@mossbear/eval-core 0.1.0-alpha.26

package/dist/redact-prose.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-prose.test.js","sourceRoot":"","sources":["../src/redact-prose.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;GAIG;AACH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;QAC7C,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,WAAW,CACxB,sKAAsK,CACvK,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAA;YAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YAC1D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;YAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAA;YACvD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;QAEF,kCAAkC;QAClC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,MAAM,GAAG,WAAW,CACxB,+DAA+D,CAChE,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAA;YAC7D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,MAAM,GAAG,WAAW,CACxB,kFAAkF,CACnF,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;YAC/C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;QAEF,qEAAqE;QACrE,mEAAmE;QACnE,wDAAwD;QACxD,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAG,WAAW,CACxB,yEAAyE,CAC1E,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;YACjE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAA;YACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,sDAAsD,CAAC,CAAA;YAElF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,oCAAoC,CAAC,CAAA;YAEhE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAA;QAC7D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,cAAc,EAAE,8BAA8B,CAAC;YAChD,CAAC,YAAY,EAAE,oCAAoC,CAAC;YACpD,CAAC,qBAAqB,EAAE,wCAAwC,CAAC;YACjE,CAAC,OAAO,EAAE,8BAA8B,CAAC;YACzC,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;YAC1C,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;SAC3D,CAAC,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,yBAAyB,KAAK,qBAAqB,CAAC,CAAA;YAE/E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YACtD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC,CAAC,CAAA;QAEF,yEAAyE;QACzE,mEAAmE;QACnE,uEAAuE;QACvE,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,QAAQ,EAAE,4CAA4C,EAAE,sBAAsB,CAAC;YAChF,CAAC,OAAO,EAAE,mCAAmC,EAAE,cAAc,CAAC;SAC/D,CAAC,CAAC,+CAA+C,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,wDAAwD;QACxD,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,WAAW,CACxB,yDAAyD,CAC1D,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;YACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;QAEF,uEAAuE;QACvE,sEAAsE;QACtE,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,MAAM,GAAG,WAAW,CAAC,+CAA+C,CAAC,CAAA;YAE3E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;YACnD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACpD,CAAC,CAAC,CAAA;QAEF,0EAA0E;QAC1E,uEAAuE;QACvE,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,MAAM,GAAG,0CAA0C,CAAA;YACzD,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,MAAM,iBAAiB,CAAC,CAAA;YAEnE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,WAAW,CAAC,uDAAuD,CAAC,CAAA;YAEnF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAA;YAChE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAA;YACrD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG,kDAAkD,CAAA;YACjE,MAAM,MAAM,GAAG,WAAW,CAAC,sBAAsB,MAAM,eAAe,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,MAAM,MAAM,GAAG,WAAW,CACxB,gGAAgG,CACjG,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAA;YACvE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;YACjD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF;;;OAGG;IACH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACtD,EAAE,CAAC,IAAI,CAAC;YACN,6EAA6E;YAC7E,+EAA+E;YAC/E,6EAA6E;YAC7E,uEAAuE;YACvE,iFAAiF;YACjF,mEAAmE;SACpE,CAAC,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE;YAClC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC/B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,uEAAuE;QACvE,4EAA4E;QAC5E,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,MAAM,KAAK,GACT,yFAAyF,CAAA;YAC3F,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF,0EAA0E;QAC1E,wEAAwE;QACxE,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,kBAAkB,EAAE,OAAO,CAAC;YAC7B,CAAC,wBAAwB,EAAE,UAAU,CAAC;YACtC,CAAC,oCAAoC,EAAE,WAAW,CAAC;SACpD,CAAC,CAAC,oDAAoD,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,0EAA0E;QAC1E,0DAA0D;QAC1D,EAAE,CAAC,IAAI,CAAC;YACN,4CAA4C;YAC5C,gDAAgD;SACjD,CAAC,CAAC,uCAAuC,EAAE,CAAC,UAAU,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,eAAe,UAAU,UAAU,CAAA;YAEjD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,KAAK,GAAG,wDAAwD,CAAA;YACtE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YAEhC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;YAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,eAAe,GAAG,EAAE,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,MAAM,GAAG,WAAW,CAAC,oCAAoC,CAAC,CAAA;YAEhE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACvC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,sEAAsE;QACtE,iDAAiD;QACjD,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;YACxE,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAA;YAClD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;YACjC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;YACnC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;YAE7C,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;YACpC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,eAAe,GAAG,EAAE,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;QAEF,uEAAuE;QACvE,mDAAmD;QACnD,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,WAAW,CACxB,sCAAsC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAC3E,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAA;YACvE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,MAAM,GAAG,WAAW,CACxB,0FAA0F,CAC3F,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,6CAA6C,CAAC,CAAA;YAEzE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAA;YACjD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAG,WAAW,CAAC,gCAAgC,CAAC,CAAA;YAE5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACjC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,KAAK,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAC5B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACpC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACzC,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,mDAAmD;IACnD,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,KAAK,GAAG,iEAAiE,CAAA;QAE/E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAEhC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/sanitize-command.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Secret redaction and length-capping for shell command text.
+ *
+ * Command text can embed secrets or whole file bodies (heredocs, inline env
+ * vars). The CLI runs every logged command through this before it becomes an
+ * action summary, so nothing that leaves the machine carries credentials or
+ * bulk file content (`packages/cli/src/action-queue.ts`). File contents are
+ * never read or included in the first place.
+ *
+ * Lives in eval-core rather than the CLI because grading is what consumes the
+ * result: this is the boundary that decides what a grader may ever see of a
+ * command.
+ */
+/**
+ * Redact common secret shapes from a shell command and cap its length so
+ * command text never carries credentials or bulk file content off-box.
+ *
+ * Pure function — no I/O.
+ */
+export declare function sanitizeCommand(command: string): string;
+//# sourceMappingURL=sanitize-command.d.ts.map

package/dist/sanitize-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-command.d.ts","sourceRoot":"","sources":["../src/sanitize-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAkEH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASvD"}

package/dist/sanitize-command.js

@@ -0,0 +1,92 @@
+/**
+ * Secret redaction and length-capping for shell command text.
+ *
+ * Command text can embed secrets or whole file bodies (heredocs, inline env
+ * vars). The CLI runs every logged command through this before it becomes an
+ * action summary, so nothing that leaves the machine carries credentials or
+ * bulk file content (`packages/cli/src/action-queue.ts`). File contents are
+ * never read or included in the first place.
+ *
+ * Lives in eval-core rather than the CLI because grading is what consumes the
+ * result: this is the boundary that decides what a grader may ever see of a
+ * command.
+ */
+/**
+ * Maximum characters of a single command string that survive redaction.
+ * Short commands convey which tools the agent invoked — which is all a grader
+ * needs; anything longer is bulk payload (heredocs, inline file writes) that
+ * must not leave the machine.
+ */
+const MAX_COMMAND_CHARS = 200;
+/**
+ * Redactions applied to command text, in order: heredoc bodies (bulk inline
+ * file content), private-key blocks, URL userinfo credentials, Authorization
+ * headers, sensitive key=value / key: value pairs (quoted values with spaces
+ * included), then well-known bare token prefixes (OpenAI/Anthropic sk-,
+ * GitHub ghp_/github_pat_, Slack xox*, AWS AKIA). Redaction is best-effort —
+ * the length cap below is the backstop for anything these patterns miss.
+ */
+const COMMAND_REDACTIONS = [
+    // Heredoc: `cmd <<[-]['"]?WORD['"]? \n <body> \n WORD`. The body is inline
+    // file content (secrets, source) that must never leave the machine — replace
+    // it wholesale, keeping only the delimiters. Runs first so a heredoc'd
+    // private key / token is gone before the narrower patterns below even scan.
+    // Terminates on the closing delimiter line or end-of-input (unterminated
+    // capture). Over-matching a rare `a << B` bit-shift only over-redacts, which
+    // is the safe failure mode here.
+    [/(<<-?\s*['"]?)([A-Za-z_]\w*)(['"]?)[\s\S]*?(\n[ \t]*\2\b|$)/g, '$1$2$3 [redacted]$4'],
+    [
+        /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END[A-Z ]*PRIVATE KEY-----|$)/g,
+        '[redacted]',
+    ],
+    [/\b([a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:)[^@\s]+@/gi, '$1[redacted]@'],
+    [/\b(authorization\s*:\s*)(?:bearer\s+)?\S+/gi, '$1[redacted]'],
+    // Sensitive assignment: an env-var-ish key (the sensitive word optionally
+    // wrapped in `DB_…` / `…_FILE` segments, so `DB_PASSWORD`/`OPENAI_API_KEY`
+    // match, not just a bare word) followed by `=`/`:` and a value that is a
+    // double/single-quoted string (spaces and all) or an unquoted run up to the
+    // next whitespace. Anchored at a shell-token boundary ($1, preserved) so it
+    // never fires mid-word; the whole value — quotes included — is redacted so
+    // whitespace-containing passphrases can't slip through.
+    [
+        /(^|[\s;&|(])([\w.-]*(?:api[_-]?key|access[_-]?key|secret[_-]?key|client[_-]?secret|token|secret|passw(?:or)?d|credentials?)[\w.-]*\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s]+)/gi,
+        '$1$2[redacted]',
+    ],
+    // Our own CLI token (`API_KEY_PREFIX`, apps/dashboard/src/features/auth
+    // /constants.ts). Listed with the third-party prefixes because the documented
+    // setup path — `mossbear sync --token auden_…` — is a *space-separated* flag,
+    // so the `key=value` rule above never sees it: without this, the hook logs
+    // that command and the next sync uploads a live dashboard credential in an
+    // action summary. The product's own secret shape is the one most likely to
+    // appear in a command a user runs.
+    //
+    // Still `auden_`, and deliberately: the prefix is baked into every token
+    // already issued, and it is what the dashboard routes on
+    // (`validateAuthHeader.ts`, `writeAuthor.ts`), so the rename cannot change it
+    // without invalidating live credentials. Whatever prefix a future re-mint
+    // uses has to be added here at the same time — a token this rule does not
+    // match is one the action log keeps in plaintext.
+    [/\bauden_[A-Za-z0-9_-]{8,}/g, '[redacted]'],
+    [/\bsk-[A-Za-z0-9_-]{8,}/g, '[redacted]'],
+    [/\bgh[pousr]_[A-Za-z0-9]{8,}/g, '[redacted]'],
+    [/\bgithub_pat_[A-Za-z0-9_]{8,}/g, '[redacted]'],
+    [/\bxox[baprs]-[A-Za-z0-9-]{8,}/g, '[redacted]'],
+    [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'],
+];
+/**
+ * Redact common secret shapes from a shell command and cap its length so
+ * command text never carries credentials or bulk file content off-box.
+ *
+ * Pure function — no I/O.
+ */
+export function sanitizeCommand(command) {
+    let out = command;
+    for (const [pattern, replacement] of COMMAND_REDACTIONS) {
+        out = out.replace(pattern, replacement);
+    }
+    if (out.length > MAX_COMMAND_CHARS) {
+        out = `${out.slice(0, MAX_COMMAND_CHARS)} [... truncated, ${out.length - MAX_COMMAND_CHARS} characters omitted]`;
+    }
+    return out;
+}
+//# sourceMappingURL=sanitize-command.js.map

package/dist/sanitize-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-command.js","sourceRoot":"","sources":["../src/sanitize-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAgC;IACtD,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,iCAAiC;IACjC,CAAC,8DAA8D,EAAE,qBAAqB,CAAC;IACvF;QACE,iFAAiF;QACjF,YAAY;KACb;IACD,CAAC,gDAAgD,EAAE,eAAe,CAAC;IACnE,CAAC,6CAA6C,EAAE,cAAc,CAAC;IAC/D,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,wDAAwD;IACxD;QACE,2KAA2K;QAC3K,gBAAgB;KACjB;IACD,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,mCAAmC;IACnC,EAAE;IACF,yEAAyE;IACzE,yDAAyD;IACzD,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,CAAC,4BAA4B,EAAE,YAAY,CAAC;IAC5C,CAAC,yBAAyB,EAAE,YAAY,CAAC;IACzC,CAAC,8BAA8B,EAAE,YAAY,CAAC;IAC9C,CAAC,gCAAgC,EAAE,YAAY,CAAC;IAChD,CAAC,gCAAgC,EAAE,YAAY,CAAC;IAChD,CAAC,uBAAuB,EAAE,YAAY,CAAC;CACxC,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,GAAG,GAAG,OAAO,CAAA;IACjB,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACxD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,oBAAoB,GAAG,CAAC,MAAM,GAAG,iBAAiB,sBAAsB,CAAA;IAClH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/sanitize-command.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sanitize-command.test.d.ts.map

package/dist/sanitize-command.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-command.test.d.ts","sourceRoot":"","sources":["../src/sanitize-command.test.ts"],"names":[],"mappings":""}

package/dist/sanitize-command.test.js

@@ -0,0 +1,75 @@
+import { describe, it, expect } from 'vitest';
+import { sanitizeCommand } from './sanitize-command.js';
+describe('sanitizeCommand', () => {
+    it('leaves short benign commands untouched', () => {
+        expect(sanitizeCommand('bun test')).toBe('bun test');
+        expect(sanitizeCommand('git commit -m "fix: thing"')).toBe('git commit -m "fix: thing"');
+    });
+    it('redacts our own CLI token, including the space-separated flag form', () => {
+        // The documented setup command puts a live dashboard credential on the
+        // command line, where PostToolUse logs it and the next sync would upload
+        // it in an action summary. The `key=value` rule never sees a
+        // space-separated flag, so the token prefix has to be matched directly.
+        // The prefix stays `auden_` after the rename because it is what every
+        // issued token carries (`API_KEY_PREFIX`).
+        expect(sanitizeCommand('mossbear sync --token auden_tPtcsSvXyRxygMSkBjjDpBKz')).toBe('mossbear sync --token [redacted]');
+        expect(sanitizeCommand('mossbear init --token=auden_abcdefgh12345678')).toBe('mossbear init --token=[redacted]');
+    });
+    it('does not redact ordinary words that merely start with the prefix', () => {
+        expect(sanitizeCommand('cd auden_repo && ls')).toBe('cd auden_repo && ls');
+    });
+    it('redacts bearer tokens in Authorization headers', () => {
+        const out = sanitizeCommand('curl -H "Authorization: Bearer sk-abc123def456ghi789" https://api.example.com');
+        expect(out).not.toContain('sk-abc123def456ghi789');
+        expect(out).toContain('[redacted]');
+        expect(out).toContain('https://api.example.com');
+    });
+    it('redacts credentials in connection-string URLs', () => {
+        const out = sanitizeCommand('psql postgres://auden:s3cretpw@db.host:5432/mossbear');
+        expect(out).not.toContain('s3cretpw');
+        expect(out).toContain('postgres://auden:[redacted]@db.host:5432/mossbear');
+    });
+    it('redacts sensitive key=value assignments', () => {
+        const out = sanitizeCommand('OPENAI_API_KEY=sk-live-abcdef123456 bun run eval');
+        expect(out).not.toContain('abcdef123456');
+        expect(out).toContain('bun run eval');
+    });
+    it('redacts quoted secret values that contain spaces', () => {
+        const out = sanitizeCommand('PASSWORD="correct horse battery staple" deploy');
+        expect(out).not.toContain('correct horse battery staple');
+        expect(out).toContain('PASSWORD=[redacted]');
+        expect(out).toContain('deploy');
+        const single = sanitizeCommand("DB_PASSWORD='a b c d' run");
+        expect(single).not.toContain('a b c d');
+        expect(single).toContain('run');
+    });
+    it('strips heredoc bodies, keeping only the delimiters', () => {
+        const out = sanitizeCommand("cat > src/config.ts <<EOF\nexport const KEY = 'sk-verysecret12345'\nmore lines\nEOF");
+        expect(out).not.toContain('sk-verysecret12345');
+        expect(out).not.toContain('more lines');
+        expect(out).toContain('[redacted]');
+        expect(out).toContain('EOF');
+    });
+    it('redacts well-known token prefixes standing alone', () => {
+        for (const secret of [
+            'ghp_16C7e42F292c6912E7710c838347Ae178B4a',
+            'github_pat_11ABCDEFG_abcdefghij',
+            'xoxb-1234567890-abcdefghijk',
+            'AKIAIOSFODNN7EXAMPLE',
+        ]) {
+            const out = sanitizeCommand(`deploy --with ${secret}`);
+            expect(out).not.toContain(secret);
+        }
+    });
+    it('redacts private key blocks even without an END marker', () => {
+        const out = sanitizeCommand('cat > key.pem <<EOF\n-----BEGIN RSA PRIVATE KEY-----\nMIIEow\nEOF');
+        expect(out).not.toContain('MIIEow');
+    });
+    it('truncates long commands and notes omitted length', () => {
+        const long = `echo ${'x'.repeat(500)}`;
+        const out = sanitizeCommand(long);
+        expect(out.length).toBeLessThan(300);
+        expect(out).toContain('[... truncated,');
+    });
+});
+//# sourceMappingURL=sanitize-command.test.js.map

package/dist/sanitize-command.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-command.test.js","sourceRoot":"","sources":["../src/sanitize-command.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CACxD,4BAA4B,CAC7B,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,6DAA6D;QAC7D,wEAAwE;QACxE,sEAAsE;QACtE,2CAA2C;QAC3C,MAAM,CAAC,eAAe,CAAC,sDAAsD,CAAC,CAAC,CAAC,IAAI,CAClF,kCAAkC,CACnC,CAAA;QACD,MAAM,CAAC,eAAe,CAAC,8CAA8C,CAAC,CAAC,CAAC,IAAI,CAC1E,kCAAkC,CACnC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,eAAe,CACzB,+EAA+E,CAChF,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,GAAG,GAAG,eAAe,CAAC,sDAAsD,CAAC,CAAA;QACnF,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,mDAAmD,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG,eAAe,CAAC,kDAAkD,CAAC,CAAA;QAC/E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,eAAe,CAAC,gDAAgD,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;QACzD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAE/B,MAAM,MAAM,GAAG,eAAe,CAAC,2BAA2B,CAAC,CAAA;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,eAAe,CACzB,qFAAqF,CACtF,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACvC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,KAAK,MAAM,MAAM,IAAI;YACnB,0CAA0C;YAC1C,iCAAiC;YACjC,6BAA6B;YAC7B,sBAAsB;SACvB,EAAE,CAAC;YACF,MAAM,GAAG,GAAG,eAAe,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAA;YACtD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,eAAe,CACzB,mEAAmE,CACpE,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,QAAQ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACtC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/strip-code-blocks.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Structural removal of Markdown code blocks from an assistant message, ahead
+ * of any redaction.
+ *
+ * `transcript-content-classes-plan.md` puts assistant code blocks in the
+ * highest-risk row it still syncs anything from — "it is the user's code" — and
+ * decides they are **stripped by default**, leaving a language-and-line-count
+ * placeholder. The same plan is explicit about *how*: "a regex over prose must
+ * never be what stands between a code block and the wire". So this walks the
+ * message by Markdown block structure and removes whole blocks, and the prose
+ * redactor (`./redact-prose.ts`) runs afterwards on what is left — never
+ * instead of this.
+ *
+ * It lives here rather than in the CLI for the reason the plan gives for
+ * `redactProse`: shared, so the CLI and any future server-side path cannot
+ * drift into different strengths of the same protection.
+ *
+ * **This deliberately over-strips, and that asymmetry is the design.** Every
+ * ambiguous case below resolves toward "treat it as code". Stripping a line of
+ * prose costs the grader a sentence; failing to strip a line of code puts the
+ * user's source on the wire, which is the one outcome the class table exists to
+ * prevent. Two places where that shows:
+ *
+ *   - **Indented blocks are stripped regardless of what precedes them.**
+ *     CommonMark says an indented chunk cannot interrupt a paragraph, so
+ *     `Here is the code:\n    const key = 'sk-live-…'` is officially a lazy
+ *     paragraph continuation, not a code block. Following the spec there would
+ *     leak exactly the text a reader would call code. Any line indented four
+ *     spaces or a tab outside a fence is therefore code here. The cost is that
+ *     a hanging-indented prose line, or a list nested four spaces deep, is
+ *     stripped too.
+ *   - **An unterminated fence eats the rest of the message.** A message that
+ *     opens ``` and never closes it is truncated at the fence rather than
+ *     recovered from, because the alternative is guessing where the author
+ *     meant the code to end.
+ */
+/** What a stripped block leaves behind, and what it cost. */
+export type CodeBlockStripResult = {
+    /** The message with every code block replaced by a placeholder. */
+    text: string;
+    /** How many blocks were removed. */
+    blocks: number;
+    /** How many lines those blocks contained, excluding fence lines. */
+    lines: number;
+};
+/**
+ * Replace every fenced and indented code block in `message` with a placeholder.
+ *
+ * Pure and total: any string is valid input, and the result never contains a
+ * line that was inside a code block.
+ */
+export declare function stripCodeBlocks(message: string): CodeBlockStripResult;
+//# sourceMappingURL=strip-code-blocks.d.ts.map

package/dist/strip-code-blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip-code-blocks.d.ts","sourceRoot":"","sources":["../src/strip-code-blocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAqBH,6DAA6D;AAC7D,MAAM,MAAM,oBAAoB,GAAG;IACjC,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAmFD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB,CA+DrE"}

package/dist/strip-code-blocks.js

@@ -0,0 +1,200 @@
+/**
+ * Structural removal of Markdown code blocks from an assistant message, ahead
+ * of any redaction.
+ *
+ * `transcript-content-classes-plan.md` puts assistant code blocks in the
+ * highest-risk row it still syncs anything from — "it is the user's code" — and
+ * decides they are **stripped by default**, leaving a language-and-line-count
+ * placeholder. The same plan is explicit about *how*: "a regex over prose must
+ * never be what stands between a code block and the wire". So this walks the
+ * message by Markdown block structure and removes whole blocks, and the prose
+ * redactor (`./redact-prose.ts`) runs afterwards on what is left — never
+ * instead of this.
+ *
+ * It lives here rather than in the CLI for the reason the plan gives for
+ * `redactProse`: shared, so the CLI and any future server-side path cannot
+ * drift into different strengths of the same protection.
+ *
+ * **This deliberately over-strips, and that asymmetry is the design.** Every
+ * ambiguous case below resolves toward "treat it as code". Stripping a line of
+ * prose costs the grader a sentence; failing to strip a line of code puts the
+ * user's source on the wire, which is the one outcome the class table exists to
+ * prevent. Two places where that shows:
+ *
+ *   - **Indented blocks are stripped regardless of what precedes them.**
+ *     CommonMark says an indented chunk cannot interrupt a paragraph, so
+ *     `Here is the code:\n    const key = 'sk-live-…'` is officially a lazy
+ *     paragraph continuation, not a code block. Following the spec there would
+ *     leak exactly the text a reader would call code. Any line indented four
+ *     spaces or a tab outside a fence is therefore code here. The cost is that
+ *     a hanging-indented prose line, or a list nested four spaces deep, is
+ *     stripped too.
+ *   - **An unterminated fence eats the rest of the message.** A message that
+ *     opens ``` and never closes it is truncated at the fence rather than
+ *     recovered from, because the alternative is guessing where the author
+ *     meant the code to end.
+ */
+/** Longest info-string word accepted as a language label. */
+const MAX_LANGUAGE_LENGTH = 20;
+/**
+ * Characters a language label may contain.
+ *
+ * The info string is author-controlled free text sitting on the same line as
+ * the fence — ```` ```ts title="~/.aws/credentials" ```` is well-formed
+ * Markdown. Copying it into the placeholder verbatim would hand back a
+ * free-text channel out of the very block this function just removed, so only
+ * the first whitespace-delimited word is considered and it must match this
+ * shape; anything else yields a placeholder with no language rather than a
+ * sanitized approximation of one.
+ */
+const LANGUAGE_PATTERN = /^[A-Za-z0-9_+#-]+$/;
+/** Columns a tab advances to, for deciding whether a line is indented code. */
+const TAB_WIDTH = 4;
+/**
+ * Render the placeholder that stands in for a removed block.
+ *
+ * Line count and language only: the plan's class table specifies exactly this
+ * pair, and anything more (a first line, a hash, a length in characters) is a
+ * fingerprint of the code rather than a description of it. Whether a hash
+ * *should* ride along is an open question on the plan and is deliberately not
+ * answered here.
+ */
+function placeholder(language, lines) {
+    const unit = lines === 1 ? 'line' : 'lines';
+    return language
+        ? `[code block: ${language}, ${lines} ${unit}]`
+        : `[code block: ${lines} ${unit}]`;
+}
+/** First word of a fence's info string, when it is a plausible language. */
+function parseLanguage(infoString) {
+    const first = infoString.trim().split(/\s+/)[0];
+    if (!first || first.length > MAX_LANGUAGE_LENGTH)
+        return null;
+    return LANGUAGE_PATTERN.test(first) ? first : null;
+}
+/**
+ * A Markdown blockquote prefix: up to three spaces, then one or more `>`
+ * markers, each optionally followed by a space.
+ *
+ * Stripped before the fence and indent tests run, because a code block nested
+ * in a container is still a code block. Without this, ``` > ```ts ``` matches
+ * neither branch — the `>` defeats the fence pattern and the line is only two
+ * columns in, so the indent branch misses it too — and every line of the block
+ * is copied out verbatim, leaving the prose redactor as the only thing between
+ * the user's source and the wire. That is precisely the arrangement the plan
+ * forbids ("a regex over prose must never be what stands between a code block
+ * and the wire"), and an assistant quoting code back to a user is an ordinary
+ * thing to do.
+ *
+ * Nested quotes (`> > `) collapse the same way, since the test is applied to
+ * what remains after the whole prefix.
+ */
+const QUOTE_PREFIX_PATTERN = /^ {0,3}(?:>[ \t]?)+/;
+/** The line with any blockquote markers removed, for structural tests. */
+function unquote(line) {
+    return line.replace(QUOTE_PREFIX_PATTERN, '');
+}
+/** Leading indentation in columns, counting a tab as up to {@link TAB_WIDTH}. */
+function indentColumns(line) {
+    let columns = 0;
+    for (const char of line) {
+        if (char === ' ')
+            columns += 1;
+        else if (char === '\t')
+            columns += TAB_WIDTH - (columns % TAB_WIDTH);
+        else
+            break;
+    }
+    return columns;
+}
+/**
+ * A fence opener: up to three spaces of indent, then three or more backticks or
+ * tildes. Four spaces would make it indented code instead, which the caller
+ * handles.
+ */
+const FENCE_PATTERN = /^ {0,3}(`{3,}|~{3,})(.*)$/;
+/**
+ * Whether `line` closes a fence opened with `marker`.
+ *
+ * CommonMark's rule, and it matters: a closing fence must be at least as long
+ * as its opener and carry no info string, so ``` inside a ````-fenced block
+ * does not end it. Getting this wrong in the lenient direction would end the
+ * block early and emit its remaining lines as prose.
+ */
+function closesFence(line, marker) {
+    const match = FENCE_PATTERN.exec(unquote(line));
+    if (!match)
+        return false;
+    const [, fence, rest] = match;
+    if (!fence || fence[0] !== marker[0])
+        return false;
+    return fence.length >= marker.length && rest !== undefined && rest.trim() === '';
+}
+/**
+ * Replace every fenced and indented code block in `message` with a placeholder.
+ *
+ * Pure and total: any string is valid input, and the result never contains a
+ * line that was inside a code block.
+ */
+export function stripCodeBlocks(message) {
+    const source = message.split('\n');
+    const out = [];
+    let blocks = 0;
+    let lines = 0;
+    let index = 0;
+    while (index < source.length) {
+        const line = source[index] ?? '';
+        // Structural tests run on the line with any container prefix removed; the
+        // *original* line is what gets emitted when it turns out to be prose.
+        const bare = unquote(line);
+        const fence = indentColumns(bare) < 4 ? FENCE_PATTERN.exec(bare) : null;
+        if (fence) {
+            const marker = fence[1] ?? '```';
+            const language = parseLanguage(fence[2] ?? '');
+            let cursor = index + 1;
+            let body = 0;
+            while (cursor < source.length && !closesFence(source[cursor] ?? '', marker)) {
+                body += 1;
+                cursor += 1;
+            }
+            out.push(placeholder(language, body));
+            blocks += 1;
+            lines += body;
+            // Past the closing fence, or past the end when there was none — an
+            // unterminated fence consumes the remainder rather than recovering.
+            index = cursor + 1;
+            continue;
+        }
+        if (indentColumns(bare) >= 4 && bare.trim() !== '') {
+            let cursor = index;
+            let body = 0;
+            // Blank lines *inside* an indented run belong to the block, so a chunk
+            // separated by an empty line is one placeholder rather than two. A blank
+            // line is only a terminator once a non-indented line follows it.
+            while (cursor < source.length) {
+                const current = unquote(source[cursor] ?? '');
+                if (current.trim() === '') {
+                    const next = unquote(source[cursor + 1] ?? '');
+                    if (next.trim() === '' || indentColumns(next) < 4)
+                        break;
+                    cursor += 1;
+                    body += 1;
+                    continue;
+                }
+                if (indentColumns(current) < 4)
+                    break;
+                cursor += 1;
+                body += 1;
+            }
+            out.push(placeholder(null, body));
+            blocks += 1;
+            lines += body;
+            index = cursor;
+            continue;
+        }
+        out.push(line);
+        index += 1;
+    }
+    return { text: out.join('\n'), blocks, lines };
+}
+//# sourceMappingURL=strip-code-blocks.js.map

package/dist/strip-code-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip-code-blocks.js","sourceRoot":"","sources":["../src/strip-code-blocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,6DAA6D;AAC7D,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG,oBAAoB,CAAA;AAE7C,+EAA+E;AAC/E,MAAM,SAAS,GAAG,CAAC,CAAA;AAYnB;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,QAAuB,EAAE,KAAa;IACzD,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IAC3C,OAAO,QAAQ;QACb,CAAC,CAAC,gBAAgB,QAAQ,KAAK,KAAK,IAAI,IAAI,GAAG;QAC/C,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,GAAG,CAAA;AACtC,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,UAAkB;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB;QAAE,OAAO,IAAI,CAAA;IAC7D,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAElD,0EAA0E;AAC1E,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAA;aACzB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,SAAS,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;;YAC/D,MAAK;IACZ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,aAAa,GAAG,2BAA2B,CAAA;AAEjD;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAA;IAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAClD,OAAO,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QAChC,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAE1B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACvE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAA;YAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAC9C,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,CAAA;YACtB,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC5E,IAAI,IAAI,CAAC,CAAA;gBACT,MAAM,IAAI,CAAC,CAAA;YACb,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;YACrC,MAAM,IAAI,CAAC,CAAA;YACX,KAAK,IAAI,IAAI,CAAA;YACb,mEAAmE;YACnE,oEAAoE;YACpE,KAAK,GAAG,MAAM,GAAG,CAAC,CAAA;YAClB,SAAQ;QACV,CAAC;QAED,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACnD,IAAI,MAAM,GAAG,KAAK,CAAA;YAClB,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,uEAAuE;YACvE,yEAAyE;YACzE,iEAAiE;YACjE,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC7C,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;oBAC9C,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,MAAK;oBACxD,MAAM,IAAI,CAAC,CAAA;oBACX,IAAI,IAAI,CAAC,CAAA;oBACT,SAAQ;gBACV,CAAC;gBACD,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,MAAK;gBACrC,MAAM,IAAI,CAAC,CAAA;gBACX,IAAI,IAAI,CAAC,CAAA;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;YACjC,MAAM,IAAI,CAAC,CAAA;YACX,KAAK,IAAI,IAAI,CAAA;YACb,KAAK,GAAG,MAAM,CAAA;YACd,SAAQ;QACV,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACd,KAAK,IAAI,CAAC,CAAA;IACZ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAChD,CAAC"}

package/dist/strip-code-blocks.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=strip-code-blocks.test.d.ts.map

package/dist/strip-code-blocks.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip-code-blocks.test.d.ts","sourceRoot":"","sources":["../src/strip-code-blocks.test.ts"],"names":[],"mappings":""}