@niroai/niro 0.16.0 → 0.18.0

package/src/lib/repoPush.js

@@ -0,0 +1,495 @@
+/**
+ * Send a whole repository to Niro, when the person typing `niro audit-push-repo` answers yes.
+ *
+ * **What it is for, since 2026-11-11.** The way a user sends a repository to Niro for support:
+ * when something is wrong and they are happy for us to look at their code (Niraj, 2026-11-11: "We
+ * plan to ask users to use it when something is wrong and they're happy to share the repo with us
+ * to have a look at it"). Typing the command and answering yes is the consent, so it works with
+ * "Help improve Niro" on or off, on every plan, and with a lease past its expiry time. Before that
+ * day it needed the plan's `audit_full_repo` claim and sharing on (the rule of 2026-11-05); neither is
+ * checked now. `audit_full_repo` was dropped because niro-billing does not set it on every plan
+ * (LeaseService.auditFullRepoFor: true only on a plan marked "by terms" or for an account that gave
+ * consent, and the seeded Free plan is neither). Decision 01M75P5GYJBJ4NG3FHGSP2NJHE.
+ *
+ * **What this is, and why it is separate from `audit-send`.** The coverage audit normally
+ * sends only the files it flagged: a file is flagged when a line looks like a declaration or
+ * a route and the graph holds nothing covering it, which is a handful of files out of a
+ * repository. This command sends the whole repository, which is also how we get a corpus to
+ * measure the parser against rather than only the places it already failed. Decision 13 of the
+ * local-engine plan (which, until 2026-11-11, limited it to plans that allowed it).
+ *
+ * **Where it lands** (Niraj, 2026-10-16, answering the open question): "in S3 (locally minio)
+ * under the customer's account == exactly the same location if customer was uploading it as
+ * AGENT_UPLOAD". So this is not a new destination: it is the upload path the CLI has always
+ * had, `POST /api/agent/repos` for a workspace and then the ordinary sync chain, which stores
+ * source at `source/<accountId>/<repoId>/<path>` when the service runs in object-store mode
+ * (`niro-commons` `ObjectStoreSourceStore`). Account-scoped, so an erasure request is a
+ * prefix delete, and nothing in that chain creates a project
+ * (`AgentSyncController.registerAgentRepo` allocates a workspace and returns a git id).
+ *
+ * **This is the highest-consequence code in the plan**, which is its own risk 6: a wrong
+ * permission, or a push that ignores the gitignore pass, uploads a private repository nobody
+ * agreed to send. Three things follow from that and none of them is optional.
+ *
+ * 1. **It refuses rather than guesses.** The licence lease is still asked for, for the account
+ *    id, and a service that refused, a service that could not be reached or a lease that will
+ *    not parse is a refusal. An unknown answer is a no.
+ * 2. **The file set is the files Niro indexes, and nothing else** (since 2026-11-11: the engine's
+ *    own list, `niro-local indexed-files`, through shareFiles.js, which the background sharing uses
+ *    too), behind the same onboarding gate and the same server-side filter as every other upload
+ *    path. Before 2026-11-11 the list was folderSync's manifest, picked by file name. The first version of
+ *    this file had the manifest and neither of the other two, and an adversarial review
+ *    measured what that cost. Without the gate, running this in `~/projects/github` offered
+ *    198,998 files and 2,392 MiB, of which 6,044 were files their own repositories gitignore,
+ *    because `.gitignore` is only honoured when the folder being sent is itself a git work
+ *    tree. Without the server filter, the monorepo root sent 100 files over the 256 KiB cap,
+ *    678 MiB, 71 per cent of the bytes, which no other path would put on the wire.
+ * 3. **It is explicit, and it says what it will do before it does it.** No watcher calls this
+ *    and no command calls it as a side effect. (The watcher's background sharing, on when "Help
+ *    improve Niro" is on, is shareCode.js: it shares this file's workspace, file list and
+ *    redaction, but never this function, and keeps every gate this command dropped.) A folder
+ *    excluded with `niro share exclude` is asked about ("Send it anyway?") and sent only on a
+ *    yes. A person types it, sees the count and the size, and answers a question. With no terminal there is nobody to answer, so it refuses unless
+ *    `--yes` was passed: the one guard underneath (`folderSync.aggregateGuard`, 50,000 files
+ *    and 1 GiB) prints a warning and PROCEEDS when nothing can answer it, which is right for
+ *    a folder somebody onboarded on purpose and wrong for this.
