@nodatachat/mcp 1.3.20 → 1.3.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE.md +105 -105
- package/README.md +294 -291
- package/dist/gate.js +2 -2
- package/dist/index.js +169 -158
- package/dist/status.js +1 -1
- package/package.json +57 -57
package/dist/gate.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! @nodatachat/mcp 1.3.
|
|
1
|
+
/*! @nodatachat/mcp 1.3.22 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
|
|
2
2
|
import{appendFileSync as yi,copyFileSync as Vr,existsSync as bi,mkdirSync as _i,readFileSync as ki,statSync as xt,writeFileSync as Xr}from"node:fs";import{homedir as Fe}from"node:os";import{basename as Ne,extname as wt,isAbsolute as He,join as Le,resolve as Oe}from"node:path";var v={text:[],header:[],secrets:[],table:null};function he(e){e.table&&(v.table=e.table);for(let t of e.text??[])v.text.some(i=>i.kind===t.kind)||v.text.push(t);e.header&&!v.header.includes(e.header)&&v.header.push(e.header);for(let t of e.secrets??[])v.secrets.some(i=>i.id===t.id)||v.secrets.push(t)}function me(){return v.text}function Ue(){return v.header}function C(){return v.table}function We(){return v.secrets}var U=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function P(){let e=We().filter(t=>!U.some(i=>i.id===t.id));return[...U,...e]}var Mt=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],zt=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],Bt=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,Ut=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function L(e){if(!e)return null;let t=e.trim();if(Bt.test(t)||/^name$/i.test(t))return null;let i=t.replace(/[\s-]+/g,"_");for(let n of[...zt,...Mt])if(n.pattern.test(t)||n.pattern.test(i))return{type:n.type,label:n.label};if(Ut.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(i))return{type:"name",label:"Person name"};for(let n of Ue()){let s=n(t);if(s)return{type:s.type,label:s.label}}return null}function Ke(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let i=t.padStart(9,"0"),n=0;for(let s=0;s<9;s++){let r=parseInt(i[s]??"0",10)*(s%2+1);r>9&&(r-=9),n+=r}return n%10===0&&parseInt(i,10)>0}function Wt(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let i=0,n=!1;for(let s=t.length-1;s>=0;s-=1){let r=parseInt(t[s]??"0",10);n&&(r*=2,r>9&&(r-=9)),i+=r,n=!n}return i%10===0}function Kt(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let i=t.slice(4)+t.slice(0,4),n=0;for(let s of i){let r=s>="A"&&s<="Z"?String(s.charCodeAt(0)-55):s;for(let o of r)n=(n*10+Number(o))%97}return n===1}var ge="(?<!\\d)(?<!\\d[.,])",ye="(?!\\d)(?![.,]\\d)",Ge=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${ge}\\d{9}${ye}`,"g"),validate:Ke,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${ge}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${ye}`,"g"),validate:Wt,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:Kt,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${ge}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${ye}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function W(e,t){let i=[],n="",s=!1;for(let r=0;r<e.length;r++){let o=e[r];s?o==='"'&&e[r+1]==='"'?(n+='"',r++):o==='"'?s=!1:n+=o:o==='"'?s=!0:o===t?(i.push(n),n=""):n+=o}return i.push(n),i}import{inflateRawSync as xn}from"node:zlib";import{inflateSync as Gt}from"node:zlib";var be=new Set([".pdf"]),Ze=8*1024*1024;function Zt(e){let t=e.toString("latin1"),i=new Map,n=/(\d+)\s+(\d+)\s+obj\b/g,s;for(;(s=n.exec(t))!==null;){let r=Number(s[1]),o=n.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let c=t.indexOf("stream",o),l,p=null;if(c>=0&&c<a){l=t.slice(o,c);let d=c+6;t[d]==="\r"&&(d+=1),t[d]===`
|
|
3
3
|
`&&(d+=1);let u=t.indexOf("endstream",d);u>d&&(p=e.subarray(d,u))}else l=t.slice(o,a);i.set(r,{num:r,dict:l,stream:p})}for(let r of[...i.values()]){if(!r.stream||!/\/Type\s*\/ObjStm\b/.test(r.dict))continue;let o=ke(r),a=Number(/\/N\s+(\d+)/.exec(r.dict)?.[1]??0),c=Number(/\/First\s+(\d+)/.exec(r.dict)?.[1]??-1);if(o===null||!a||c<0)continue;let l=o.slice(0,c).trim().split(/\s+/).map(Number);for(let p=0;p<a;p+=1){let d=l[2*p],u=l[2*p+1];if(d===void 0||u===void 0||Number.isNaN(d)||Number.isNaN(u))break;let f=p+1<a?l[2*(p+1)+1]:void 0,m=o.slice(c+u,f!==void 0?c+f:void 0);i.has(d)||i.set(d,{num:d,dict:m,stream:null})}}return i}function _e(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let i=0,n=0;for(let s of t){let r=s.codePointAt(0)??0;r<32||r>=127&&r<=191||r===65533||r>=57344&&r<=63743?i+=1:/[\p{L}\p{N}]/u.test(s)&&(n+=1)}return i/t.length>.2||n/t.length<.25}function Vt(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let i=t.indexOf("~>");i>=0&&(t=t.slice(0,i));let n=[],s=0,r=0;for(let o of t){if(o==="z"&&r===0){n.push(0,0,0,0);continue}let a=o.charCodeAt(0)-33;if(a<0||a>84)return null;s=s*85+a,r+=1,r===5&&(n.push(s>>>24&255,s>>>16&255,s>>>8&255,s&255),s=0,r=0)}if(r>0){for(let a=r;a<5;a+=1)s=s*85+84;let o=[s>>>24&255,s>>>16&255,s>>>8&255,s&255];for(let a=0;a<r-1;a+=1)n.push(o[a]??0)}return Buffer.from(n)}function Xt(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",i=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(i)?Buffer.from(i,"hex"):null}function Jt(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(i=>i[1]??"")}function ke(e){if(!e.stream)return null;let t=e.stream;for(let i of Jt(e.dict)){let n=null;if(i==="FlateDecode")try{n=Gt(t)}catch{return null}else if(i==="ASCII85Decode")n=Vt(t);else if(i==="ASCIIHexDecode")n=Xt(t);else return null;if(n===null)return null;t=n}return t.toString("latin1")}function qt(e){let t=new Map,i=1,n=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(n&&n[1]){let c=/<([0-9A-Fa-f]+)>/.exec(n[1]);c&&c[1]&&c[1].length>=4&&(i=2)}let s=c=>{let l="";for(let p=0;p+3<c.length+1;p+=4){let d=parseInt(c.slice(p,p+4),16);Number.isFinite(d)&&d>0&&(l+=String.fromCharCode(d))}return l},r=/beginbfchar([\s\S]*?)endbfchar/g,o;for(;(o=r.exec(e))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(o[1]??""))!==null;)t.set(parseInt(l[1]??"0",16),s(l[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(o=a.exec(e))!==null;){let c=o[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,p;for(;(p=l.exec(c))!==null;){let d=parseInt(p[1]??"0",16),u=parseInt(p[2]??"0",16),f=parseInt((p[3]??"0").slice(0,4)||"0",16);if(!(u-d>65535))for(let m=d;m<=u;m+=1)t.set(m,String.fromCharCode(f+(m-d)))}}return{map:t,bytes:i}}function Yt(e){let t=new Map,i=[],n=[];for(let r of e.values()){for(let o of r.dict.matchAll(/\/Font\s*<<([\s\S]*?)>>/g))o[1]&&n.push(o[1]);for(let o of r.dict.matchAll(/\/Font\s+(\d+)\s+\d+\s+R/g)){let a=e.get(Number(o[1]));a&&n.push(a.dict)}}let s=new Set;for(let r of n){let o=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=o.exec(r))!==null;){let c=`${a[1]}#${a[2]}`;s.has(c)||(s.add(c),i.push([a[1]??"",Number(a[2])]))}}for(let[r,o]of i){let a=e.get(o);if(!a)continue;let c=null,l=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(l){let d=e.get(Number(l[1])),u=d?ke(d):null;u&&(c=qt(u))}if(c||(c=tn(a.dict,e)),!c)continue;let p=t.get(r)??[];p.push(c),t.set(r,p)}return t}var Qt=["alef","bet","gimel","dalet","he","vav","zayin","het","tet","yod","finalkaf","kaf","lamed","finalmem","mem","finalnun","nun","samekh","ayin","finalpe","pe","finaltsadi","tsadi","qof","resh","shin","tav"];function en(e){let t=/^uni([0-9A-Fa-f]{4})$/.exec(e)??/^u([0-9A-Fa-f]{4,6})$/.exec(e);if(t)return String.fromCodePoint(parseInt(t[1],16));let i=/^afii(\d{5})$/.exec(e);if(i){let r=Number(i[1]);if(r>=57664&&r<=57690)return String.fromCharCode(1488+(r-57664))}let n=Qt.indexOf(e.replace(/hebrew$/,""));return n>=0?String.fromCharCode(1488+n):e==="space"?" ":/^[A-Za-z]$/.test(e)?e:{zero:"0",one:"1",two:"2",three:"3",four:"4",five:"5",six:"6",seven:"7",eight:"8",nine:"9",period:".",comma:",",hyphen:"-",colon:":",slash:"/",at:"@"}[e]??null}function tn(e,t){let i=e,n=/\/Encoding\s+(\d+)\s+\d+\s+R/.exec(e);n&&(i=t.get(Number(n[1]))?.dict??"");let s=/\/Differences\s*\[([^\]]*)\]/.exec(i);if(!s?.[1])return null;let r=new Map,o=0;for(let a of s[1].match(/\d+|\/[^\s/[\]]+/g)??[]){if(/^\d+$/.test(a)){o=Number(a);continue}let c=en(a.slice(1));c!==null&&r.set(o,c),o+=1}return r.size?{map:r,bytes:1}:null}function qe(e){let t=[];for(let i=0;i<e.length;i+=1){let n=e[i];if(n!=="\\"){t.push(n.charCodeAt(0)&255);continue}let s=e[i+1];if(s===void 0)break;if(s>="0"&&s<="7"){let o="",a=i+1;for(;a<e.length&&o.length<3&&e[a]>="0"&&e[a]<="7";)o+=e[a],a+=1;t.push(parseInt(o,8)&255),i=a-1;continue}let r={n:10,r:13,t:9,b:8,f:12};t.push(r[s]??s.charCodeAt(0)&255),i+=1}return t}function Ye(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let i=2;i+1<e.length;i+=2)t+=String.fromCharCode((e[i]??0)<<8|(e[i+1]??0));return t}function Ve(e,t){let i=Ye(e);if(i!==null)return i;if(!t)return e.map(s=>String.fromCharCode(s)).join("");let n="";if(t.bytes===2)for(let s=0;s+1<e.length;s+=2){let r=(e[s]??0)<<8|(e[s+1]??0);n+=t.map.get(r)??""}else for(let s of e)n+=t.map.get(s)??String.fromCharCode(s);return n}function nn(e){let t=0;for(let i of e){let n=i.codePointAt(0)??0;/[\p{L}\p{N}]/u.test(i)?t+=1:(n<32||n>=127&&n<=191||n===65533)&&(t-=2)}return t}function Xe(e,t){if(!t||t.length<=1)return Ve(e,t?.[0]);let i="",n=-1/0;for(let s of t){let r=Ve(e,s),o=nn(r);o>n&&(i=r,n=o)}return i}function sn(e,t){let i="",n="",s,r=!1,o="",a=0,c=null,l=()=>{n.trim()&&(i+=n+`
|
|
4
4
|
`),n="",a=0},p=()=>{n&&!n.endsWith(" ")&&a>1&&(n+=" ")},d=/\/([^\s/<>[\]()]+)\s+-?[\d.]+\s+Tf|(-?[\d.]+)\s+(-?[\d.]+)\s+T[dD]\b|(?:-?[\d.]+\s+){5}(-?[\d.]+)\s+Tm\b|T\*|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|\[|\]|-?\d+(?:\.\d+)?|TJ|Tj|'|"/g,u;for(;(u=d.exec(e))!==null;){let f=u[0];if(u[1]!==void 0&&f.endsWith("Tf")){s=t.get(u[1]);continue}if(u[2]!==void 0){Math.abs(Number(u[3]))>.01?l():Number(u[2])!==0&&p();continue}if(u[4]!==void 0){let m=Number(u[4]);c!==null&&Math.abs(m-c)>.01?l():c!==null&&p(),c=m;continue}if(f==="T*"){l();continue}if(f==="["){r=!0;continue}if(f==="]"){r=!1;continue}if(f==="TJ"||f==="Tj"||f==="'"||f==='"'){(f==="'"||f==='"')&&l(),o&&(n+=o,a=o.trim().length,o="");continue}if(f.startsWith("("))o+=Xe(qe(f.slice(1,-1)),s);else if(f.startsWith("<")){let m=f.slice(1,-1).replace(/\s+/g,""),h=[];for(let y=0;y+1<m.length;y+=2)h.push(parseInt(m.slice(y,y+2),16));o+=Xe(h,s)}else r&&Number(f)<-200&&o&&!o.endsWith(" ")&&(o+=" ")}return o&&(n+=o),l(),i}function rn(e,t){let i=e.toString("latin1"),n=/\/Info\s+(\d+)\s+\d+\s+R/.exec(i),s=n?t.get(Number(n[1]))?.dict:void 0;if(!s)return"";let r=[],o=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=o.exec(s))!==null;){let c=a[2]??"";if(c.startsWith("(")){let l=qe(c.slice(1,-1));r.push(Ye(l)??l.map(p=>String.fromCharCode(p)).join(""))}else{let l=c.slice(1,-1).replace(/\s+/g,""),p="";if(l.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<l.length+1;d+=4)p+=String.fromCharCode(parseInt(l.slice(d,d+4),16));else for(let d=0;d+1<l.length;d+=2)p+=String.fromCharCode(parseInt(l.slice(d,d+2),16));r.push(p)}}return r.join(`
|
|
@@ -24,7 +24,7 @@ ${a} ${c}
|
|
|
24
24
|
`))}a+u.length>Ee&&(u=u.slice(0,Math.max(0,Ee-a)),c=!0),u.trim().length!==0&&(r.push(u),o.push(l),a+=u.length)}return r.length===0?null:{text:r.join(`
|
|
25
25
|
`),truncated:c,parts:o}}function Y(e,t,i={}){if(st.has(t))return Cn(e,t);if(be.has(t)){let n=Se(e,i);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.engine}`],engine:n.engine,uncertain:n.uncertain}:null}return null}var Pn=new Set([...st,...be]);import{deflateRawSync as Nn}from"node:zlib";var rt={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},Ln=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,Dn=[...Ge].sort((e,t)=>+(t.subkind==="iban")-+(e.subkind==="iban"));function D(e,t,i=1){e[t]=(e[t]??0)+i}var ot=null,F=e=>{let t=e.trim();ot&&t&&ot.add(t)};function w(e,t={}){let i=e;for(let n of P()){let s=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g");i=i.replace(s,r=>(D(t,"secret"),F(r),"[SECRET]"))}for(let n of Dn)n.pattern.lastIndex=0,i=i.replace(n.pattern,s=>n.validate(s)?(D(t,n.subkind),F(s),rt[n.subkind]??`[${n.subkind.toUpperCase()}]`):s);i=i.replace(Ln,n=>(D(t,"email"),F(n),rt.email));for(let n of me()){let s=n.find(i).sort((r,o)=>o.start-r.start);for(let r of s)F(i.slice(r.start,r.end)),i=i.slice(0,r.start)+`[${n.kind.toUpperCase()}]`+i.slice(r.end),D(t,n.kind)}return{text:i,counts:t,columnsHidden:[]}}function Ae(){let e=new Map,t={};return(i,n)=>{F(n);let s=`${i}\0${n.trim()}`,r=e.get(s);return r===void 0&&(r=t[i]=(t[i]??0)+1,e.set(s,r)),`[${i.toUpperCase()}-${r}]`}}function Ie(e){let t=e.trim();return/^\[[A-Z_]+(?:-\d+)?\]$/.test(t)||/^[\d]{0,4}[*•xX]{3,}[\d]{0,4}$/.test(t)}var ct=/^\s*-?\d+(?:\.\d+)?\s*$/;function $e(e){let t=new Set;for(let[i,n]of e){let s=n.filter(o=>ct.test(o));if(s.length<3)continue;s.filter(o=>w(o).text!==o).length/s.length<.5&&t.add(i)}return t}function at(e,t){return e.includes(t)||e.includes('"')||e.includes(`
|
|
26
26
|
`)?`"${e.replace(/"/g,'""')}"`:e}function Fn(e){let t=(e.match(/\t/g)??[]).length,i=(e.match(/;/g)??[]).length,n=(e.match(/,/g)??[]).length;return t>n&&t>=i?" ":i>n?";":","}function Te(e,t){let i=e.split(/\r?\n/),n=t??Fn(i[0]??""),s=W(i[0]??"",n),r=s.map(f=>L(f)),o={},a=Ae(),c=i.slice(1).map(f=>f===""?null:W(f,n)),l=new Map;for(let f of c)f?.forEach((m,h)=>l.set(h,[...l.get(h)??[],m]));let p=$e(l),d=C();if(d){let f=c.filter(m=>m!==null).slice(0,200);for(let m of d({name:"table",headers:s,rows:f})){let h=s.indexOf(m.column);h>=0&&!(m.how==="header"&&p.has(h))&&(r[h]={type:m.type,label:m.category})}}let u=[s.map(f=>at(f,n)).join(n)];for(let f of c){if(f===null){u.push("");continue}let m=f.map((h,y)=>{let _=r[y];return _&&h.trim()!==""&&!Ie(h)?(D(o,`column:${_.type}`),a(_.type,h)):p.has(y)&&ct.test(h)?h:w(h,o).text});u.push(m.map(h=>at(h,n)).join(n))}return{text:u.join(`
|
|
27
|
-
`),counts:o,columnsHidden:s.filter((f,m)=>r[m])}}var Hn=/^xl\/(pivotCache|charts|externalLinks)\//,pt=10;function On(e,t,i=1){e[t]=(e[t]??0)+i}function ut(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""")}function ft(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),i="";for(let n of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))i+=n[1];return S(i)}function jn(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>ft(t[1]??"")):[]}var ht=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function Q(e,t){let i=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return i?i[1]:null}function I(e,t){if(e.type==="s"){let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?t[Number(n[1])]??null:null}if(e.type==="inlineStr"){let n=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return n?ft(n[1]):null}if(e.type==="b"||e.type==="e")return null;let i=/<v>([^<]*)<\/v>/.exec(e.inner);return i?S(i[1]):null}function Mn(e){let t=[];for(let i of e.matchAll(ht)){let n=Q(i[1],"r"),s=n?/^([A-Z]+)(\d+)$/.exec(n):null;if(!s)return null;t.push({full:i[0],attrs:i[1],inner:i[2]??"",col:s[1],row:Number(s[2]),type:Q(i[1],"t")??"n"})}return t}function zn(e,t){let i=[...new Set(e.map(n=>n.row))].sort((n,s)=>n-s).slice(0,pt);for(let n of i){let s=new Map;for(let r of e.filter(o=>o.row===n)){let o=I(r,t),a=o?L(o):null;a&&s.set(r.col,{type:a.type,header:o.trim()})}if(s.size>0)return{row:n,cols:s}}return{row:-1,cols:new Map}}var Bn=/^xl\/worksheets\/sheet\d+\.xml$/,Un=200;function Wn(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function Kn(e,t){let i=[...new Set(e.map(r=>r.row))].sort((r,o)=>r-o).slice(0,pt),n=-1,s=-1/0;for(let r of i){let o=e.filter(l=>l.row===r).map(l=>(I(l,t)??"").trim()).filter(Boolean);if(o.length<2)continue;let a=o.filter(l=>!Wn(l)).length,c=a*2-(o.length-a);c>s&&(s=c,n=r)}return n}function Gn(e,t,i){let n=zn(t,i),s=C();if(!s)return n;let r=n.row>=0?n.row:Kn(t,i);if(r<0)return n;let o=t.filter(d=>d.row===r).map(d=>({col:d.col,text:(I(d,i)??"").trim()})).filter(d=>d.text),a=new Map(o.map((d,u)=>[d.col,u])),c=new Map;for(let d of t){if(d.row<=r)continue;let u=a.get(d.col);if(u!==void 0){if(!c.has(d.row)){if(c.size>=Un)continue;c.set(d.row,o.map(()=>""))}c.get(d.row)[u]=I(d,i)??""}}let l=new Map(r===n.row?n.cols:[]),p=o.map(d=>d.text);for(let d of s({name:e,headers:p,rows:[...c.values()]})){let u=p.indexOf(d.column);u<0||l.set(o[u].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:r,cols:l}}function lt(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${ut(t)}</t></is></c>`}var Zn=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let i=t;for(let n=0;n<8;n+=1)i=i&1?3988292384^i>>>1:i>>>1;e[t]=i>>>0}return e})();function Vn(e){let t=4294967295;for(let i=0;i<e.length;i+=1)t=Zn[(t^e[i])&255]^t>>>8;return(t^4294967295)>>>0}var dt=33;function mt(e){let t=[],i=[],n=0;for(let o of e){let a=Buffer.from(o.name,"utf8"),c=o.name.endsWith("/"),l=c?Buffer.alloc(0):Nn(o.data),p=c?0:8,d=c?0:Vn(o.data),u=Buffer.alloc(30);u.writeUInt32LE(67324752,0),u.writeUInt16LE(20,4),u.writeUInt16LE(2048,6),u.writeUInt16LE(p,8),u.writeUInt16LE(dt,12),u.writeUInt32LE(d,14),u.writeUInt32LE(l.length,18),u.writeUInt32LE(o.data.length,22),u.writeUInt16LE(a.length,26),t.push(u,a,l);let f=Buffer.alloc(46);f.writeUInt32LE(33639248,0),f.writeUInt16LE(20,4),f.writeUInt16LE(20,6),f.writeUInt16LE(2048,8),f.writeUInt16LE(p,10),f.writeUInt16LE(dt,14),f.writeUInt32LE(d,16),f.writeUInt32LE(l.length,20),f.writeUInt32LE(o.data.length,24),f.writeUInt16LE(a.length,28),f.writeUInt32LE(n,42),i.push(f,a),n+=u.length+a.length+l.length}let s=Buffer.concat(i),r=Buffer.alloc(22);return r.writeUInt32LE(101010256,0),r.writeUInt16LE(e.length,8),r.writeUInt16LE(e.length,10),r.writeUInt32LE(s.length,12),r.writeUInt32LE(n,16),Buffer.concat([...t,s,r])}function Re(e){let t=J(e);if(!t||t.length===0||t.some(h=>Hn.test(h.name)))return null;let i=new Map;for(let h of t){if(h.name.endsWith("/")){i.set(h.name,Buffer.alloc(0));continue}let y=q(e,h);if(!y)return null;i.set(h.name,y)}let n=[...i.keys()].filter(h=>Bn.test(h));if(n.length===0)return null;let s=i.get("xl/sharedStrings.xml")?.toString("utf8")??null,r=jn(s),o=new Set,a={},c=new Set,l=Ae();for(let h of n){let y=i.get(h).toString("utf8"),_=Mn(y);if(!_)return null;let ce=Gn(h.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),_,r),M=ce.row,T=new Map;for(let k of _){if(k.type!=="n"||k.row<=M)continue;let x=I(k,r);x!==null&&T.set(k.col,[...T.get(k.col)??[],x])}let z=$e(T),B=new Map;for(let[k,{type:x,header:le,how:de}]of ce.cols)de==="header"&&z.has(k)||(B.set(k,x),c.add(le));let Ot=y.replace(ht,(k,x,le)=>{let de=Q(x,"r"),[,pe,jt]=/^([A-Z]+)(\d+)$/.exec(de),R={full:k,attrs:x,inner:le??"",col:pe,row:Number(jt),type:Q(x,"t")??"n"},E=I(R,r),ue=()=>{if(R.type==="s"){let Be=/<v>([^<]*)<\/v>/.exec(R.inner);Be&&o.add(Number(Be[1]))}return k};if(E===null||E.trim()==="")return ue();let fe=B.get(pe);if(fe&&R.row>M&&!Ie(E))return On(a,`column:${fe}`),lt(x,l(fe,E));if(R.type==="n"&&z.has(pe))return ue();let ze=w(E,a);return ze.text===E?ue():lt(x,ze.text)});i.set(h,Buffer.from(Ot,"utf8"))}if(s){let h=-1,y=s.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,_=>(h+=1,o.has(h)?_:"<si><t></t></si>"));i.set("xl/sharedStrings.xml",Buffer.from(y,"utf8"))}for(let h of[...i.keys()].filter(y=>/^xl\/comments\d*\.xml$/.test(y))){let _=i.get(h).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(ce,M,T,z)=>{let B=w(S(T),a);return`${M}${ut(B.text)}${z}`});i.set(h,Buffer.from(_,"utf8"))}let p=i.get("docProps/core.xml");if(p){let h=p.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");i.set("docProps/core.xml",Buffer.from(h,"utf8"))}let d=i.get("xl/workbook.xml");if(d){let h=d.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");i.set("xl/workbook.xml",Buffer.from(h,"utf8"))}let u=i.get("docProps/app.xml");if(u){let h=u.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");i.set("docProps/app.xml",Buffer.from(h,"utf8"))}let f=i.has("xl/calcChain.xml"),m=t.map(h=>h.name).filter(h=>!(f&&h==="xl/calcChain.xml"));if(f)for(let h of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let y=i.get(h);y&&i.set(h,Buffer.from(y.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:mt(m.map(h=>({name:h,data:i.get(h)}))),counts:a,columnsHidden:[...c]}}var N=/(^|\/)(\.env(\.[\w.-]+)?|[\w.-]+\.env(\.[\w.-]+)?)$/i,Xn=/(SECRET|PASSWORD|PASSWD|PASS|PWD|TOKEN|PRIVATE|CREDENTIAL|API_?KEY|_KEY|KEY_ID|DSN|DATABASE_URL|_URI|POOLER_URL|SALT|PEPPER)$/i,Jn=/(^NEXT_PUBLIC_|^VITE_|^EXPO_PUBLIC_|ANON_KEY$|PUBLISHABLE_KEY$|PUBLIC_KEY$)/i;function Ce(e){let t=0;for(let i of e.split(/\r?