@mossbear/eval-core 0.1.0-alpha.26

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mossbear
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,9 @@
+# @mossbear/eval-core
+
+Portable pieces of Mossbear's evaluation path — command redaction, the `EvalAdapter` LLM seam, and on-demand guide normalization. Grading itself runs on the [Mossbear](https://app.mossbear.io) dashboard; this package holds the parts that must stay importable outside it.
+
+`sanitizeCommand` is used by the [`mossbear` CLI](https://www.npmjs.com/package/mossbear) to redact shell command text before an action is ever recorded; the adapter and normalization prompt are used server-side.
+
+You normally don't install this directly; it ships as a dependency of `mossbear`.
+
+Source: https://github.com/auden-to/auden (`packages/eval-core`)

package/dist/adapter.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The LLM completion seam.
+ *
+ * eval-core never imports fetch or any HTTP library directly — a caller
+ * supplies the transport and this package stays dependency-free and testable.
+ * The dashboard implements it in `src/lib/eval/serverEvalAdapter.ts`; tests
+ * pass mocks.
+ */
+/** Token counts for one completion call, when an adapter can report them. */
+export type EvalUsage = {
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+};
+/** Adapter interface for LLM completion. */
+export interface EvalAdapter {
+    complete(system: string, user: string): Promise<string>;
+    /**
+     * Optional: adapters that can report token usage alongside a completion's
+     * text implement this instead of (or in addition to) `complete`. Callers
+     * that care about usage/cost attribution (docs/plans/token-cost-tracking-plan.md)
+     * call this when present; an adapter without it is still a valid
+     * `EvalAdapter`.
+     */
+    completeWithUsage?(system: string, user: string): Promise<{
+        text: string;
+        usage: EvalUsage | null;
+    }>;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6EAA6E;AAC7E,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B,CAAA;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvD;;;;;;OAMG;IACH,iBAAiB,CAAC,CAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC,CAAA;CACtD"}

package/dist/adapter.js

@@ -0,0 +1,10 @@
+/**
+ * The LLM completion seam.
+ *
+ * eval-core never imports fetch or any HTTP library directly — a caller
+ * supplies the transport and this package stays dependency-free and testable.
+ * The dashboard implements it in `src/lib/eval/serverEvalAdapter.ts`; tests
+ * pass mocks.
+ */
+export {};
+//# sourceMappingURL=adapter.js.map

package/dist/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @mossbear/eval-core
+ *
+ * Pure evaluation logic with no filesystem, network, or secret-loading side effects.
+ * This package must remain importable outside the CLI package.
+ */
+export { type EvalAdapter, type EvalUsage } from './adapter.js';
+export { sanitizeCommand } from './sanitize-command.js';
+export { stripCodeBlocks, type CodeBlockStripResult } from './strip-code-blocks.js';
+export { MAX_PROSE_CHARS, PROSE_REDACTION_CLASSES, redactProse, type ProseRedactionClass, type ProseRedactionReport, } from './redact-prose.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAEnF,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -0,0 +1,10 @@
+/**
+ * @mossbear/eval-core
+ *
+ * Pure evaluation logic with no filesystem, network, or secret-loading side effects.
+ * This package must remain importable outside the CLI package.
+ */
+export { sanitizeCommand } from './sanitize-command.js';
+export { stripCodeBlocks } from './strip-code-blocks.js';
+export { MAX_PROSE_CHARS, PROSE_REDACTION_CLASSES, redactProse, } from './redact-prose.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,eAAe,EAA6B,MAAM,wBAAwB,CAAA;AAEnF,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,WAAW,GAGZ,MAAM,mBAAmB,CAAA"}

package/dist/redact-prose.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Secret redaction and length-capping for **prose** — transcript message text,
+ * as opposed to the shell command text `sanitizeCommand` handles.
+ *
+ * Why a second redactor rather than reusing the first: `sanitizeCommand` is
+ * pattern-matched against *shell syntax* — heredocs, `KEY=value` anchored at a
+ * shell token boundary, `Authorization:` headers
+ * (`./sanitize-command.ts:31-49`). `transcript-content-classes-plan.md:20`
+ * records that it "catches none of it in prose" and names a prose redactor the
+ * load-bearing deliverable rather than a checkbox on one. This is that gate.
+ *
+ * It lives here beside `sanitizeCommand`, and not in the CLI, because the plan
+ * asks for exactly that (`transcript-content-classes-plan.md:43`): shared, so
+ * the CLI and any future server-side path cannot drift into different
+ * strengths of the same protection.
+ *
+ * **What this is not.** Slice 1 is the redactor and nothing else. It does not
+ * extract transcript messages, does not strip code blocks, does not touch the
+ * sync payload, and no caller uploads its output — nothing about what leaves
+ * the machine changes in this slice. Two consequences of that are worth saying
+ * out loud rather than assuming:
+ *
+ *   - **Code-block stripping is structural and happens before this runs.**
+ *     Fenced and indented blocks come out by the Markdown structure of the
+ *     message (Slice 2). A regex over prose must never be what stands between
+ *     a code block and the wire, so nothing here attempts it.
+ *   - **Redaction is best-effort; the length cap is the backstop.** The same
+ *     admission `sanitizeCommand` makes (`./sanitize-command.ts:26-29`). A
+ *     pattern list cannot enumerate every
+ *     secret shape, which is exactly why the class table strips whole classes
+ *     rather than trusting a scrubber to find secrets inside them.
+ *
+ * Reports **what it redacted, by class and count**, so a disclosure surface can
+ * show the user what was removed rather than asserting safety at them.
+ */
+/**
+ * Maximum characters of a single prose message that survive redaction.
+ *
+ * Deliberately far larger than `sanitizeCommand`'s 200
+ * (`./sanitize-command.ts:20`): a command is a tool
+ * invocation, where anything long is bulk payload, whereas prose is the
+ * content — "I'm going to X because Y" is the whole reason this class syncs at
+ * all, and truncating it to a couple of sentences would leave the grader with
+ * the same intent-free evidence it has today. Long enough for a real
+ * explanation, short enough that a pasted file body cannot ride along whole.
+ */
+export declare const MAX_PROSE_CHARS = 2000;
+/**
+ * The classes this reports on. Named rather than free-form strings so a
+ * disclosure surface can label each count without re-deriving the taxonomy —
+ * and so adding a pattern forces a decision about which class it belongs to.
+ */
+export declare const PROSE_REDACTION_CLASSES: readonly ["private_key", "url_credentials", "assignment", "token", "email", "long_random_string"];
+export type ProseRedactionClass = (typeof PROSE_REDACTION_CLASSES)[number];
+export type ProseRedactionReport = {
+    /** The redacted text, length-capped. */
+    text: string;
+    /** How many spans were replaced, per class. Absent classes redacted nothing. */
+    counts: Partial<Record<ProseRedactionClass, number>>;
+    /** Total spans replaced across all classes. */
+    redactedCount: number;
+    /** The text hit `MAX_PROSE_CHARS` and lost its tail. */
+    wasTruncated: boolean;
+};
+/**
+ * Redact secrets from prose and cap its length, reporting what was removed.
+ *
+ * Runs on-device, before upload, always — the server never receives the
+ * unredacted form and therefore cannot leak it.
+ */
+export declare function redactProse(input: string | null | undefined): ProseRedactionReport;
+//# sourceMappingURL=redact-prose.d.ts.map

package/dist/redact-prose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-prose.d.ts","sourceRoot":"","sources":["../src/redact-prose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,OAAO,CAAA;AAqBnC;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,mGAO1B,CAAA;AAEV,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1E,MAAM,MAAM,oBAAoB,GAAG;IACjC,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,YAAY,EAAE,OAAO,CAAA;CACtB,CAAA;AA2FD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,oBAAoB,CAiClF"}

package/dist/redact-prose.js

@@ -0,0 +1,202 @@
+/**
+ * Secret redaction and length-capping for **prose** — transcript message text,
+ * as opposed to the shell command text `sanitizeCommand` handles.
+ *
+ * Why a second redactor rather than reusing the first: `sanitizeCommand` is
+ * pattern-matched against *shell syntax* — heredocs, `KEY=value` anchored at a
+ * shell token boundary, `Authorization:` headers
+ * (`./sanitize-command.ts:31-49`). `transcript-content-classes-plan.md:20`
+ * records that it "catches none of it in prose" and names a prose redactor the
+ * load-bearing deliverable rather than a checkbox on one. This is that gate.
+ *
+ * It lives here beside `sanitizeCommand`, and not in the CLI, because the plan
+ * asks for exactly that (`transcript-content-classes-plan.md:43`): shared, so
+ * the CLI and any future server-side path cannot drift into different
+ * strengths of the same protection.
+ *
+ * **What this is not.** Slice 1 is the redactor and nothing else. It does not
+ * extract transcript messages, does not strip code blocks, does not touch the
+ * sync payload, and no caller uploads its output — nothing about what leaves
+ * the machine changes in this slice. Two consequences of that are worth saying
+ * out loud rather than assuming:
+ *
+ *   - **Code-block stripping is structural and happens before this runs.**
+ *     Fenced and indented blocks come out by the Markdown structure of the
+ *     message (Slice 2). A regex over prose must never be what stands between
+ *     a code block and the wire, so nothing here attempts it.
+ *   - **Redaction is best-effort; the length cap is the backstop.** The same
+ *     admission `sanitizeCommand` makes (`./sanitize-command.ts:26-29`). A
+ *     pattern list cannot enumerate every
+ *     secret shape, which is exactly why the class table strips whole classes
+ *     rather than trusting a scrubber to find secrets inside them.
+ *
+ * Reports **what it redacted, by class and count**, so a disclosure surface can
+ * show the user what was removed rather than asserting safety at them.
+ */
+/**
+ * Maximum characters of a single prose message that survive redaction.
+ *
+ * Deliberately far larger than `sanitizeCommand`'s 200
+ * (`./sanitize-command.ts:20`): a command is a tool
+ * invocation, where anything long is bulk payload, whereas prose is the
+ * content — "I'm going to X because Y" is the whole reason this class syncs at
+ * all, and truncating it to a couple of sentences would leave the grader with
+ * the same intent-free evidence it has today. Long enough for a real
+ * explanation, short enough that a pasted file body cannot ride along whole.
+ */
+export const MAX_PROSE_CHARS = 2000;
+/**
+ * Characters actually scanned by the patterns below.
+ *
+ * The cap on the *output* is not a bound on the *work*: without this, every
+ * pattern scans an arbitrarily long untrusted message before a single
+ * character is discarded, and the assignment matcher backtracks badly on
+ * adversarial input (a long run of `SECRET` with no `=` after it). A pasted
+ * megabyte could then stall CLI sync to produce 2,000 characters.
+ *
+ * Generous rather than equal to `MAX_PROSE_CHARS` because redaction *shrinks*
+ * text — a secret replaced by `[redacted]` pulls later content into the
+ * surviving window — so the scan has to see more than it will keep. Anything
+ * past this is dropped before scanning and counts as truncation.
+ */
+const MAX_SCAN_CHARS = MAX_PROSE_CHARS * 8;
+/** Marker substituted for redacted spans. Matches `sanitizeCommand`'s. */
+const REDACTED = '[redacted]';
+/**
+ * The classes this reports on. Named rather than free-form strings so a
+ * disclosure surface can label each count without re-deriving the taxonomy —
+ * and so adding a pattern forces a decision about which class it belongs to.
+ */
+export const PROSE_REDACTION_CLASSES = [
+    'private_key',
+    'url_credentials',
+    'assignment',
+    'token',
+    'email',
+    'long_random_string',
+];
+/**
+ * Ordered redactions. Order matters the same way it does in `sanitizeCommand`:
+ * the widest structural shapes run first, so a token *inside* a PEM block or a
+ * URL is already gone before the narrower patterns scan for it.
+ */
+const PROSE_REDACTIONS = [
+    // Whole private-key blocks, including an unterminated one — a truncated key
+    // is still a key. First, because everything else would otherwise match the
+    // base64 inside it.
+    [
+        'private_key',
+        /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END[A-Z ]*PRIVATE KEY-----|$)/g,
+        REDACTED,
+    ],
+    // `Authorization: Bearer <token>` / `Basic <blob>`, as pasted from a request
+    // or a curl transcript. These values are routinely short-lived and short —
+    // too short for the prefix and long-run rules below — and `Authorization` is
+    // a header name rather than a sensitive assignment key, so without this rule
+    // a pasted header uploads a live credential verbatim. `sanitizeCommand`
+    // carries the same pattern for command text (`./sanitize-command.ts:45`).
