@mrciphersmith/keryx 0.3.19 → 0.3.21

package/dist/cli.js

@@ -9080,6 +9080,24 @@ var init_config = __esm(() => {
 });
 
 // src/security/detect/entropy.ts
+function isAdjacentLabel(content, start) {
+  const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
+  if (ADJACENT_LABEL.test(before)) {
+    return true;
+  }
+  if (before.trim().length > 0) {
+    return false;
+  }
+  const lineStart = content.lastIndexOf(`
+`, start - 1);
+  if (lineStart < 0) {
+    return false;
+  }
+  const prevLineStart = content.lastIndexOf(`
+`, lineStart - 1) + 1;
+  const prevLine = content.slice(prevLineStart, lineStart);
+  return CONTINUATION_LABEL_LINE_RE.test(prevLine);
+}
 function isHexBlob(value) {
   return HEX_BLOB.test(value) && /[a-f]/i.test(value);
 }
@@ -9091,8 +9109,24 @@ function lastLineOf(before) {
 `);
   return newline < 0 ? before : before.slice(newline + 1);
 }
+function isPlainCasedWord(letters) {
+  return /^[a-z]+$/.test(letters) || /^[A-Z]+$/.test(letters) || /^[A-Z][a-z]*$/.test(letters);
+}
 function isSingleTransitionTag(segment) {
-  return /^[A-Za-z]+[0-9]+$/.test(segment) || /^[0-9]+[A-Za-z]+$/.test(segment);
+  const letterThenDigit = /^([A-Za-z]+)([0-9]+)$/.exec(segment);
+  if (letterThenDigit !== null) {
+    const letters = letterThenDigit[1];
+    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
+  }
+  const digitThenLetter = /^([0-9]+)([A-Za-z]+)$/.exec(segment);
+  if (digitThenLetter !== null) {
+    const letters = digitThenLetter[2];
+    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
+  }
+  return false;
+}
+function isSlugHexTail(segment) {
+  return SLUG_HEX_TAIL_RE.test(segment);
 }
 function isWordSlug(value) {
   const segments = value.split(/[-_]/);
@@ -9100,15 +9134,25 @@ function isWordSlug(value) {
     return false;
   }
   let words = 0;
-  for (const segment of segments) {
-    const isAlpha = /^[A-Za-z]+$/.test(segment);
+  for (let i = 0;i < segments.length; i += 1) {
+    const segment = segments[i];
     const isDigits = /^[0-9]+$/.test(segment);
-    if (!isAlpha && !isDigits && !isSingleTransitionTag(segment)) {
-      return false;
+    if (isDigits) {
+      continue;
     }
-    if (isAlpha && segment.length >= 3) {
-      words += 1;
+    if (isPlainCasedWord(segment)) {
+      if (segment.length >= 3) {
+        words += 1;
+      }
+      continue;
     }
+    if (isSingleTransitionTag(segment)) {
+      continue;
+    }
+    if (i === segments.length - 1 && isSlugHexTail(segment)) {
+      continue;
+    }
+    return false;
   }
   return words >= 1;
 }
@@ -9252,6 +9296,36 @@ function secretShapedCandidatesIn(text) {
 function looksSecretShapedIn(text) {
   return secretShapedCandidatesIn(text).length > 0;
 }
+function labelledPieceQualifies(piece) {
+  if (isAllowShapedValue(piece)) {
+    return { entropy: shannonEntropy(piece) };
+  }
+  if (isHexBlob(piece)) {
+    return { entropy: shannonEntropy(piece) };
+  }
+  if (!/[0-9]/.test(piece) && !/[+=]/.test(piece)) {
+    return null;
+  }
+  const withoutSeparators = piece.replace(/[-_.+]/g, "");
+  const entropy = shannonEntropy(withoutSeparators.length > 0 ? withoutSeparators : piece);
+  if (entropy >= 3.6) {
+    return { entropy };
+  }
+  return null;
+}
+function firstQualifyingSlashPiece(head) {
+  let offset = 0;
+  for (const piece of head.split("/")) {
+    if (piece.length > 0) {
+      const found = labelledPieceQualifies(piece);
+      if (found !== null) {
+        return { offset, length: piece.length, entropy: found.entropy };
+      }
+    }
+    offset += piece.length + 1;
+  }