+ *
+ * **Secrets are masked on this machine before anything is sent** (Niraj, 2026-11-06; niro-local
+ * `docs/usecases/on-machine-redaction.md`). The engine writes masked copies of the accepted files
+ * into a new private temporary folder (`niro-local redact-files`, llm-gateway's own rules, names
+ * kept), and the upload reads from that folder, never from the repository. The folder is deleted
+ * whatever happens. A file that is not text is not copied, so not sent; a file that masking made
+ * larger than the server's per-file cap is dropped. Both are counted on screen. If the engine
+ * cannot mask (too old, or it fails), nothing is sent. `doInitialSync` itself is unchanged and is
+ * still what `niro init`, `niro add repo` and takeover use to upload unmasked source for hosted
+ * Niro to build from; only this command points it at the masked copies.
+ *
+ * **Why the CLI trusts the claim without checking the signature**, which the engine does
+ * check: the claim protects the customer from us, not us from the customer. Everything here
+ * uploads the customer's own code to the customer's own account with the customer's own
+ * token, so somebody who forged a claim would be uploading their own repository to their own
+ * storage. The engine's signature check exists for the opposite direction, where the claim
+ * decides whether a licence is valid.
+ */
+const crypto = require("crypto");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const agentApi = require("./agentApi");
+const api = require("./api");
+const color = require("./color");
+const folderSync = require("./folderSync");
+const lease = require("./lease");
+const onboardTarget = require("./onboardTarget");
+const prompt = require("./prompt");
+const shareExclusions = require("./shareExclusions");
+const shareFiles = require("./shareFiles");
+
+/** Asked when the folder itself is excluded with `niro share exclude` (Niraj, 2026-11-11). */
+const EXCLUDED_QUESTION = "    You excluded this folder from sharing. Send it anyway?";
+
+/** Asked instead when the list of excluded folders cannot be read, so every folder counts as excluded. */
+const UNREADABLE_EXCLUSIONS_QUESTION = "    Niro could not read your excluded-folders list. Send anyway?";
+
+/** Where a push is remembered, so the same repository is not sent twice by accident. */
+const STATE_FILE = path.join(os.homedir(), ".niro", "audit-repos.json");
+
+function loadState() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(STATE_FILE, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Written 0600 through a renamed temporary file, so a file left 0664 by an older version becomes
+ * 0600 too. It holds folder paths, workspace ids and the account id (independent check of 31ffc5f,
+ * finding 4).
+ */
+function saveState(state) {
+  fs.mkdirSync(path.dirname(STATE_FILE), { recursive: true });
+  const tmp = `${STATE_FILE}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n", { mode: 0o600 });
+  fs.renameSync(tmp, STATE_FILE);
+}
+
+/** The engine's masking of a set of files, shared with the background sharing (shareFiles.js). */
+const engineRedact = (...args) => shareFiles.engineRedact(...args);
+
+/** One key per folder per backend, because a git id from one stack is meaningless on another. */
+function keyFor(folder) {
+  return `${api.currentBaseUrl()}::${folder}`;
+}
+
+/**
+ * Can this machine read its account from the licence service?
+ *
+ * Returns `{ allowed: true, accountId, planId }`, or `{ allowed: false, reason }` where the
+ * reason is already a sentence for a developer to read. A refused, unreachable or unreadable
+ * lease is a no. Nothing else is checked: not the plan's `audit_full_repo`, not "Help improve
+ * Niro" (`share_code`), and not the lease's expiry, because typing the command and answering yes
+ * is the consent (Niraj, 2026-11-11).
+ */
+async function permitted({ fetchLease = lease.fetchLease } = {}) {
+  const nonce = crypto.randomBytes(16).toString("hex");
+  const answer = await fetchLease(nonce);
+  if (answer.refused) {
+    return { allowed: false, reason: answer.reason || "the licence service refused this account" };
+  }
+  if (answer.unreachable) {
+    return {
+      allowed: false,
+      reason: `the licence service could not be reached (${answer.detail || "no detail"}), so nothing was sent`,
+    };
+  }
+  const claims = lease.claimsOf(answer.lease);
+  if (!claims) {
+    return { allowed: false, reason: "the licence could not be read, so nothing was sent" };
+  }
+  return { allowed: true, accountId: claims.account_id, planId: claims.plan_id };
+}
+
+/**
+ * The marked workspace this folder's shared code goes to, and the server's answer about which of
+ * `manifest`'s files it will take. Used by `niro audit-push-repo` and by the background sharing
+ * (shareCode.js), so one folder has one workspace however its code is sent.
+ *
+ * Returns `{ gitId, filtered }`, or `{ refused: reason }` when the server cannot promise to delete
+ * the code when sharing is switched off. `state` and `key` are the caller's when it has the record
+ * open already; the entry is written before anything is uploaded.
+ */
+async function sharedWorkspace(resolved, accountId, manifest, { state = loadState(), key = keyFor(resolved) } = {}) {
+  const already = state[key];
+  // The workspace is allocated before the filter, because the filter is a question about a
+  // repository the service has to know. Written down straight away, with no `sentAt`: a push
+  // that fails halfway leaves bytes on the server, and without this the next run allocated a
+  // SECOND workspace and sent everything again.
+  // Reused only when that workspace was registered with the sharing mark (`shared: true`, written
+  // below once the server echoed it). An entry from before the mark existed names a workspace the
+  // server would never delete when sharing goes off, so it is not sent to again.
+  let gitId = already && already.shared === true ? already.gitId : null;
+  if (gitId && already.accountId && accountId && already.accountId !== accountId) {
+    // A different account on the same backend. The service refuses a workspace that is not
+    // the caller's anyway (AgentSyncService.requireRepo), so this only decides whether the
+    // developer gets a clear message or a "repository not found".
+    gitId = null;
+  }
+  let filtered;
+  if (gitId) {
+    try {
+      filtered = await agentApi.filterManifest(gitId, manifest);
+    } catch (err) {
+      // The server deleted that workspace, which is what happens 7 days after sharing was
+      // switched off (or when the developer deleted it in the console). Forget it and make a
+      // new one below, rather than failing with "Repository not found" for ever.
+      if (!agentApi.isRepoNotFound(err)) throw err;
+      delete state[key];
+      saveState(state);
+      gitId = null;
+    }
+  }
+  if (!gitId) {
+    const registered = await agentApi.registerSharedRepo({ displayName: path.basename(resolved) });
+    if (!registered.sharedForImprovement) {
+      // An older server ignores the mark without saying so. It would keep this code after
+      // sharing is switched off, so the empty workspace is taken back and nothing is sent.
+      if (registered.gitId) {
+        try {
+          await agentApi.deleteRepo(registered.gitId);
+        } catch {
+          // The workspace is empty: nothing was uploaded to it. The refusal below still stands.
+        }
+      }
+      return {
+        refused:
+          "the Niro service cannot yet promise to delete this code when sharing is switched off, so nothing was sent",
+      };
+    }
+    gitId = registered.gitId;
+    state[key] = { gitId, sentAt: null, files: 0, accountId, shared: true };
+    saveState(state);
+    // The server decides what it will take, which is what every other upload path does
+    // (`init.js:476`, `add-repo.js`, `takeover.js`) and what `folderSync` calls "the
+    // authoritative gate". The one rule it adds that the local walk has not got is the
+    // per-file size cap: without this, the monorepo root sent 100 files over the 256 KiB cap,
+    // 678 MiB, 71 per cent of the bytes, which no other path would have put on the wire.
+    filtered = await agentApi.filterManifest(gitId, manifest);
+  }
+  return { gitId, filtered };
+}
+
+/**
+ * Send one folder's source.
+ *
+ * Returns what happened, rather than printing it, so the command prints and a test can read
+ * it. `force` sends a folder that has been sent before; without it a second call says when
+ * the first one happened and does nothing.
+ */
+async function pushFolder(
+  folder,
+  {
+    force = false,
+    yes = false,
+    log = console.log,
+    fetchLease = lease.fetchLease,
+    confirm = prompt.confirm,
+    interactive = !prompt.isNonInteractive(),
+    redactFiles = engineRedact,
+  } = {}
+) {
+  const resolved = path.resolve(folder);
+  if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) {
+    return { sent: false, reason: `not a directory: ${resolved}` };
+  }
+  // A folder the user excluded from sharing is asked about first, before anything about it is
+  // read: typed, the person may send it anyway (Niraj, 2026-11-11). The background sharing never
+  // sends it. The question needs a person: `--yes` answers the size question below, not this one,
+  // because the exclusion was a choice made on purpose, so with no terminal nothing is sent.
+  //
+  // Every question, and the refusal when nobody can answer, comes before any request to Niro other
+  // than the licence lease: nothing about the repository, not even its file names, leaves before a
+  // yes (independent check of aac6573: a "no" with sharing off still registered a workspace and
+  // sent the names to the server's filter).
+  let sendExcluded = false;
+  if (shareExclusions.isExcluded(resolved)) {
+    const unreadable = shareExclusions.read() === null;
+    if (!interactive) {
+      return {
+        sent: false,
+        excluded: true,
+        reason: unreadable
+          ? `the list of excluded folders (${shareExclusions.file()}) cannot be read and there is no terminal to ask you. Fix or delete it, or run this in a terminal`
+          : "this folder is excluded from code sharing and there is no terminal to ask you. Run it in a terminal, or run `niro share include <folder>` first",
+      };
+    }
+    if (!(await confirm(unreadable ? UNREADABLE_EXCLUSIONS_QUESTION : EXCLUDED_QUESTION, false))) {
+      return { sent: false, excluded: true, reason: "you said no: this folder stays excluded from sharing" };
+    }
+    sendExcluded = true;
+  }
+
+  // The same gate `niro init` and `niro add repo` pass through, and for a stronger reason
+  // here: it refuses $HOME, the filesystem root, a parent of $HOME and the system
+  // directories, and its own comment describes this command exactly ("there is no legitimate
+  // reason to upload $HOME, and a scripted --force must not be able to do it by accident",
+  // onboardTarget.js:198-204). It also refuses a folder holding no project indicator, which
+  // is what a directory full of unrelated repositories looks like, and that case is the
+  // expensive one: measured before this gate was added, `~/projects/github` offered 198,998
+  // files and 2,392 MiB, 6,044 of them files their own repositories gitignore, because the
+  // gitignore pass only runs when the folder being sent is itself a git work tree.
+  if (!onboardTarget.ensureOnboardable(resolved, {})) {
+    // That gate's own refusal ends by offering `--force`, which it honours for a folder with
+    // no project indicator. This command deliberately does NOT pass it through, because a
+    // folder of unrelated repositories is exactly the case `--force` would wave past, and
+    // `--force` here means "send it again" instead. Said plainly, or the developer types a
+    // flag that does something else.
+    return {
+      sent: false,
+      gateRefused: true,
+      reason: "this folder must not be sent whole (the refusal is above)",
+    };
+  }
+
+  // The token first, so a machine that cannot authenticate does not build a manifest of
+  // somebody's repository only to fail. Same order as the journal and audit uploads.
+  try {
+    await api.ensureFreshToken();
+  } catch (err) {
+    return { sent: false, reason: (err && err.message) || String(err) };
+  }
+
+  const permission = await permitted({ fetchLease });
+  if (!permission.allowed) return { sent: false, reason: permission.reason };
+  // Nobody can answer the question below: refused here, after the lease and before anything else
+  // reaches Niro, so the reason is the lease's when the lease is the problem.
+  if (!yes && !interactive) {
+    // The caller prints "Nothing was sent: <reason>", so the reason does not repeat it.
+    return { sent: false, reason: "there is no terminal to confirm from. Pass --yes to mean it." };
+  }
+
+  const state = loadState();
+  const key = keyFor(resolved);
+  const already = state[key];
+  if (already && already.sentAt && !force) {
+    return {
+      sent: false,
+      alreadySent: true,
+      reason: `already sent on ${already.sentAt} (${already.files} files). Use --force to send it again.`,
+    };
+  }
+
+  // The files the engine considers when it indexes this folder, and nothing else (Niraj,
+  // 2026-11-11: "we send what is indexed with niro"): the same list the background sharing sends
+  // (shareFiles.js). Until 2026-11-11 this was folderSync's own walk, which picked by file name and
+  // could differ from what Niro indexes.
+  let listed;
+  try {
+    listed = await shareFiles.indexedFiles(resolved);
+  } catch (err) {
+    return {
+      sent: false,
+      reason: `the local engine could not list this folder's files (${firstLine(err)}), so nothing was sent. Run \`niro upgrade\` and try again`,
+    };
+  }
+  // Files under a folder the user excluded (this folder, or one inside it) are held back by
+  // shareFiles. They are sent only on a yes: the one above for this folder, or the question here
+  // for a folder inside it. With no terminal, a folder inside stays out and the rest is sent.
+  let files = listed.files;
+  const heldFiles = Array.isArray(listed.heldFiles) ? listed.heldFiles : [];
+  if (heldFiles.length > 0) {
+    if (!sendExcluded && interactive) {
+      sendExcluded = await confirm(
+        `    You excluded ${heldFiles.length} file(s) in this folder from sharing. Send them too?`,
+        false
+      );
+    }
+    if (sendExcluded) files = files.concat(heldFiles);
+    else log(`    ${heldFiles.length} file(s) under a folder you excluded from sharing are not sent.`);
+  }
+  if (files.length === 0) {
+    return { sent: false, reason: "no files to send: nothing in this folder is uploadable" };
+  }
+  // Masked copies first, into a folder only this user can read (mkdtemp makes it 0700), so the
+  // count and the size shown below are what will be sent. Deleted in the finally whatever
+  // happens, including a "no" to the question. Everything up to the question is on this machine:
+  // the workspace and the server's file filter come after the yes.
+  const maskedDir = fs.mkdtempSync(path.join(os.tmpdir(), "niro-push-masked-"));
+  // Ctrl-C, a kill or any exit during the upload must delete the copies too: a finally does not
+  // run when the process is ended by a signal (the independent check found the copies left).
+  const removeCopies = () => fs.rmSync(maskedDir, { recursive: true, force: true });
+  const onSignal = (signal) => {
+    removeCopies();
+    process.exit(signal === "SIGINT" ? 130 : signal === "SIGHUP" ? 129 : 143);
+  };
+  const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+  for (const signal of signals) process.on(signal, onSignal);
+  process.on("exit", removeCopies);
+  let uploaded;
+  let gitId;
+  try {
+    let masked;
+    try {
+      // The engine masks secrets, then redact.js removes author and company names from each copy:
+      // the same two passes the background sharing makes (shareFiles.maskCopies).
+      masked = await shareFiles.maskCopies(resolved, maskedDir, files.map((file) => file.path), shareFiles.redactionContext(resolved), {
+        redactFiles: async (...args) => {
+          const report = await redactFiles(...args);
+          if (!report || !report.redacted || !Array.isArray(report.files)) throw new NotMasked();
+          return report;
+        },
+      });
+    } catch (err) {
+      if (err instanceof NotMasked) {
+        return { sent: false, reason: "the local engine did not say it masked the files, so nothing was sent" };
+      }
+      return {
+        sent: false,
+        reason: `the local engine could not mask the files (${firstLine(err)}), so nothing was sent. Run \`niro upgrade\` and try again`,
+      };
+    }
+    // Masking can make a file longer than the value it hides; the server would refuse it. The
+    // server's own cap is checked again after the yes, when its filter answers.
+    const sending = masked.files.filter((file) => file.bytes <= folderSync.PER_FILE_CAP_BYTES);
+    const grown = masked.files.length - sending.length;
+    const notText = Number(masked.not_text) || 0;
+    const tooSlow = Number(masked.too_slow) || 0;
+    const skipped = notText + (Number(masked.missing) || 0) + (Number(masked.refused) || 0);
+    // Only the masks in the files that are sent (it counted the dropped files' masks too).
+    const masksSent = sending.reduce((total, file) => total + (Number(file.masks) || 0), 0);
+    if (sending.length === 0) {
+      return { sent: false, reason: "no file was left to send once the files were masked" };
+    }
+    const bytes = sending.reduce((total, file) => total + file.bytes, 0);
+
+    // Said before anything is uploaded, and then asked. A whole repository is the most this
+    // product ever sends, so the developer sees the size of it first.
+    log("");
+    log(`    ${resolved}`);
+    log(`    ${sending.length} files, ${megabytes(bytes)}, to your own account's storage at Niro.`);
+    log("    This is the whole repository, not only the files the audit flagged.");
+    log(`    Secrets were masked on this machine first: ${masksSent} value(s) replaced.`);
+    if (notText) log(`    ${notText} file(s) are not sent because they are not text.`);
+    if (tooSlow) log(`    ${tooSlow} file(s) are not sent because masking them took too long.`);
+    if (skipped - notText) log(`    ${skipped - notText} file(s) could not be read and are not sent.`);
+    if (grown) log(`    ${grown} file(s) are not sent because masking made them larger than the server takes.`);
+    if (masked.linesMoved) log(`    ${masked.linesMoved} file(s) are not sent because removing names would have moved their lines.`);
+    log("");
+    if (!yes && !(await confirm("    Send it?", false))) {
+      return { sent: false, reason: "you said no" };
+    }
+
+    // After the yes, and only then: the marked workspace, and the server's answer about which of
+    // these files it will take (its per-file size cap is the rule it adds). Only the names of the
+    // files the person agreed to send are in the question.
+    const workspace = await sharedWorkspace(resolved, permission.accountId, shareFiles.manifestOf(sending), { state, key });
+    if (workspace.refused) return { sent: false, reason: workspace.refused };
+    gitId = workspace.gitId;
+    const filtered = workspace.filtered;
+    const accepted = new Set(filtered.included_paths || filtered.includedPaths || []);
+    const serverCap = Number(filtered.max_file_size_bytes || filtered.maxFileSizeBytes) || folderSync.PER_FILE_CAP_BYTES;
+    const taken = sending.filter((file) => accepted.has(file.path) && file.bytes <= serverCap);
+    if (taken.length === 0) {
+      return { sent: false, reason: "the service accepted none of this folder's files" };
+    }
+    if (taken.length < sending.length) {
+      log(`    ${sending.length - taken.length} file(s) are not sent because the server does not take them.`);
+    }
+    const sendPaths = taken.map((file) => file.path);
+    // The copies' own sizes, so the aggregate guard does not re-stat them (it once re-stat'ed a
+    // whole repository because it was not given the sizes it already had).
+    const maskedSizes = Object.fromEntries(taken.map((file) => [file.path, file.bytes]));
+    const sentBytes = taken.reduce((total, file) => total + file.bytes, 0);
+    const sentMasks = taken.reduce((total, file) => total + (Number(file.masks) || 0), 0);
+
+    // The guard inside this (1 GiB, 50,000 files) throws, which is the right shape: a
+    // repository over the limit is not sent at all rather than sent in part. It reads the
+    // masked copies, never the repository.
+    await folderSync.doInitialSync(gitId, maskedDir, sendPaths, { sizes: maskedSizes });
+    uploaded = { files: sendPaths.length, bytes: sentBytes, masks: sentMasks, notText, tooSlow, grown };
+  } finally {
+    for (const signal of signals) process.removeListener(signal, onSignal);
+    process.removeListener("exit", removeCopies);
+    removeCopies();
+  }
+
+  state[key] = {
+    gitId,
+    sentAt: new Date().toISOString(),
+    files: uploaded.files,
+    bytes: uploaded.bytes,
+    accountId: permission.accountId,
+    shared: true,
+  };
+  saveState(state);
+  return { sent: true, gitId, ...uploaded };
+}
+
+/** The engine answered, but without saying it masked: kept apart so the reason says exactly that. */
+class NotMasked extends Error {}
+
+/** The first line of an error, without its stack, for a one-line reason. */
+function firstLine(err) {
+  return String((err && err.message) || err).split("\n")[0].slice(0, 200);
+}
+
+/** A size a person reads, for the one line that decides whether they say yes. */
+function megabytes(bytes) {
+  if (bytes < 1024 * 1024) return `${Math.max(1, Math.round(bytes / 1024))} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+module.exports = {
+  permitted,
+  pushFolder,
+  sharedWorkspace,
+  keyFor,
+  loadState,
+  megabytes,
+  engineRedact,
+  STATE_FILE,
+  EXCLUDED_QUESTION,
+  UNREADABLE_EXCLUSIONS_QUESTION,
+};

package/src/lib/secret.js

@@ -111,4 +111,4 @@ function _strip(value, omit, maskValues) {
   return value;
 }
 
-module.exports = { maskSecret, isSecretKey, looksSecretValue, stripSecrets };
+module.exports = { maskSecret, isSecretKey, looksSecretValue, stripSecrets, SECRET_KEY_PATTERN };