@misaka-net/misakanet-setup 0.5.6 → 0.7.0

package/hook/checkpoint_reminder.mjs

@@ -226,6 +226,94 @@ function failureText(payload) {
   return '';
 }
 
+/**
+ * Deterministic redaction — the query must not carry the machine's secrets out of it.
+ *
+ * Issue #3692: the rules block used to *ask* the agent to redact, and an instruction is
+ * only a request. When the model did not comply, the internal table name, the home
+ * directory path or the token left the machine inside a search query. This table is the
+ * mechanical version of that rule: it runs on the error text before the fragment is
+ * printed into the agent's context, and again before anything is sent over the network.
+ * Redacting only at the network call would not be enough — the un-redacted text would
+ * still be in the agent's context, and the agent's own `misakanet_search` call would
+ * carry it.
+ *
+ * The ids are the server's (`workers/lib/redact-patterns.json`), so both ends name the
+ * same classes and the client never invents a rule the server does not know. Real
+ * domains and personal names are deliberately NOT redacted: the corpus is indexed by error
+ * text, and over-redaction would cost search quality for a leak that is not in scope.
+ *
+ * One path segment: anything but a space, a separator or punctuation that would end the
+ * segment (so a trailing comma or bracket in prose stays outside the match).
+ */
+const SEG = "[^\\s/\\\\'\"<>,;:!?()\\[\\]{}]";
+// A path only counts as a *filesystem* path when it starts at a known root, or when its
+// last segment carries a file extension. Without that, every API route in the corpus
+// ("/api/v1/users", "/oauth/token") would be swallowed — and the corpus is indexed by
+// error text, so a swallowed route destroys the lesson it belongs to. The roots are
+// case-sensitive, except "Users" and "Volumes", which are written in capitals by
+// convention but arrive in every casing.
+const FS_ROOTS = "(?:home|root|var|opt|etc|usr|tmp|mnt|srv|data|private|workspace|app|code|project"
+  + "|[Uu][Ss][Ee][Rr][Ss]|[Vv][Oo][Ll][Uu][Mm][Ee][Ss])";
+const FILE_EXT = "[A-Za-z][A-Za-z0-9_\\-]*";
+
+const REDACT_RULES = [
+  // A Unix absolute path: either it starts at a known filesystem root, or its last
+  // segment has a file extension ("/opt/app/config.yaml"). The look-behind keeps it out
+  // of a URL ("https://host/a/b" — the slash follows a word character) and out of a
+  // relative path; "file://" is matched as a whole, because its inner path is a path.
+  { id: 'abs_path', pattern: `(?<![A-Za-z0-9_:/~.\\-])(?:file://)?/(?:${FS_ROOTS}(?:/${SEG}+)+|(?:${SEG}+/)*${SEG}*\\.${FILE_EXT})`, flags: 'g', replacement: '<PATH>' },
+  // A Windows path, with either separator. The look-behind keeps the "s://" of a URL out.
+  { id: 'windows_path', pattern: `(?<![A-Za-z0-9_])[A-Za-z]:[\\\\/](?:${SEG}+[\\\\/])*${SEG}*`, flags: 'g', replacement: '<PATH>' },
+  // The secret rules are the server's shapes with two additions its copy does not need: a
+  // word boundary (so "task_identifier" is not read as the key "sk_identifier") and a floor
+  // of six characters on the bearer value (so the phrase "Bearer token" in prose survives).
+  // A real credential is longer than that; a real key is not glued to the end of a word.
+  { id: 'bearer_token', pattern: '(?<![A-Za-z0-9])(?:Bearer|Authorization)\\s+[A-Za-z0-9\\-._~+/]{6,}=*', flags: 'gi', replacement: '[REDACTED:bearer_token]' },
+  { id: 'github_token', pattern: '(?<![A-Za-z0-9])(?:ghp|gho|ghu|ghs|ghr|github_pat)_[A-Za-z0-9]{10,}', flags: 'g', replacement: '[REDACTED:github_token]' },
+  { id: 'api_key', pattern: '(?<![A-Za-z0-9])(?:sk|pk|rk|ak)[_-][A-Za-z0-9]{10,}', flags: 'g', replacement: '[REDACTED:api_key]' },
+  // The top-level domain has to be alphabetic: "foo@1.2.3" is an npm version spec, and
+  // eating it would destroy the version the reporter was talking about.
+  { id: 'email', pattern: '[A-Za-z0-9._%+\\-]+@[A-Za-z0-9\\-]+(?:\\.[A-Za-z0-9\\-]*)*\\.[A-Za-z]{2,}', flags: 'g', replacement: '<REDACTED:email>' },
+];
+
+const COMPILED_REDACT_RULES = REDACT_RULES.map((rule) => ({
+  ...rule,
+  regex: new RegExp(rule.pattern, rule.flags),
+}));
+
+/**
+ * Replace every secret the table knows about. Never throws: a broken rule must not become
+ * a failed hook (the hook's contract is that it cannot break a session).
+ */
+function redact(text) {
+  let out = String(text);
+  for (const rule of COMPILED_REDACT_RULES) {
+    try {
+      out = out.replace(rule.regex, rule.replacement);
+    } catch (err) {
+      debug(`redaction rule ${rule.id} failed: ${err}`);
+    }
+  }
+  return out;
+}
+
+/**
+ * Cut the query to a length, without cutting a placeholder in half: a truncated
+ * `<REDACTED:email` is noise the agent would carry into its own call.
+ *
+ * Counted in code points, not UTF-16 units, so this and the Python twin cut in the same
+ * place — the parity test compares their stdout byte for byte.
+ */
+function clip(text, limit) {
+  const chars = Array.from(text);
+  if (chars.length <= limit) return text;
+  let cut = chars.slice(0, limit).join('');
+  const open = cut.lastIndexOf('<');
+  if (open !== -1 && cut.indexOf('>', open) === -1) cut = cut.slice(0, open);
+  return cut;
+}
+
 function target() {
   const configured = (process.env.MISAKANET_ENDPOINT || CANONICAL_ENDPOINT).trim();
   const envToken = (process.env.MISAKANET_TOKEN || '').trim();
@@ -251,7 +339,9 @@ async function search(query) {
       signal: controller.signal,
       body: JSON.stringify({
         jsonrpc: '2.0', id: 1, method: 'tools/call',
-        params: { name: 'misakanet_search', arguments: { query: query.slice(0, 300), top: 1, detail: 'summary' } },
+        // Redacted again on the way out: the fragment is already redacted, but this is the
+        // only place where the text actually leaves the machine, so it gets its own gate.
+        params: { name: 'misakanet_search', arguments: { query: redact(query).slice(0, 300), top: 1, detail: 'summary' } },
       }),
     });
     clearTimeout(timer);
@@ -302,7 +392,9 @@ function promptMode(payload) {
 async function failureMode(payload) {
   const text = failureText(payload);
   if (!text) return;
-  const fragment = text.split(/\s+/).join(' ').slice(0, 120);
+  // Redact first, cut second: the query the agent is told to search with must not carry a
+  // path, an address or a token, and the agent may copy it into its own later call.
+  const fragment = clip(redact(text).split(/\s+/).join(' '), 120);
   const lines = [
     '[MisakaNet] 刚刚有一次工具调用失败。在**重试或换修法之前**先查一次（第二次盲试就是『重复犯错』）：',
     `  misakanet_search(query=${JSON.stringify(fragment)})   # 查不到就用 kind="question" 提 intake，别猜`,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@misaka-net/misakanet-setup",
-  "version": "0.5.6",
-  "description": "One-command setup: teach your Claude Code / Codex / Hermes / OpenClaw / codewhale to search MisakaNet failure lessons before repeating a mistake, and to distil the session at a checkpoint.",
+  "version": "0.7.0",
+  "description": "MisakaNet failure lessons for your agents: writes an MCP endpoint into each agent config, rules blocks where the client takes one, and a Claude Code hook. At most one anonymous request leaves this machine at install; then only the agent's calls — unless MISAKANET_HOOK_FETCH=1 (off by default) the hook sends the failed call's error text or command.",
   "bin": {
     "misakanet-setup": "bin/misakanet-setup.mjs"
   },