@mrciphersmith/keryx 0.3.76 → 0.3.77

package/dist/cli.js

@@ -20145,7 +20145,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.76",
+    version: "0.3.77",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -126919,13 +126919,75 @@ var init_proxy = __esm(() => {
   init_guard();
 });
 
+// src/commands/granted-json-ids.ts
+function letters(index) {
+  return String(index).replace(/\d/g, (d) => String.fromCharCode(97 + Number(d)));
+}
+function protectJsonIds(text) {
+  const head = text.trim();
+  if (head.length === 0 || head[0] !== "[" && head[0] !== "{")
+    return;
+  if (text.includes(PLACEHOLDER))
+    return;
+  try {
+    JSON.parse(head);
+  } catch {
+    return;
+  }
+  const hidden = [];
+  const hide = (value) => {
+    hidden.push(value);
+    return `${PLACEHOLDER}${letters(hidden.length - 1)}x`;
+  };
+  let out = "";
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === '"') {
+      let j = i + 1;
+      while (j < text.length && text[j] !== '"')
+        j += text[j] === "\\" ? 2 : 1;
+      const literal = text.slice(i, j + 1);
+      const inner = literal.slice(1, -1);
+      const prefix = GITHUB_URL_PREFIX.exec(inner);
+      const rest = prefix === null ? "" : inner.slice(prefix[0].length);
+      out += prefix !== null && GITHUB_URL_REST.test(rest) ? `"${prefix[0]}${rest.replace(/\d+/g, hide)}"` : literal;
+      i = j + 1;
+      continue;
+    }
+    const number = ch === "-" || ch >= "0" && ch <= "9" ? NUMBER2.exec(text.slice(i, i + 40)) : null;
+    if (number !== null) {
+      const key = /"((?:[^"\\]|\\.)*)"\s*:\s*$/.exec(out.slice(-120))?.[1] ?? "";
+      out += SENSITIVE_KEY.test(key) ? number[0] : hide(number[0]);
+      i += number[0].length;
+      continue;
+    }
+    out += ch;
+    i += 1;
+  }
+  return {
+    text: out,
+    restore: (scrubbed) => scrubbed.replace(new RegExp(`${PLACEHOLDER}([a-j]+)x`, "g"), (whole, index) => {
+      const at = Number(index.replace(/[a-j]/g, (c) => String(c.charCodeAt(0) - 97)));
+      return hidden[at] ?? whole;
+    })
+  };
+}
+var PLACEHOLDER = "kxjsonid", GITHUB_URL_PREFIX, GITHUB_URL_REST, SENSITIVE_KEY, NUMBER2;
+var init_granted_json_ids = __esm(() => {
+  GITHUB_URL_PREFIX = /^https:\/\/(?:api\.)?github\.com\/(?:repos\/)?[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\//;
+  GITHUB_URL_REST = /^(?:actions\/runs|pull|issues)\/\d+(?:\/[A-Za-z0-9_-]+)*(?:#[A-Za-z_-]+-?\d+)?$/;
+  SENSITIVE_KEY = /token|secret|pass|key|auth|credential|private|ssn|phone|card|account|iban|pin|otp/i;
+  NUMBER2 = /^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/;
+});
+
 // src/commands/trigger-agent-task.ts
 import { execFile as execFile11 } from "child_process";
 import { randomUUID as randomUUID35 } from "crypto";
 import { mkdtemp as mkdtemp5, mkdir as mkdir60, readdir as readdir42, rm as rm19, writeFile as writeFile37 } from "fs/promises";
 import { homedir as homedir12, tmpdir as tmpdir11 } from "os";
 import path266 from "path";
-function scrubGrantedOutput(text, env, secrets = []) {
+function scrubGrantedOutput(text, env, secrets = [], json = false) {
   let out = text;
   for (const value of secrets) {
     if (value.length >= 8)
@@ -126938,10 +127000,18 @@ function scrubGrantedOutput(text, env, secrets = []) {
   }
   for (const [shape, mask] of TOKEN_SHAPES)
     out = out.replace(shape, mask);
+  if (json) {
+    const at = out.indexOf(STDERR_MARK);
+    const protectedJson = protectJsonIds(at === -1 ? out : out.slice(0, at));
+    if (protectedJson !== undefined) {
+      const tail = at === -1 ? "" : redactSensitiveText(out.slice(at));
+      return protectedJson.restore(redactSensitiveText(protectedJson.text)) + tail;
+    }
+  }
   return redactSensitiveText(out);
 }
-function scrubThenCap(raw, env, secrets, max = GRANTED_MAX_BYTES) {
-  const scrubbed = scrubGrantedOutput(raw, env, secrets);
+function scrubThenCap(raw, env, secrets, max = GRANTED_MAX_BYTES, json = false) {
+  const scrubbed = scrubGrantedOutput(raw, env, secrets, json);
   if (scrubbed.length <= max)
     return scrubbed;
   const head = scrubbed.slice(0, max);
@@ -126959,7 +127029,7 @@ ${stderr}` : ""}`;