+    [
+        'token',
+        /\b(authorization\s*:\s*)(?:bearer\s+|basic\s+|token\s+)?\S+/gi,
+        `$1${REDACTED}`,
+    ],
+    // URL userinfo. Both shapes: `scheme://user:secret@host` and the
+    // token-as-sole-userinfo form `scheme://token@host`, which a colon-requiring
+    // pattern misses entirely and which no other rule here catches when the token
+    // is short. The host always stays — "it failed against api.example.com" is
+    // the part worth grading.
+    [
+        'url_credentials',
+        /\b([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+(?::[^@\s]*)?@/gi,
+        `$1${REDACTED}@`,
+    ],
+    // A sensitive key followed by `=` or `:` and a value. Unlike the command
+    // version this is *not* anchored at a shell-token boundary — in prose the
+    // pair is embedded in a sentence ("I set OPENAI_API_KEY=sk-… and reran"), so
+    // anchoring on shell syntax is precisely what misses it.
+    //
+    // The sensitive word must be a **whole `_`/`-` separated segment** of the
+    // key, not a substring of it. As an arbitrary substring, `SECRET` matches
+    // `secretary` and `TOKEN` matches `tokenization`, so ordinary prose like
+    // "secretary: Alice" lost its value — and prose scrubbed into nonsense is
+    // useless to a grader and alarming to a reader, which makes over-redaction a
+    // defect here rather than a safe default.
+    //
+    // The quoted-value arms consume escape sequences (`\\.`) rather than stopping
+    // at the first inner quote: a value like `"correct horse \\"battery staple"`
+    // otherwise terminates early and leaves the tail of the password in place.
+    [
+        'assignment',
+        /\b((?:[A-Za-z0-9]+[_-])*(?:SECRET|PASSWORD|PASSWD|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIAL)(?:[_-][A-Za-z0-9]+)*)(\s*[=:]\s*)(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|\S+)/gi,
+        `$1$2${REDACTED}`,
+    ],
+    // Well-known bare token shapes, by their published prefixes. Prefix-anchored
+    // rather than entropy-guessed, so an ordinary long word is never mistaken for
+    // a credential.
+    [
+        'token',
+        /\b(?:sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|AIza[A-Za-z0-9_-]{20,})/g,
+        REDACTED,
+    ],
+    // Email addresses, listed among the plan's targets
+    // (`transcript-content-classes-plan.md:43`).
+    ['email', /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, REDACTED],
+    // Long unbroken base64/hex runs: a credential shape this list has no prefix
+    // for. Runs last, so anything a named pattern would have caught is gone.
+    //
+    // Two constraints keep it from eating ordinary text, and both are load-bearing:
+    //
+    //   - **Delimiter lookarounds, not `\b`.** `+` and `/` are in the base64
+    //     alphabet but are not word characters, so a blob beginning with one has
+    //     no word boundary to match at — `\b` would start a character late and
+    //     leave a 40-character secret one short of the floor, passing it through
+    //     whole.
+    //   - **It must contain a digit.** Length alone is not a random-string
+    //     signal: `createAuthenticatedDashboardRequestContext` is 42 characters
+    //     of ordinary identifier, and redacting it removes the exact detail a
+    //     grader needs. Digests, ids and encoded blobs carry digits; long
+    //     camel-case names do not. An all-alphabetic secret is the accepted
+    //     miss, and it is what the named patterns above and the cap exist for.
+    [
+        'long_random_string',
+        /(?<![A-Za-z0-9+/=_-])(?=[A-Za-z0-9+/_-]*\d)[A-Za-z0-9+/_-]{40,}={0,2}(?![A-Za-z0-9+/=_-])/g,
+        REDACTED,
+    ],
+];
+/**
+ * Redact secrets from prose and cap its length, reporting what was removed.
+ *
+ * Runs on-device, before upload, always — the server never receives the
+ * unredacted form and therefore cannot leak it.
+ */
+export function redactProse(input) {
+    if (typeof input !== 'string' || input === '') {
+        return { text: '', counts: {}, redactedCount: 0, wasTruncated: false };
+    }
+    // Bounded before any pattern runs — see `MAX_SCAN_CHARS`.
+    const wasScanTruncated = input.length > MAX_SCAN_CHARS;
+    let text = wasScanTruncated ? input.slice(0, MAX_SCAN_CHARS) : input;
+    const counts = {};
+    let redactedCount = 0;
+    for (const [redactionClass, pattern, replacement] of PROSE_REDACTIONS) {
+        // Counted before replacing, and against a fresh regex, so the shared
+        // literal's `lastIndex` cannot carry between calls — a stateful `g` regex
+        // silently skipping the first match of the next message is exactly the
+        // failure a redactor must not have.
+        const counter = new RegExp(pattern.source, pattern.flags);
+        const matches = text.match(counter);
+        if (!matches || matches.length === 0)
+            continue;
+        counts[redactionClass] = (counts[redactionClass] ?? 0) + matches.length;
+        redactedCount += matches.length;
+        text = text.replace(new RegExp(pattern.source, pattern.flags), replacement);
+    }
+    const wasTruncated = wasScanTruncated || text.length > MAX_PROSE_CHARS;
+    if (text.length > MAX_PROSE_CHARS) {
+        // Marked rather than silently cut, so a reader can tell a short message
+        // from a long one that lost its tail.
+        text = `${text.slice(0, MAX_PROSE_CHARS)}… [truncated]`;
+    }
+    return { text, counts, redactedCount, wasTruncated };
+}
+//# sourceMappingURL=redact-prose.js.map

package/dist/redact-prose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-prose.js","sourceRoot":"","sources":["../src/redact-prose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAA;AAEnC;;;;;;;;;;;;;GAaG;AACH,MAAM,cAAc,GAAG,eAAe,GAAG,CAAC,CAAA;AAE1C,0EAA0E;AAC1E,MAAM,QAAQ,GAAG,YAAY,CAAA;AAE7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,aAAa;IACb,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,OAAO;IACP,oBAAoB;CACZ,CAAA;AAeV;;;;GAIG;AACH,MAAM,gBAAgB,GAAqD;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,oBAAoB;IACpB;QACE,aAAa;QACb,iFAAiF;QACjF,QAAQ;KACT;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E;QACE,OAAO;QACP,+DAA+D;QAC/D,KAAK,QAAQ,EAAE;KAChB;IACD,iEAAiE;IACjE,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,0BAA0B;IAC1B;QACE,iBAAiB;QACjB,qDAAqD;QACrD,KAAK,QAAQ,GAAG;KACjB;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,yDAAyD;IACzD,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,0CAA0C;IAC1C,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E;QACE,YAAY;QACZ,mMAAmM;QACnM,OAAO,QAAQ,EAAE;KAClB;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,gBAAgB;IAChB;QACE,OAAO;QACP,2KAA2K;QAC3K,QAAQ;KACT;IACD,mDAAmD;IACnD,6CAA6C;IAC7C,CAAC,OAAO,EAAE,qDAAqD,EAAE,QAAQ,CAAC;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,EAAE;IACF,gFAAgF;IAChF,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,aAAa;IACb,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,2EAA2E;IAC3E;QACE,oBAAoB;QACpB,4FAA4F;QAC5F,QAAQ;KACT;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;IACxE,CAAC;IAED,0DAA0D;IAC1D,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,GAAG,cAAc,CAAA;IACtD,IAAI,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACpE,MAAM,MAAM,GAAiD,EAAE,CAAA;IAC/D,IAAI,aAAa,GAAG,CAAC,CAAA;IAErB,KAAK,MAAM,CAAC,cAAc,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACtE,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAE9C,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAA;QACvE,aAAa,IAAI,OAAO,CAAC,MAAM,CAAA;QAC/B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAA;IAC7E,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,CAAA;IACtE,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClC,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,eAAe,CAAA;IACzD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;AACtD,CAAC"}

package/dist/redact-prose.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=redact-prose.test.d.ts.map

package/dist/redact-prose.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-prose.test.d.ts","sourceRoot":"","sources":["../src/redact-prose.test.ts"],"names":[],"mappings":""}

package/dist/redact-prose.test.js

@@ -0,0 +1,234 @@
+import { describe, expect, it } from 'vitest';
+import { MAX_PROSE_CHARS, redactProse } from './redact-prose.js';
+/**
+ * The corpus this redactor is judged against. Each entry is a plausible line of
+ * assistant or user prose from a real session: what must be removed, and — just
+ * as load-bearing — what must survive intact.
+ */
+describe('redactProse', () => {
+    describe('secrets that must not survive', () => {
+        it('removes a PEM private key block', () => {
+            const result = redactProse('Here is the key I generated:\n-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAx7Vn9kQm\nQm5kZXJ0aGVzdHJpbmc=\n-----END RSA PRIVATE KEY-----\nUse it for the deploy.');
+            expect(result.text).not.toContain('MIIEowIBAAKCAQEAx7Vn9kQm');
+            expect(result.text).not.toContain('BEGIN RSA PRIVATE KEY');
+            expect(result.text).toContain('Here is the key I generated:');
+            expect(result.text).toContain('Use it for the deploy.');
+            expect(result.counts.private_key).toBe(1);
+        });
+        // A truncated key is still a key.
+        it('removes an unterminated private key block', () => {
+            const result = redactProse('-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAA');
+            expect(result.text).not.toContain('b3BlbnNzaC1rZXktdjEAAAAA');
+            expect(result.counts.private_key).toBe(1);
+        });
+        it('removes credentials from a URL but keeps the host', () => {
+            const result = redactProse('I connected with postgres://admin:hunter2@db.example.com:5432/app and it worked.');
+            expect(result.text).not.toContain('hunter2');
+            expect(result.text).toContain('db.example.com');
+            expect(result.counts.url_credentials).toBe(1);
+        });
+        // `sanitizeCommand` anchors this at a shell-token boundary, which is
+        // exactly what misses it mid-sentence. This is the gap that made a
+        // separate prose redactor the load-bearing deliverable.
+        it('removes KEY=value embedded in a sentence', () => {
+            const result = redactProse('I set OPENAI_API_KEY=sk-proj-abcdefghijklmnop1234 and reran the script.');
+            expect(result.text).not.toContain('sk-proj-abcdefghijklmnop1234');
+            expect(result.text).toContain('I set OPENAI_API_KEY');
+            expect(result.text).toContain('and reran the script.');
+        });
+        it('removes a quoted value with spaces', () => {
+            const result = redactProse('The config had DB_PASSWORD = "correct horse battery"');
+            expect(result.text).not.toContain('correct horse battery');
+            expect(result.counts.assignment).toBe(1);
+        });
+        it('removes a colon-separated secret', () => {
+            const result = redactProse('auth token: aVeryLongOpaqueValue99');
+            expect(result.text).not.toContain('aVeryLongOpaqueValue99');
+        });
+        it.each([
+            ['OpenAI-style', 'sk-proj-QQQQwwwweeee1234RRRR'],
+            ['GitHub PAT', 'ghp_abcdefghijklmnopqrstuvwxyz0123'],
+            ['GitHub fine-grained', 'github_pat_11ABCDEFG0abcdefghij_KLMNOP'],
+            ['Slack', 'xoxb-1234567890-abcdefghijkl'],
+            ['AWS access key', 'AKIAIOSFODNN7EXAMPLE'],
+            ['Google API key', 'AIzaSyA1234567890abcdefghijklmnopqrs'],
+        ])('removes a bare %s token', (_name, token) => {
+            const result = redactProse(`The failing call used ${token} as its credential.`);
+            expect(result.text).not.toContain(token);
+            expect(result.text).toContain('The failing call used');
+            expect(result.redactedCount).toBeGreaterThan(0);
+        });
+        // A pasted request header: `Authorization` is not a sensitive assignment
+        // key, and these values are routinely too short for the prefix and
+        // long-run rules, so without a rule of their own they upload verbatim.
+        it.each([
+            ['Bearer', 'Authorization: Bearer short-live-token-123', 'short-live-token-123'],
+            ['Basic', 'Authorization: Basic dXNlcjpwYXNz', 'dXNlcjpwYXNz'],
+        ])('removes an %s Authorization header credential', (_name, prose, secret) => {
+            const result = redactProse(prose);
+            expect(result.text).not.toContain(secret);
+            expect(result.text).toContain('Authorization');
+        });
+        // A colon-requiring pattern misses the token-as-sole-userinfo form, and
+        // nothing else here catches it when the token is short.
+        it('removes token-only URL userinfo', () => {
+            const result = redactProse('Connected with postgres://short-live-token@127.0.0.1/db');
+            expect(result.text).not.toContain('short-live-token');
+            expect(result.text).toContain('127.0.0.1');
+        });
+        // Stopping at the first inner quote leaves the tail of the password in
+        // place, which is worse than not matching at all — it looks redacted.
+        it('consumes escaped quotes inside a quoted value', () => {
+            const result = redactProse('DB_PASSWORD="correct horse \\"battery staple"');
+            expect(result.text).not.toContain('battery staple');
+            expect(result.text).toBe('DB_PASSWORD=[redacted]');
+        });
+        // `+` and `/` are base64 characters but not word characters, so a leading
+        // one leaves `\b` nothing to match and the run one short of the floor.
+        it('removes a base64 run beginning with a non-word character', () => {
+            const secret = '/123456789012345678901234567890123456789';
+            const result = redactProse(`The blob was ${secret} in the header.`);
+            expect(result.text).not.toContain(secret);
+            expect(result.counts.long_random_string).toBe(1);
+        });
+        it('removes email addresses', () => {
+            const result = redactProse('Ping alex.doe+work@example.co.uk about the migration.');
+            expect(result.text).not.toContain('alex.doe+work@example.co.uk');
+            expect(result.text).toContain('about the migration.');
+            expect(result.counts.email).toBe(1);
+        });
+        it('removes a long opaque base64/hex run', () => {
+            const digest = 'a3f5c9e17b2d4869fa0c5e3d7b91240affe6c8d251b7093e';
+            const result = redactProse(`The session id was ${digest} in the logs.`);
+            expect(result.text).not.toContain(digest);
+            expect(result.counts.long_random_string).toBe(1);
+        });
+        it('removes every secret when a message carries several', () => {
+            const result = redactProse('Mailed ops@example.com the key ghp_abcdefghijklmnopqrstuvwxyz0123 and set API_KEY=topsecret123');
+            expect(result.text).not.toContain('ops@example.com');
+            expect(result.text).not.toContain('ghp_abcdefghijklmnopqrstuvwxyz0123');
+            expect(result.text).not.toContain('topsecret123');
+            expect(result.redactedCount).toBeGreaterThanOrEqual(3);
+        });
+    });
+    /**
+     * The other half of the contract. Prose scrubbed into nonsense is useless to
+     * a grader and alarming to a reader, so over-redaction is a defect too.
+     */
+    describe('ordinary text that must not be mangled', () => {
+        it.each([
+            "I'm going to refactor the sync queue because the retry logic double-counts.",
+            'The test failed at apps/dashboard/src/lib/runs/format.ts:42 with a TypeError.',
+            'Renaming getUserById to fetchUserById across 14 call sites; the answer: 42.',
+            'Run `bun run test` first — it takes about 18 seconds on this machine.',
+            'The verdict vocabulary is aligned | unguided | misaligned, never anything else.',
+            'See https://example.com/docs/getting-started for the setup steps.',
+        ])('leaves %s untouched', (prose) => {
+            const result = redactProse(prose);
+            expect(result.text).toBe(prose);
+            expect(result.redactedCount).toBe(0);
+        });
+        // The floor on the loosest pattern is what protects ordinary language:
+        // English words, paths and identifiers do not reach 40 unbroken characters.
+        it('does not redact a long ordinary sentence as a random string', () => {
+            const prose = 'The implementation of the deterministic detector counts distinct runs rather than rows.';
+            const result = redactProse(prose);
+            expect(result.text).toBe(prose);
+        });
+        // As an arbitrary substring, SECRET matches `secretary` and TOKEN matches
+        // `tokenization`. These are ordinary prose, not credential assignments.
+        it.each([
+            ['secretary: Alice', 'Alice'],
+            ['tokenization: complete', 'complete'],
+            ['The password reset flow: works now', 'works now'],
+        ])('keeps %s, whose key only contains a sensitive word', (prose, value) => {
+            expect(redactProse(prose).text).toContain(value);
+        });
+        // Length alone is not a random-string signal. Redacting a long identifier
+        // removes the exact implementation detail a grader needs.
+        it.each([
+            'createAuthenticatedDashboardRequestContext',
+            'useRunGuideVerdictLabelsWithFallbackResolution',
+        ])('keeps the long ordinary identifier %s', (identifier) => {
+            const prose = `The call to ${identifier} failed.`;
+            expect(redactProse(prose).text).toBe(prose);
+        });
+        it('keeps a non-sensitive assignment', () => {
+            const prose = 'I set NODE_ENV=production and the build shrank by 40%.';
+            const result = redactProse(prose);
+            expect(result.text).toBe(prose);
+        });
+    });
+    describe('length capping', () => {
+        it('caps and marks a message past the limit', () => {
+            const long = 'word '.repeat(MAX_PROSE_CHARS);
+            const result = redactProse(long);
+            expect(result.wasTruncated).toBe(true);
+            expect(result.text).toContain('[truncated]');
+            expect(result.text.length).toBeLessThan(MAX_PROSE_CHARS + 30);
+        });
+        it('leaves a message inside the limit alone', () => {
+            const result = redactProse('A short explanation of the change.');
+            expect(result.wasTruncated).toBe(false);
+            expect(result.text).not.toContain('[truncated]');
+        });
+        // The output cap is not a bound on the work: without a scan bound every
+        // pattern scans the whole untrusted message first, and the assignment
+        // matcher backtracks badly on adversarial input.
+        it('bounds the work on a hostile input rather than only the output', () => {
+            const hostile = `${'SECRET'.repeat(200_000)} tail`;
+            const started = performance.now();
+            const result = redactProse(hostile);
+            const elapsedMs = performance.now() - started;
+            expect(elapsedMs).toBeLessThan(2000);
+            expect(result.wasTruncated).toBe(true);
+            expect(result.text.length).toBeLessThan(MAX_PROSE_CHARS + 30);
+        });
+        // The cap is the backstop for whatever the patterns miss, so it has to
+        // apply after redaction rather than instead of it.
+        it('still redacts before truncating', () => {
+            const result = redactProse(`ghp_abcdefghijklmnopqrstuvwxyz0123 ${'padding '.repeat(MAX_PROSE_CHARS)}`);
+            expect(result.text).not.toContain('ghp_abcdefghijklmnopqrstuvwxyz0123');
+            expect(result.wasTruncated).toBe(true);
+        });
+    });
+    describe('the report', () => {
+        it('counts each class separately', () => {
+            const result = redactProse('Contact a@example.com and b@example.com; the token is ghp_abcdefghijklmnopqrstuvwxyz0123');
+            expect(result.counts.email).toBe(2);
+            expect(result.counts.token).toBe(1);
+            expect(result.redactedCount).toBe(3);
+        });
+        it('omits classes that redacted nothing', () => {
+            const result = redactProse('Ping ops@example.com when the deploy lands.');
+            expect(result.counts.email).toBe(1);
+            expect(result.counts.private_key).toBeUndefined();
+            expect(result.counts.token).toBeUndefined();
+        });
+        it('reports nothing redacted for clean prose', () => {
+            const result = redactProse('Nothing sensitive here at all.');
+            expect(result.counts).toEqual({});
+            expect(result.redactedCount).toBe(0);
+        });
+        it('treats empty, null, and undefined as empty prose', () => {
+            for (const input of ['', null, undefined]) {
+                const result = redactProse(input);
+                expect(result.text).toBe('');
+                expect(result.redactedCount).toBe(0);
+                expect(result.wasTruncated).toBe(false);
+            }
+        });
+    });
+    // A stateful `g` regex silently skipping the first match of the next message
+    // is exactly the failure a redactor must not have.
+    it('redacts identically on repeated calls', () => {
+        const prose = 'The key ghp_abcdefghijklmnopqrstuvwxyz0123 leaked into the log.';
+        const first = redactProse(prose);
+        const second = redactProse(prose);
+        const third = redactProse(prose);
+        expect(second.text).toBe(first.text);
+        expect(third.text).toBe(first.text);
+        expect(second.counts).toEqual(first.counts);
+    });
+});
+//# sourceMappingURL=redact-prose.test.js.map