+  return null;
+}
 function detectEntropy(content) {
   const matches = [];
   const urlSpans = findUrlSpans(content);
@@ -9274,9 +9348,9 @@ function detectEntropy(content) {
     if (urlSpans.some((u) => start < u.end && end > u.start)) {
       continue;
     }
-    const { qualifies, entropy } = bareShapeQualifies(value);
-    if (qualifies) {
-      matches.push(buildMatch(start, end, value, entropy));
+    const found = labelledPieceQualifies(value);
+    if (found !== null) {
+      matches.push(buildMatch(start, end, value, found.entropy));
     }
   }
   TOKEN.lastIndex = 0;
@@ -9291,26 +9365,32 @@ function detectEntropy(content) {
     if (matches.some((existing) => start < existing.end && end > existing.start)) {
       continue;
     }
-    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
-    const { qualifies, entropy } = bareShapeQualifies(head);
-    if (!qualifies) {
+    if (!isAdjacentLabel(content, start)) {
       continue;
     }
-    const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
-    if (!SENSITIVE_LABEL.test(before)) {
+    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
+    if (head.includes("/")) {
+      const piece = firstQualifyingSlashPiece(head);
+      if (piece === null) {
+        continue;
+      }
+      const pieceStart = start + piece.offset;
+      const pieceEnd = pieceStart + piece.length;
+      matches.push(buildMatch(pieceStart, pieceEnd, content.slice(pieceStart, pieceEnd), piece.entropy));
       continue;
     }
-    if (isAllowShapedValue(head) && !ADJACENT_LABEL.test(before)) {
+    const found = labelledPieceQualifies(head);
+    if (found === null) {
       continue;
     }
-    matches.push(buildMatch(start, end, value, entropy));
+    matches.push(buildMatch(start, end, value, found.entropy));
   }
   return matches.sort((a, b) => a.start - b.start);
 }
-var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), SENSITIVE_LABEL, ADJACENT_LABEL, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
+var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), FILLER_WORDS = "is|was|set|to|the|value|now", ADJACENT_LABEL, CONTINUATION_LABEL_LINE_RE, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, TAG_MAX_LETTER_RUN = 8, SLUG_HEX_TAIL_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
 var init_entropy = __esm(() => {
-  SENSITIVE_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(${caseless(SENSITIVE_LABEL_WORDS)})(?:$|[^A-Za-z0-9]|(?=[A-Z]))`);
-  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*["']?$`);
+  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*` + `(?:\\s+(?:${caseless(FILLER_WORDS)})){0,2}` + `["']?\\s*[:=]?\\s*["']?$`);
+  CONTINUATION_LABEL_LINE_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*\\\\\\s*$`);
   LABEL_ASSIGNMENT_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${SENSITIVE_LABEL_WORDS})[A-Za-z0-9_-]*"?\\s*=\\s*"?([A-Za-z0-9+/_=-]{6,})`, "gi");
   TOKEN = /[A-Za-z0-9+/=_-]{20,}(?:\.[A-Za-z0-9+/=_-]{6,})*/g;
   TOKEN_HEAD = /^[A-Za-z0-9+/=_-]+/;
@@ -9318,6 +9398,7 @@ var init_entropy = __esm(() => {
   FULL_GIT_SHA_RE = /^[0-9a-f]{40}$/i;
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   INTEGRITY_RE = /^(?:sha256|sha512)-[A-Za-z0-9+/]+=*$/;
+  SLUG_HEX_TAIL_RE = /^[0-9a-f]{10,16}$/i;
   URL_SPAN_RE = /\bhttps?:\/\/[^\s<>"'\\]+/g;
   URL_TRAILING_PUNCTUATION_RE = /[.,;:!?)\]}]$/;
 });
@@ -18037,7 +18118,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.19",
+    version: "0.3.21",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -129096,6 +129177,37 @@ function createSystemWebWorkerRunner() {
 
 // src/harness/web/outbound-secret.ts
 init_service4();
+var HEX32_FRAGMENT = "[0-9a-f]{32}";
+var SHA40_FRAGMENT = "[0-9a-f]{40}";
+var GIST_HEX32_PATH_RE = new RegExp(`^/(?:[^/]+/)?(${HEX32_FRAGMENT})/?$`, "i");
+var GITHUB_COMMIT_OR_BLOB_PATH_RE = new RegExp(`/(?:commit|blob)/(${SHA40_FRAGMENT})(?:/|$)`, "i");
+var GITLAB_COMMIT_PATH_RE = new RegExp(`/-/commit/(${SHA40_FRAGMENT})(?:/|$)`, "i");
+function knownPublicIdentifierIn(url) {
+  const host = url.hostname.toLowerCase();
+  if (host === "gist.github.com") {
+    return GIST_HEX32_PATH_RE.exec(url.pathname)?.[1] ?? null;
+  }
+  if (host === "github.com") {
+    return GITHUB_COMMIT_OR_BLOB_PATH_RE.exec(url.pathname)?.[1] ?? null;
+  }
+  if (host === "gitlab.com") {
+    return GITLAB_COMMIT_PATH_RE.exec(url.pathname)?.[1] ?? null;
+  }
+  return null;
+}
+function stripKnownPublicIdentifier(text) {
+  let url;
+  try {
+    url = new URL(text);
+  } catch {
+    return text;
+  }
+  const identifier = knownPublicIdentifierIn(url);
+  if (identifier === null) {
+    return text;
+  }
+  return text.replace(identifier, "0".repeat(identifier.length));
+}
 function safeDecodeComponent(value) {
   try {
     return decodeURIComponent(value);
@@ -129139,13 +129251,14 @@ function anyComponentLooksSecret(text) {
   return false;
 }
 function containsOutboundSecret(text) {
-  if (detectSecrets(text).length > 0) {
+  const scanText = stripKnownPublicIdentifier(text);
+  if (detectSecrets(scanText).length > 0) {
     return true;
   }
-  if (isEntropyBackendEnabled() && detectEntropy(text).length > 0) {
+  if (isEntropyBackendEnabled() && detectEntropy(scanText).length > 0) {
     return true;
   }
-  return anyComponentLooksSecret(text);
+  return anyComponentLooksSecret(scanText);
 }
 async function recordOutboundSecretFinding(cwd, tool, subject) {
   try {