       const code = error === null ? 0 : typeof error.code === "number" ? error.code : null;
       const reason = error === null ? "" : `
 [exit: ${code ?? error.message}]`;
-      resolve({ output: `${scrubThenCap(raw, env, secrets)}${scrubGrantedOutput(reason, env, secrets)}`, exitCode: code, ok: error === null });
+      resolve({ output: `${scrubThenCap(raw, env, secrets, GRANTED_MAX_BYTES, true)}${scrubGrantedOutput(reason, env, secrets)}`, exitCode: code, ok: error === null });
     });
   });
 }
@@ -127326,7 +127396,9 @@ function defaultArmTimeout2(ms, fire) {
   timer.unref?.();
   return () => clearTimeout(timer);
 }
-var GRANTED_TIMEOUT_MS = 30000, GRANTED_MAX_BYTES, SECRET_ENV_NAME, TOKEN_SHAPES;
+var GRANTED_TIMEOUT_MS = 30000, GRANTED_MAX_BYTES, STDERR_MARK = `
+[stderr]
+`, SECRET_ENV_NAME, TOKEN_SHAPES;
 var init_trigger_agent_task = __esm(() => {
   init_agent();
   init_agent_hooks();
@@ -127338,6 +127410,7 @@ var init_trigger_agent_task = __esm(() => {
   init_fs();
   init_maintenance_lock();
   init_service2();
+  init_granted_json_ids();
   init_granted_binary();
   init_schedule_verify();
   init_granted_tools();
@@ -127388,9 +127461,9 @@ function ghEnvForProject(projectRoot, base = process.env) {
 function parseGrantedOutput(output, ok, exitCode) {
   const exit = EXIT_MARK.exec(output);
   const withoutExit = exit === null ? output : output.slice(0, exit.index);
-  const stderrAt = withoutExit.indexOf(STDERR_MARK);
+  const stderrAt = withoutExit.indexOf(STDERR_MARK2);
   const stdout = stderrAt === -1 ? withoutExit : withoutExit.slice(0, stderrAt);
-  const stderr = stderrAt === -1 ? "" : withoutExit.slice(stderrAt + STDERR_MARK.length).trim();
+  const stderr = stderrAt === -1 ? "" : withoutExit.slice(stderrAt + STDERR_MARK2.length).trim();
   if (!ok) {
     const why = stderr.length > 0 ? stderr : exit !== null ? exit[0].trim() : "gh failed";
     return { ok: false, stdout: "", detail: `${why.replace(/\s+/g, " ").slice(0, 300)}`, exitCode };
@@ -127400,7 +127473,7 @@ function parseGrantedOutput(output, ok, exitCode) {
   }
   return { ok: true, stdout, detail: "", exitCode };
 }
-var GH_ENV_ALLOWED, STDERR_MARK = `
+var GH_ENV_ALLOWED, STDERR_MARK2 = `
 [stderr]
 `, TRUNCATED, EXIT_MARK, defaultGhRunner = async (call) => {
   const result = await runGrantedCommand(call.bin, call.argv, call.cwd, call.env, call.signal, call.secrets);
@@ -185268,10 +185341,10 @@ function codeOf(text) {
   return stripTrailingComment2(text).trimEnd();
 }
 function numericSkeleton(text) {
-  return text.replace(NUMBER2, "\x00");
+  return text.replace(NUMBER3, "\x00");
 }
 function numbersOf(text) {
-  return [...text.matchAll(NUMBER2)].map((match) => ({ value: Number(match[0]), index: match.index ?? 0 }));
+  return [...text.matchAll(NUMBER3)].map((match) => ({ value: Number(match[0]), index: match.index ?? 0 }));
 }
 function enclosingNames(code, index) {
   const names = [];
@@ -185534,7 +185607,7 @@ function renderFloorMarkdown(report) {
   return lines.join(`
 `);
 }
-var FLOOR_FINDING_KINDS, COMMENT_OPENER, FLOOR_WORDS, CEILING_WORDS, CAPACITY_WORDS, NUMBER2, KEY_SEPARATORS, TRAILING_IDENTIFIER, TRAILING_INDEX, OPENS_CONTAINER, TYPE_KEYWORDS, COMMENTED_LINE, MODIFIER_SEGMENT, DISABLED_CALL, DISABLED_ANNOTATION, OTHER_TEST_PATHS, ASSERTION_HEAD, SUPPRESSION_MARKERS, ANNOTATION_MARKERS;
+var FLOOR_FINDING_KINDS, COMMENT_OPENER, FLOOR_WORDS, CEILING_WORDS, CAPACITY_WORDS, NUMBER3, KEY_SEPARATORS, TRAILING_IDENTIFIER, TRAILING_INDEX, OPENS_CONTAINER, TYPE_KEYWORDS, COMMENTED_LINE, MODIFIER_SEGMENT, DISABLED_CALL, DISABLED_ANNOTATION, OTHER_TEST_PATHS, ASSERTION_HEAD, SUPPRESSION_MARKERS, ANNOTATION_MARKERS;
 var init_floor = __esm(() => {
   init_selection();
   FLOOR_FINDING_KINDS = [
@@ -185624,7 +185697,7 @@ var init_floor = __esm(() => {
     "parallel",
     "batch"
   ]);
-  NUMBER2 = /[0-9]+(?:\.[0-9]+)?/g;
+  NUMBER3 = /[0-9]+(?:\.[0-9]+)?/g;
   KEY_SEPARATORS = /[\s:=(["'`{<]*$/;
   TRAILING_IDENTIFIER = /[A-Za-z0-9_$.-]+$/;
   TRAILING_INDEX = /\[\s*[0-9]*\s*\]$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.76",
+  "version": "0.3.77",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {