@lchase/kiln 0.8.0 → 0.9.0

package/dist/redact.js

@@ -0,0 +1,63 @@
+/**
+ * Masks secrets in text Kiln writes to the event log, the ledger, and a
+ * pull request body. One function owns that. A log or a PR is public-shaped
+ * even when a test command or a check excerpt is not.
+ *
+ * Token shapes cover the common issued-credential prefixes. A value is also
+ * masked when it belongs to an env assignment, a JSON field, or an auth
+ * header whose name contains TOKEN, KEY, SECRET, or PASSWORD.
+ */
+const SECRET_NAME = /token|key|secret|password/i;
+const TOKEN_SHAPES = [
+    /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/g,
+    /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+    /\bglpat-[A-Za-z0-9\-_]{16,}\b/g,
+    /\bxox[baprs]-[A-Za-z0-9-]{10,}/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\bsk-ant-[A-Za-z0-9\-_]{10,}\b/g,
+    /\bsk-[A-Za-z0-9]{20,}\b/g,
+    /\bnpm_[A-Za-z0-9]{20,}\b/g,
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+];
+const AUTH_HEADER = /\b(authorization|proxy-authorization|x-api-key|x-auth-token)\s*:[^\n]*/gi;
+const BEARER = /\bBearer\s+[A-Za-z0-9\-._~+/]{8,}={0,2}/g;
+const ENV_ASSIGN = /(^|[\n\r;\s])((?:export[ \t]+)?)([A-Za-z_][A-Za-z0-9_]*)([ \t]*=[ \t]*)("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s#]+)/g;
+const JSON_FIELD = /"([A-Za-z_][A-Za-z0-9_]*)"(\s*:\s*)("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')/g;
+/** Replace secret-shaped text with `[redacted]`. Idempotent on its own output. */
+export function redact(text) {
+    let out = text.replace(ENV_ASSIGN, (full, lead, prefix, name, eq, value) => {
+        if (!SECRET_NAME.test(name))
+            return full;
+        return `${lead}${prefix}${name}${eq}[redacted]`;
+    });
+    out = out.replace(JSON_FIELD, (full, name, mid, value) => {
+        if (!SECRET_NAME.test(name))
+            return full;
+        const quote = value.startsWith("'") ? "'" : '"';
+        return `"${name}"${mid}${quote}[redacted]${quote}`;
+    });
+    out = out.replace(AUTH_HEADER, (_full, name) => `${name}: [redacted]`);
+    out = out.replace(BEARER, "Bearer [redacted]");
+    for (const pattern of TOKEN_SHAPES) {
+        out = out.replace(pattern, "[redacted]");
+    }
+    return out;
+}
+/** Walk a JSON value and redact every string. Object keys that name a secret drop the value. */
+export function redactDeep(value) {
+    if (typeof value === "string")
+        return redact(value);
+    if (typeof value !== "object" || value === null)
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => redactDeep(item));
+    const out = {};
+    for (const [key, inner] of Object.entries(value)) {
+        if (typeof inner === "string" && SECRET_NAME.test(key)) {
+            out[key] = "[redacted]";
+            continue;
+        }
+        out[key] = redactDeep(inner);
+    }
+    return out;
+}

package/dist/reliability.js

@@ -4,6 +4,7 @@ import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync
 import { dirname, join, resolve, sep } from "node:path";
 import { z } from "zod";
 import { authenticationFailureLine } from "./auth.js";
+import { appendEvent } from "./events.js";
 import { jobBasename } from "./paths.js";
 import { FAILURE_REASONS } from "./reconcile.js";
 /**
@@ -105,6 +106,17 @@ export function recoverRuns(config, jobs, options) {
         const recorded = recordFailure(config, job.jobId, existing, pending, options.now);
         if (recorded.created) {
             appendLog(job.logPath, recorded.ledger.attempts.at(-1));
+            const runId = pending.runId ?? job.run?.runId;
+            appendEvent(config.kilnDir, {
+                job_id: job.jobId,
+                run_id: runId ?? null,
+                event: "run.failed",
+                properties: {
+                    reason: pending.reason,
+                    ...(pending.detail ? { detail: pending.detail } : {}),
+                    once: runId ? `run.failed:${runId}` : `run.failed:launch:${recorded.ledger.attempts.length}`,
+                },
+            });
             notes.push({
                 jobId: job.jobId,
                 kind: kindFor(pending.reason),
@@ -115,8 +127,17 @@ export function recoverRuns(config, jobs, options) {
         }
         const checkout = job.run?.checkout ?? config.repos[job.repo]?.path;
         const runId = pending.runId ?? job.run?.runId;
-        if (checkout && runId)
-            cleanupRunWorktree(checkout, runId);
+        if (checkout && runId) {
+            const outcome = cleanupRunWorktree(checkout, runId);
+            if (outcome === "removed" || outcome === "kept") {
+                appendEvent(config.kilnDir, {
+                    job_id: job.jobId,
+                    run_id: runId,
+                    event: outcome === "removed" ? "worktree.cleaned" : "worktree.kept",
+                    properties: { once: `worktree.${outcome}:${runId}` },
+                });
+            }
+        }
     }
     return notes;
 }

package/dist/serve.js

@@ -7,8 +7,9 @@ import { AUTH_PREFLIGHT_PREFIX } from "./auth.js";
 import { loadKilnConfig } from "./config.js";
 import { answerJob, readStatus, retryJob, runTick, startupRecovery } from "./driver.js";
 import { browse } from "./fs-browse.js";
-import { defaultHost } from "./host.js";
+import { appendEvent, eventsForJob } from "./events.js";
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
+import { defaultHost } from "./host.js";
 import { intakeJobs } from "./intake-http.js";
 import { packageRoot } from "./paths.js";
 import { SANDBOX_PREFLIGHT_PREFIX } from "./sandbox.js";
@@ -189,6 +190,15 @@ async function handle(req, res, state, boundPort, css, csrf) {
         sendJson(res, 200, statusDocument(state), secrets);
         return;
     }
+    if (path === "/api/events") {
+        const jobId = url.searchParams.get("job_id");
+        if (!jobId || !JOB_ID.test(jobId)) {
+            sendJson(res, 400, { error: "job_id is required." }, secrets);
+            return;
+        }
+        sendJson(res, 200, { job_id: jobId, events: eventsForJob(config.kilnDir, jobId) }, secrets);
+        return;
+    }
     const apiJob = /^\/api\/jobs\/([^/]+)$/.exec(path);
     if (apiJob?.[1]) {
         const jobId = parseJobId(apiJob[1]);
@@ -503,6 +513,11 @@ function refreshLiveConfig(state) {
         state.configError = undefined;
         state.mtimeMs = file.mtimeMs;
         state.size = file.size;
+        appendEvent(next.kilnDir, {
+            job_id: null,
+            event: "config.reloaded",
+            properties: {},
+        });
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lchase/kiln",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Run a workflow on any registered repo. A markdown spec is the input.",
   "license": "MIT",
   "type": "module",