@mycadet/credential-executor 0.0.1 → 0.12.6-dev.202610080043.b727a33

package/node_modules/@mycadet/service-contracts/src/plan-credit.ts

@@ -0,0 +1,66 @@
+/**
+ * Plan-credit derivations shared by the assistant runtime's `platform credits`
+ * route and the web client's usage meter, so both read the billing summary's
+ * grant figures the same way and can never quote different readings.
+ */
+
+export type BillingPlanId = "base" | "pro";
+
+function clamp01(value: number): number {
+  if (!Number.isFinite(value) || value < 0) {
+    return 0;
+  }
+  return value > 1 ? 1 : value;
+}
+
+/**
+ * How much of the usage credit an account was granted it has already used:
+ * the granted total less what is still unused, over that total. The initial
+ * $5 grant burns 0 to 100% as it is spent, and a further grant grows the total
+ * so the bar drops back. Null when nothing was ever granted, or when the
+ * platform reports neither figure, which has no honest reading rather than a
+ * full or empty bar.
+ */
+export function usageGrantRatio(
+  totalUsd: number | null,
+  availableUsd: number | null,
+): number | null {
+  if (totalUsd == null || availableUsd == null || totalUsd <= 0) {
+    return null;
+  }
+  return clamp01((totalUsd - availableUsd) / totalUsd);
+}
+
+/**
+ * The plan-credit reading with the plan's fallback applied. The grant figures
+ * count only unexpired grants, so a Pro subscription whose grants total
+ * nothing has used or expired everything it was granted (a full bar, with
+ * nothing scheduled to refill it), while a base plan in that position was
+ * never granted anything (no reading). An unknown plan gets the ratio when
+ * the figures allow one and no fallback otherwise.
+ */
+export function planCreditUsedFraction(
+  totalUsd: number | null,
+  availableUsd: number | null,
+  planId: BillingPlanId | null,
+): number | null {
+  const ratio = usageGrantRatio(totalUsd, availableUsd);
+  if (ratio != null) {
+    return ratio;
+  }
+  if (planId === "pro" && totalUsd != null && totalUsd <= 0) {
+    return 1;
+  }
+  return null;
+}
+
+/**
+ * Credit bought or earned on top of the plan-included grants: the balance less
+ * whatever is still unused on those grants, never below zero, to the cent.
+ */
+export function extraCreditUsd(
+  balanceUsd: number,
+  availableUsd: number,
+): number {
+  return Math.round(Math.max(0, balanceUsd - availableUsd) * 100) / 100;
+}

package/node_modules/@mycadet/service-contracts/src/platform-credential.ts

@@ -0,0 +1,41 @@
+/**
+ * Wire contract for asking an assistant whether its stored platform-managed
+ * credential still authenticates.
+ *
+ * The daemon route is the authoritative serving side:
+ *   - `POST /v1/platform/verify-credential`
+ *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *
+ * The daemon's platform client produces the verdict, the route reports it,
+ * and the `cadet` CLI reads it before deciding whether a stored key can be
+ * re-injected (`cli/src/lib/assistant-api-key-resolution.ts`), so all three
+ * share one definition and cannot silently drift. The web app reads the same
+ * shape through its generated daemon client.
+ */
+import { z } from "zod";
+
+/**
+ * What the platform said about the stored credential, right now.
+ *
+ *   - `valid`: the platform accepted it.
+ *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *     credential needs replacing.
+ *   - `unknown`: the check itself could not run (no credential stored, the
+ *     platform unreachable, a server error). Not evidence either way.
+ */
+export const PlatformCredentialVerificationStatusSchema = z.enum([
+  "valid",
+  "rejected",
+  "unknown",
+]);
+export type PlatformCredentialVerificationStatus = z.infer<
+  typeof PlatformCredentialVerificationStatusSchema
+>;
+
+/** `POST /v1/platform/verify-credential` response body. */
+export const PlatformVerifyCredentialResponseSchema = z.object({
+  status: PlatformCredentialVerificationStatusSchema,
+});
+export type PlatformVerifyCredentialResponse = z.infer<
+  typeof PlatformVerifyCredentialResponseSchema
+>;

package/node_modules/@mycadet/service-contracts/src/reactions.ts

@@ -0,0 +1,140 @@
+/**
+ * Canonical vocabulary for a reaction's emoji, shared by every service that
+ * handles one: the gateway that normalizes it, the daemon that stores and
+ * projects it, and the web that renders it.
+ *
+ * The kind is said by the channel rather than inferred from how the emoji
+ * is spelled. Modelled on Zulip's `reaction_type`, the one surveyed system
+ * that separates the namespace from the name.
+ *
+ * `shortcode` is a name in a channel's own namespace that the channel's
+ * adapter could not place among the standard emoji. Slack sends `+1` and
+ * `blob_wave` alike, as names; its normalizer resolves the standard ones to
+ * `unicode` from Slack's own list, and what remains is a workspace upload
+ * only the workspace can render. It is a distinct kind from `unicode`, not
+ * a stand-in for an unknown one, and nothing past an adapter needs a
+ * channel's naming to read it.
+ */
+import { z } from "zod";
+
+export const REACTION_EMOJI_KINDS = ["unicode", "shortcode", "custom"] as const;
+export type ReactionEmojiKind = (typeof REACTION_EMOJI_KINDS)[number];
+
+/**
+ * The typed emoji fields every schema that carries a reaction spreads in,
+ * so the wire contract, the stored envelopes, and the response projection
+ * describe one shape. Optional throughout: a persisted row or a replayed
+ * payload may carry only the spelling.
+ */
+export const ReactionEmojiFieldsSchema = z.object({
+  /** Which namespace the emoji was drawn from. */
+  emojiKind: z.enum(REACTION_EMOJI_KINDS).optional(),
+  /**
+   * The emoji's name in that namespace: the character itself for `unicode`,
+   * the bare name for `shortcode` and `custom`. Never a mention form.
+   */
+  emojiName: z.string().optional(),
+  /** The channel's id for a `custom` emoji, absent for every other kind. */
+  emojiId: z.string().optional(),
+  /** Whether a `custom` emoji animates. Absent for every other kind. */
+  emojiAnimated: z.boolean().optional(),
+});
+export type ReactionEmojiFields = z.infer<typeof ReactionEmojiFieldsSchema>;
+
+/** The typed fields with the kind and name known. */
+export type ReactionEmojiIdentity = ReactionEmojiFields & {
+  emojiKind: ReactionEmojiKind;
+  emojiName: string;
+};
+
+/**
+ * The typed emoji fields a source actually carries, with undefined ones
+ * omitted: an absent key and a present-but-undefined one serialize alike, but the
+ * stored envelope and the response should carry only what was declared. Every writer of a reaction shape (the wire
+ * payload, both stored envelopes, the response projection) copies the
+ * fields through this rather than restating the four-way pick.
+ */
+export function pickReactionEmojiFields(
+  source: ReactionEmojiFields,
+): ReactionEmojiFields {
+  return {
+    ...(source.emojiKind !== undefined ? { emojiKind: source.emojiKind } : {}),
+    ...(source.emojiName !== undefined ? { emojiName: source.emojiName } : {}),
+    ...(source.emojiId !== undefined ? { emojiId: source.emojiId } : {}),
+    ...(source.emojiAnimated !== undefined
+      ? { emojiAnimated: source.emojiAnimated }
+      : {}),
+  };
+}
+
+/**
+ * Parse Discord's custom-emoji mention form. The form travels the wire as a
+ * reaction's spelling, so more than one package reads it: the daemon rebuilds
+ * a REST path from it when the assistant reacts, and a row carrying only the
+ * spelling recovers its kind from it. One parser, so the two cannot disagree
+ * about what counts as one.
+ *
+ * `animated` reports whether the spelling carries the `a` marker. Discord's
+ * normalizer never writes that marker, so it is read only from spellings that
+ * arrive from elsewhere: a row written by another producer, or a value the
+ * model hands back as it received it.
+ */
+export function parseDiscordEmojiMention(
+  emoji: string,
+): { name: string; id: string; animated: boolean } | null {
+  const match = /^<(a?):([^:>]+):(\d+)>$/.exec(emoji);
+  return match
+    ? { name: match[2]!, id: match[3]!, animated: match[1] === "a" }
+    : null;
+}
+
+/**
+ * Recover an emoji's kind from its spelling alone. This is the one inference
+ * the design permits, reserved for a value that carries the string and no
+ * typed fields: a persisted row or a replayed retry payload. A value that
+ * declares its kind never reaches this; `reactionEmojiIdentity` makes that
+ * choice for every reader.
+ *
+ * A mention form is unambiguous. Past that the two remaining kinds are told
+ * apart by whether the string is a name at all: a channel's shortcode is
+ * ASCII word characters, optionally carrying Slack's `::skin-tone-N`
+ * suffix, and anything else is the character itself.
+ */
+export function classifyReactionEmojiSpelling(
+  emoji: string,
+): ReactionEmojiIdentity {
+  const custom = parseDiscordEmojiMention(emoji);
+  if (custom) {
+    // The plain `<:name:id>` form says nothing about animation: the
+    // normalizer spells every custom emoji that way and reports animation
+    // in the typed field instead, so a spelling without the `a` marker is
+    // "unrecorded", not "not animated". Only the `<a:` form asserts it.
+    return {
+      emojiKind: "custom",
+      emojiName: custom.name,
+      emojiId: custom.id,
+      ...(custom.animated ? { emojiAnimated: true } : {}),
+    };
+  }
+  return /^[\w+-]+(::skin-tone-[2-6])?$/.test(emoji)
+    ? { emojiKind: "shortcode", emojiName: emoji }
+    : { emojiKind: "unicode", emojiName: emoji };
+}
+
+/**
+ * The typed identity of a reaction's emoji: the fields it declares when it
+ * declares a kind, otherwise the kind recovered from its spelling. Every
+ * reader that must know what an emoji is goes through this, so the wire
+ * contract and the web agree on when the spelling is consulted.
+ */
+export function reactionEmojiIdentity(
+  reaction: { emoji: string } & ReactionEmojiFields,
+): ReactionEmojiIdentity {
+  return reaction.emojiKind !== undefined && reaction.emojiName !== undefined
+    ? {
+        ...pickReactionEmojiFields(reaction),
+        emojiKind: reaction.emojiKind,
+        emojiName: reaction.emojiName,
+      }
+    : classifyReactionEmojiSpelling(reaction.emoji);
+}

package/node_modules/@mycadet/service-contracts/src/redacted-credential.ts

@@ -0,0 +1,226 @@
+/**
+ * Redacted-credential sentinel — the shared wire format for chat-persisted
+ * secret redactions.
+ *
+ * When the daemon persists a chat message containing a detected secret (and
+ * the `chat-credential-reveal` feature flag is on), the secret is replaced
+ * with a plain-text sentinel instead of the legacy `<redacted type="…" />`
+ * HTML marker. The sentinel is plain text on purpose: the chat markdown
+ * pipeline has no rehype-raw, so an HTML marker can never become an element —
+ * a text sentinel survives markdown parsing as an ordinary text node that a
+ * rehype plugin can match and upgrade into an interactive chip.
+ *
+ * Two shapes:
+ *   `〔redacted:TYPE〕`                — secret detected, vault identity unknown
+ *   `〔redacted:TYPE:SERVICE:FIELD〕`  — secret byte-matched to a stored credential
+ *
+ * The enriched shape is only emitted when the daemon has *proven* the match
+ * (exact plaintext comparison against a credential fetched for this turn) —
+ * never inferred. A wrong SERVICE:FIELD here would let the client reveal the
+ * wrong secret, so producers must treat enrichment as opt-in per proven match.
+ *
+ * The corner brackets (U+3014/U+3015) were chosen because they are not
+ * markdown syntax characters, never appear in the secret formats we detect,
+ * and are visually distinct if a client without chip support renders the raw
+ * sentinel.
+ *
+ * This module is shared by the daemon (producer) and clients/web (consumer)
+ * so the format can never drift between the two. It is intentionally
+ * dependency-free and data-only.
+ */
+
+export const REDACTED_SENTINEL_OPEN = "\u3014"; // 〔
+export const REDACTED_SENTINEL_CLOSE = "\u3015"; // 〕
+export const REDACTED_SENTINEL_TAG = "redacted";
+
+/**
+ * Version stamped as a `_redactionVersion` rider on daemon-persisted text
+ * blocks whose raw text passed through {@link neutralizeRedactedSentinels}
+ * before persistence. The daemon's history read boundary
+ * (`renderHistoryContent`) neutralizes text blocks WITHOUT this rider —
+ * rows persisted before the forgery guard existed — so a forged sentinel in
+ * old history can never reach a chip-enabled client surface. Internal to the
+ * daemon: the wire projection rebuilds blocks and never ships the rider.
+ */
+export const SENTINEL_REDACTION_VERSION = 2;
+
+/**
+ * Service/field segments are percent-encoded into the sentinel so arbitrary
+ * credential identifiers survive the colon-delimited format. The credential
+ * routes accept service/field as arbitrary strings — colon-qualified names
+ * exist in real vaults (migration `018-rekey-compound-credential-keys`
+ * produces `service = "integration:google"`), so a delimiter-collision
+ * charset restriction would silently downgrade proven reveals for those
+ * credentials to the non-revealable shape. Encoding keeps the common
+ * kebab/snake identifiers fully legible while making every other string
+ * representable.
+ *
+ * The encoded form contains only `[A-Za-z0-9_.%-]` — `encodeURIComponent`
+ * plus the characters it leaves bare that fall outside that set — so the
+ * sentinel regex stays unambiguous around its `:` delimiters and `〕` close.
+ */
+function encodeSentinelSegment(segment: string): string {
+  return encodeURIComponent(segment).replace(
+    /[!'()*~]/g,
+    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+}
+
+/**
+ * Inverse of {@link encodeSentinelSegment}. Returns undefined for malformed
+ * percent-escapes — daemon-encoded segments always decode, and forged
+ * sentinels are neutralized at persist time, so this path is defensive.
+ */
+function decodeSentinelSegment(segment: string): string | undefined {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Charset for the TYPE label. Pattern labels are our own
+ * (`secret-patterns.ts` / scanner-only patterns) and contain only words,
+ * spaces, and hyphens — but validate anyway so a future label containing a
+ * colon or bracket cannot silently corrupt the format.
+ */
+const TYPE_RE = /^[^:\u3014\u3015]+$/;
+
+export interface RedactedCredentialSentinel {
+  /** Human-readable secret type label, e.g. "Anthropic API Key". */
+  type: string;
+  /** Vault service namespace — present only when the match was proven. */
+  service?: string;
+  /** Vault field name — present only when the match was proven. */
+  field?: string;
+}
+
+/** True when the sentinel carries a proven vault identity. */
+export function isRevealableSentinel(
+  s: RedactedCredentialSentinel,
+): s is RedactedCredentialSentinel & { service: string; field: string } {
+  return s.service !== undefined && s.field !== undefined;
+}
+
+/**
+ * Build a sentinel string. Service/field are percent-encoded (see
+ * {@link encodeSentinelSegment}), so any non-empty identifier the credential
+ * routes accept — including colon-qualified names like `integration:google`
+ * — round-trips through the enriched shape. Empty segments fall back to the
+ * plain (non-revealable) shape; the function throws only if the type label
+ * itself is unusable (which would mean a broken pattern table).
+ */
+export function buildRedactedSentinel(
+  sentinel: RedactedCredentialSentinel,
+): string {
+  const { type, service, field } = sentinel;
+  if (!TYPE_RE.test(type)) {
+    throw new Error(`Invalid redacted-sentinel type label: ${type}`);
+  }
+  const base = `${REDACTED_SENTINEL_OPEN}${REDACTED_SENTINEL_TAG}:${type}`;
+  if (
+    service !== undefined &&
+    field !== undefined &&
+    service !== "" &&
+    field !== ""
+  ) {
+    const encService = encodeSentinelSegment(service);
+    const encField = encodeSentinelSegment(field);
+    return `${base}:${encService}:${encField}${REDACTED_SENTINEL_CLOSE}`;
+  }
+  return `${base}${REDACTED_SENTINEL_CLOSE}`;
+}
+
+/**
+ * Global-flag regex for locating sentinels inside a larger text. Callers must
+ * not share a single instance across concurrent iterations (stateful
+ * `lastIndex`); use {@link createRedactedSentinelRegex}.
+ */
+export function createRedactedSentinelRegex(): RegExp {
+  // 〔redacted:TYPE〕 or 〔redacted:TYPE:SERVICE:FIELD〕
+  // TYPE = anything except colon/brackets; SERVICE/FIELD = the
+  // percent-encoded segment charset (see encodeSentinelSegment). Capture
+  // groups carry the ENCODED segments — decode via decodeRedactedSentinelMatch.
+  return new RegExp(
+    `${REDACTED_SENTINEL_OPEN}${REDACTED_SENTINEL_TAG}:([^:\u3014\u3015]+?)(?::([A-Za-z0-9_.%-]+):([A-Za-z0-9_.%-]+))?${REDACTED_SENTINEL_CLOSE}`,
+    "g",
+  );
+}
+
+/**
+ * Global-flag regex for locating NEUTRALIZED sentinels — the word-joiner
+ * form {@link neutralizeRedactedSentinels} produces — inside a larger text.
+ * Renderers use this to show a defused redaction marker as an inert badge
+ * instead of leaking bare sentinel glyphs into the transcript. The capture
+ * groups mirror {@link createRedactedSentinelRegex}, but consumers must NOT
+ * trust them as vault coordinates: a neutralized span is by definition text
+ * the daemon refused to vouch for. Same statefulness caveat as the genuine
+ * regex — create a fresh instance per iteration.
+ */
+export function createNeutralizedSentinelRegex(): RegExp {
+  return new RegExp(
+    `${REDACTED_SENTINEL_OPEN}\\u2060${REDACTED_SENTINEL_TAG}:([^:\\u3014\\u3015]+?)(?::([A-Za-z0-9_.%-]+):([A-Za-z0-9_.%-]+))?${REDACTED_SENTINEL_CLOSE}`,
+    "g",
+  );
+}
+
+/**
+ * Map a {@link createRedactedSentinelRegex} match to a decoded sentinel.
+ * Shared by {@link parseRedactedSentinel} and the web rehype plugin so the
+ * segment decoding never drifts between consumers. A malformed
+ * percent-escape (unreachable for daemon-minted sentinels; forged ones are
+ * neutralized at persist) degrades to the plain non-revealable shape rather
+ * than surfacing bogus vault coordinates.
+ */
+export function decodeRedactedSentinelMatch(
+  m: RegExpExecArray,
+): RedactedCredentialSentinel {
+  const [, type, encService, encField] = m;
+  if (encService !== undefined && encField !== undefined) {
+    const service = decodeSentinelSegment(encService);
+    const field = decodeSentinelSegment(encField);
+    if (service !== undefined && field !== undefined) {
+      return { type, service, field };
+    }
+  }
+  return { type };
+}
+
+/**
+ * Neutralize sentinel-shaped strings that were NOT produced by the redactor.
+ *
+ * The sentinel is plain text, so any content source (model output quoting a
+ * transcript, fetched web content, a pasted message) could otherwise forge
+ * one and manufacture a reveal chip for an arbitrary stored credential.
+ * Producers must call this on raw text *before* inserting their own
+ * sentinels, so the only sentinels that survive persistence are the ones the
+ * redactor itself emitted from a detected secret.
+ *
+ * Neutralization inserts a word joiner (U+2060, zero-width, non-breaking)
+ * after the opening bracket — visually identical for a human reading a
+ * quoted sentinel, but the consumer regex no longer matches. Idempotent:
+ * after one pass the trigger prefix no longer occurs, so re-running is a
+ * no-op and never corrupts text further.
+ */
+export function neutralizeRedactedSentinels(text: string): string {
+  const trigger = `${REDACTED_SENTINEL_OPEN}${REDACTED_SENTINEL_TAG}:`;
+  if (!text.includes(trigger)) return text;
+  return text.replaceAll(
+    trigger,
+    `${REDACTED_SENTINEL_OPEN}\u2060${REDACTED_SENTINEL_TAG}:`,
+  );
+}
+
+/**
+ * Parse a single exact sentinel string (the whole input must be one
+ * sentinel). Returns undefined when the input is not a valid sentinel.
+ */
+export function parseRedactedSentinel(
+  text: string,
+): RedactedCredentialSentinel | undefined {
+  const re = createRedactedSentinelRegex();
+  const m = re.exec(text);
+  if (!m || m[0] !== text) return undefined;
+  return decodeRedactedSentinelMatch(m);
+}