\n/)){let n=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(i);if(!n||!Xn.test(n[1])||Jn.test(n[1]))continue;let s=n[2].trim().replace(/^(['"])(.*)\1$/,"$2");s.length>=8&&!/^\$\{?[A-Z_]+\}?$/.test(s)&&t++}return t}var Vs=64*1024*1024,Xs=32*1024;var Js=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase()));var ti=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],g=(e,t,i)=>({provider:e,url:t,steps:[...i,...ti]}),ni={"aws-access-key":g("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":g("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":g("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":g("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":g("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":g("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":g("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":g("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":g("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":g("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":g("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":g("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":g("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":g("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":g("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"openai-project-key":g("OpenAI","https://platform.openai.com/api-keys",["Open API keys (per project).","Create a new secret key for the same project."]),"anthropic-key":g("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":g("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"supabase-access-token":g("Supabase (personal access token \u2014 reaches every project of the account)","https://supabase.com/dashboard/account/tokens",["Open Account \u2192 Access Tokens.","Revoke this token, then generate a new one only where it is needed (CLI, MCP) \u2014 prefer a read-only MCP."]),"supabase-secret-key":g("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new secret key, switch your servers to it, then delete this one."]),"postgres-uri":g("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":g("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":g("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":g("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":g("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":g("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":g("An access token","",["Revoke the token in the service that issued it and issue a new one."])},ii=g("A credential","",["Find the service it belongs to and issue a new credential there."]);function Pe(e){return ni[e]??ii}function gt(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)}import{existsSync as si,mkdirSync as Nr,readFileSync as ri,statSync as yt,writeFileSync as Hr}from"node:fs";import{homedir as oi}from"node:os";import{join as ai}from"node:path";var ci=()=>ai(oi(),".nodata","flagged.json");function li(e){let t=e.replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t}var H=null;function di(){let e=ci();try{if(!si(e))return{};let t=yt(e).mtimeMs;if(H&&H.path===e&&H.mtimeMs===t)return H.store;let i=JSON.parse(ri(e,"utf8"));return H={path:e,mtimeMs:t,store:i},i}catch{return{}}}function ee(e){let t=di()[li(e)];if(!t)return null;try{if(yt(e).mtimeMs>t.mtimeMs+1e3)return null}catch{return null}return t.kinds}import{existsSync as pi,mkdirSync as Br,readFileSync as ui,writeFileSync as Ur}from"node:fs";import{homedir as fi}from"node:os";import{join as hi}from"node:path";var bt=()=>hi(fi(),".nodata","prefs.json");function mi(){try{let e=pi(bt())?JSON.parse(ui(bt(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function gi(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function O(){return mi()??gi()}function $(e,t,i=O()){return i==="he"?e:t}var vi=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),xi=50*1024*1024,wi=8,Si={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function je(e){let t=Ne(e).toLowerCase();return vi.has(wt(t))||N.test(t)}var Ei=/^(reports|receipts)(\/|$)|^(prefs|consent|flagged|statusline-prev|key-backup)\.json$|^(gate|status)\.mjs$|^(gate|answers)\.log$/i,Ai=/\.nodata[\\/]+(device-key\.json|secrets\.json|credentials\.json|issuer-ed25519\.json|capsule\.json|capsule-key|shares|approvals)\b/i;function De(e){let t=Le(Fe(),".nodata").replace(/\\/g,"/").toLowerCase();if(!e.replace(/\\/g,"/").toLowerCase().startsWith(t+"/"))return!1;let n=e.replace(/\\/g,"/").slice(t.length+1);return n!==""&&!Ei.test(n)}function Ii(e){return Ai.test(e)}function $i(e){return je(e)||ee(e)!==null}var te=class extends Error{};function Ti(e){let t=wt(e).toLowerCase(),i=ki(e),n,s;if(t===".csv"||t===".tsv")s=i.toString("utf8"),n=Te(s,t===".tsv"?" ":void 0).counts;else if(t===".xlsx"||t===".xlsm"||t===".docx"||t===".pptx"||t===".pdf"){let o=t===".xlsx"||t===".xlsm"?Re(i):null,a=Y(i,t);if(!a&&!o)throw new te;s=a?.text??"",n=o?o.counts:w(s).counts}else s=i.toString("utf8"),n=w(s).counts;let r=U.filter(o=>o.pattern.test(s)).length;return N.test(Ne(e).toLowerCase())&&(r=Math.max(r,Ce(s))),r&&(n.secret=Math.max(n.secret??0,r)),n}var Ri={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function St(e){let t=O()==="he",i=n=>(t?Ri[n]:Si[n])??n;return Object.entries(e).sort((n,s)=>s[1]-n[1]).map(([n,s])=>`${s} ${n.startsWith("column:")?`${i(n.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:i(n)}`).join(", ")}function Ci(e){return St(e)}function Et(e,t,i){let n=r=>He(r)?r:Oe(i,r),s=r=>{try{return xt(r).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[n(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&s(n(t.path)))return[n(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let r=t.command,o=[...[...r.matchAll(/"([^"]*)"/g)].map(c=>c[1]),...[...r.matchAll(/'([^']*)'/g)].map(c=>c[1]),...r.split(/[\s|;&<>(),=`]+/)],a=[];for(let c of o){let l=c.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,Fe()).replace(/^\/([a-zA-Z])\//,(d,u)=>process.platform==="win32"?`${u}:/`:d);if(!l)continue;let p=n(l);if(!(!je(l)&&!De(p)&&ee(p)===null)&&(s(p)&&!a.includes(p)&&a.push(p),a.length>=wi))break}return a}return[]}function j(e){return e.replace(/\\+/g,"/")}function Pi(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function At(e,t,i){let n=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&Pi(t.command))return n;for(let s of Et(e,t,i)){if(!$i(s)||gt(s)||!bi(s))continue;let r,o=je(s)?null:ee(s);if(o){r=`${j(s)}: ${$("\u05E7\u05D5\u05D3 \u05E9\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05E1\u05D9\u05DE\u05E0\u05D4","code your last scan flagged")} \u2014 ${Ci(o)}`,n.push(r);continue}try{if(xt(s).size>xi)r=`${j(s)}: too large to check here (over 50 MB)`;else{let a=Ti(s);if(Object.keys(a).length===0)continue;r=`${j(s)}: ${St(a)}`}}catch(a){r=a instanceof te?`${j(s)}: ${$("\u05DC\u05D0 \u05E0\u05D9\u05EA\u05DF \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05D8\u05E7\u05E1\u05D8 (\u05E1\u05E8\u05D9\u05E7\u05D4, \u05D4\u05E6\u05E4\u05E0\u05D4 \u05D0\u05D5 \u05D2\u05D5\u05E4\u05DF \u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA) \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","its text could not be read (a scan, encryption or an unsupported font) \u2014 NOT checked, treat it as sensitive")}`:`${j(s)}: could not be checked`}n.push(r)}return n}var _t=/(?:\.aws[\\/]+credentials|\.npmrc|\.yarnrc\.yml|\.pypirc|[._]netrc|\.git-credentials|\.pgpass|\.docker[\\/]+config\.json|\.kube[\\/]+config|gh[\\/]+hosts\.yml|\.supabase[\\/]+access-token|application_default_credentials\.json|gcloud[\\/]+(?:credentials|access_tokens)\.db|\.azure[\\/]+(?:msal_token_cache|accessTokens)|com\.vercel\.cli[\\/]+auth\.json|\.ssh[\\/]+id_(?:rsa|ed25519|ecdsa|dsa)(?![\w.]))/i,kt=/(?:TOKEN|SECRET|PASSW(?:OR)?D|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIAL|SERVICE_ROLE|_KEY$)/i,Li=[[/^(?:env|set|export\s+-p|declare\s+-x|get-childitem\s+env:\S*|gci\s+env:\S*|dir\s+env:\S*|ls\s+env:\S*)\s*$/i,"every environment variable"],[/^gh\s+auth\s+(?:token\b|status\b.*(?:\s-t\b|--show-token))/i,"the GitHub login token"],[/^gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token\b/i,"a Google Cloud access token"],[/^az\s+account\s+get-access-token\b/i,"an Azure access token"],[/^aws\s+(?:configure\s+(?:get\s+\S*(?:secret|token)\S*|export-credentials)|sts\s+get-session-token|ecr\s+get-login-password)\b/i,"AWS credentials"],[/^supabase\s+projects\s+api-keys\b/i,"the project's Supabase keys (incl. service_role)"],[/^heroku\s+auth:token\b/i,"the Heroku login token"],[/^op\s+(?:read|item\s+get)\b/i,"a 1Password secret"],[/^vault\s+(?:kv\s+get|read)\b/i,"a Vault secret"],[/^doppler\s+secrets\b/i,"Doppler secrets"],[/^security\s+find-(?:generic|internet)-password\b.*\s-w\b/i,"a keychain password"],[/^git\s+credential\s+fill\b/i,"a saved Git password"],[/^kubectl\s+get\s+secrets?\b.*\s-o\b/i,"Kubernetes secrets"]],Di=/^(?:echo|printf|print|write-output|write-host|say)\b/i,Fi=/^(?:cat|type|get-content|gc|more|less|head|tail|bat|nl|strings|xxd|od|hexdump|grep|egrep|rg|select-string|sls|awk|sed|jq|yq|python\d*|py|node|ruby|perl)\b/i,Ni=/\$\{?env:([A-Za-z_][\w]*)|\$\{?([A-Za-z_][\w]*)|%([A-Za-z_][\w]*)%|GetEnvironmentVariable\(\s*['"]([^'"]+)['"]/g;function Hi(e,t,i){let n=e==="Read"&&typeof t.file_path=="string"?t.file_path:e==="Grep"&&typeof t.path=="string"?t.path:"";if(n&&_t.test((He(n)?n:Oe(i,n)).replace(/\\/g,"/")))return`a saved login (${Ne(n)})`;if(e!=="Bash"&&e!=="PowerShell"||typeof t.command!="string")return null;let s=t.command.split(/(\|\||&&|[;|\n])/);for(let r=0;r<s.length;r+=2){let o=s[r+1]==="|",a=s[r].trim().replace(/^(?:sudo\s+|cmd(?:\.exe)?\s+\/c\s+|powershell(?:\.exe)?\s+(?:-command\s+)?|pwsh\s+(?:-c(?:ommand)?\s+)?)+/i,"").replace(/^["']|["']$/g,"");if(Fi.test(a)&&_t.test(a))return"a saved login file";for(let[l,p]of Li)if(l.test(a))return p;let c=a.match(/^printenv(?:\s+(\S+))?\s*$/i);if(c&&(!c[1]||kt.test(c[1])))return c[1]?`the variable ${c[1]}`:"every environment variable";if(!o&&(Di.test(a)||/GetEnvironmentVariable/i.test(a)))for(let l of a.matchAll(Ni)){let p=l[1]??l[2]??l[3]??l[4]??"";if(kt.test(p))return`the variable ${p}`}}return null}function Oi(e){let t;try{t=typeof e=="string"?e:JSON.stringify(e??"")}catch{return{}}if(!t)return{};t=t.slice(0,2*1024*1024);let i={};for(let n of P()){let s=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g"),r=(t.match(s)??[]).length;r&&(i[n.id]=(i[n.id]??0)+r)}return i}function ji(e){let t=Object.keys(e);if(t.length===0)return null;let i=t.reduce((s,r)=>s+e[r],0),n=[...new Set(t.map(s=>{let r=Pe(s);return r.url?`${r.provider}: ${r.url}`:r.provider}))];return`NoData \xB7 A CREDENTIAL IS IN THIS OUTPUT (${i}: ${t.join(", ")}). It is now in this conversation and was sent to the AI model. Do not repeat, quote, shorten, mask-by-hand or reuse it \u2014 not in your answer, not in a command, not in a file. Tell the user in one line that a key was shown here and should be replaced at its provider (${n.join(" \xB7 ")}); nodata_scan_folder gives the full steps. Next time, run commands that need secrets through nodata_run: the output comes back with every value blanked.`+(O()==="he"?" Answer the user in Hebrew.":"")}function Mi(e,t,i){let n=(e==="Bash"||e==="PowerShell")&&typeof t.command=="string"?t.command:"",s=e==="Grep"&&typeof t.path=="string"?t.path:e==="Read"&&typeof t.file_path=="string"?t.file_path:"";return n&&Ii(n)||s&&De(He(s)?s:Oe(i,s))||Et(e,t,i).some(De)?$("NoData \u05D7\u05E1\u05DD: \u05D6\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05E4\u05EA\u05D7 \u05E9\u05DC NoData (\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8, \u05D4\u05DB\u05E1\u05E4\u05EA \u05D0\u05D5 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF). \u05DE\u05D9 \u05E9\u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E4\u05EA\u05D5\u05D7 \u05DB\u05DC \u05E7\u05D5\u05D1\u05E5 \u05E0\u05E2\u05D5\u05DC, \u05D5\u05DC\u05DB\u05DF \u05D0\u05E3 \u05E1\u05D5\u05DB\u05DF \u05DC\u05D0 \u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC-NoData \u05D0\u05D9\u05DF \u05E2\u05D5\u05EA\u05E7 \u05E9\u05DC \u05D4\u05DE\u05E4\u05EA\u05D7 \u05D5\u05D0\u05D9\u05DF \u05D3\u05E8\u05DA \u05DC\u05E9\u05D7\u05D6\u05E8 \u05D0\u05D5\u05EA\u05D5: \u05D4\u05D2\u05D9\u05D1\u05D5\u05D9 \u05E9\u05DC\u05DA \u05D4\u05D5\u05D0 \u05D4\u05D3\u05E8\u05DA \u05D4\u05D9\u05D7\u05D9\u05D3\u05D4. \u05DC\u05D2\u05D9\u05D1\u05D5\u05D9, \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC \u05D5\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8: npx -y @nodatachat/mcp@latest key-backup E: (E: = \u05D4\u05D3\u05D9\u05E1\u05E7-\u05D0\u05D5\u05DF-\u05E7\u05D9).","NoData refused: this is one of NoData's own key files (the device key, the vault login or the org credential). Whoever reads it can open every sealed file, so no agent reads it \u2014 not even with approval. NoData holds no copy of this key and cannot recover it: your backup is the only recovery. To back it up, in a terminal (not the chat): npx -y @nodatachat/mcp@latest key-backup E: (E: = your USB drive). Do not suggest other recovery routes \u2014 there are none."):null}function zi(e,t,i,n){let s=Mi(e,t,i);if(s)return{decision:"deny",reason:s};let r=Hi(e,t,i);if(r){let c=$(`NoData: \u05D4\u05E4\u05E7\u05D5\u05D3\u05D4 \u05D4\u05D6\u05D5 \u05DE\u05E6\u05D9\u05D2\u05D4 ${r}. \u05DE\u05D4 \u05E9\u05D4\u05D9\u05D0 \u05DE\u05D3\u05E4\u05D9\u05E1\u05D4 \u05E0\u05DB\u05E0\u05E1 \u05DC\u05E9\u05D9\u05D7\u05D4 \u05D5\u05E0\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA, \u05D5\u05DE\u05E4\u05EA\u05D7 \u05E9\u05E0\u05E8\u05D0\u05D4 \u05DB\u05D0\u05DF \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D7\u05DC\u05D9\u05E3.
|
|
27
|
+
`),counts:o,columnsHidden:s.filter((f,m)=>r[m])}}var Hn=/^xl\/(pivotCache|charts|externalLinks)\//,pt=10;function On(e,t,i=1){e[t]=(e[t]??0)+i}function ut(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""")}function ft(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),i="";for(let n of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))i+=n[1];return S(i)}function jn(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>ft(t[1]??"")):[]}var ht=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function Q(e,t){let i=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return i?i[1]:null}function I(e,t){if(e.type==="s"){let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?t[Number(n[1])]??null:null}if(e.type==="inlineStr"){let n=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return n?ft(n[1]):null}if(e.type==="b"||e.type==="e")return null;let i=/<v>([^<]*)<\/v>/.exec(e.inner);return i?S(i[1]):null}function Mn(e){let t=[];for(let i of e.matchAll(ht)){let n=Q(i[1],"r"),s=n?/^([A-Z]+)(\d+)$/.exec(n):null;if(!s)return null;t.push({full:i[0],attrs:i[1],inner:i[2]??"",col:s[1],row:Number(s[2]),type:Q(i[1],"t")??"n"})}return t}function zn(e,t){let i=[...new Set(e.map(n=>n.row))].sort((n,s)=>n-s).slice(0,pt);for(let n of i){let s=new Map;for(let r of e.filter(o=>o.row===n)){let o=I(r,t),a=o?L(o):null;a&&s.set(r.col,{type:a.type,header:o.trim()})}if(s.size>0)return{row:n,cols:s}}return{row:-1,cols:new Map}}var Bn=/^xl\/worksheets\/sheet\d+\.xml$/,Un=200;function Wn(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function Kn(e,t){let i=[...new Set(e.map(r=>r.row))].sort((r,o)=>r-o).slice(0,pt),n=-1,s=-1/0;for(let r of i){let o=e.filter(l=>l.row===r).map(l=>(I(l,t)??"").trim()).filter(Boolean);if(o.length<2)continue;let a=o.filter(l=>!Wn(l)).length,c=a*2-(o.length-a);c>s&&(s=c,n=r)}return n}function Gn(e,t,i){let n=zn(t,i),s=C();if(!s)return n;let r=n.row>=0?n.row:Kn(t,i);if(r<0)return n;let o=t.filter(d=>d.row===r).map(d=>({col:d.col,text:(I(d,i)??"").trim()})).filter(d=>d.text),a=new Map(o.map((d,u)=>[d.col,u])),c=new Map;for(let d of t){if(d.row<=r)continue;let u=a.get(d.col);if(u!==void 0){if(!c.has(d.row)){if(c.size>=Un)continue;c.set(d.row,o.map(()=>""))}c.get(d.row)[u]=I(d,i)??""}}let l=new Map(r===n.row?n.cols:[]),p=o.map(d=>d.text);for(let d of s({name:e,headers:p,rows:[...c.values()]})){let u=p.indexOf(d.column);u<0||l.set(o[u].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:r,cols:l}}function lt(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${ut(t)}</t></is></c>`}var Zn=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let i=t;for(let n=0;n<8;n+=1)i=i&1?3988292384^i>>>1:i>>>1;e[t]=i>>>0}return e})();function Vn(e){let t=4294967295;for(let i=0;i<e.length;i+=1)t=Zn[(t^e[i])&255]^t>>>8;return(t^4294967295)>>>0}var dt=33;function mt(e){let t=[],i=[],n=0;for(let o of e){let a=Buffer.from(o.name,"utf8"),c=o.name.endsWith("/"),l=c?Buffer.alloc(0):Nn(o.data),p=c?0:8,d=c?0:Vn(o.data),u=Buffer.alloc(30);u.writeUInt32LE(67324752,0),u.writeUInt16LE(20,4),u.writeUInt16LE(2048,6),u.writeUInt16LE(p,8),u.writeUInt16LE(dt,12),u.writeUInt32LE(d,14),u.writeUInt32LE(l.length,18),u.writeUInt32LE(o.data.length,22),u.writeUInt16LE(a.length,26),t.push(u,a,l);let f=Buffer.alloc(46);f.writeUInt32LE(33639248,0),f.writeUInt16LE(20,4),f.writeUInt16LE(20,6),f.writeUInt16LE(2048,8),f.writeUInt16LE(p,10),f.writeUInt16LE(dt,14),f.writeUInt32LE(d,16),f.writeUInt32LE(l.length,20),f.writeUInt32LE(o.data.length,24),f.writeUInt16LE(a.length,28),f.writeUInt32LE(n,42),i.push(f,a),n+=u.length+a.length+l.length}let s=Buffer.concat(i),r=Buffer.alloc(22);return r.writeUInt32LE(101010256,0),r.writeUInt16LE(e.length,8),r.writeUInt16LE(e.length,10),r.writeUInt32LE(s.length,12),r.writeUInt32LE(n,16),Buffer.concat([...t,s,r])}function Re(e){let t=J(e);if(!t||t.length===0||t.some(h=>Hn.test(h.name)))return null;let i=new Map;for(let h of t){if(h.name.endsWith("/")){i.set(h.name,Buffer.alloc(0));continue}let y=q(e,h);if(!y)return null;i.set(h.name,y)}let n=[...i.keys()].filter(h=>Bn.test(h));if(n.length===0)return null;let s=i.get("xl/sharedStrings.xml")?.toString("utf8")??null,r=jn(s),o=new Set,a={},c=new Set,l=Ae();for(let h of n){let y=i.get(h).toString("utf8"),_=Mn(y);if(!_)return null;let ce=Gn(h.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),_,r),M=ce.row,T=new Map;for(let k of _){if(k.type!=="n"||k.row<=M)continue;let x=I(k,r);x!==null&&T.set(k.col,[...T.get(k.col)??[],x])}let z=$e(T),B=new Map;for(let[k,{type:x,header:le,how:de}]of ce.cols)de==="header"&&z.has(k)||(B.set(k,x),c.add(le));let Ot=y.replace(ht,(k,x,le)=>{let de=Q(x,"r"),[,pe,jt]=/^([A-Z]+)(\d+)$/.exec(de),R={full:k,attrs:x,inner:le??"",col:pe,row:Number(jt),type:Q(x,"t")??"n"},E=I(R,r),ue=()=>{if(R.type==="s"){let Be=/<v>([^<]*)<\/v>/.exec(R.inner);Be&&o.add(Number(Be[1]))}return k};if(E===null||E.trim()==="")return ue();let fe=B.get(pe);if(fe&&R.row>M&&!Ie(E))return On(a,`column:${fe}`),lt(x,l(fe,E));if(R.type==="n"&&z.has(pe))return ue();let ze=w(E,a);return ze.text===E?ue():lt(x,ze.text)});i.set(h,Buffer.from(Ot,"utf8"))}if(s){let h=-1,y=s.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,_=>(h+=1,o.has(h)?_:"<si><t></t></si>"));i.set("xl/sharedStrings.xml",Buffer.from(y,"utf8"))}for(let h of[...i.keys()].filter(y=>/^xl\/comments\d*\.xml$/.test(y))){let _=i.get(h).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(ce,M,T,z)=>{let B=w(S(T),a);return`${M}${ut(B.text)}${z}`});i.set(h,Buffer.from(_,"utf8"))}let p=i.get("docProps/core.xml");if(p){let h=p.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");i.set("docProps/core.xml",Buffer.from(h,"utf8"))}let d=i.get("xl/workbook.xml");if(d){let h=d.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");i.set("xl/workbook.xml",Buffer.from(h,"utf8"))}let u=i.get("docProps/app.xml");if(u){let h=u.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");i.set("docProps/app.xml",Buffer.from(h,"utf8"))}let f=i.has("xl/calcChain.xml"),m=t.map(h=>h.name).filter(h=>!(f&&h==="xl/calcChain.xml"));if(f)for(let h of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let y=i.get(h);y&&i.set(h,Buffer.from(y.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:mt(m.map(h=>({name:h,data:i.get(h)}))),counts:a,columnsHidden:[...c]}}var N=/(^|\/)(\.env(\.[\w.-]+)?|[\w.-]+\.env(\.[\w.-]+)?)$/i,Xn=/(SECRET|PASSWORD|PASSWD|PASS|PWD|TOKEN|PRIVATE|CREDENTIAL|API_?KEY|_KEY|KEY_ID|DSN|DATABASE_URL|_URI|POOLER_URL|SALT|PEPPER)$/i,Jn=/(^NEXT_PUBLIC_|^VITE_|^EXPO_PUBLIC_|ANON_KEY$|PUBLISHABLE_KEY$|PUBLIC_KEY$)/i;function Ce(e){let t=0;for(let i of e.split(/\r?\n/)){let n=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(i);if(!n||!Xn.test(n[1])||Jn.test(n[1]))continue;let s=n[2].trim().replace(/^(['"])(.*)\1$/,"$2");s.length>=8&&!/^\$\{?[A-Z_]+\}?