package/dist/core.js

@@ -4029,6 +4029,24 @@ var init_config2 = __esm(() => {
 });
 
 // src/security/detect/entropy.ts
+function isAdjacentLabel(content, start) {
+  const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
+  if (ADJACENT_LABEL.test(before)) {
+    return true;
+  }
+  if (before.trim().length > 0) {
+    return false;
+  }
+  const lineStart = content.lastIndexOf(`
+`, start - 1);
+  if (lineStart < 0) {
+    return false;
+  }
+  const prevLineStart = content.lastIndexOf(`
+`, lineStart - 1) + 1;
+  const prevLine = content.slice(prevLineStart, lineStart);
+  return CONTINUATION_LABEL_LINE_RE.test(prevLine);
+}
 function isHexBlob(value) {
   return HEX_BLOB.test(value) && /[a-f]/i.test(value);
 }
@@ -4040,8 +4058,24 @@ function lastLineOf(before) {
 `);
   return newline < 0 ? before : before.slice(newline + 1);
 }
+function isPlainCasedWord(letters) {
+  return /^[a-z]+$/.test(letters) || /^[A-Z]+$/.test(letters) || /^[A-Z][a-z]*$/.test(letters);
+}
 function isSingleTransitionTag(segment) {
-  return /^[A-Za-z]+[0-9]+$/.test(segment) || /^[0-9]+[A-Za-z]+$/.test(segment);
+  const letterThenDigit = /^([A-Za-z]+)([0-9]+)$/.exec(segment);
+  if (letterThenDigit !== null) {
+    const letters = letterThenDigit[1];
+    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
+  }
+  const digitThenLetter = /^([0-9]+)([A-Za-z]+)$/.exec(segment);
+  if (digitThenLetter !== null) {
+    const letters = digitThenLetter[2];
+    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
+  }
+  return false;
+}
+function isSlugHexTail(segment) {
+  return SLUG_HEX_TAIL_RE.test(segment);
 }
 function isWordSlug(value) {
   const segments = value.split(/[-_]/);
@@ -4049,15 +4083,25 @@ function isWordSlug(value) {
     return false;
   }
   let words = 0;
-  for (const segment of segments) {
-    const isAlpha = /^[A-Za-z]+$/.test(segment);
+  for (let i = 0;i < segments.length; i += 1) {
+    const segment = segments[i];
     const isDigits = /^[0-9]+$/.test(segment);
-    if (!isAlpha && !isDigits && !isSingleTransitionTag(segment)) {
-      return false;
+    if (isDigits) {
+      continue;
     }
-    if (isAlpha && segment.length >= 3) {
-      words += 1;
+    if (isPlainCasedWord(segment)) {
+      if (segment.length >= 3) {
+        words += 1;
+      }
+      continue;
     }
+    if (isSingleTransitionTag(segment)) {
+      continue;
+    }
+    if (i === segments.length - 1 && isSlugHexTail(segment)) {
+      continue;
+    }
+    return false;
   }
   return words >= 1;
 }
@@ -4201,6 +4245,36 @@ function secretShapedCandidatesIn(text) {
 function looksSecretShapedIn(text) {
   return secretShapedCandidatesIn(text).length > 0;
 }
+function labelledPieceQualifies(piece) {
+  if (isAllowShapedValue(piece)) {
+    return { entropy: shannonEntropy(piece) };
+  }
+  if (isHexBlob(piece)) {
+    return { entropy: shannonEntropy(piece) };
+  }
+  if (!/[0-9]/.test(piece) && !/[+=]/.test(piece)) {
+    return null;
+  }
+  const withoutSeparators = piece.replace(/[-_.+]/g, "");
+  const entropy = shannonEntropy(withoutSeparators.length > 0 ? withoutSeparators : piece);
+  if (entropy >= 3.6) {
+    return { entropy };
+  }
+  return null;
+}
+function firstQualifyingSlashPiece(head) {
+  let offset = 0;
+  for (const piece of head.split("/")) {
+    if (piece.length > 0) {
+      const found = labelledPieceQualifies(piece);
+      if (found !== null) {
+        return { offset, length: piece.length, entropy: found.entropy };
+      }
+    }
+    offset += piece.length + 1;
+  }
+  return null;
+}
 function detectEntropy(content) {
   const matches = [];
   const urlSpans = findUrlSpans(content);
@@ -4223,9 +4297,9 @@ function detectEntropy(content) {
     if (urlSpans.some((u) => start < u.end && end > u.start)) {
       continue;
     }
-    const { qualifies, entropy } = bareShapeQualifies(value);
-    if (qualifies) {
-      matches.push(buildMatch(start, end, value, entropy));
+    const found = labelledPieceQualifies(value);
+    if (found !== null) {
+      matches.push(buildMatch(start, end, value, found.entropy));
     }
   }
   TOKEN.lastIndex = 0;
@@ -4240,26 +4314,32 @@ function detectEntropy(content) {
     if (matches.some((existing) => start < existing.end && end > existing.start)) {
       continue;
     }
-    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
-    const { qualifies, entropy } = bareShapeQualifies(head);
-    if (!qualifies) {
+    if (!isAdjacentLabel(content, start)) {
       continue;
     }
-    const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
-    if (!SENSITIVE_LABEL.test(before)) {
+    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
+    if (head.includes("/")) {
+      const piece = firstQualifyingSlashPiece(head);
+      if (piece === null) {
+        continue;
+      }
+      const pieceStart = start + piece.offset;
+      const pieceEnd = pieceStart + piece.length;
+      matches.push(buildMatch(pieceStart, pieceEnd, content.slice(pieceStart, pieceEnd), piece.entropy));
       continue;
     }
-    if (isAllowShapedValue(head) && !ADJACENT_LABEL.test(before)) {
+    const found = labelledPieceQualifies(head);
+    if (found === null) {
       continue;
     }
-    matches.push(buildMatch(start, end, value, entropy));
+    matches.push(buildMatch(start, end, value, found.entropy));
   }
   return matches.sort((a, b) => a.start - b.start);
 }
-var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), SENSITIVE_LABEL, ADJACENT_LABEL, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
+var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), FILLER_WORDS = "is|was|set|to|the|value|now", ADJACENT_LABEL, CONTINUATION_LABEL_LINE_RE, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, TAG_MAX_LETTER_RUN = 8, SLUG_HEX_TAIL_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
 var init_entropy = __esm(() => {
-  SENSITIVE_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(${caseless(SENSITIVE_LABEL_WORDS)})(?:$|[^A-Za-z0-9]|(?=[A-Z]))`);
-  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*["']?$`);
+  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*` + `(?:\\s+(?:${caseless(FILLER_WORDS)})){0,2}` + `["']?\\s*[:=]?\\s*["']?$`);
+  CONTINUATION_LABEL_LINE_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*\\\\\\s*$`);
   LABEL_ASSIGNMENT_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${SENSITIVE_LABEL_WORDS})[A-Za-z0-9_-]*"?\\s*=\\s*"?([A-Za-z0-9+/_=-]{6,})`, "gi");
   TOKEN = /[A-Za-z0-9+/=_-]{20,}(?:\.[A-Za-z0-9+/=_-]{6,})*/g;
   TOKEN_HEAD = /^[A-Za-z0-9+/=_-]+/;
@@ -4267,6 +4347,7 @@ var init_entropy = __esm(() => {
   FULL_GIT_SHA_RE = /^[0-9a-f]{40}$/i;
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   INTEGRITY_RE = /^(?:sha256|sha512)-[A-Za-z0-9+/]+=*$/;
+  SLUG_HEX_TAIL_RE = /^[0-9a-f]{10,16}$/i;
   URL_SPAN_RE = /\bhttps?:\/\/[^\s<>"'\\]+/g;
   URL_TRAILING_PUNCTUATION_RE = /[.,;:!?)\]}]$/;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {