // folder its .project_root names. A folder without the marker (a seat that wrote its session
-// again after its run cleaned up) gets the project projects.json gives its name. Only folders
-// read from tmp/ and history/ are looked up, so no name there reaches another folder.
+// again after its run cleaned up) gets the project projects.json gives its name. A name two
+// project folders claim (a hand edit, another gemini) is no seat's for sure: its unmarked folder
+// gets no owner, only the `claimants`, and stays. One folder written twice ("x", "x/") is one owner.
+// Only folders read from tmp/ and history/ are looked up, so no name there reaches another folder.
 function projectFolders(env) {
   const home = geminiHome(env);
   return [join(home, ".gemini"), join(home, ".cache", ".gemini")].flatMap((g) => {
@@ -131,29 +139,50 @@ function projectFolders(env) {
     return ["tmp", "history"].flatMap((kind) => listDir(join(g, kind)).map((name) => {
       const dir = join(g, kind, name);
       const root = projectRoot(dir);
-      return { dir, owner: root === undefined ? names.get(name) : root };
+      if (root !== undefined) return { dir, owner: root, claimants: [] };
+      const claimants = [...(names.get(name) ?? [])];
+      return { dir, owner: claimants.length === 1 ? claimants[0] : null, claimants };
     }));
-  }).filter((p) => p.owner);
+  }).filter((p) => p.owner || p.claimants.length > 1);
 }
 
-// The folders gemini keeps for sessions run in `seat`, matched by the path as written and as
-// resolved; the seat folder may be gone already.
-export function sessionFolders(seat, { env = process.env, platform = process.platform } = {}) {
+// Whether a project folder is `seat`, by the path as written or as resolved (it may be gone).
+function seatOwner(seat, platform) {
   const want = new Set([norm(seat, platform), norm(real(seat), platform)]);
-  return projectFolders(env).filter((p) => want.has(norm(p.owner, platform))).map((p) => p.dir);
+  return (owner) => want.has(norm(owner, platform));
 }
 
-// The session folders of seat folders under `base` that are gone: .project_root names
-// <base>/ralph-qa.<id>/gemini and that folder no longer exists (a run cut short before its clean).
-// A run still going has its seat folder, so its records stay.
+// Whether a project folder is <base>/ralph-qa.<id>/gemini and gone (a run cut short before its
+// clean). A run still going has its seat folder, so its records stay.
 const SEAT_PARENT = /^ralph-qa\.[A-Za-z0-9]+$/;
-export function staleSessionFolders(base, { env = process.env, platform = process.platform, exists = existsSync } = {}) {
+function staleOwner(base, platform, exists) {
   const roots = new Set([norm(base, platform), norm(real(base), platform)]);
-  const stale = ({ owner }) => {
+  return (owner) => {
     const o = norm(owner, platform);
     return basename(o) === "gemini" && SEAT_PARENT.test(basename(dirname(o))) && roots.has(dirname(dirname(o))) && !exists(owner);
   };
-  return projectFolders(env).filter(stale).map((p) => p.dir);
+}
+
+// The folders to remove, of the project folders `mine` takes, and those left because their name
+// is also another project folder's.
+function folderPlan(env, mine) {
+  const all = projectFolders(env);
+  return {
+    dirs: all.filter((p) => p.owner && mine(p.owner)).map((p) => p.dir),
+    skipped: all.filter((p) => !p.owner && p.claimants.some(mine)).map((p) => p.dir),
+  };
+}
+
+// The folders gemini keeps for sessions run in `seat`, matched by the path as written and as
+// resolved; the seat folder may be gone already.
+export function sessionFolders(seat, { env = process.env, platform = process.platform } = {}) {
+  return folderPlan(env, seatOwner(seat, platform)).dirs;
+}
+
+// The session folders of seat folders under `base` that are gone: .project_root names
+// <base>/ralph-qa.<id>/gemini and that folder no longer exists.
+export function staleSessionFolders(base, { env = process.env, platform = process.platform, exists = existsSync } = {}) {
+  return folderPlan(env, staleOwner(base, platform, exists)).dirs;
 }
 
 function check(seat) {
@@ -176,9 +205,27 @@ function check(seat) {
   return 0;
 }
 
-function remove(dirs) {
+// Removes `dirs`; gives back what it removed and the folders it left because their name is another project's too.
+function removeFolders({ dirs, skipped }) {
   for (const dir of dirs) rmSync(dir, { recursive: true, force: true });
-  process.stdout.write(JSON.stringify({ removed: dirs }) + "\n");
+  return { removed: dirs, skipped };
+}
+
+// clean and sweep for a caller in the same process (the ralph-qa runner, seat-run.mjs).
+export function cleanSeat(seat, { env = process.env, platform = process.platform } = {}) {
+  return removeFolders(folderPlan(env, seatOwner(seat, platform)));
+}
+export function sweepBase(base, { env = process.env, platform = process.platform, exists = existsSync } = {}) {
+  return removeFolders(folderPlan(env, staleOwner(base, platform, exists)));
+}
+
+// Removes `dirs` and says which folders it left (`skipped`), on stdout as JSON and one line each on stderr.
+function remove(plan) {
+  const { removed, skipped } = removeFolders(plan);
+  for (const dir of skipped) {
+    process.stderr.write(`gemini-seat: left ${dir}: two project folders in projects.json claim its name, so it may hold another project's sessions; remove it by hand if they are the seat's\n`);
+  }
+  process.stdout.write(JSON.stringify({ removed, skipped }) + "\n");
   return 0;
 }
 
@@ -193,7 +240,8 @@ function main(argv) {
     return 2;
   }
   if (cmd === "check") return check(folder);
-  return remove(cmd === "clean" ? sessionFolders(folder) : staleSessionFolders(folder));
+  const mine = cmd === "clean" ? seatOwner(folder, process.platform) : staleOwner(folder, process.platform, existsSync);
+  return remove(folderPlan(process.env, mine));
 }
 
 const invokedDirectly = () => {

package/skills/ralph-qa/references/payload-scan.mjs

@@ -10,12 +10,15 @@
  * none): the whole block is the secret, not just the BEGIN line. The matched text itself is never
  * printed, so the report cannot become the leak. The patterns cover common key and token
  * formats, private key blocks (PGP too), secret assignments (quoted, or unquoted with letters
- * and digits), passwords (quoted, with a symbol, alone on a config or env-file line, or after a
- * Dockerfile `ENV KEY value`), secrets given as command-line flags, curl's user and password flag,
+ * and digits), passwords (quoted, with a symbol, alone on a config or env-file line, a KEY=value
+ * word after a space, a quote, `(` or `=` as in `env`, `docker -e`, `--from-literal=`, or after a Dockerfile
+ * `ENV KEY value`; the shell's own PWD or OLDPWD holding a path is no password),
+ * secrets given as command-line flags, curl's user and password flag,
  * hex keys, Basic and Bearer credentials, credentials in URLs and
  * long high-entropy strings (a lockfile's sha512- integrity hash and a Go or Terraform h1: hash
  * aside); they do not prove a payload clean. A Docker secret file's path after a *_FILE key is
- * not read as the password it points to. Every repeat and lookahead is bounded (a run longer than
+ * not read as the password it points to, and a value masked as a whole `[REDACTED]` word (the mask
+ * SKILL.md asks for) is no value, so a masked payload scans clean; a mask glued to the rest of a value is not. Every repeat and lookahead is bounded (a run longer than
  * 65536 characters is read in pieces) or anchored, so a long line takes linear time and cannot
  * overflow the regex stack.
  */
@@ -25,6 +28,9 @@ import { fileURLToPath } from "node:url";
 const SECRET_KEY = String.raw`(?:api[_-]?key|secret|token|passw(?:or)?d|pwd|access[_-]?key|credential|비밀번호|패스워드)[\w-]{0,64}["']?\s*[:=]\s*`;
 // `pass` and `passphrase` count only as a word of their own (DB_PASS, "pass"), not inside bypass.
 const PASS_WORD = String.raw`(?:passw(?:or)?d|pwd|passcode|(?<![a-z])pass(?:phrase)?(?![a-z]))`;
+// An env-style key that holds a password word, up to its `=`, and a value that is no reference or whole placeholder
+// (`$X`, `<your-password>`, `{{ x }}`, `%(x)s`, `%X%`). A value that only starts with `<` or `{` is still read.
+const ENV_KEY = String.raw`[A-Za-z0-9_]{0,64}(?:passw(?:or)?d|pwd|passcode)[A-Za-z0-9_]{0,64}=(?!-|\$|<[^>\s]{1,64}>|\{\{|%\(|%[A-Za-z_][A-Za-z0-9_]{0,64}%)`;
 const PASSWORD_KEY = String.raw`(?:${PASS_WORD}|비밀번호|패스워드)[\w-]{0,64}["']?\s*[:=]\s*`;
 // An unquoted value that is not code: none of the characters an expression or a reference
 // holds, and at least one symbol (an identifier has none).
@@ -54,7 +60,9 @@ export const PATTERNS = [
   ["assigned-secret", new RegExp(SECRET_KEY + String.raw`["'](?:[^"'\s]{12,256}|(?=[^"'\s]{0,10}\d)[^"'\s]{8,11})["']`, "i")],
   ["assigned-secret-bare", new RegExp(SECRET_KEY + String.raw`(?=[^\s"']{0,256}\d)(?=[^\s"']{0,256}[A-Za-z])[^\s"'(\[{]{12,256}`, "i")],
   ["assigned-password", new RegExp(PASSWORD_KEY + String.raw`(?:["'][^"'\s]{6,256}["']|(?=${BARE}{0,256}[^\w\s;,"'().\[\]{}$<>])${BARE}{6,256})`, "i")],
-  ["env-password", /^[+\- ]?\s*(?:export\s+)?[A-Za-z0-9_]{0,64}(?:passw(?:or)?d|pwd|passcode)[A-Za-z0-9_]{0,64}=[^\s$"'][^\s"']{5,256}/i],
+  // at the head of a line, or as a word after a space, a quote, `(` or `=` (env, docker -e, --from-literal=, a subshell),
+  // its value ending the word
+  ["env-password", new RegExp(String.raw`^[+\- ]?\s*(?:export\s+)?${ENV_KEY}[^\s"']{6,256}|(?<=[\s"'(=])${ENV_KEY}[^\s"',;()\[\]{}]{6,256}(?=[\s"']|$)`, "i")],
   // a password alone on a config line: YAML, compose lists, .properties, Dockerfile ENV, diff marks
   ["config-password", new RegExp(String.raw`^[+\- ]?\s*(?:-\s+|export\s+|ENV\s+)?[\w.-]{0,64}${PASS_WORD}[\w.-]{0,64}["']?\s*[:=]\s*["']?(?![-$<{%])[^\s"',;()\[\]{}]{6,256}["']?\s*(?:#.*)?$`, "i")],
   // a Dockerfile's legacy `ENV KEY value` form, the value alone after the space
@@ -94,10 +102,16 @@ const highEntropy = (line) => [...line.matchAll(LONG_RUN)].some((m) => !publicHa
 // not that password: the kinds that read a value after a key name see a `-` there instead. The
 // other kinds still read the line as it is, so a key's own format shows wherever it sits.
 const SECRET_FILE_PATH = /(?<![\w.-])([\w.-]{0,128}_FILE["']?(?:[ \t]*[:=][ \t]*|[ \t]+)["']?)\/[\w.@-]{1,128}(?:\/[\w.@-]{1,128}){0,32}(?=["']?(?:[\s,;#]|$))/gi;
+// The shell's own working folder (PWD, OLDPWD, as `env`, `declare -x` or a JSON dump shows it) holding a plain path:
+// no password, though PWD reads like one. A key that only ends in PWD (MYSQL_PWD) and a value that is no plain path
+// stay. Taken out before the keyed patterns read the line, as lineage does.
+const SHELL_DIR = /(?<=^[+\- ]?|[\s"'$])((?:OLD)?PWD["']?[ \t]*[:=][ \t]*["']?)(?:~|\/|[A-Za-z]:[\\/])[^\s"'!#$%&*;|<>()[\]{}`^?=]{0,4096}(?=["']?(?:[\s,]|$))/g;
 const KEYED = new Set(["assigned-secret", "assigned-secret-bare", "assigned-password", "env-password", "config-password",
   "dockerfile-env-password"]);
 
 const KEY_END = new RegExp(`-----END ${PRIVATE_KEY}`);
+// The mask SKILL.md asks for, as a word of its own. One glued to the rest of a value is no mask: what is left is read.
+const WHOLE_MASK = /(?<!\w)\[REDACTED\](?!\w)/g;
 
 // Each line's secret-like kinds, once per kind and line. A private key closes at the first END
 // marker at or after its line: the END lines are found once and walked with the lines, so many
@@ -109,12 +123,13 @@ export function scan(text) {
   let next = 0;
   lines.forEach((line, i) => {
     while (next < ends.length && ends[next] < i + 1) next += 1;
-    const keyed = line.replace(SECRET_FILE_PATH, "$1-");
+    const plain = line.replace(WHOLE_MASK, "-");
+    const keyed = plain.replace(SECRET_FILE_PATH, "$1-").replace(SHELL_DIR, "$1-");
     for (const [kind, re] of PATTERNS) {
-      if (!re.test(KEYED.has(kind) ? keyed : line)) continue;
+      if (!re.test(KEYED.has(kind) ? keyed : plain)) continue;
       hits.push(kind === "private-key" ? { line: i + 1, kind, end: ends[next] ?? null } : { line: i + 1, kind });
     }
-    if (highEntropy(line)) hits.push({ line: i + 1, kind: "high-entropy" });
+    if (highEntropy(plain)) hits.push({ line: i + 1, kind: "high-entropy" });
   });
   return { count: hits.length, hits };
 }