$/.test(s)&&t++}return t}var Vs=64*1024*1024,Xs=32*1024;var Js=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase()));var ti=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],g=(e,t,i)=>({provider:e,url:t,steps:[...i,...ti]}),ni={"aws-access-key":g("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":g("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":g("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":g("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":g("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":g("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":g("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":g("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":g("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":g("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":g("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":g("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":g("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":g("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":g("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"openai-project-key":g("OpenAI","https://platform.openai.com/api-keys",["Open API keys (per project).","Create a new secret key for the same project."]),"anthropic-key":g("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":g("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"supabase-access-token":g("Supabase (personal access token \u2014 reaches every project of the account)","https://supabase.com/dashboard/account/tokens",["Open Account \u2192 Access Tokens.","Revoke this token, then generate a new one only where it is needed (CLI, MCP) \u2014 prefer a read-only MCP."]),"supabase-secret-key":g("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new secret key, switch your servers to it, then delete this one."]),"postgres-uri":g("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":g("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":g("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":g("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":g("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":g("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":g("An access token","",["Revoke the token in the service that issued it and issue a new one."])},ii=g("A credential","",["Find the service it belongs to and issue a new credential there."]);function Pe(e){return ni[e]??ii}function gt(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)}import{existsSync as si,mkdirSync as Nr,readFileSync as ri,statSync as yt,writeFileSync as Hr}from"node:fs";import{homedir as oi}from"node:os";import{join as ai}from"node:path";var ci=()=>ai(oi(),".nodata","flagged.json");function li(e){let t=e.replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t}var H=null;function di(){let e=ci();try{if(!si(e))return{};let t=yt(e).mtimeMs;if(H&&H.path===e&&H.mtimeMs===t)return H.store;let i=JSON.parse(ri(e,"utf8"));return H={path:e,mtimeMs:t,store:i},i}catch{return{}}}function ee(e){let t=di()[li(e)];if(!t)return null;try{if(yt(e).mtimeMs>t.mtimeMs+1e3)return null}catch{return null}return t.kinds}import{existsSync as pi,mkdirSync as Br,readFileSync as ui,writeFileSync as Ur}from"node:fs";import{homedir as fi}from"node:os";import{join as hi}from"node:path";var bt=()=>hi(fi(),".nodata","prefs.json");function mi(){try{let e=pi(bt())?JSON.parse(ui(bt(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function gi(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function O(){return mi()??gi()}function $(e,t,i=O()){return i==="he"?e:t}var vi=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),xi=50*1024*1024,wi=8,Si={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function je(e){let t=Ne(e).toLowerCase();return vi.has(wt(t))||N.test(t)}var Ei=/^(reports|receipts)(\/|$)|^(prefs|consent|flagged|statusline-prev|key-backup)\.json$|^(gate|status)\.mjs$|^(gate|answers)\.log$/i,Ai=/\.nodata[\\/]+(device-key\.json|secrets\.json|credentials\.json|issuer-ed25519\.json|capsule\.json|capsule-key|shares|approvals|fabric-key\.json|machine-salt|pending-link\.json)\b/i;function De(e){let t=Le(Fe(),".nodata").replace(/\\/g,"/").toLowerCase();if(!e.replace(/\\/g,"/").toLowerCase().startsWith(t+"/"))return!1;let n=e.replace(/\\/g,"/").slice(t.length+1);return n!==""&&!Ei.test(n)}function Ii(e){return Ai.test(e)}function $i(e){return je(e)||ee(e)!==null}var te=class extends Error{};function Ti(e){let t=wt(e).toLowerCase(),i=ki(e),n,s;if(t===".csv"||t===".tsv")s=i.toString("utf8"),n=Te(s,t===".tsv"?" ":void 0).counts;else if(t===".xlsx"||t===".xlsm"||t===".docx"||t===".pptx"||t===".pdf"){let o=t===".xlsx"||t===".xlsm"?Re(i):null,a=Y(i,t);if(!a&&!o)throw new te;s=a?.text??"",n=o?o.counts:w(s).counts}else s=i.toString("utf8"),n=w(s).counts;let r=U.filter(o=>o.pattern.test(s)).length;return N.test(Ne(e).toLowerCase())&&(r=Math.max(r,Ce(s))),r&&(n.secret=Math.max(n.secret??0,r)),n}var Ri={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function St(e){let t=O()==="he",i=n=>(t?Ri[n]:Si[n])??n;return Object.entries(e).sort((n,s)=>s[1]-n[1]).map(([n,s])=>`${s} ${n.startsWith("column:")?`${i(n.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:i(n)}`).join(", ")}function Ci(e){return St(e)}function Et(e,t,i){let n=r=>He(r)?r:Oe(i,r),s=r=>{try{return xt(r).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[n(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&s(n(t.path)))return[n(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let r=t.command,o=[...[...r.matchAll(/"([^"]*)"/g)].map(c=>c[1]),...[...r.matchAll(/'([^']*)'/g)].map(c=>c[1]),...r.split(/[\s|;&<>(),=`]+/)],a=[];for(let c of o){let l=c.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,Fe()).replace(/^\/([a-zA-Z])\//,(d,u)=>process.platform==="win32"?`${u}:/`:d);if(!l)continue;let p=n(l);if(!(!je(l)&&!De(p)&&ee(p)===null)&&(s(p)&&!a.includes(p)&&a.push(p),a.length>=wi))break}return a}return[]}function j(e){return e.replace(/\\+/g,"/")}function Pi(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function At(e,t,i){let n=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&Pi(t.command))return n;for(let s of Et(e,t,i)){if(!$i(s)||gt(s)||!bi(s))continue;let r,o=je(s)?null:ee(s);if(o){r=`${j(s)}: ${$("\u05E7\u05D5\u05D3 \u05E9\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05E1\u05D9\u05DE\u05E0\u05D4","code your last scan flagged")} \u2014 ${Ci(o)}`,n.push(r);continue}try{if(xt(s).size>xi)r=`${j(s)}: too large to check here (over 50 MB)`;else{let a=Ti(s);if(Object.keys(a).length===0)continue;r=`${j(s)}: ${St(a)}`}}catch(a){r=a instanceof te?`${j(s)}: ${$("\u05DC\u05D0 \u05E0\u05D9\u05EA\u05DF \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05D8\u05E7\u05E1\u05D8 (\u05E1\u05E8\u05D9\u05E7\u05D4, \u05D4\u05E6\u05E4\u05E0\u05D4 \u05D0\u05D5 \u05D2\u05D5\u05E4\u05DF \u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA) \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","its text could not be read (a scan, encryption or an unsupported font) \u2014 NOT checked, treat it as sensitive")}`:`${j(s)}: could not be checked`}n.push(r)}return n}var _t=/(?:\.aws[\\/]+credentials|\.npmrc|\.yarnrc\.yml|\.pypirc|[._]netrc|\.git-credentials|\.pgpass|\.docker[\\/]+config\.json|\.kube[\\/]+config|gh[\\/]+hosts\.yml|\.supabase[\\/]+access-token|application_default_credentials\.json|gcloud[\\/]+(?:credentials|access_tokens)\.db|\.azure[\\/]+(?:msal_token_cache|accessTokens)|com\.vercel\.cli[\\/]+auth\.json|\.ssh[\\/]+id_(?:rsa|ed25519|ecdsa|dsa)(?![\w.]))/i,kt=/(?:TOKEN|SECRET|PASSW(?:OR)?D|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIAL|SERVICE_ROLE|_KEY$)/i,Li=[[/^(?:env|set|export\s+-p|declare\s+-x|get-childitem\s+env:\S*|gci\s+env:\S*|dir\s+env:\S*|ls\s+env:\S*)\s*$/i,"every environment variable"],[/^gh\s+auth\s+(?:token\b|status\b.*(?:\s-t\b|--show-token))/i,"the GitHub login token"],[/^gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token\b/i,"a Google Cloud access token"],[/^az\s+account\s+get-access-token\b/i,"an Azure access token"],[/^aws\s+(?:configure\s+(?:get\s+\S*(?:secret|token)\S*|export-credentials)|sts\s+get-session-token|ecr\s+get-login-password)\b/i,"AWS credentials"],[/^supabase\s+projects\s+api-keys\b/i,"the project's Supabase keys (incl. service_role)"],[/^heroku\s+auth:token\b/i,"the Heroku login token"],[/^op\s+(?:read|item\s+get)\b/i,"a 1Password secret"],[/^vault\s+(?:kv\s+get|read)\b/i,"a Vault secret"],[/^doppler\s+secrets\b/i,"Doppler secrets"],[/^security\s+find-(?:generic|internet)-password\b.*\s-w\b/i,"a keychain password"],[/^git\s+credential\s+fill\b/i,"a saved Git password"],[/^kubectl\s+get\s+secrets?\b.*\s-o\b/i,"Kubernetes secrets"]],Di=/^(?:echo|printf|print|write-output|write-host|say)\b/i,Fi=/^(?:cat|type|get-content|gc|more|less|head|tail|bat|nl|strings|xxd|od|hexdump|grep|egrep|rg|select-string|sls|awk|sed|jq|yq|python\d*|py|node|ruby|perl)\b/i,Ni=/\$\{?env:([A-Za-z_][\w]*)|\$\{?([A-Za-z_][\w]*)|%([A-Za-z_][\w]*)%|GetEnvironmentVariable\(\s*['"]([^'"]+)['"]/g;function Hi(e,t,i){let n=e==="Read"&&typeof t.file_path=="string"?t.file_path:e==="Grep"&&typeof t.path=="string"?t.path:"";if(n&&_t.test((He(n)?n:Oe(i,n)).replace(/\\/g,"/")))return`a saved login (${Ne(n)})`;if(e!=="Bash"&&e!=="PowerShell"||typeof t.command!="string")return null;let s=t.command.split(/(\|\||&&|[;|\n])/);for(let r=0;r<s.length;r+=2){let o=s[r+1]==="|",a=s[r].trim().replace(/^(?:sudo\s+|cmd(?:\.exe)?\s+\/c\s+|powershell(?:\.exe)?\s+(?:-command\s+)?|pwsh\s+(?:-c(?:ommand)?\s+)?)+/i,"").replace(/^["']|["']$/g,"");if(Fi.test(a)&&_t.test(a))return"a saved login file";for(let[l,p]of Li)if(l.test(a))return p;let c=a.match(/^printenv(?:\s+(\S+))?\s*$/i);if(c&&(!c[1]||kt.test(c[1])))return c[1]?`the variable ${c[1]}`:"every environment variable";if(!o&&(Di.test(a)||/GetEnvironmentVariable/i.test(a)))for(let l of a.matchAll(Ni)){let p=l[1]??l[2]??l[3]??l[4]??"";if(kt.test(p))return`the variable ${p}`}}return null}function Oi(e){let t;try{t=typeof e=="string"?e:JSON.stringify(e??"")}catch{return{}}if(!t)return{};t=t.slice(0,2*1024*1024);let i={};for(let n of P()){let s=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g"),r=(t.match(s)??[]).length;r&&(i[n.id]=(i[n.id]??0)+r)}return i}function ji(e){let t=Object.keys(e);if(t.length===0)return null;let i=t.reduce((s,r)=>s+e[r],0),n=[...new Set(t.map(s=>{let r=Pe(s);return r.url?`${r.provider}: ${r.url}`:r.provider}))];return`NoData \xB7 A CREDENTIAL IS IN THIS OUTPUT (${i}: ${t.join(", ")}). It is now in this conversation and was sent to the AI model. Do not repeat, quote, shorten, mask-by-hand or reuse it \u2014 not in your answer, not in a command, not in a file. Tell the user in one line that a key was shown here and should be replaced at its provider (${n.join(" \xB7 ")}); nodata_scan_folder gives the full steps. Next time, run commands that need secrets through nodata_run: the output comes back with every value blanked.`+(O()==="he"?" Answer the user in Hebrew.":"")}function Mi(e,t,i){let n=(e==="Bash"||e==="PowerShell")&&typeof t.command=="string"?t.command:"",s=e==="Grep"&&typeof t.path=="string"?t.path:e==="Read"&&typeof t.file_path=="string"?t.file_path:"";return n&&Ii(n)||s&&De(He(s)?s:Oe(i,s))||Et(e,t,i).some(De)?$("NoData \u05D7\u05E1\u05DD: \u05D6\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05E4\u05EA\u05D7 \u05E9\u05DC NoData (\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8, \u05D4\u05DB\u05E1\u05E4\u05EA \u05D0\u05D5 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF). \u05DE\u05D9 \u05E9\u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E4\u05EA\u05D5\u05D7 \u05DB\u05DC \u05E7\u05D5\u05D1\u05E5 \u05E0\u05E2\u05D5\u05DC, \u05D5\u05DC\u05DB\u05DF \u05D0\u05E3 \u05E1\u05D5\u05DB\u05DF \u05DC\u05D0 \u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC-NoData \u05D0\u05D9\u05DF \u05E2\u05D5\u05EA\u05E7 \u05E9\u05DC \u05D4\u05DE\u05E4\u05EA\u05D7 \u05D5\u05D0\u05D9\u05DF \u05D3\u05E8\u05DA \u05DC\u05E9\u05D7\u05D6\u05E8 \u05D0\u05D5\u05EA\u05D5: \u05D4\u05D2\u05D9\u05D1\u05D5\u05D9 \u05E9\u05DC\u05DA \u05D4\u05D5\u05D0 \u05D4\u05D3\u05E8\u05DA \u05D4\u05D9\u05D7\u05D9\u05D3\u05D4. \u05DC\u05D2\u05D9\u05D1\u05D5\u05D9, \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC \u05D5\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8: npx -y @nodatachat/mcp@latest key-backup E: (E: = \u05D4\u05D3\u05D9\u05E1\u05E7-\u05D0\u05D5\u05DF-\u05E7\u05D9).","NoData refused: this is one of NoData's own key files (the device key, the vault login or the org credential). Whoever reads it can open every sealed file, so no agent reads it \u2014 not even with approval. NoData holds no copy of this key and cannot recover it: your backup is the only recovery. To back it up, in a terminal (not the chat): npx -y @nodatachat/mcp@latest key-backup E: (E: = your USB drive). Do not suggest other recovery routes \u2014 there are none."):null}function zi(e,t,i,n){let s=Mi(e,t,i);if(s)return{decision:"deny",reason:s};let r=Hi(e,t,i);if(r){let c=$(`NoData: \u05D4\u05E4\u05E7\u05D5\u05D3\u05D4 \u05D4\u05D6\u05D5 \u05DE\u05E6\u05D9\u05D2\u05D4 ${r}. \u05DE\u05D4 \u05E9\u05D4\u05D9\u05D0 \u05DE\u05D3\u05E4\u05D9\u05E1\u05D4 \u05E0\u05DB\u05E0\u05E1 \u05DC\u05E9\u05D9\u05D7\u05D4 \u05D5\u05E0\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA, \u05D5\u05DE\u05E4\u05EA\u05D7 \u05E9\u05E0\u05E8\u05D0\u05D4 \u05DB\u05D0\u05DF \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D7\u05DC\u05D9\u05E3.
|
|
28
28
|
\u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: \u05DC\u05D4\u05E8\u05D9\u05E5 \u05D0\u05D5\u05EA\u05D4 \u05D1\u05E2\u05E6\u05DE\u05DA \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC (\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8), \u05D0\u05D5 nodata_run \u2014 \u05E9\u05DE\u05E8\u05D9\u05E5 \u05E4\u05E7\u05D5\u05D3\u05D4 \u05E2\u05DD \u05D4\u05E1\u05D5\u05D3\u05D5\u05EA \u05D5\u05DE\u05D7\u05D6\u05D9\u05E8 \u05D0\u05EA \u05D4\u05E4\u05DC\u05D8 \u05DB\u05E9\u05DB\u05DC \u05E2\u05E8\u05DA \u05DE\u05D5\u05E1\u05EA\u05E8.`+(n?"":" \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData: this shows ${r}. Whatever it prints enters the conversation and goes to the AI model, and a key seen there has to be replaced.
|
|
29
29
|
Instead: run it yourself in a terminal (not the chat), or nodata_run \u2014 it runs a command with the secrets and returns the output with every value blanked.`+(n?"":" Allow anyway?"));return{decision:n?"deny":"ask",reason:c}}let o=At(e,t,i);if(o.length===0)return{decision:"allow"};let a=$(`NoData \u05E1\u05E8\u05E7 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05D1\u05DE\u05D7\u05E9\u05D1 \u05E9\u05DC\u05DA \u2014 \u05E9\u05D5\u05DD \u05D3\u05D1\u05E8 \u05DC\u05D0 \u05D9\u05E6\u05D0:
|
|
30
30
|
${o.join(`
|