@massa-ai/core 1.18.0 → 1.19.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/data/memory/observation-contract.d.ts +14 -2
- package/dist/data/memory/observation-contract.d.ts.map +1 -1
- package/dist/data/memory/observation-contract.js.map +1 -1
- package/dist/data/memory/observation-repository-pg.d.ts +2 -2
- package/dist/data/memory/observation-repository-pg.d.ts.map +1 -1
- package/dist/data/memory/observation-repository-pg.js.map +1 -1
- package/dist/kernel/sanitize/credential-scrub.d.ts +63 -0
- package/dist/kernel/sanitize/credential-scrub.d.ts.map +1 -0
- package/dist/kernel/sanitize/credential-scrub.js +119 -0
- package/dist/kernel/sanitize/credential-scrub.js.map +1 -0
- package/dist/services/hooks/hook-service.d.ts.map +1 -1
- package/dist/services/hooks/hook-service.js +14 -1
- package/dist/services/hooks/hook-service.js.map +1 -1
- package/dist/tools/compact_snapshot.d.ts.map +1 -1
- package/dist/tools/compact_snapshot.js +18 -7
- package/dist/tools/compact_snapshot.js.map +1 -1
- package/package.json +2 -2
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { SanitizedPayloadJson } from "../../kernel/sanitize/credential-scrub.js";
|
|
1
2
|
export declare const LIFECYCLE_EVENTS: readonly ["session-start", "user-prompt", "pre-tool-use", "post-tool-use", "pre-compact", "session-end"];
|
|
2
3
|
export type LifecycleEventKind = (typeof LIFECYCLE_EVENTS)[number];
|
|
3
4
|
export declare const OBSERVATION_CATEGORIES: readonly ["files-read", "files-written", "file-search", "tool-calls", "git-changes", "tasks", "plan-changes", "errors", "error-resolution", "iteration-loop", "decisions", "constraints", "rejected-approaches", "user-prompts", "intent", "goal", "role", "blocked-on", "rules", "skills-invoked", "subagents-spawned", "env-changes", "cwd-changes", "session-settings", "external-refs", "web-fetch", "searches", "memories-stored", "compaction-snapshots", "mcp-calls", "agent-findings", "cost-telemetry", "lifecycle-raw"];
|
|
@@ -16,6 +17,17 @@ export interface Observation {
|
|
|
16
17
|
agentId?: string | null;
|
|
17
18
|
attributionSource?: AttributionSource | null;
|
|
18
19
|
}
|
|
20
|
+
/**
|
|
21
|
+
* Observation shape accepted by {@link ObservationStore.insert}. Identical to
|
|
22
|
+
* {@link Observation} except `payloadJson` must be the branded
|
|
23
|
+
* `SanitizedPayloadJson` produced by `kernel/sanitize/credential-scrub.ts`'s
|
|
24
|
+
* `scrubCredentials()` — the only way to construct that brand. Read shapes
|
|
25
|
+
* (`Observation`, `ObservationRow`, `listRecent`/`listBySession` results)
|
|
26
|
+
* stay plain `string`: rows read back are not re-branded (XP-02 / AD-014).
|
|
27
|
+
*/
|
|
28
|
+
export type InsertableObservation = Omit<Observation, "payloadJson"> & {
|
|
29
|
+
payloadJson: SanitizedPayloadJson;
|
|
30
|
+
};
|
|
19
31
|
export interface ObservationRow {
|
|
20
32
|
id: string;
|
|
21
33
|
project_id: string;
|
|
@@ -29,7 +41,7 @@ export interface ObservationRow {
|
|
|
29
41
|
attribution_source?: string | null;
|
|
30
42
|
}
|
|
31
43
|
export interface ObservationStore {
|
|
32
|
-
insert(obs:
|
|
44
|
+
insert(obs: InsertableObservation): void;
|
|
33
45
|
listRecent(projectId: string, limit: number): Observation[];
|
|
34
46
|
listBySession(sessionId: string, limit: number): Observation[];
|
|
35
47
|
countByProject(projectId: string): number;
|
|
@@ -37,7 +49,7 @@ export interface ObservationStore {
|
|
|
37
49
|
}
|
|
38
50
|
export declare class MemoryObservationStore implements ObservationStore {
|
|
39
51
|
rows: Observation[];
|
|
40
|
-
insert(row:
|
|
52
|
+
insert(row: InsertableObservation): void;
|
|
41
53
|
listRecent(projectId: string, limit: number): Observation[];
|
|
42
54
|
listBySession(sessionId: string, limit: number): Observation[];
|
|
43
55
|
countByProject(projectId: string): number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"observation-contract.d.ts","sourceRoot":"","sources":["../../../src/data/memory/observation-contract.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,0GAA2G,CAAC;AACzI,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AACnE,eAAO,MAAM,sBAAsB,mgBAAogB,CAAC;AACxiB,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1E,eAAO,MAAM,mBAAmB,wEAAyE,CAAC;AAC1G,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAAE;AACxR,MAAM,WAAW,cAAc;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE;AACnQ,MAAM,WAAW,gBAAgB;IAAG,MAAM,CAAC,GAAG,EAAE,
|
|
1
|
+
{"version":3,"file":"observation-contract.d.ts","sourceRoot":"","sources":["../../../src/data/memory/observation-contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,eAAO,MAAM,gBAAgB,0GAA2G,CAAC;AACzI,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AACnE,eAAO,MAAM,sBAAsB,mgBAAogB,CAAC;AACxiB,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1E,eAAO,MAAM,mBAAmB,wEAAyE,CAAC;AAC1G,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAAE;AACxR;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG;IAAE,WAAW,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAC7G,MAAM,WAAW,cAAc;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE;AACnQ,MAAM,WAAW,gBAAgB;IAAG,MAAM,CAAC,GAAG,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAAC;IAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAAC;IAAC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,WAAW,IAAI,MAAM,CAAC;CAAE;AAC9Q,qBAAa,sBAAuB,YAAW,gBAAgB;IAAU,IAAI,EAAE,WAAW,EAAE,CAAM;IAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,GAAG,IAAI;IAA2C,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE;IAAiK,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE;IAAiK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAA2E,WAAW,IAAI,MAAM;CAAuB;AACjxB,wBAAgB,gBAAgB,IAAI,MAAM,CAAyC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"observation-contract.js","sourceRoot":"","sources":["../../../src/data/memory/observation-contract.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"observation-contract.js","sourceRoot":"","sources":["../../../src/data/memory/observation-contract.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,CAAU,CAAC;AAEzI,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,CAAU,CAAC;AAExiB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,CAAU,CAAC;AAc1G,MAAM,OAAO,sBAAsB;IAAsC,IAAI,GAAkB,EAAE,CAAC;IAAC,MAAM,CAAC,GAA0B,IAAU,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,UAAU,CAAC,SAAiB,EAAE,KAAa,IAAmB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,aAAa,CAAC,SAAiB,EAAE,KAAa,IAAmB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,cAAc,CAAC,SAAiB,IAAY,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,WAAW,KAAa,OAAO,QAAQ,CAAC,CAAC,CAAC;CAAE;AACjxB,MAAM,UAAU,gBAAgB,KAAa,OAAO,OAAO,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC"}
|
|
@@ -26,7 +26,7 @@
|
|
|
26
26
|
* BIGINT ms-epoch to match the store's `createdAt: number` contract (NOT the
|
|
27
27
|
* Prisma model's DateTime — see the migration note).
|
|
28
28
|
*/
|
|
29
|
-
import type { Observation, ObservationStore } from "./observation-contract.js";
|
|
29
|
+
import type { Observation, ObservationStore, InsertableObservation } from "./observation-contract.js";
|
|
30
30
|
export declare class PgObservationStore implements ObservationStore {
|
|
31
31
|
private prisma;
|
|
32
32
|
/**
|
|
@@ -51,7 +51,7 @@ export declare class PgObservationStore implements ObservationStore {
|
|
|
51
51
|
* PgScheduledJobStore's inflight-merge).
|
|
52
52
|
*/
|
|
53
53
|
private ensureHydrated;
|
|
54
|
-
insert(obs:
|
|
54
|
+
insert(obs: InsertableObservation): void;
|
|
55
55
|
listRecent(projectId: string, limit: number): Observation[];
|
|
56
56
|
listBySession(sessionId: string, limit: number): Observation[];
|
|
57
57
|
countByProject(projectId: string): number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"observation-repository-pg.d.ts","sourceRoot":"","sources":["../../../src/data/memory/observation-repository-pg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,
|
|
1
|
+
{"version":3,"file":"observation-repository-pg.d.ts","sourceRoot":"","sources":["../../../src/data/memory/observation-repository-pg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAEhB,qBAAqB,EACtB,MAAM,2BAA2B,CAAC;AAmDnC,qBAAa,kBAAmB,YAAW,gBAAgB;IACzD,OAAO,CAAC,MAAM,CAAgB;IAC9B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAA8B;IAC/C;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAElD,OAAO,CAAC,SAAS;IAKjB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAgDtB,MAAM,CAAC,GAAG,EAAE,qBAAqB,GAAG,IAAI;IAuFxC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE;IAS3D,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE;IAS9D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAOzC,WAAW,IAAI,MAAM;IAIrB,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,mEAAmE;IAC7D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM/B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"observation-repository-pg.js","sourceRoot":"","sources":["../../../src/data/memory/observation-repository-pg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"observation-repository-pg.js","sourceRoot":"","sources":["../../../src/data/memory/observation-repository-pg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAwBjF,SAAS,KAAK,CAAC,CAAqC;IAClD,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAmB;IAC7C,MAAM,GAAG,GAAmB;QAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;KACzC,CAAC;IACF,oEAAoE;IACpE,uEAAuE;IACvE,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,MAA+B;QAC3C,QAAQ,EAAG,GAAG,CAAC,QAA2C,IAAI,SAAS;QACvE,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;QAClC,iBAAiB,EAAG,GAAG,CAAC,kBAA8D,IAAI,SAAS;KACpG,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,kBAAkB;IACrB,MAAM,CAAgB;IAC9B;;;OAGG;IACK,MAAM,GAA6B,IAAI,GAAG,EAAE,CAAC;IAC7C,QAAQ,GAAG,KAAK,CAAC;IACjB,SAAS,GAAyB,IAAI,CAAC;IAC/C;;;;OAIG;IACK,eAAe,GAAG,CAAC,CAAC;IACpB,MAAM,CAAU,gBAAgB,GAAG,MAAM,CAAC;IAE1C,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC1C,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,wEAAwE;QACxE,IACE,IAAI,CAAC,eAAe,GAAG,CAAC;YACxB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,GAAG,kBAAkB,CAAC,gBAAgB,EACvE,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAoB;;;SAGtD,CAAC;gBACF,MAAM,IAAI,GAA6B,IAAI,GAAG,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;gBAChC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAClB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5C,CAAC;gBACD,wEAAwE;gBACxE,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;wBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACxC,CAAC;gBACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,sEAAsE;gBACtE,yDAAyD;gBACzD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;oBAC7D,KAAK,EAAG,CAAW,CAAC,OAAO;iBAC5B,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,MAAM,CAAC,GAA0B;QAC/B,yEAAyE;QACzE,EAAE;QACF,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,0BAA0B;QAC1B,MAAM,eAAe,GAAG,+BAA+B,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,CAAC,EAAE,EACN,eAAe,IAAI,eAAe,KAAK,GAAG,CAAC,SAAS;YAClD,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE;YACxC,CAAC,CAAC,GAAG,CACR,CAAC;QACF,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3B,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,sEAAsE;QACtE,2EAA2E;QAC3E,mEAAmE;QACnE,EAAE;QACF,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,0CAA0C;QAC1C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,mEAAmE;gBACnE,MAAM,kBAAkB,GAAG,MAAM,+BAA+B,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1F,IAAI,kBAAkB,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACrE,CAAC;gBACD,MAAM,MAAM,CAAC,WAAW,CAAA;;;;cAIlB,GAAG,CAAC,EAAE;cACN,kBAAkB;cAClB,GAAG,CAAC,SAAS;cACb,GAAG,CAAC,MAAM;cACV,GAAG,CAAC,QAAQ,IAAI,IAAI;cACpB,GAAG,CAAC,WAAW;cACf,GAAG,CAAC,UAAU;cACd,GAAG,CAAC,SAAS;cACb,GAAG,CAAC,OAAO,IAAI,IAAI;cACnB,GAAG,CAAC,iBAAiB,IAAI,IAAI;;;;;;;;;;;;SAYlC,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;oBAC5D,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,KAAK,EAAG,CAAW,CAAC,OAAO;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,UAAU,CAAC,SAAiB,EAAE,KAAa;QACzC,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;aACxC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;aACzC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,KAAa;QAC5C,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;aACxC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;aACzC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAAE,CAAC,EAAE,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,WAAW;QACT,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IAC9B,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,OAAO;QACX,wEAAwE;QACxE,sEAAsE;QACtE,mCAAmC;QACnC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC"}
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Credential scrubber — kernel leaf (XP-02 / TASK-XP-003).
|
|
3
|
+
*
|
|
4
|
+
* Narrow, recognizable credential-shape redaction for hook-ingested payloads.
|
|
5
|
+
* Consumed by `services/hooks` and `tools/` (the two production writers) and
|
|
6
|
+
* by `data/memory/observation-contract.ts`'s insert seam (which is what
|
|
7
|
+
* enforces the branded type below) — a cross-tier leaf, which is exactly
|
|
8
|
+
* what `kernel/` exists for (CLAUDE.md "Architecture" section: membership is
|
|
9
|
+
* the path prefix, there is no allowlist).
|
|
10
|
+
*
|
|
11
|
+
* v1 rule set is deliberately narrow (spec.md "XP-02 redaction v1 rule set"):
|
|
12
|
+
* PEM private-key blocks, JWTs, AWS access-key ids, OpenAI-style `sk-` keys,
|
|
13
|
+
* GitHub tokens, Slack tokens, and Bearer-scheme tokens. General PII/entropy
|
|
14
|
+
* detection is explicitly out of scope — over-redaction of legitimate code
|
|
15
|
+
* is the adjacent regression class this v1 deliberately avoids.
|
|
16
|
+
*
|
|
17
|
+
* No `assertSanitized` escape hatch: the branded `SanitizedPayloadJson` type
|
|
18
|
+
* is only constructible by running the real scrubber below. An assertion
|
|
19
|
+
* constructor would reopen the hole the brand exists to close.
|
|
20
|
+
*
|
|
21
|
+
* Non-growth invariant: scrubbing never makes the payload longer, keeping it
|
|
22
|
+
* sound against the pre-scrub `HOOKS_MAX_PAYLOAD_BYTES` cap in
|
|
23
|
+
* `hook-service.ts` (checked before this module ever runs). Each rule's
|
|
24
|
+
* `[REDACTED:<id>]` marker is sized to be no longer than that shape's
|
|
25
|
+
* minimum possible match. Two rules needed a small adjustment from
|
|
26
|
+
* design.md C1's literal draft to hold that exactly:
|
|
27
|
+
* - `aws-key` (design: `aws-key-id`): a real AWS access-key id is FIXED at
|
|
28
|
+
* exactly 20 characters (4-char prefix + 16 alphanumeric), so the
|
|
29
|
+
* unabridged id's marker (21 chars) would have made every redaction grow
|
|
30
|
+
* the payload by one byte. Dropping the "-id" suffix brings the marker
|
|
31
|
+
* to 18 chars, comfortably under 20.
|
|
32
|
+
* - `slack-token`: the near-miss floor is `{18,}` here, not design's
|
|
33
|
+
* literal `{10,}` — at 10 the marker (22 chars) exceeds the minimum
|
|
34
|
+
* match (15 chars). Slack tokens are not format-fixed the way an AWS key
|
|
35
|
+
* id is, and real tokens run well past 18 characters past the prefix in
|
|
36
|
+
* practice, so this costs nothing against genuine matches while holding
|
|
37
|
+
* the invariant.
|
|
38
|
+
* (SPEC_DEVIATION from design.md C1's literal id/floor for these two rules;
|
|
39
|
+
* reasoned above — reported to the workflow.)
|
|
40
|
+
*/
|
|
41
|
+
declare const SanitizedBrand: unique symbol;
|
|
42
|
+
/**
|
|
43
|
+
* JSON-serialized payload that has passed {@link scrubCredentials}. Only
|
|
44
|
+
* constructible by calling that function.
|
|
45
|
+
*/
|
|
46
|
+
export type SanitizedPayloadJson = string & {
|
|
47
|
+
readonly [SanitizedBrand]: true;
|
|
48
|
+
};
|
|
49
|
+
export interface ScrubResult {
|
|
50
|
+
sanitized: SanitizedPayloadJson;
|
|
51
|
+
/** Count of replacements, per rule id. 0 for every rule on clean input. */
|
|
52
|
+
redactions: Record<string, number>;
|
|
53
|
+
total: number;
|
|
54
|
+
}
|
|
55
|
+
/** Every rule id, in the fixed order rules run — used to build the 0-map. */
|
|
56
|
+
export declare const RULE_IDS: readonly string[];
|
|
57
|
+
/**
|
|
58
|
+
* Scrub every v1 credential shape from `payloadJson`. Pure — identical input
|
|
59
|
+
* always produces identical output, with no IO or shared state.
|
|
60
|
+
*/
|
|
61
|
+
export declare function scrubCredentials(payloadJson: string): ScrubResult;
|
|
62
|
+
export {};
|
|
63
|
+
//# sourceMappingURL=credential-scrub.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"credential-scrub.d.ts","sourceRoot":"","sources":["../../../src/kernel/sanitize/credential-scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,CAAC,MAAM,cAAc,EAAE,OAAO,MAAM,CAAC;AAE5C;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAEhF,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAmED,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EAA2B,CAAC;AAElE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAkBjE"}
|
|
@@ -0,0 +1,119 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Credential scrubber — kernel leaf (XP-02 / TASK-XP-003).
|
|
3
|
+
*
|
|
4
|
+
* Narrow, recognizable credential-shape redaction for hook-ingested payloads.
|
|
5
|
+
* Consumed by `services/hooks` and `tools/` (the two production writers) and
|
|
6
|
+
* by `data/memory/observation-contract.ts`'s insert seam (which is what
|
|
7
|
+
* enforces the branded type below) — a cross-tier leaf, which is exactly
|
|
8
|
+
* what `kernel/` exists for (CLAUDE.md "Architecture" section: membership is
|
|
9
|
+
* the path prefix, there is no allowlist).
|
|
10
|
+
*
|
|
11
|
+
* v1 rule set is deliberately narrow (spec.md "XP-02 redaction v1 rule set"):
|
|
12
|
+
* PEM private-key blocks, JWTs, AWS access-key ids, OpenAI-style `sk-` keys,
|
|
13
|
+
* GitHub tokens, Slack tokens, and Bearer-scheme tokens. General PII/entropy
|
|
14
|
+
* detection is explicitly out of scope — over-redaction of legitimate code
|
|
15
|
+
* is the adjacent regression class this v1 deliberately avoids.
|
|
16
|
+
*
|
|
17
|
+
* No `assertSanitized` escape hatch: the branded `SanitizedPayloadJson` type
|
|
18
|
+
* is only constructible by running the real scrubber below. An assertion
|
|
19
|
+
* constructor would reopen the hole the brand exists to close.
|
|
20
|
+
*
|
|
21
|
+
* Non-growth invariant: scrubbing never makes the payload longer, keeping it
|
|
22
|
+
* sound against the pre-scrub `HOOKS_MAX_PAYLOAD_BYTES` cap in
|
|
23
|
+
* `hook-service.ts` (checked before this module ever runs). Each rule's
|
|
24
|
+
* `[REDACTED:<id>]` marker is sized to be no longer than that shape's
|
|
25
|
+
* minimum possible match. Two rules needed a small adjustment from
|
|
26
|
+
* design.md C1's literal draft to hold that exactly:
|
|
27
|
+
* - `aws-key` (design: `aws-key-id`): a real AWS access-key id is FIXED at
|
|
28
|
+
* exactly 20 characters (4-char prefix + 16 alphanumeric), so the
|
|
29
|
+
* unabridged id's marker (21 chars) would have made every redaction grow
|
|
30
|
+
* the payload by one byte. Dropping the "-id" suffix brings the marker
|
|
31
|
+
* to 18 chars, comfortably under 20.
|
|
32
|
+
* - `slack-token`: the near-miss floor is `{18,}` here, not design's
|
|
33
|
+
* literal `{10,}` — at 10 the marker (22 chars) exceeds the minimum
|
|
34
|
+
* match (15 chars). Slack tokens are not format-fixed the way an AWS key
|
|
35
|
+
* id is, and real tokens run well past 18 characters past the prefix in
|
|
36
|
+
* practice, so this costs nothing against genuine matches while holding
|
|
37
|
+
* the invariant.
|
|
38
|
+
* (SPEC_DEVIATION from design.md C1's literal id/floor for these two rules;
|
|
39
|
+
* reasoned above — reported to the workflow.)
|
|
40
|
+
*/
|
|
41
|
+
function markerFor(id) {
|
|
42
|
+
return `[REDACTED:${id}]`;
|
|
43
|
+
}
|
|
44
|
+
/** A rule whose whole match is replaced by its marker. */
|
|
45
|
+
function fullMatchRule(id, pattern) {
|
|
46
|
+
const marker = markerFor(id);
|
|
47
|
+
return {
|
|
48
|
+
id,
|
|
49
|
+
replace(text) {
|
|
50
|
+
let count = 0;
|
|
51
|
+
const replaced = text.replace(pattern, () => {
|
|
52
|
+
count++;
|
|
53
|
+
return marker;
|
|
54
|
+
});
|
|
55
|
+
return { text: replaced, count };
|
|
56
|
+
},
|
|
57
|
+
};
|
|
58
|
+
}
|
|
59
|
+
// PEM content is bounded to 8192 chars between BEGIN/END so a run of
|
|
60
|
+
// unterminated "-----BEGIN...-----" occurrences (adversarial input) cannot
|
|
61
|
+
// force each one to lazily scan the rest of a large payload looking for a
|
|
62
|
+
// match that never comes — real PEM bodies (even RSA-4096) are a few KiB at
|
|
63
|
+
// most, so this bound never clips a genuine key.
|
|
64
|
+
const PEM_PATTERN = /-----BEGIN [A-Z ]{0,32}PRIVATE KEY-----[\s\S]{0,8192}?-----END [A-Z ]{0,32}PRIVATE KEY-----/g;
|
|
65
|
+
const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
|
|
66
|
+
const AWS_KEY_PATTERN = /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g;
|
|
67
|
+
const SK_KEY_PATTERN = /\bsk-[A-Za-z0-9_-]{20,}\b/g;
|
|
68
|
+
const GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g;
|
|
69
|
+
const SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{18,}\b/g;
|
|
70
|
+
const BEARER_PATTERN = /(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})/g;
|
|
71
|
+
const RULES = [
|
|
72
|
+
// PEM first: fully consumes the block before any other rule can see
|
|
73
|
+
// inside it, and the substituted marker cannot itself match another rule.
|
|
74
|
+
fullMatchRule("pem", PEM_PATTERN),
|
|
75
|
+
fullMatchRule("jwt", JWT_PATTERN),
|
|
76
|
+
fullMatchRule("aws-key", AWS_KEY_PATTERN),
|
|
77
|
+
fullMatchRule("sk-key", SK_KEY_PATTERN),
|
|
78
|
+
fullMatchRule("github-token", GITHUB_TOKEN_PATTERN),
|
|
79
|
+
fullMatchRule("slack-token", SLACK_TOKEN_PATTERN),
|
|
80
|
+
// Runs last and keeps the `Bearer ` prefix literal, replacing only the
|
|
81
|
+
// token — running it last means a more specific rule above (e.g. a JWT
|
|
82
|
+
// used as a bearer token) already replaced its match with a marker whose
|
|
83
|
+
// characters fall outside this rule's charset, so it is not re-matched.
|
|
84
|
+
{
|
|
85
|
+
id: "bearer",
|
|
86
|
+
replace(text) {
|
|
87
|
+
let count = 0;
|
|
88
|
+
const replaced = text.replace(BEARER_PATTERN, (_m, prefix) => {
|
|
89
|
+
count++;
|
|
90
|
+
return `${prefix}${markerFor("bearer")}`;
|
|
91
|
+
});
|
|
92
|
+
return { text: replaced, count };
|
|
93
|
+
},
|
|
94
|
+
},
|
|
95
|
+
];
|
|
96
|
+
/** Every rule id, in the fixed order rules run — used to build the 0-map. */
|
|
97
|
+
export const RULE_IDS = RULES.map((r) => r.id);
|
|
98
|
+
/**
|
|
99
|
+
* Scrub every v1 credential shape from `payloadJson`. Pure — identical input
|
|
100
|
+
* always produces identical output, with no IO or shared state.
|
|
101
|
+
*/
|
|
102
|
+
export function scrubCredentials(payloadJson) {
|
|
103
|
+
const redactions = {};
|
|
104
|
+
for (const id of RULE_IDS)
|
|
105
|
+
redactions[id] = 0;
|
|
106
|
+
let text = payloadJson;
|
|
107
|
+
for (const rule of RULES) {
|
|
108
|
+
const { text: next, count } = rule.replace(text);
|
|
109
|
+
text = next;
|
|
110
|
+
redactions[rule.id] += count;
|
|
111
|
+
}
|
|
112
|
+
const total = Object.values(redactions).reduce((sum, n) => sum + n, 0);
|
|
113
|
+
return {
|
|
114
|
+
sanitized: text,
|
|
115
|
+
redactions,
|
|
116
|
+
total,
|
|
117
|
+
};
|
|
118
|
+
}
|
|
119
|
+
//# sourceMappingURL=credential-scrub.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"credential-scrub.js","sourceRoot":"","sources":["../../../src/kernel/sanitize/credential-scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAsBH,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,aAAa,EAAE,GAAG,CAAC;AAC5B,CAAC;AAED,0DAA0D;AAC1D,SAAS,aAAa,CAAC,EAAU,EAAE,OAAe;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7B,OAAO;QACL,EAAE;QACF,OAAO,CAAC,IAAY;YAClB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC1C,KAAK,EAAE,CAAC;gBACR,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,WAAW,GACf,8FAA8F,CAAC;AACjG,MAAM,WAAW,GAAG,iEAAiE,CAAC;AACtF,MAAM,eAAe,GAAG,0CAA0C,CAAC;AACnE,MAAM,cAAc,GAAG,4BAA4B,CAAC;AACpD,MAAM,oBAAoB,GAAG,kEAAkE,CAAC;AAChG,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAChE,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAE/D,MAAM,KAAK,GAAW;IACpB,oEAAoE;IACpE,0EAA0E;IAC1E,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC;IACjC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC;IACjC,aAAa,CAAC,SAAS,EAAE,eAAe,CAAC;IACzC,aAAa,CAAC,QAAQ,EAAE,cAAc,CAAC;IACvC,aAAa,CAAC,cAAc,EAAE,oBAAoB,CAAC;IACnD,aAAa,CAAC,aAAa,EAAE,mBAAmB,CAAC;IACjD,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE;QACE,EAAE,EAAE,QAAQ;QACZ,OAAO,CAAC,IAAY;YAClB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,MAAc,EAAE,EAAE;gBACnE,KAAK,EAAE,CAAC;gBACR,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;KACF;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAsB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAElE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,EAAE,IAAI,QAAQ;QAAE,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAE9C,IAAI,IAAI,GAAG,WAAW,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,GAAG,IAAI,CAAC;QACZ,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvE,OAAO;QACL,SAAS,EAAE,IAA4B;QACvC,UAAU;QACV,KAAK;KACN,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hook-service.d.ts","sourceRoot":"","sources":["../../../src/services/hooks/hook-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,
|
|
1
|
+
{"version":3,"file":"hook-service.d.ts","sourceRoot":"","sources":["../../../src/services/hooks/hook-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AAKnC,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,yCAAyC;AACzC,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAcD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,aAAa,EAClB,eAAe,EAAE,MAAM,GACtB,gBAAgB,CA0DlB;AAID,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAQD,qBAAa,WAAW;IACtB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,IAAI,GAAE,kBAAuB;IAWzC,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB;IAI9C;;;;;;OAMG;IACG,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;IAMpD;;;;;OAKG;IACG,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAmB7C,mBAAmB;CA2DlC;AAED,qBAAa,eAAgB,SAAQ,KAAK;aACZ,IAAI,EAAE,GAAG,GAAG,GAAG;gBAAf,IAAI,EAAE,GAAG,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM;CAI7D;AA6DD,wBAAgB,cAAc,IAAI,WAAW,CAI5C;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}
|
|
@@ -21,6 +21,7 @@ import { WriterQueue } from "./writer-queue.js";
|
|
|
21
21
|
import { extractCategory } from "./observation-extractor.js";
|
|
22
22
|
import { observationConsolidationJob } from "../jobs/observation-consolidation-job.js";
|
|
23
23
|
import { getAttributionResolver, } from "./attribution-resolver.js";
|
|
24
|
+
import { scrubCredentials } from "../../kernel/sanitize/credential-scrub.js";
|
|
24
25
|
/** No-op bridge default (used before the real job is wired / in tests). */
|
|
25
26
|
class NoopBridge {
|
|
26
27
|
maybeRun() { }
|
|
@@ -160,13 +161,25 @@ export class HookService {
|
|
|
160
161
|
// Enqueue may throw QueueSaturatedError BEFORE any side effect; pinning
|
|
161
162
|
// happens only after admission survives (HAR-04, no pin on rejection).
|
|
162
163
|
void this.queue.enqueue(async () => {
|
|
164
|
+
// XP-02 boundary: scrub before persisting so no writer can land raw
|
|
165
|
+
// credential-shaped content (spec.md P1 "Passive Capture stops
|
|
166
|
+
// persisting raw secrets"). scrubCredentials() is the only way to
|
|
167
|
+
// produce the branded SanitizedPayloadJson InsertableObservation.insert
|
|
168
|
+
// requires.
|
|
169
|
+
const scrub = scrubCredentials(JSON.stringify(ev.payload));
|
|
170
|
+
if (scrub.total > 0) {
|
|
171
|
+
logger.debug("hook payload redacted before persist", {
|
|
172
|
+
redactions: scrub.redactions,
|
|
173
|
+
total: scrub.total,
|
|
174
|
+
});
|
|
175
|
+
}
|
|
163
176
|
const obs = {
|
|
164
177
|
id,
|
|
165
178
|
projectId: attribution.projectId,
|
|
166
179
|
sessionId: ev.sessionId,
|
|
167
180
|
source: ev.event,
|
|
168
181
|
category: extractCategory(ev.event, ev.payload),
|
|
169
|
-
payloadJson:
|
|
182
|
+
payloadJson: scrub.sanitized,
|
|
170
183
|
importance: ev.importance,
|
|
171
184
|
createdAt: ev.ts,
|
|
172
185
|
agentId: ev.agentId,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hook-service.js","sourceRoot":"","sources":["../../../src/services/hooks/hook-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GAIjB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EACL,sBAAsB,GAEvB,MAAM,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"hook-service.js","sourceRoot":"","sources":["../../../src/services/hooks/hook-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GAIjB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EACL,sBAAsB,GAEvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAmC7E,2EAA2E;AAC3E,MAAM,UAAU;IACd,QAAQ,KAAU,CAAC;CACpB;AAED,+EAA+E;AAE/E,SAAS,KAAK,CAAC,CAAS,EAAE,EAAU,EAAE,EAAU;IAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAkB,EAClB,eAAuB;IAEvB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACzE,CAAC;IAED,wDAAwD;IACxD,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,GAAG;YACT,KAAK,EAAE,uBAAuB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;SAClD,CAAC;IACJ,CAAC;IAED,gCAAgC;IAChC,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IACjF,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IAC/E,CAAC;IAED,YAAY;IACZ,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,GAAG;YACT,KAAK,EAAE,oCAAoC,eAAe,GAAG;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAE5F,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,MAAM,OAAO,GACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAE1E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;KAC5F,CAAC;AACJ,CAAC;AAeD,gFAAgF;AAChF,SAAS,qBAAqB,CAAC,OAAgC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC;IACpD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,MAAM,OAAO,WAAW;IACb,KAAK,CAAmB;IACxB,KAAK,CAAc;IACnB,MAAM,CAAgB;IACtB,QAAQ,CAA0B;IAC1B,eAAe,CAAS;IACxB,SAAS,CAAe;IAEzC,YAAY,OAA2B,EAAE;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACjD,MAAM,aAAa,GAAG,eAAe,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;QAC/D,IAAI,CAAC,eAAe;YAClB,IAAI,CAAC,eAAe,IAAI,eAAe,EAAE,CAAC,eAAe,CAAC;QAC5D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,sBAAsB,EAAE,CAAC;IAC5D,CAAC;IAED,QAAQ,CAAC,GAAkB;QACzB,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,GAAkB;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,IAAqB;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;QACrE,CAAC;QACD,2BAA2B;QAC3B,MAAM,SAAS,GAAsB,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,8CAA8C;QAC9C,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,EAAmB;QACnD,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC9C,eAAe,EAAE,EAAE,CAAC,SAAS;YAC7B,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,GAAG,EAAE,qBAAqB,CAAC,EAAE,CAAC,OAAO,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,wEAAwE;QACxE,uEAAuE;QACvE,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YACjC,oEAAoE;YACpE,+DAA+D;YAC/D,kEAAkE;YAClE,wEAAwE;YACxE,YAAY;YACZ,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;oBACnD,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,GAA0B;gBACjC,EAAE;gBACF,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,SAAS,EAAE,EAAE,CAAC,SAAS;gBACvB,MAAM,EAAE,EAAE,CAAC,KAAK;gBAChB,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC;gBAC/C,WAAW,EAAE,KAAK,CAAC,SAAS;gBAC5B,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,SAAS,EAAE,EAAE,CAAC,EAAE;gBAChB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,iBAAiB,EAAE,WAAW,CAAC,MAAM;aACtC,CAAC;YACF,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACvB,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE;oBACvC,aAAa,EAAE,GAAG,CAAC,EAAE;oBACrB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;oBACrC,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,oEAAoE;gBACpE,iEAAiE;gBACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;oBACxC,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,KAAK,EAAG,CAAW,CAAC,OAAO;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,2EAA2E;QAC3E,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACZ;IAA5B,YAA4B,IAAe,EAAE,OAAe;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAW;QAEzC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAE5E,MAAM,cAAc,GAAG;IACrB,OAAO,EAAE,IAAI;IACb,eAAe,EAAE,MAAM;IACvB,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;IAC1B,MAAM,EAAE;QACN,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,CAAC;QAClB,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;QAC5B,SAAS,EAAE,CAAC;KACb;CACF,CAAC;AAEF,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAA0B,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,SAAS,oBAAoB;IAC3B,IAAI,CAAC;QACH,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,+CAA+C;QAC/C,IACE,2BAA2B;YAC3B,OAAO,2BAA2B,CAAC,QAAQ,KAAK,UAAU,EAC1D,CAAC;YACD,OAAO,2BAA4C,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IACD,OAAO,IAAI,UAAU,EAAE,CAAC;AAC1B,CAAC;AAED,IAAI,aAAa,GAAuB,IAAI,CAAC;AAE7C,MAAM,UAAU,cAAc;IAC5B,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,aAAa,GAAG,IAAI,WAAW,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB;IAC9B,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"compact_snapshot.d.ts","sourceRoot":"","sources":["../../src/tools/compact_snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAU,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,2CAA2C,CAAC;
|
|
1
|
+
{"version":3,"file":"compact_snapshot.d.ts","sourceRoot":"","sources":["../../src/tools/compact_snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAU,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,2CAA2C,CAAC;AAUnD,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,qBAAa,mBAAoB,YAAW,YAAY;IACtD,IAAI,SAAsB;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAmB;IAClD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA0B;gBAEhD,OAAO,GAAE,0BAA+B;IAIpD,WAAW,SAMgF;IAC3F,WAAW;;;;;;;;;;;;;;;;;;;;;;MAwBT;IAEI,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC;CAsGrD"}
|
|
@@ -17,6 +17,7 @@ import { logger } from "@massa-ai/shared";
|
|
|
17
17
|
import { getObservationStore, newObservationId, } from "../data/memory/observation-repository.js";
|
|
18
18
|
import { getCompactionSnapshotService } from "../services/hooks/compaction-snapshot-service.js";
|
|
19
19
|
import { getAttributionResolver, } from "../services/hooks/attribution-resolver.js";
|
|
20
|
+
import { scrubCredentials } from "../kernel/sanitize/credential-scrub.js";
|
|
20
21
|
export class CompactSnapshotTool {
|
|
21
22
|
name = "compact_snapshot";
|
|
22
23
|
storeOverride;
|
|
@@ -74,19 +75,29 @@ export class CompactSnapshotTool {
|
|
|
74
75
|
persistedId = newObservationId();
|
|
75
76
|
try {
|
|
76
77
|
const attribution = await (this.resolverOverride ?? getAttributionResolver()).resolve({ callerProjectId: projectId, sessionId, cwd });
|
|
78
|
+
// XP-02 boundary: this writer bypasses HookService entirely (it
|
|
79
|
+
// persists via `/api/v1/hook/compact-snapshot`), so it must apply
|
|
80
|
+
// the same scrub-before-persist boundary independently.
|
|
81
|
+
const scrub = scrubCredentials(JSON.stringify({
|
|
82
|
+
snapshot: snapshot.xml,
|
|
83
|
+
eventCount: snapshot.eventCount,
|
|
84
|
+
compactCount: snapshot.compactCount,
|
|
85
|
+
generatedAt: snapshot.generatedAt,
|
|
86
|
+
sectionCount: snapshot.sections.length,
|
|
87
|
+
}));
|
|
88
|
+
if (scrub.total > 0) {
|
|
89
|
+
logger.debug("compact_snapshot payload redacted before persist", {
|
|
90
|
+
redactions: scrub.redactions,
|
|
91
|
+
total: scrub.total,
|
|
92
|
+
});
|
|
93
|
+
}
|
|
77
94
|
store.insert({
|
|
78
95
|
id: persistedId,
|
|
79
96
|
projectId: attribution.projectId,
|
|
80
97
|
sessionId,
|
|
81
98
|
source: "pre-compact",
|
|
82
99
|
category: "compaction-snapshots",
|
|
83
|
-
payloadJson:
|
|
84
|
-
snapshot: snapshot.xml,
|
|
85
|
-
eventCount: snapshot.eventCount,
|
|
86
|
-
compactCount: snapshot.compactCount,
|
|
87
|
-
generatedAt: snapshot.generatedAt,
|
|
88
|
-
sectionCount: snapshot.sections.length,
|
|
89
|
-
}),
|
|
100
|
+
payloadJson: scrub.sanitized,
|
|
90
101
|
importance: 0.8,
|
|
91
102
|
createdAt: Date.now(),
|
|
92
103
|
attributionSource: attribution.source,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"compact_snapshot.js","sourceRoot":"","sources":["../../src/tools/compact_snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAA8B,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,EACL,sBAAsB,GAEvB,MAAM,2CAA2C,CAAC;
|
|
1
|
+
{"version":3,"file":"compact_snapshot.js","sourceRoot":"","sources":["../../src/tools/compact_snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAA8B,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,EACL,sBAAsB,GAEvB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAgB1E,MAAM,OAAO,mBAAmB;IAC9B,IAAI,GAAG,kBAAkB,CAAC;IACT,aAAa,CAAoB;IACjC,gBAAgB,CAA2B;IAE5D,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3C,CAAC;IACD,WAAW,GACT,+EAA+E;QAC/E,+EAA+E;QAC/E,8EAA8E;QAC9E,4EAA4E;QAC5E,+FAA+F;QAC/F,wFAAwF,CAAC;IAC3F,WAAW,GAAG;QACZ,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,sCAAsC;aACpD;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,oCAAoC;aAClD;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,KAAK;gBACd,WAAW,EACT,oFAAoF;aACvF;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sIAAsI;aACzI;SACF;QACD,QAAQ,EAAE,CAAC,WAAW,CAAC;KACxB,CAAC;IAEF,KAAK,CAAC,MAAM,CAAC,MAAe;QAC1B,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,MAA+B,CAAC;QAEnG,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,mBAAmB,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC7B,SAAS;gBACT,SAAS;gBACT,YAAY,EAAE,CAAC;aAChB,CAAC,CAAC;YAEH,0EAA0E;YAC1E,6DAA6D;YAC7D,IAAI,WAA+B,CAAC;YACpC,IAAI,OAAO,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBACvC,WAAW,GAAG,gBAAgB,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,MAAM,CACxB,IAAI,CAAC,gBAAgB,IAAI,sBAAsB,EAAE,CAClD,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC1D,gEAAgE;oBAChE,kEAAkE;oBAClE,wDAAwD;oBACxD,MAAM,KAAK,GAAG,gBAAgB,CAC5B,IAAI,CAAC,SAAS,CAAC;wBACb,QAAQ,EAAE,QAAQ,CAAC,GAAG;wBACtB,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;wBACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;qBACvC,CAAC,CACH,CAAC;oBACF,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;wBACpB,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;4BAC/D,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;yBACnB,CAAC,CAAC;oBACL,CAAC;oBACD,KAAK,CAAC,MAAM,CAAC;wBACX,EAAE,EAAE,WAAW;wBACf,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,SAAS;wBACT,MAAM,EAAE,aAAa;wBACrB,QAAQ,EAAE,sBAAsB;wBAChC,WAAW,EAAE,KAAK,CAAC,SAAS;wBAC5B,UAAU,EAAE,GAAG;wBACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;wBACrB,iBAAiB,EAAE,WAAW,CAAC,MAAM;qBACtC,CAAC,CAAC;oBACH,uEAAuE;oBACvE,CAAC,IAAI,CAAC,gBAAgB,IAAI,sBAAsB,EAAE,CAAC,CAAC,UAAU,CAC5D,SAAS,EACT,WAAW,CAAC,SAAS,EACrB,WAAW,CAAC,MAAM,CACnB,CAAC;oBACF,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;wBACzC,WAAW;wBACX,SAAS;wBACT,KAAK,EAAE,QAAQ,CAAC,KAAK;qBACtB,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;wBAC1D,KAAK,EAAG,CAAW,CAAC,OAAO;qBAC5B,CAAC,CAAC;oBACH,WAAW,GAAG,SAAS,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,QAAQ,EAAE,QAAQ,CAAC,GAAG;oBACtB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;oBACtC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACtC,QAAQ,EAAE,CAAC,CAAC,QAAQ;wBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,cAAc,EAAE,CAAC,CAAC,cAAc;qBACjC,CAAC,CAAC;oBACH,WAAW;oBACX,WAAW,EAAE,QAAQ,CAAC,WAAW;iBAClC;gBACD,QAAQ,EAAE;oBACR,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;iBAC5C;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAc,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wCAAyC,KAAe,CAAC,OAAO,EAAE;aAC1E,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@massa-ai/core",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.19.0",
|
|
4
4
|
"author": "luizgmassa",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -44,7 +44,7 @@
|
|
|
44
44
|
"@ai-sdk/google": "^3.0.19",
|
|
45
45
|
"@ai-sdk/mistral": "^3.0.17",
|
|
46
46
|
"@ai-sdk/openai": "^3.0.24",
|
|
47
|
-
"@massa-ai/shared": "1.
|
|
47
|
+
"@massa-ai/shared": "1.19.0",
|
|
48
48
|
"@prisma/adapter-pg": "^7.5.0",
|
|
49
49
|
"@prisma/client": "^7.5.0",
|
|
50
50
|
"@prisma/client-runtime-utils": "^7.3.0",
|