@mirrowel/opencode-openshare 0.2.0 → 0.3.0-dev.1

package/src/dialogs.tsx

@@ -163,11 +163,11 @@ function estimatedVisualRows(message: string, width: number) {
   return message.split(/\r?\n/).reduce((rows, line) => rows + Math.max(1, Math.ceil(line.length / Math.max(1, width))), 0)
 }
 
-/** Deterministic character-level pre-wrap (parity lesson: opentui's
- * word wrap cannot break unbreakable tokens like a JSON policy blob, so
- * "wrapped" text still escaped the dialog border — live-caught). Both the
- * [i] pane and InfoDialog render THESE lines; the row estimate uses the
- * same output, so heights match what renders. */
+/** Deterministic character-level pre-wrap: opentui's word wrap cannot
+ * break unbreakable tokens like a JSON policy blob, so "wrapped" text still
+ * escapes the dialog border. Both the [i] pane and InfoDialog render THESE
+ * lines; the row estimate uses the same output, so heights match what
+ * renders. */
 export function preWrap(text: string, width: number): string[] {
   const out: string[] = []
   for (const raw of text.split(/\r?\n/)) {
@@ -229,10 +229,9 @@ function InfoLines(props: { api: TuiPluginApi; lines: string[] }): JSX.Element {
   )
 }
 
-/** title column cap (family menuTitleWidth, live-caught need: a server URL
- * as a row title stretched the column toward half the dialog — the owner
- * capped it further: full URLs belong in the [i] pane, not the row).
- * Capped + ellipsized. */
+/** Title column cap (family menuTitleWidth): a server URL as a row title
+ * would otherwise stretch the column toward half the dialog. Full URLs
+ * belong in the [i] pane, not the row. Capped and ellipsized. */
 function menuTitleWidth(width: DialogWidth, options: readonly { title: string }[]) {
   const longest = Math.max(0, ...options.map((option) => option.title.length)) + 2
   if (width === "xlarge") return Math.min(Math.max(20, longest), 28)
@@ -246,13 +245,12 @@ function ellipsize(text: string, width: number) {
 
 /** OpenShare visual frame: rounded accent border + accent title row. The
  * logic inside the menus stays the ported family pattern; this wrapper is
- * purely presentation (owner-preferred styling). Natural width — the host
- * dialog panel provides the container; the border hugs the content. */
-// Frame note (live-caught): the HOST dialog panel renders plugin content
-// with paddingTop=1 (opencode dialog.tsx), so a BORDERED frame always
-// showed a dead panel strip above its top border. Borderless family
-// shape + a solid accent rule under the title: zero dead space, accent
-// identity kept.
+ * purely presentation. Natural width: the host dialog panel provides the
+ * container and the border hugs the content. */
+// Frame note: the HOST dialog panel renders plugin content with
+// paddingTop=1 (opencode dialog.tsx), so a BORDERED frame always shows a
+// dead panel strip above its top border. Borderless family shape plus a
+// solid accent rule under the title: zero dead space, accent identity kept.
 function DialogFrame(props: { api: TuiPluginApi; title: string; children: JSX.Element }): JSX.Element {
   const theme = () => props.api.theme.current
   return (
@@ -323,8 +321,8 @@ export function MenuDialog<Value>(props: {
   const dimensions = useTerminalDimensions()
   const listHeight = createMemo(() => cappedHeight(props.options.length, maxRows(props.api, dimensions().height, 12, 4), 4))
   // fixed title column shared by every row (family menuTitleWidth): flex
-  // columns stagger per-row because flex splits by content — a computed
-  // width is what makes the value/description column align (live-caught).
+  // columns stagger per row because flex splits by content, so a computed
+  // width is what makes the value/description column align.
   const width = dialogWidthOf(props.api)
   const titleWidth = createMemo(() => menuTitleWidth(width, props.options))
   const hasHelp = createMemo(() => props.options.some((option) => option.help))
@@ -352,8 +350,8 @@ export function MenuDialog<Value>(props: {
     })
   // [i] pane sections: "## Header" lines in help split sections; the pane
   // height comes from the CONTENT (pre-wrapped rows), capped by the same
-  // dialog metrics — no longer bound to the spawning menu's list height
-  // (live-caught: a 3-row menu gave a 3-row info pane).
+  // dialog metrics rather than the spawning menu's list height (which gave
+  // a 3-row menu a 3-row info pane).
   const helpSections = createMemo(() => {
     const raw = current()?.help ?? ""
     const sections: Array<{ title: string; lines: string[] }> = [{ title: "", lines: [] }]
@@ -602,11 +600,10 @@ function claimDialog(api: TuiPluginApi): () => void {
   pendingDialog = release
   return release
 }
-/** showMenuOnce, family discipline with the flicker fix (2026-10-19):
- * done() does NOT clear the host stack — the next dialog's replace() is an
- * atomic swap, so clearing first paints one empty frame (the esc-to-parent
- * flicker, live-caught). Chain ends clear explicitly (command exits,
- * settings exit). */
+/** showMenuOnce, family discipline: done() does NOT clear the host stack,
+ * because the next dialog's replace() is an atomic swap and clearing first
+ * paints one empty frame (the esc-to-parent flicker). Chain ends clear
+ * explicitly (command exits, settings exit). */
 export function showMenuOnce<Value>(api: TuiPluginApi, props: { title: string; options: MenuOption<Value>[]; current?: Value; hint?: string }): Promise<Value | undefined> {
   return new Promise((resolve) => {
     let settled = false
@@ -627,11 +624,11 @@ export function showMenuOnce<Value>(api: TuiPluginApi, props: { title: string; o
 }
 
 // --- InfoDialog (config-studio port): a real message body ----------------------
-// Content-derived height, pre-wrapped (char-level — word wrap cannot break
+// Content-derived height, pre-wrapped (char-level: word wrap cannot break
 // JSON blobs), semantically styled lines, page/home/end keys, and an action
-// footer with buttons + key shortcuts. Replaces the hint-as-message menus
-// for confirm/alert (whose single overflow-hidden line clipped destructive
-// prompts mid-URL — live-caught).
+// footer with buttons + key shortcuts. Replaces the hint-as-message menus for
+// confirm/alert, whose single overflow-hidden line clipped destructive
+// prompts mid-URL.
 
 export type DialogAction = { title: string; value: string; key?: string; danger?: boolean }
 
@@ -772,9 +769,9 @@ export function showAlertMenu(api: TuiPluginApi, props: { title: string; message
 
 // --- prompt (text entry — the one custom piece) -------------------------------
 
-// Full printable ASCII (parity fix, live-caught class: the lowercase-only
-// set made uppercase CREATE_TOKENs and codes UNTYPEABLE). Space is bound
-// separately below; escape is the back binding, so it's excluded.
+// Full printable ASCII: a lowercase-only set makes uppercase
+// CREATE_TOKENs and codes UNTYPEABLE. Space is bound separately below;
+// escape is the back binding, so it is excluded.
 const PROMPT_CHARS = [
   ..."abcdefghijklmnopqrstuvwxyz",
   ..."ABCDEFGHIJKLMNOPQRSTUVWXYZ",

package/src/redact.ts

@@ -0,0 +1,134 @@
+/**
+ * Client-only redaction + light path transform (Wave 3 trust).
+ *
+ * Owner verdict: the server stays dumb - the client controls what leaves
+ * the machine. This pass runs once at enqueue (the single choke point
+ * every item crosses before any transport) on UNGATED shares only: a
+ * share with login+pass is private from casual observers already, and
+ * redacting there would corrupt content the server owner can see anyway
+ * (documented caveat: NOT private from the server owner until Wave 3b
+ * encryption lands).
+ *
+ * Extending: add a detector to BUILTINS (fork-friendly registry) or set
+ * `redact.patterns` in the config (regex source strings, global flag).
+ */
+
+/** A detector: stable `kind` names the marker, e.g. `[redacted:aws-key]`. */
+export type RedactRule = { kind: string; re: RegExp }
+
+export const BUILTINS: RedactRule[] = [
+  { kind: "aws-key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { kind: "gh-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g },
+  { kind: "gh-token", re: /\bgithub_pat_[A-Za-z0-9_]{22,255}\b/g },
+  { kind: "api-key", re: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+  { kind: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+  { kind: "google-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { kind: "bearer", re: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi },
+  // PEM private-key blocks (whole block)
+  { kind: "private-key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+  // .env style assignments for secret-shaped names
+  { kind: "env-secret", re: /(?<![A-Za-z0-9_])(?:export\s+)?[A-Z0-9_]*(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|CREDENTIALS?)[A-Z0-9_]*\s*=\s*\S+/g },
+  // URL connection strings with embedded passwords (password masked)
+  { kind: "conn-string", re: /\b[a-z][a-z0-9+.-]*:\/\/[^:@/\s"']+:[^@/\s"']{4,}@/gi },
+]
+
+/** Config-supplied rules (regex source strings, applied globally). */
+function compile(patterns: unknown): RedactRule[] {
+  if (!Array.isArray(patterns)) return []
+  const out: RedactRule[] = []
+  for (const p of patterns) {
+    if (typeof p !== "string" || !p) continue
+    try {
+      out.push({ kind: "user", re: new RegExp(p, "g") })
+    } catch {
+      // a broken user regex must never kill sharing - skip it
+    }
+  }
+  return out
+}
+
+export type RedactionHit = { kind: string; sample: string }
+
+/** Home-directory prefix -> `~`; applied consistently to session.directory
+ * AND tool path fields so viewer-side relativization still works (both
+ * ends share the ~-prefixed form). */
+export function tildePath(p: string, home: string): string {
+  if (!p || !home || p.length <= home.length) return p
+  const norm = (s: string) => s.replace(/[\\/]+/g, "/").replace(/\/$/, "")
+  const np = norm(p)
+  const nh = norm(home)
+  if (np === nh) return "~"
+  if (np.startsWith(nh + "/")) return "~" + np.slice(nh.length)
+  return p
+}
+
+const PATH_KEYS = new Set(["file", "path", "filePath", "cwd", "directory", "root"])
+
+type Opts = { rules: RedactRule[]; home: string; enabled: boolean }
+type Stats = { hits: RedactionHit[]; changed: boolean }
+
+/**
+ * Apply redaction (when enabled) + the light path transform to one
+ * contract item. Returns the ORIGINAL untouched when nothing matched
+ * (zero-copy fast path for clean sessions); otherwise a mutated deep
+ * clone - the host's live object is never touched.
+ */
+export function redactItem(item: unknown, opts: Opts): { item: unknown; hits: RedactionHit[] } {
+  const flat = JSON.stringify(item) ?? "null"
+  const needRedact = opts.enabled && opts.rules.some((r) => { r.re.lastIndex = 0; return r.re.test(flat) })
+  const needPaths = !!opts.home && flat.includes(opts.home)
+  if (!needRedact && !needPaths) return { item, hits: [] }
+  const clone = JSON.parse(flat) as unknown
+  const stats: Stats = { hits: [], changed: false }
+  walk(clone, opts, stats)
+  return { item: clone, hits: stats.hits }
+}
+
+function walk(node: unknown, opts: Opts, stats: Stats, key?: string): void {
+  if (Array.isArray(node)) {
+    for (let i = 0; i < node.length; i++) {
+      const v = node[i]
+      if (typeof v === "string") node[i] = applyString(v, opts, stats, key)
+      else walk(v, opts, stats, key)
+    }
+    return
+  }
+  if (node && typeof node === "object") {
+    for (const [k, v] of Object.entries(node as Record<string, unknown>)) {
+      if (typeof v === "string") (node as Record<string, unknown>)[k] = applyString(v, opts, stats, k)
+      else walk(v, opts, stats, k)
+    }
+  }
+}
+
+function applyString(v: string, opts: Opts, stats: Stats, key?: string): string {
+  let out = v
+  if (opts.enabled) {
+    for (const r of opts.rules) {
+      r.re.lastIndex = 0
+      out = out.replace(r.re, (full) => {
+        if (stats.hits.length < 8 && !stats.hits.some((h) => h.kind === r.kind)) {
+          stats.hits.push({ kind: r.kind, sample: full.slice(0, 60) })
+        }
+        stats.changed = true
+        if (r.kind === "conn-string") {
+          // keep scheme://user, mask the password, keep @host
+          const at = full.lastIndexOf("@")
+          const colon = full.indexOf(":", full.indexOf("://") + 3) + 1
+          if (at > colon && colon > 0) return full.slice(0, colon) + "[redacted:conn-string]" + full.slice(at)
+        }
+        return `[redacted:${r.kind}]`
+      })
+    }
+  }
+  if (key && PATH_KEYS.has(key) && opts.home && out.includes(opts.home)) {
+    out = tildePath(out, opts.home)
+    stats.changed = true
+  }
+  return out
+}
+
+/** All active rules (built-ins + compiled user patterns). */
+export function activeRules(userPatterns: unknown): RedactRule[] {
+  return [...BUILTINS, ...compile(userPatterns)]
+}