@mrciphersmith/keryx 0.3.20 → 0.3.21

package/dist/cli.js

@@ -9080,6 +9080,24 @@ var init_config = __esm(() => {
 });
 
 // src/security/detect/entropy.ts
+function isAdjacentLabel(content, start) {
+  const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
+  if (ADJACENT_LABEL.test(before)) {
+    return true;
+  }
+  if (before.trim().length > 0) {
+    return false;
+  }
+  const lineStart = content.lastIndexOf(`
+`, start - 1);
+  if (lineStart < 0) {
+    return false;
+  }
+  const prevLineStart = content.lastIndexOf(`
+`, lineStart - 1) + 1;
+  const prevLine = content.slice(prevLineStart, lineStart);
+  return CONTINUATION_LABEL_LINE_RE.test(prevLine);
+}
 function isHexBlob(value) {
   return HEX_BLOB.test(value) && /[a-f]/i.test(value);
 }
@@ -9279,12 +9297,19 @@ function looksSecretShapedIn(text) {
   return secretShapedCandidatesIn(text).length > 0;
 }
 function labelledPieceQualifies(piece) {
-  const base = bareShapeQualifies(piece);
-  if (base.qualifies) {
-    return { entropy: base.entropy };
-  }
   if (isAllowShapedValue(piece)) {
-    return { entropy: base.entropy };
+    return { entropy: shannonEntropy(piece) };
+  }
+  if (isHexBlob(piece)) {
+    return { entropy: shannonEntropy(piece) };
+  }
+  if (!/[0-9]/.test(piece) && !/[+=]/.test(piece)) {
+    return null;
+  }
+  const withoutSeparators = piece.replace(/[-_.+]/g, "");
+  const entropy = shannonEntropy(withoutSeparators.length > 0 ? withoutSeparators : piece);
+  if (entropy >= 3.6) {
+    return { entropy };
   }
   return null;
 }
@@ -9323,9 +9348,9 @@ function detectEntropy(content) {
     if (urlSpans.some((u) => start < u.end && end > u.start)) {
       continue;
     }
-    const { qualifies, entropy } = bareShapeQualifies(value);
-    if (qualifies) {
-      matches.push(buildMatch(start, end, value, entropy));
+    const found = labelledPieceQualifies(value);
+    if (found !== null) {
+      matches.push(buildMatch(start, end, value, found.entropy));
     }
   }
   TOKEN.lastIndex = 0;
@@ -9340,8 +9365,7 @@ function detectEntropy(content) {
     if (matches.some((existing) => start < existing.end && end > existing.start)) {
       continue;
     }
-    const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
-    if (!ADJACENT_LABEL.test(before)) {
+    if (!isAdjacentLabel(content, start)) {
       continue;
     }
     const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
@@ -9363,9 +9387,10 @@ function detectEntropy(content) {
   }
   return matches.sort((a, b) => a.start - b.start);
 }
-var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), ADJACENT_LABEL, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, TAG_MAX_LETTER_RUN = 8, SLUG_HEX_TAIL_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
+var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), FILLER_WORDS = "is|was|set|to|the|value|now", ADJACENT_LABEL, CONTINUATION_LABEL_LINE_RE, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, TAG_MAX_LETTER_RUN = 8, SLUG_HEX_TAIL_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
 var init_entropy = __esm(() => {
-  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*["']?$`);
+  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*` + `(?:\\s+(?:${caseless(FILLER_WORDS)})){0,2}` + `["']?\\s*[:=]?\\s*["']?$`);
+  CONTINUATION_LABEL_LINE_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*\\\\\\s*$`);
   LABEL_ASSIGNMENT_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${SENSITIVE_LABEL_WORDS})[A-Za-z0-9_-]*"?\\s*=\\s*"?([A-Za-z0-9+/_=-]{6,})`, "gi");
   TOKEN = /[A-Za-z0-9+/=_-]{20,}(?:\.[A-Za-z0-9+/=_-]{6,})*/g;
   TOKEN_HEAD = /^[A-Za-z0-9+/=_-]+/;
@@ -18093,7 +18118,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.20",
+    version: "0.3.21",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -129152,6 +129177,37 @@ function createSystemWebWorkerRunner() {
 
 // src/harness/web/outbound-secret.ts
 init_service4();
+var HEX32_FRAGMENT = "[0-9a-f]{32}";
+var SHA40_FRAGMENT = "[0-9a-f]{40}";
+var GIST_HEX32_PATH_RE = new RegExp(`^/(?:[^/]+/)?(${HEX32_FRAGMENT})/?$`, "i");
+var GITHUB_COMMIT_OR_BLOB_PATH_RE = new RegExp(`/(?:commit|blob)/(${SHA40_FRAGMENT})(?:/|$)`, "i");
+var GITLAB_COMMIT_PATH_RE = new RegExp(`/-/commit/(${SHA40_FRAGMENT})(?:/|$)`, "i");
+function knownPublicIdentifierIn(url) {
+  const host = url.hostname.toLowerCase();
+  if (host === "gist.github.com") {
+    return GIST_HEX32_PATH_RE.exec(url.pathname)?.[1] ?? null;
+  }
+  if (host === "github.com") {
+    return GITHUB_COMMIT_OR_BLOB_PATH_RE.exec(url.pathname)?.[1] ?? null;
+  }
+  if (host === "gitlab.com") {
+    return GITLAB_COMMIT_PATH_RE.exec(url.pathname)?.[1] ?? null;
+  }
+  return null;
+}
+function stripKnownPublicIdentifier(text) {
+  let url;
+  try {
+    url = new URL(text);
+  } catch {
+    return text;
+  }
+  const identifier = knownPublicIdentifierIn(url);
+  if (identifier === null) {
+    return text;
+  }
+  return text.replace(identifier, "0".repeat(identifier.length));
+}
 function safeDecodeComponent(value) {
   try {
     return decodeURIComponent(value);
@@ -129195,13 +129251,14 @@ function anyComponentLooksSecret(text) {
   return false;
 }
 function containsOutboundSecret(text) {
-  if (detectSecrets(text).length > 0) {
+  const scanText = stripKnownPublicIdentifier(text);
+  if (detectSecrets(scanText).length > 0) {
     return true;
   }
-  if (isEntropyBackendEnabled() && detectEntropy(text).length > 0) {
+  if (isEntropyBackendEnabled() && detectEntropy(scanText).length > 0) {
     return true;
   }
-  return anyComponentLooksSecret(text);
+  return anyComponentLooksSecret(scanText);
 }
 async function recordOutboundSecretFinding(cwd, tool, subject) {
   try {

package/dist/core.js

@@ -4029,6 +4029,24 @@ var init_config2 = __esm(() => {
 });
 
 // src/security/detect/entropy.ts
+function isAdjacentLabel(content, start) {
+  const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
+  if (ADJACENT_LABEL.test(before)) {
+    return true;
+  }
+  if (before.trim().length > 0) {
+    return false;
+  }
+  const lineStart = content.lastIndexOf(`
+`, start - 1);
+  if (lineStart < 0) {
+    return false;
+  }
+  const prevLineStart = content.lastIndexOf(`
+`, lineStart - 1) + 1;
+  const prevLine = content.slice(prevLineStart, lineStart);
+  return CONTINUATION_LABEL_LINE_RE.test(prevLine);
+}
 function isHexBlob(value) {
   return HEX_BLOB.test(value) && /[a-f]/i.test(value);
 }
@@ -4228,12 +4246,19 @@ function looksSecretShapedIn(text) {
   return secretShapedCandidatesIn(text).length > 0;
 }
 function labelledPieceQualifies(piece) {
-  const base = bareShapeQualifies(piece);
-  if (base.qualifies) {
-    return { entropy: base.entropy };
-  }
   if (isAllowShapedValue(piece)) {
-    return { entropy: base.entropy };
+    return { entropy: shannonEntropy(piece) };
+  }
+  if (isHexBlob(piece)) {
+    return { entropy: shannonEntropy(piece) };
+  }
+  if (!/[0-9]/.test(piece) && !/[+=]/.test(piece)) {
+    return null;
+  }
+  const withoutSeparators = piece.replace(/[-_.+]/g, "");
+  const entropy = shannonEntropy(withoutSeparators.length > 0 ? withoutSeparators : piece);
+  if (entropy >= 3.6) {
+    return { entropy };
   }
   return null;
 }
@@ -4272,9 +4297,9 @@ function detectEntropy(content) {
     if (urlSpans.some((u) => start < u.end && end > u.start)) {
       continue;
     }
-    const { qualifies, entropy } = bareShapeQualifies(value);
-    if (qualifies) {
-      matches.push(buildMatch(start, end, value, entropy));
+    const found = labelledPieceQualifies(value);
+    if (found !== null) {
+      matches.push(buildMatch(start, end, value, found.entropy));
     }
   }
   TOKEN.lastIndex = 0;
@@ -4289,8 +4314,7 @@ function detectEntropy(content) {
     if (matches.some((existing) => start < existing.end && end > existing.start)) {
       continue;
     }
-    const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
-    if (!ADJACENT_LABEL.test(before)) {
+    if (!isAdjacentLabel(content, start)) {
       continue;
     }
     const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
@@ -4312,9 +4336,10 @@ function detectEntropy(content) {
   }
   return matches.sort((a, b) => a.start - b.start);
 }
-var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), ADJACENT_LABEL, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, TAG_MAX_LETTER_RUN = 8, SLUG_HEX_TAIL_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
+var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), FILLER_WORDS = "is|was|set|to|the|value|now", ADJACENT_LABEL, CONTINUATION_LABEL_LINE_RE, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, TAG_MAX_LETTER_RUN = 8, SLUG_HEX_TAIL_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
 var init_entropy = __esm(() => {
-  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*["']?$`);
+  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*` + `(?:\\s+(?:${caseless(FILLER_WORDS)})){0,2}` + `["']?\\s*[:=]?\\s*["']?$`);
+  CONTINUATION_LABEL_LINE_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*\\\\\\s*$`);
   LABEL_ASSIGNMENT_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${SENSITIVE_LABEL_WORDS})[A-Za-z0-9_-]*"?\\s*=\\s*"?([A-Za-z0-9+/_=-]{6,})`, "gi");
   TOKEN = /[A-Za-z0-9+/=_-]{20,}(?:\.[A-Za-z0-9+/=_-]{6,})*/g;
   TOKEN_HEAD = /^[A-Za-z0-9+/=_-]+/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {