@nodatachat/mcp 1.3.26 → 1.3.27

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/gate.js +2 -2
  2. package/dist/index.js +173 -173
  3. package/dist/status.js +2 -2
  4. package/package.json +1 -1
package/dist/gate.js CHANGED
@@ -1,4 +1,4 @@
1
- /*! @nodatachat/mcp 1.3.26 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
1
+ /*! @nodatachat/mcp 1.3.27 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
2
2
  import{appendFileSync as ii,copyFileSync as ea,existsSync as Vt,mkdirSync as si,readdirSync as oi,readFileSync as ai,statSync as Ye,writeFileSync as ta}from"node:fs";import{homedir as Z}from"node:os";import{basename as Qe,extname as Kt,isAbsolute as N,join as fe,relative as ci,resolve as k}from"node:path";var w={text:[],header:[],secrets:[],table:null};function Re(e){e.table&&(w.table=e.table);for(let t of e.text??[])w.text.some(r=>r.kind===t.kind)||w.text.push(t);e.header&&!w.header.includes(e.header)&&w.header.push(e.header);for(let t of e.secrets??[])w.secrets.some(r=>r.id===t.id)||w.secrets.push(t)}function Te(){return w.text}function it(){return w.header}function O(){return w.table}function st(){return w.secrets}var Y=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function j(){let e=st().filter(t=>!Y.some(r=>r.id===t.id));return[...Y,...e]}var pn=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],fn=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],hn=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,mn=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function M(e){if(!e)return null;let t=e.trim();if(hn.test(t)||/^name$/i.test(t))return null;let r=t.replace(/[\s-]+/g,"_");for(let n of[...fn,...pn])if(n.pattern.test(t)||n.pattern.test(r))return{type:n.type,label:n.label};if(mn.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(r))return{type:"name",label:"Person name"};for(let n of it()){let i=n(t);if(i)return{type:i.type,label:i.label}}return null}function ot(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let i=0;i<9;i++){let s=parseInt(r[i]??"0",10)*(i%2+1);s>9&&(s-=9),n+=s}return n%10===0&&parseInt(r,10)>0}function gn(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let r=0,n=!1;for(let i=t.length-1;i>=0;i-=1){let s=parseInt(t[i]??"0",10);n&&(s*=2,s>9&&(s-=9)),r+=s,n=!n}return r%10===0}function yn(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let r=t.slice(4)+t.slice(0,4),n=0;for(let i of r){let s=i>="A"&&i<="Z"?String(i.charCodeAt(0)-55):i;for(let o of s)n=(n*10+Number(o))%97}return n===1}var Ce="(?<!\\d)(?<!\\d[.,])",Pe="(?!\\d)(?![.,]\\d)",at=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${Ce}\\d{9}${Pe}`,"g"),validate:ot,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${Ce}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${Pe}`,"g"),validate:gn,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:yn,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${Ce}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${Pe}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function Q(e,t){let r=[],n="",i=!1;for(let s=0;s<e.length;s++){let o=e[s];i?o==='"'&&e[s+1]==='"'?(n+='"',s++):o==='"'?i=!1:n+=o:o==='"'?i=!0:o===t?(r.push(n),n=""):n+=o}return r.push(n),r}import{inflateRawSync as Gn}from"node:zlib";import{inflateSync as bn}from"node:zlib";var Le=new Set([".pdf"]),ct=8*1024*1024;function _n(e){let t=e.toString("latin1"),r=new Map,n=/(\d+)\s+(\d+)\s+obj\b/g,i;for(;(i=n.exec(t))!==null;){let s=Number(i[1]),o=n.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let l=t.indexOf("stream",o),c,u=null;if(l>=0&&l<a){c=t.slice(o,l);let d=l+6;t[d]==="\r"&&(d+=1),t[d]===`
3
3
  `&&(d+=1);let p=t.indexOf("endstream",d);p>d&&(u=e.subarray(d,p))}else c=t.slice(o,a);r.set(s,{num:s,dict:c,stream:u})}for(let s of[...r.values()]){if(!s.stream||!/\/Type\s*\/ObjStm\b/.test(s.dict))continue;let o=Ne(s),a=Number(/\/N\s+(\d+)/.exec(s.dict)?.[1]??0),l=Number(/\/First\s+(\d+)/.exec(s.dict)?.[1]??-1);if(o===null||!a||l<0)continue;let c=o.slice(0,l).trim().split(/\s+/).map(Number);for(let u=0;u<a;u+=1){let d=c[2*u],p=c[2*u+1];if(d===void 0||p===void 0||Number.isNaN(d)||Number.isNaN(p))break;let f=u+1<a?c[2*(u+1)+1]:void 0,m=o.slice(l+p,f!==void 0?l+f:void 0);r.has(d)||r.set(d,{num:d,dict:m,stream:null})}}return r}function De(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let r=0,n=0;for(let i of t){let s=i.codePointAt(0)??0;s<32||s>=127&&s<=191||s===65533||s>=57344&&s<=63743?r+=1:/[\p{L}\p{N}]/u.test(i)&&(n+=1)}return r/t.length>.2||n/t.length<.25}function kn(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let r=t.indexOf("~>");r>=0&&(t=t.slice(0,r));let n=[],i=0,s=0;for(let o of t){if(o==="z"&&s===0){n.push(0,0,0,0);continue}let a=o.charCodeAt(0)-33;if(a<0||a>84)return null;i=i*85+a,s+=1,s===5&&(n.push(i>>>24&255,i>>>16&255,i>>>8&255,i&255),i=0,s=0)}if(s>0){for(let a=s;a<5;a+=1)i=i*85+84;let o=[i>>>24&255,i>>>16&255,i>>>8&255,i&255];for(let a=0;a<s-1;a+=1)n.push(o[a]??0)}return Buffer.from(n)}function vn(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",r=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(r)?Buffer.from(r,"hex"):null}function xn(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(r=>r[1]??"")}function Ne(e){if(!e.stream)return null;let t=e.stream;for(let r of xn(e.dict)){let n=null;if(r==="FlateDecode")try{n=bn(t)}catch{return null}else if(r==="ASCII85Decode")n=kn(t);else if(r==="ASCIIHexDecode")n=vn(t);else return null;if(n===null)return null;t=n}return t.toString("latin1")}function wn(e){let t=new Map,r=1,n=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(n&&n[1]){let l=/<([0-9A-Fa-f]+)>/.exec(n[1]);l&&l[1]&&l[1].length>=4&&(r=2)}let i=l=>{let c="";for(let u=0;u+3<l.length+1;u+=4){let d=parseInt(l.slice(u,u+4),16);Number.isFinite(d)&&d>0&&(c+=String.fromCharCode(d))}return c},s=/beginbfchar([\s\S]*?)endbfchar/g,o;for(;(o=s.exec(e))!==null;){let l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,c;for(;(c=l.exec(o[1]??""))!==null;)t.set(parseInt(c[1]??"0",16),i(c[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(o=a.exec(e))!==null;){let l=o[1]??"",c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,u;for(;(u=c.exec(l))!==null;){let d=parseInt(u[1]??"0",16),p=parseInt(u[2]??"0",16),f=parseInt((u[3]??"0").slice(0,4)||"0",16);if(!(p-d>65535))for(let m=d;m<=p;m+=1)t.set(m,String.fromCharCode(f+(m-d)))}}return{map:t,bytes:r}}function Sn(e){let t=new Map,r=[],n=[];for(let s of e.values()){for(let o of s.dict.matchAll(/\/Font\s*<<([\s\S]*?)>>/g))o[1]&&n.push(o[1]);for(let o of s.dict.matchAll(/\/Font\s+(\d+)\s+\d+\s+R/g)){let a=e.get(Number(o[1]));a&&n.push(a.dict)}}let i=new Set;for(let s of n){let o=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=o.exec(s))!==null;){let l=`${a[1]}#${a[2]}`;i.has(l)||(i.add(l),r.push([a[1]??"",Number(a[2])]))}}for(let[s,o]of r){let a=e.get(o);if(!a)continue;let l=null,c=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(c){let d=e.get(Number(c[1])),p=d?Ne(d):null;p&&(l=wn(p))}if(l||(l=In(a.dict,e)),!l)continue;let u=t.get(s)??[];u.push(l),t.set(s,u)}return t}var An=["alef","bet","gimel","dalet","he","vav","zayin","het","tet","yod","finalkaf","kaf","lamed","finalmem","mem","finalnun","nun","samekh","ayin","finalpe","pe","finaltsadi","tsadi","qof","resh","shin","tav"];function En(e){let t=/^uni([0-9A-Fa-f]{4})$/.exec(e)??/^u([0-9A-Fa-f]{4,6})$/.exec(e);if(t)return String.fromCodePoint(parseInt(t[1],16));let r=/^afii(\d{5})$/.exec(e);if(r){let s=Number(r[1]);if(s>=57664&&s<=57690)return String.fromCharCode(1488+(s-57664))}let n=An.indexOf(e.replace(/hebrew$/,""));return n>=0?String.fromCharCode(1488+n):e==="space"?" ":/^[A-Za-z]$/.test(e)?e:{zero:"0",one:"1",two:"2",three:"3",four:"4",five:"5",six:"6",seven:"7",eight:"8",nine:"9",period:".",comma:",",hyphen:"-",colon:":",slash:"/",at:"@"}[e]??null}function In(e,t){let r=e,n=/\/Encoding\s+(\d+)\s+\d+\s+R/.exec(e);n&&(r=t.get(Number(n[1]))?.dict??"");let i=/\/Differences\s*\[([^\]]*)\]/.exec(r);if(!i?.[1])return null;let s=new Map,o=0;for(let a of i[1].match(/\d+|\/[^\s/[\]]+/g)??[]){if(/^\d+$/.test(a)){o=Number(a);continue}let l=En(a.slice(1));l!==null&&s.set(o,l),o+=1}return s.size?{map:s,bytes:1}:null}function pt(e){let t=[];for(let r=0;r<e.length;r+=1){let n=e[r];if(n!=="\\"){t.push(n.charCodeAt(0)&255);continue}let i=e[r+1];if(i===void 0)break;if(i>="0"&&i<="7"){let o="",a=r+1;for(;a<e.length&&o.length<3&&e[a]>="0"&&e[a]<="7";)o+=e[a],a+=1;t.push(parseInt(o,8)&255),r=a-1;continue}let s={n:10,r:13,t:9,b:8,f:12};t.push(s[i]??i.charCodeAt(0)&255),r+=1}return t}function ft(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let r=2;r+1<e.length;r+=2)t+=String.fromCharCode((e[r]??0)<<8|(e[r+1]??0));return t}function lt(e,t){let r=ft(e);if(r!==null)return r;if(!t)return e.map(i=>String.fromCharCode(i)).join("");let n="";if(t.bytes===2)for(let i=0;i+1<e.length;i+=2){let s=(e[i]??0)<<8|(e[i+1]??0);n+=t.map.get(s)??""}else for(let i of e)n+=t.map.get(i)??String.fromCharCode(i);return n}function $n(e){let t=0;for(let r of e){let n=r.codePointAt(0)??0;/[\p{L}\p{N}]/u.test(r)?t+=1:(n<32||n>=127&&n<=191||n===65533)&&(t-=2)}return t}function dt(e,t){if(!t||t.length<=1)return lt(e,t?.[0]);let r="",n=-1/0;for(let i of t){let s=lt(e,i),o=$n(s);o>n&&(r=s,n=o)}return r}function Rn(e,t){let r="",n="",i,s=!1,o="",a=0,l=null,c=()=>{n.trim()&&(r+=n+`
4
4
  `),n="",a=0},u=()=>{n&&!n.endsWith(" ")&&a>1&&(n+=" ")},d=/\/([^\s/<>[\]()]+)\s+-?[\d.]+\s+Tf|(-?[\d.]+)\s+(-?[\d.]+)\s+T[dD]\b|(?:-?[\d.]+\s+){5}(-?[\d.]+)\s+Tm\b|T\*|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|\[|\]|-?\d+(?:\.\d+)?|TJ|Tj|'|"/g,p;for(;(p=d.exec(e))!==null;){let f=p[0];if(p[1]!==void 0&&f.endsWith("Tf")){i=t.get(p[1]);continue}if(p[2]!==void 0){Math.abs(Number(p[3]))>.01?c():Number(p[2])!==0&&u();continue}if(p[4]!==void 0){let m=Number(p[4]);l!==null&&Math.abs(m-l)>.01?c():l!==null&&u(),l=m;continue}if(f==="T*"){c();continue}if(f==="["){s=!0;continue}if(f==="]"){s=!1;continue}if(f==="TJ"||f==="Tj"||f==="'"||f==='"'){(f==="'"||f==='"')&&c(),o&&(n+=o,a=o.trim().length,o="");continue}if(f.startsWith("("))o+=dt(pt(f.slice(1,-1)),i);else if(f.startsWith("<")){let m=f.slice(1,-1).replace(/\s+/g,""),h=[];for(let y=0;y+1<m.length;y+=2)h.push(parseInt(m.slice(y,y+2),16));o+=dt(h,i)}else s&&Number(f)<-200&&o&&!o.endsWith(" ")&&(o+=" ")}return o&&(n+=o),c(),r}function Tn(e,t){let r=e.toString("latin1"),n=/\/Info\s+(\d+)\s+\d+\s+R/.exec(r),i=n?t.get(Number(n[1]))?.dict:void 0;if(!i)return"";let s=[],o=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=o.exec(i))!==null;){let l=a[2]??"";if(l.startsWith("(")){let c=pt(l.slice(1,-1));s.push(ft(c)??c.map(u=>String.fromCharCode(u)).join(""))}else{let c=l.slice(1,-1).replace(/\s+/g,""),u="";if(c.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<c.length+1;d+=4)u+=String.fromCharCode(parseInt(c.slice(d,d+4),16));else for(let d=0;d+1<c.length;d+=2)u+=String.fromCharCode(parseInt(c.slice(d,d+2),16));s.push(u)}}return s.join(`
@@ -25,7 +25,7 @@ ${a} ${l}
25
25
  `),truncated:l,parts:o}}function ae(e,t,r={}){if(_t.has(t))return nr(e,t);if(Le.has(t)){let n=je(e,r);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.engine}`],engine:n.engine,uncertain:n.uncertain}:null}return null}var rr=new Set([..._t,...Le]);import{deflateRawSync as ar}from"node:zlib";var kt={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},ir=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,sr=[...at].sort((e,t)=>+(t.subkind==="iban")-+(e.subkind==="iban"));function z(e,t,r=1){e[t]=(e[t]??0)+r}var vt=null,B=e=>{let t=e.trim();vt&&t&&vt.add(t)};function A(e,t={}){let r=e;for(let n of j()){let i=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g");r=r.replace(i,s=>(z(t,"secret"),B(s),"[SECRET]"))}for(let n of sr)n.pattern.lastIndex=0,r=r.replace(n.pattern,i=>n.validate(i)?(z(t,n.subkind),B(i),kt[n.subkind]??`[${n.subkind.toUpperCase()}]`):i);r=r.replace(ir,n=>(z(t,"email"),B(n),kt.email));for(let n of Te()){let i=n.find(r).sort((s,o)=>o.start-s.start);for(let s of i)B(r.slice(s.start,s.end)),r=r.slice(0,s.start)+`[${n.kind.toUpperCase()}]`+r.slice(s.end),z(t,n.kind)}return{text:r,counts:t,columnsHidden:[]}}function ze(){let e=new Map,t={};return(r,n)=>{B(n);let i=`${r}\0${n.trim()}`,s=e.get(i);return s===void 0&&(s=t[r]=(t[r]??0)+1,e.set(i,s)),`[${r.toUpperCase()}-${s}]`}}function Be(e){let t=e.trim();return/^\[[A-Z_]+(?:-\d+)?\]$/.test(t)||/^[\d]{0,4}[*•xX]{3,}[\d]{0,4}$/.test(t)}var wt=/^\s*-?\d+(?:\.\d+)?\s*$/;function Ue(e){let t=new Set;for(let[r,n]of e){let i=n.filter(o=>wt.test(o));if(i.length<3)continue;i.filter(o=>A(o).text!==o).length/i.length<.5&&t.add(r)}return t}function xt(e,t){return e.includes(t)||e.includes('"')||e.includes(`
26
26
  `)?`"${e.replace(/"/g,'""')}"`:e}function or(e){let t=(e.match(/\t/g)??[]).length,r=(e.match(/;/g)??[]).length,n=(e.match(/,/g)??[]).length;return t>n&&t>=r?" ":r>n?";":","}function We(e,t){let r=e.split(/\r?\n/),n=t??or(r[0]??""),i=Q(r[0]??"",n),s=i.map(f=>M(f)),o={},a=ze(),l=r.slice(1).map(f=>f===""?null:Q(f,n)),c=new Map;for(let f of l)f?.forEach((m,h)=>c.set(h,[...c.get(h)??[],m]));let u=Ue(c),d=O();if(d){let f=l.filter(m=>m!==null).slice(0,200);for(let m of d({name:"table",headers:i,rows:f})){let h=i.indexOf(m.column);h>=0&&!(m.how==="header"&&u.has(h))&&(s[h]={type:m.type,label:m.category})}}let p=[i.map(f=>xt(f,n)).join(n)];for(let f of l){if(f===null){p.push("");continue}let m=f.map((h,y)=>{let v=s[y];return v&&h.trim()!==""&&!Be(h)?(z(o,`column:${v.type}`),a(v.type,h)):u.has(y)&&wt.test(h)?h:A(h,o).text});p.push(m.map(h=>xt(h,n)).join(n))}return{text:p.join(`
27
27
  `),counts:o,columnsHidden:i.filter((f,m)=>s[m])}}var cr=/^xl\/(pivotCache|charts|externalLinks)\//,Et=10;function lr(e,t,r=1){e[t]=(e[t]??0)+r}function It(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function $t(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),r="";for(let n of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))r+=n[1];return E(r)}function dr(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>$t(t[1]??"")):[]}var Rt=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function ce(e,t){let r=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return r?r[1]:null}function P(e,t){if(e.type==="s"){let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?t[Number(n[1])]??null:null}if(e.type==="inlineStr"){let n=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return n?$t(n[1]):null}if(e.type==="b"||e.type==="e")return null;let r=/<v>([^<]*)<\/v>/.exec(e.inner);return r?E(r[1]):null}function ur(e){let t=[];for(let r of e.matchAll(Rt)){let n=ce(r[1],"r"),i=n?/^([A-Z]+)(\d+)$/.exec(n):null;if(!i)return null;t.push({full:r[0],attrs:r[1],inner:r[2]??"",col:i[1],row:Number(i[2]),type:ce(r[1],"t")??"n"})}return t}function pr(e,t){let r=[...new Set(e.map(n=>n.row))].sort((n,i)=>n-i).slice(0,Et);for(let n of r){let i=new Map;for(let s of e.filter(o=>o.row===n)){let o=P(s,t),a=o?M(o):null;a&&i.set(s.col,{type:a.type,header:o.trim()})}if(i.size>0)return{row:n,cols:i}}return{row:-1,cols:new Map}}var fr=/^xl\/worksheets\/sheet\d+\.xml$/,hr=200;function mr(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function gr(e,t){let r=[...new Set(e.map(s=>s.row))].sort((s,o)=>s-o).slice(0,Et),n=-1,i=-1/0;for(let s of r){let o=e.filter(c=>c.row===s).map(c=>(P(c,t)??"").trim()).filter(Boolean);if(o.length<2)continue;let a=o.filter(c=>!mr(c)).length,l=a*2-(o.length-a);l>i&&(i=l,n=s)}return n}function yr(e,t,r){let n=pr(t,r),i=O();if(!i)return n;let s=n.row>=0?n.row:gr(t,r);if(s<0)return n;let o=t.filter(d=>d.row===s).map(d=>({col:d.col,text:(P(d,r)??"").trim()})).filter(d=>d.text),a=new Map(o.map((d,p)=>[d.col,p])),l=new Map;for(let d of t){if(d.row<=s)continue;let p=a.get(d.col);if(p!==void 0){if(!l.has(d.row)){if(l.size>=hr)continue;l.set(d.row,o.map(()=>""))}l.get(d.row)[p]=P(d,r)??""}}let c=new Map(s===n.row?n.cols:[]),u=o.map(d=>d.text);for(let d of i({name:e,headers:u,rows:[...l.values()]})){let p=u.indexOf(d.column);p<0||c.set(o[p].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:s,cols:c}}function St(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${It(t)}</t></is></c>`}var br=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let r=t;for(let n=0;n<8;n+=1)r=r&1?3988292384^r>>>1:r>>>1;e[t]=r>>>0}return e})();function _r(e){let t=4294967295;for(let r=0;r<e.length;r+=1)t=br[(t^e[r])&255]^t>>>8;return(t^4294967295)>>>0}var At=33;function Tt(e){let t=[],r=[],n=0;for(let o of e){let a=Buffer.from(o.name,"utf8"),l=o.name.endsWith("/"),c=l?Buffer.alloc(0):ar(o.data),u=l?0:8,d=l?0:_r(o.data),p=Buffer.alloc(30);p.writeUInt32LE(67324752,0),p.writeUInt16LE(20,4),p.writeUInt16LE(2048,6),p.writeUInt16LE(u,8),p.writeUInt16LE(At,12),p.writeUInt32LE(d,14),p.writeUInt32LE(c.length,18),p.writeUInt32LE(o.data.length,22),p.writeUInt16LE(a.length,26),t.push(p,a,c);let f=Buffer.alloc(46);f.writeUInt32LE(33639248,0),f.writeUInt16LE(20,4),f.writeUInt16LE(20,6),f.writeUInt16LE(2048,8),f.writeUInt16LE(u,10),f.writeUInt16LE(At,14),f.writeUInt32LE(d,16),f.writeUInt32LE(c.length,20),f.writeUInt32LE(o.data.length,24),f.writeUInt16LE(a.length,28),f.writeUInt32LE(n,42),r.push(f,a),n+=p.length+a.length+c.length}let i=Buffer.concat(r),s=Buffer.alloc(22);return s.writeUInt32LE(101010256,0),s.writeUInt16LE(e.length,8),s.writeUInt16LE(e.length,10),s.writeUInt32LE(i.length,12),s.writeUInt32LE(n,16),Buffer.concat([...t,i,s])}function Ve(e){let t=se(e);if(!t||t.length===0||t.some(h=>cr.test(h.name)))return null;let r=new Map;for(let h of t){if(h.name.endsWith("/")){r.set(h.name,Buffer.alloc(0));continue}let y=oe(e,h);if(!y)return null;r.set(h.name,y)}let n=[...r.keys()].filter(h=>fr.test(h));if(n.length===0)return null;let i=r.get("xl/sharedStrings.xml")?.toString("utf8")??null,s=dr(i),o=new Set,a={},l=new Set,c=ze();for(let h of n){let y=r.get(h).toString("utf8"),v=ur(y);if(!v)return null;let we=yr(h.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),v,s),X=we.row,F=new Map;for(let x of v){if(x.type!=="n"||x.row<=X)continue;let S=P(x,s);S!==null&&F.set(x.col,[...F.get(x.col)??[],S])}let J=Ue(F),q=new Map;for(let[x,{type:S,header:Se,how:Ae}]of we.cols)Ae==="header"&&J.has(x)||(q.set(x,S),l.add(Se));let dn=y.replace(Rt,(x,S,Se)=>{let Ae=ce(S,"r"),[,Ee,un]=/^([A-Z]+)(\d+)$/.exec(Ae),H={full:x,attrs:S,inner:Se??"",col:Ee,row:Number(un),type:ce(S,"t")??"n"},T=P(H,s),Ie=()=>{if(H.type==="s"){let rt=/<v>([^<]*)<\/v>/.exec(H.inner);rt&&o.add(Number(rt[1]))}return x};if(T===null||T.trim()==="")return Ie();let $e=q.get(Ee);if($e&&H.row>X&&!Be(T))return lr(a,`column:${$e}`),St(S,c($e,T));if(H.type==="n"&&J.has(Ee))return Ie();let nt=A(T,a);return nt.text===T?Ie():St(S,nt.text)});r.set(h,Buffer.from(dn,"utf8"))}if(i){let h=-1,y=i.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,v=>(h+=1,o.has(h)?v:"<si><t></t></si>"));r.set("xl/sharedStrings.xml",Buffer.from(y,"utf8"))}for(let h of[...r.keys()].filter(y=>/^xl\/comments\d*\.xml$/.test(y))){let v=r.get(h).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(we,X,F,J)=>{let q=A(E(F),a);return`${X}${It(q.text)}${J}`});r.set(h,Buffer.from(v,"utf8"))}let u=r.get("docProps/core.xml");if(u){let h=u.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");r.set("docProps/core.xml",Buffer.from(h,"utf8"))}let d=r.get("xl/workbook.xml");if(d){let h=d.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");r.set("xl/workbook.xml",Buffer.from(h,"utf8"))}let p=r.get("docProps/app.xml");if(p){let h=p.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");r.set("docProps/app.xml",Buffer.from(h,"utf8"))}let f=r.has("xl/calcChain.xml"),m=t.map(h=>h.name).filter(h=>!(f&&h==="xl/calcChain.xml"));if(f)for(let h of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let y=r.get(h);y&&r.set(h,Buffer.from(y.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:Tt(m.map(h=>({name:h,data:r.get(h)}))),counts:a,columnsHidden:[...l]}}var L=/(^|\/)(\.env(\.[\w.-]+)?|[\w.-]+\.env(\.[\w.-]+)?)$/i,kr=/(SECRET|PASSWORD|PASSWD|PASS|PWD|TOKEN|PRIVATE|CREDENTIAL|API_?KEY|_KEY|KEY_ID|DSN|DATABASE_URL|_URI|POOLER_URL|SALT|PEPPER)$/i,vr=/(^NEXT_PUBLIC_|^VITE_|^EXPO_PUBLIC_|ANON_KEY$|PUBLISHABLE_KEY$|PUBLIC_KEY$)/i;function Ke(e){let t=0;for(let r of e.split(/\r?\n/)){let n=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(r);if(!n||!kr.test(n[1])||vr.test(n[1]))continue;let i=n[2].trim().replace(/^(['"])(.*)\1$/,"$2");i.length>=8&&!/^\$\{?[A-Z_]+\}?$/.test(i)&&t++}return t}var Ks=64*1024*1024,Gs=32*1024;var Zs=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase()));var Er=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],g=(e,t,r)=>({provider:e,url:t,steps:[...r,...Er]}),Ir={"aws-access-key":g("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":g("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":g("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":g("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":g("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":g("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":g("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":g("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":g("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":g("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":g("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":g("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":g("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":g("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":g("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"openai-project-key":g("OpenAI","https://platform.openai.com/api-keys",["Open API keys (per project).","Create a new secret key for the same project."]),"anthropic-key":g("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":g("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"supabase-access-token":g("Supabase (personal access token \u2014 reaches every project of the account)","https://supabase.com/dashboard/account/tokens",["Open Account \u2192 Access Tokens.","Revoke this token, then generate a new one only where it is needed (CLI, MCP) \u2014 prefer a read-only MCP."]),"supabase-secret-key":g("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new secret key, switch your servers to it, then delete this one."]),"postgres-uri":g("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":g("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":g("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":g("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":g("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":g("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":g("An access token","",["Revoke the token in the service that issued it and issue a new one."])},$r=g("A credential","",["Find the service it belongs to and issue a new credential there."]);function Ge(e){return Ir[e]??$r}function Ct(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)}import{existsSync as Rr,mkdirSync as No,readFileSync as Tr,statSync as Pt,writeFileSync as Fo}from"node:fs";import{homedir as Cr}from"node:os";import{join as Pr}from"node:path";var Lr=()=>Pr(Cr(),".nodata","flagged.json");function Dr(e){let t=e.replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t}var U=null;function Nr(){let e=Lr();try{if(!Rr(e))return{};let t=Pt(e).mtimeMs;if(U&&U.path===e&&U.mtimeMs===t)return U.store;let r=JSON.parse(Tr(e,"utf8"));return U={path:e,mtimeMs:t,store:r},r}catch{return{}}}function le(e){let t=Nr()[Dr(e)];if(!t)return null;try{if(Pt(e).mtimeMs>t.mtimeMs+1e3)return null}catch{return null}return t.kinds}import{existsSync as Fr,mkdirSync as zo,readFileSync as Hr,writeFileSync as Bo}from"node:fs";import{homedir as Or}from"node:os";import{join as jr}from"node:path";var Lt=()=>jr(Or(),".nodata","prefs.json");function Mr(){try{let e=Fr(Lt())?JSON.parse(Hr(Lt(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function zr(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function D(){return Mr()??zr()}function _(e,t,r=D()){return r==="he"?e:t}import{createHmac as Ur,randomBytes as Wr}from"node:crypto";import{existsSync as ue,mkdirSync as Vr,readdirSync as Kr,readFileSync as Ze,writeFileSync as Gr}from"node:fs";import{homedir as V}from"node:os";import{basename as Zr,extname as Xr,isAbsolute as Jr,join as K,relative as qr,resolve as Yr}from"node:path";function I(e){return typeof e=="number"&&Number.isFinite(e)?e:typeof e=="string"&&e.trim()!==""&&!Number.isNaN(Number(e))?Number(e):null}function Br(e,t,r){return t===null||r===null?!1:t<=r?e>=t&&e<=r:e>=t||e<=r}function Dt(e,t,r){switch(t){case"eq":return e===r;case"ne":return e!==r;case"in":return Array.isArray(r)&&r.includes(e);case"not_in":return Array.isArray(r)&&!r.includes(e);case"prefix":return typeof e=="string"&&typeof r=="string"&&e.toLowerCase().startsWith(r.toLowerCase());case"gte":{let n=I(e),i=I(r);return n!==null&&i!==null&&n>=i}case"lte":{let n=I(e),i=I(r);return n!==null&&i!==null&&n<=i}case"between":{let n=I(e);return n!==null&&Array.isArray(r)&&r.length===2&&Br(n,I(r[0]),I(r[1]))}default:return!1}}function Nt(e,t,r){switch(t){case"in":return Array.isArray(r)&&e.some(n=>r.includes(n));case"not_in":return Array.isArray(r)&&!e.some(n=>r.includes(n));default:return!1}}var Ft=()=>K(V(),".nodata","rules.json"),de=()=>K(V(),".nodata","rules-key"),Ht={allow:0,ask:1,clean_copy:2,deny:3},Qr={action:{cardinality:"scalar",ops:["eq","ne","in","not_in"],enumValues:["read","search","run","write"],label:"what the agent does (read, search, run, write)",extract:e=>e.action},"time.hour":{cardinality:"scalar",ops:["between","gte","lte","eq"],label:"hour on this computer (0-23; 18..6 wraps overnight)",extract:e=>e.now.getHours()},"time.weekday":{cardinality:"scalar",ops:["in","not_in","between","eq"],label:"weekday on this computer (0 Sunday \u2026 6 Saturday)",extract:e=>e.now.getDay()},"file.ext":{cardinality:"scalar",ops:["eq","ne","in","not_in"],label:"file type (.xlsx, .pdf, .env \u2026)",extract:e=>Xr(e.path).toLowerCase()||void 0},"file.name":{cardinality:"scalar",ops:["eq","in","prefix"],label:"file name",extract:e=>Zr(e.path).toLowerCase()}};function ei(){try{if(ue(de())){let t=Ze(de(),"utf8").trim();if(/^[0-9a-f]{64}$/.test(t))return Buffer.from(t,"hex")}}catch{}let e=Wr(32);return Vr(K(V(),".nodata"),{recursive:!0}),Gr(de(),e.toString("hex")+`
28
- `,{mode:384}),e}var ti=(e,t)=>Ur("sha256",t).update(JSON.stringify(e)).digest("hex");function Ot(){if(!ue(Ft()))return{rules:[],tampered:!1};try{let e=JSON.parse(Ze(Ft(),"utf8")),t=Array.isArray(e.rules)?e.rules:[],r=ue(de())&&typeof e.mac=="string"&&e.mac===ti(t,ei());return{rules:t,tampered:!r}}catch{return{rules:[],tampered:!0}}}var W=e=>{let t=Yr(e.replace(/^~(?=[\\/]|$)/,V())).replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t};function $(e,t){if(e.startsWith("**/")){let n=e.slice(3).replace(/\\/g,"/").replace(/\/+$/,"").toLowerCase(),i=W(t).toLowerCase();return i.endsWith("/"+n)||i.includes("/"+n+"/")}let r=qr(W(e),W(t));return r===""||!r.startsWith("..")&&!Jr(r)}function jt(e,t){let r=Qr[e.field];if(!r)return!1;let n=r.extract(t);return e.op==="exists"?n!==void 0&&n!=="":n===void 0?!1:r.cardinality==="set"?Nt(Array.isArray(n)?n:[],e.op,e.value):Dt(n,e.op,e.value)}function Xe(e,t){let r=e.map((n,i)=>({rule:n,n:i+1})).filter(n=>$(n.rule.path,t.path)).sort((n,i)=>W(i.rule.path).length-W(n.rule.path).length||n.n-i.n);for(let n of r)if((n.rule.when??[]).every(i=>jt(i,t)))return{...n,touched:t.path};return null}function Je(e,t,r,n){let i=null;for(let[s,o]of e.entries())$(o.path,t)||(o.path.startsWith("**/")?!ni(t,o.path):!$(t,o.path))||(o.when??[]).every(a=>jt(a,{action:r,path:o.path,now:n}))&&(!i||Ht[o.effect]>Ht[i.rule.effect])&&(i={rule:o,n:s+1,touched:o.path});return i}function ni(e,t){let r=0,n=(i,s)=>{if(s>5||r>4e3)return!1;let o;try{o=Kr(i,{withFileTypes:!0})}catch{return!1}for(let a of o){if(++r>4e3||!a.isDirectory()||a.name==="node_modules"||a.name===".git")continue;let l=K(i,a.name);if($(t,l)||n(l,s+1))return!0}return!1};return n(e,0)}var ri={allow:["allowed","\u05DE\u05D5\u05EA\u05E8"],ask:["ask the person","\u05DC\u05E9\u05D0\u05D5\u05DC \u05D0\u05D5\u05EA\u05DA"],clean_copy:["clean copy only","\u05E8\u05E7 \u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9"],deny:["not allowed","\u05D0\u05E1\u05D5\u05E8"]};var Mt=(e,t=!1)=>ri[e][t?1:0];function zt(){try{let e=K(V(),".nodata","org-mandate.json");if(!ue(e))return[];let t=JSON.parse(Ze(e,"utf8"));return Array.isArray(t.folder_rules)?t.folder_rules:[]}catch{return[]}}var li=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),di=50*1024*1024,ui=8,pi={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function et(e){let t=Qe(e).toLowerCase();return li.has(Kt(t))||L.test(t)}var fi=/^(reports|receipts)(\/|$)|^(prefs|consent|flagged|statusline-prev|key-backup)\.json$|^(gate|status)\.mjs$|^(gate|answers)\.log$/i,hi=/\.nodata[\\/]+(device-key\.json|secrets\.json|credentials\.json|issuer-ed25519\.json|capsule\.json|capsule-key|shares|approvals|fabric-key\.json|machine-salt|pending-link\.json)\b/i;function G(e){let t=fe(Z(),".nodata").replace(/\\/g,"/").toLowerCase();if(!e.replace(/\\/g,"/").toLowerCase().startsWith(t+"/"))return!1;let n=e.replace(/\\/g,"/").slice(t.length+1);return n!==""&&!fi.test(n)}function mi(e){return hi.test(e)}var Bt=/(\.claude[\\/]+settings(\.local)?\.json|node_modules[\\/]+@nodatachat[\\/])/i,gi=/(>|\bsed\s+-i|\btee\b|\b(rm|del|erase|mv|move|cp|copy|ren|rename)\b|Set-Content|Add-Content|Out-File|Remove-Item|Move-Item|Copy-Item|Rename-Item|WriteAllText|writeFileSync|unlinkSync)/i;function yi(e,t,r){if(e==="Bash"||e==="PowerShell"){let i=typeof t.command=="string"?t.command:"";return Bt.test(i)&&gi.test(i)}let n=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return n?Bt.test((N(n)?n:k(r,n)).replace(/\\/g,"/")):!1}function bi(e){return et(e)||le(e)!==null}var he=class extends Error{};function _i(e){let t=Kt(e).toLowerCase(),r=ai(e),n,i;if(t===".csv"||t===".tsv")i=r.toString("utf8"),n=We(i,t===".tsv"?" ":void 0).counts;else if(t===".xlsx"||t===".xlsm"||t===".docx"||t===".pptx"||t===".pdf"){let o=t===".xlsx"||t===".xlsm"?Ve(r):null,a=ae(r,t);if(!a&&!o)throw new he;i=a?.text??"",n=o?o.counts:A(i).counts}else i=r.toString("utf8"),n=A(i).counts;let s=Y.filter(o=>o.pattern.test(i)).length;return L.test(Qe(e).toLowerCase())&&(s=Math.max(s,Ke(i))),s&&(n.secret=Math.max(n.secret??0,s)),n}var ki={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function Gt(e){let t=D()==="he",r=n=>(t?ki[n]:pi[n])??n;return Object.entries(e).sort((n,i)=>i[1]-n[1]).map(([n,i])=>`${i} ${n.startsWith("column:")?`${r(n.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:r(n)}`).join(", ")}function vi(e){return Gt(e)}function Zt(e,t,r){let n=s=>N(s)?s:k(r,s),i=s=>{try{return Ye(s).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[n(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&i(n(t.path)))return[n(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let s=t.command,o=[...[...s.matchAll(/"([^"]*)"/g)].map(l=>l[1]),...[...s.matchAll(/'([^']*)'/g)].map(l=>l[1]),...s.split(/[\s|;&<>(),=`]+/)],a=[];for(let l of o){let c=l.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,Z()).replace(/^\/([a-zA-Z])\//,(d,p)=>process.platform==="win32"?`${p}:/`:d);if(!c)continue;let u=n(c);if(!(!et(c)&&!G(u)&&le(u)===null)&&(i(u)&&!a.includes(u)&&a.push(u),a.length>=ui))break}return a}return[]}function R(e){return e.replace(/\\+/g,"/")}function xi(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function Xt(e,t,r){let n=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&xi(t.command))return n;for(let i of Zt(e,t,r)){if(!bi(i)||Ct(i)||!Vt(i))continue;let s,o=et(i)?null:le(i);if(o){s=`${R(i)}: ${_("\u05E7\u05D5\u05D3 \u05E9\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05E1\u05D9\u05DE\u05E0\u05D4","code your last scan flagged")} \u2014 ${vi(o)}`,n.push(s);continue}try{if(Ye(i).size>di)s=`${R(i)}: too large to check here (over 50 MB)`;else{let a=_i(i);if(Object.keys(a).length===0)continue;s=`${R(i)}: ${Gt(a)}`}}catch(a){s=a instanceof he?`${R(i)}: ${_("\u05DC\u05D0 \u05E0\u05D9\u05EA\u05DF \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05D8\u05E7\u05E1\u05D8 (\u05E1\u05E8\u05D9\u05E7\u05D4, \u05D4\u05E6\u05E4\u05E0\u05D4 \u05D0\u05D5 \u05D2\u05D5\u05E4\u05DF \u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA) \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","its text could not be read (a scan, encryption or an unsupported font) \u2014 NOT checked, treat it as sensitive")}`:`${R(i)}: could not be checked`}n.push(s)}return n}var qe=/(?:\.aws[\\/]+credentials|\.npmrc|\.yarnrc\.yml|\.pypirc|[._]netrc|\.git-credentials|\.pgpass|\.docker[\\/]+config\.json|\.kube[\\/]+config|gh[\\/]+hosts\.yml|\.supabase[\\/]+access-token|application_default_credentials\.json|gcloud[\\/]+(?:credentials|access_tokens)\.db|\.azure[\\/]+(?:msal_token_cache|accessTokens)|com\.vercel\.cli[\\/]+auth\.json|\.ssh[\\/]+id_(?:rsa|ed25519|ecdsa|dsa)(?![\w.]))/i,me=/(?:TOKEN|SECRET|PASSW(?:OR)?D|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIAL|SERVICE_ROLE|_KEY$)/i,wi=[[/^(?:env|set|export\s+-p|declare\s+-x|get-childitem\s+env:\S*|gci\s+env:\S*|dir\s+env:\S*|ls\s+env:\S*)\s*$/i,"every environment variable"],[/^gh\s+auth\s+(?:token\b|status\b.*(?:\s-t\b|--show-token))/i,"the GitHub login token"],[/^gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token\b/i,"a Google Cloud access token"],[/^az\s+account\s+get-access-token\b/i,"an Azure access token"],[/^aws\s+(?:configure\s+(?:get\s+\S*(?:secret|token)\S*|export-credentials)|sts\s+get-session-token|ecr\s+get-login-password)\b/i,"AWS credentials"],[/^supabase\s+projects\s+api-keys\b/i,"the project's Supabase keys (incl. service_role)"],[/^heroku\s+auth:token\b/i,"the Heroku login token"],[/^op\s+(?:read|item\s+get)\b/i,"a 1Password secret"],[/^vault\s+(?:kv\s+get|read)\b/i,"a Vault secret"],[/^doppler\s+secrets\b/i,"Doppler secrets"],[/^security\s+find-(?:generic|internet)-password\b.*\s-w\b/i,"a keychain password"],[/^git\s+credential\s+fill\b/i,"a saved Git password"],[/^(?:npx\s+(?:-y\s+)?@nodatachat\/mcp(?:@\S+)?|nodata-mcp)\s+(?:secrets-run|secrets-login)\b|^node\s+\S*nodata-pull\.mjs\b/i,"the vault's secrets, outside nodata_run's approval and each key's policy"],[/^kubectl\s+get\s+secrets?\b.*\s-o\b/i,"Kubernetes secrets"]],Si=/^(?:echo|printf|print|write-output|write-host|say)\b/i,Jt=/^(?:cat|type|get-content|gc|more|less|head|tail|bat|nl|strings|xxd|od|hexdump|grep|egrep|rg|select-string|sls|awk|sed|jq|yq|python\d*|py|node|ruby|perl)\b/i,Ai=/\$\{?env:([A-Za-z_][\w]*)|\$\{?([A-Za-z_][\w]*)|%([A-Za-z_][\w]*)%|GetEnvironmentVariable\(\s*['"]([^'"]+)['"]/g;function Ei(e,t,r){let n=e==="Read"&&typeof t.file_path=="string"?t.file_path:e==="Grep"&&typeof t.path=="string"?t.path:"";if(n&&qe.test((N(n)?n:k(r,n)).replace(/\\/g,"/")))return`a saved login (${Qe(n)})`;if(e!=="Bash"&&e!=="PowerShell"||typeof t.command!="string")return null;let i=t.command.split(/(\|\||&&|[;|\n])/);for(let s=0;s<i.length;s+=2){let o=i[s+1]==="|",a=i[s].trim().replace(/^(?:sudo\s+|cmd(?:\.exe)?\s+\/c\s+|powershell(?:\.exe)?\s+(?:-command\s+)?|pwsh\s+(?:-c(?:ommand)?\s+)?)+/i,"").replace(/^["']|["']$/g,"");if(Jt.test(a)&&qe.test(a))return"a saved login file";for(let[c,u]of wi)if(c.test(a))return u;let l=a.match(/^printenv(?:\s+(\S+))?\s*$/i);if(l&&(!l[1]||me.test(l[1])))return l[1]?`the variable ${l[1]}`:"every environment variable";if(!o&&(Si.test(a)||/GetEnvironmentVariable/i.test(a)))for(let c of a.matchAll(Ai)){let u=c[1]??c[2]??c[3]??c[4]??"";if(me.test(u))return`the variable ${u}`}}return null}var qt=/^(?:grep|egrep|fgrep|rg|ag|ack|git\s+grep|findstr|select-string|sls)\b/i,Ii=/(?:^|\s)(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive|--dereference-recursive|\/s|-recurse)(?=\s|$)/i,$i=new Set(["node_modules",".git",".next","dist","build",".venv","venv","__pycache__",".cache"]),Ut=4e3,Ri=5;function Ti(e){let t=0,r=0,n=(i,s)=>{if(s>Ri||t>Ut)return;let o;try{o=oi(i,{withFileTypes:!0})}catch{return}for(let a of o){if(++t>Ut)return;let l=fe(i,a.name);a.isDirectory()?$i.has(a.name)||n(l,s+1):(L.test(a.name.toLowerCase())||qe.test(l.replace(/\\/g,"/"))||G(l))&&r++}};return n(e,0),r}var ge=e=>{try{return Ye(e).isDirectory()}catch{return!1}};function Ci(e,t){let r=ci(k(t),k(e));return r===""||!r.startsWith("..")&&!N(r)}function Pi(e,t,r){let n=s=>k(r,s.replace(/^~(?=[\\/]|$)/,Z())),i=[];if(e==="Grep"){let s=typeof t.path=="string"&&t.path?n(t.path):k(r);if(ge(s)){let o=[t.pattern,t.glob,t.type].filter(a=>typeof a=="string").join(" ");i.push({roots:[s],bySecret:me.test(o)||/\.env|env\b/i.test(String(t.glob??""))})}}else if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string")for(let s of t.command.split(/\|\||&&|[;|\n]/)){let o=s.trim().replace(/^(?:sudo\s+|xargs\s+(?:-\S+\s+)*)/i,"");if(!/^find\b.*-exec\s+(?:grep|egrep|rg|cat)\b/i.test(o)&&!(qt.test(o)&&(Ii.test(o)||/^(?:rg|ag|ack|git\s+grep)\b/i.test(o))))continue;let c=o.split(/\s+/).slice(1).map(u=>u.replace(/^['"]|['"]$/g,"")).filter(u=>u&&!u.startsWith("-")&&!/^\/[a-z]$/i.test(u)).map(n).filter(ge);i.push({roots:c.length?c:[k(r)],bySecret:me.test(o)||/\.env\b/i.test(o)})}for(let s of i)for(let o of s.roots){if(!s.bySecret&&Ci(o,r))continue;let a=Ti(o);if(a>0)return{why:s.bySecret?"by_name":"outside",root:o,keyFiles:a}}return null}var pe=new Set(["Write","Edit","MultiEdit","NotebookEdit"]);function Li(e,t,r){let n=i=>k(r,i.replace(/^~(?=[\\/]|$)/,Z()));if(e==="Read"&&typeof t.file_path=="string")return{action:"read",paths:[n(t.file_path)],roots:[]};if(pe.has(e)){let i=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return i?{action:"write",paths:[n(i)],roots:[]}:null}if(e==="Grep"){let i=typeof t.path=="string"&&t.path?n(t.path):k(r);return{action:"search",paths:[i],roots:ge(i)?[i]:[]}}if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let i=t.command,o=[...[...i.matchAll(/"([^"]*)"/g)].map(c=>c[1]),...[...i.matchAll(/'([^']*)'/g)].map(c=>c[1]),...i.split(/[\s|;&<>(),=`]+/)].map(c=>c.trim()).filter(c=>c&&!c.startsWith("-")&&/[\\/.~]/.test(c)).map(n).filter(c=>Vt(c)),a=i.split(/\|\||&&|[;|\n]/).some(c=>qt.test(c.trim())||/^find\b/i.test(c.trim())),l=o.filter(ge);return{action:a?"search":Jt.test(i.trim())?"read":"run",paths:[k(r),...o],roots:a?l.length?l:[k(r)]:[]}}return null}function Di(e,t,r,n=new Date){let i=Li(e,t,r);if(!i)return null;let{rules:s,tampered:o}=Ot(),a=zt();if(!s.length&&!a.length)return null;let l={allow:0,ask:1,clean_copy:2,deny:3},c=null;for(let d of i.paths){let p=Xe(a,{action:i.action,path:d,now:n});p&&(!c||l[p.rule.effect]>l[c.rule.effect])&&(c={...p,org:!0})}for(let d of i.roots){let p=Je(a,d,i.action,n);p&&p.rule.effect!=="allow"&&(!c||l[p.rule.effect]>l[c.rule.effect])&&(c={...p,org:!0})}let u=Ni(s,o,i,n,l);return c&&(!u||l[c.rule.effect]>=l[u.rule.effect])?c:u}function Ni(e,t,r,n,i){if(!e.length)return null;if(t){for(let o of r.paths){let a=e.find(l=>$(l.path,o)||$(o,l.path));if(a)return{rule:{...a,effect:"deny",when:[]},n:e.indexOf(a)+1,touched:o,tampered:!0}}return null}let s=null;for(let o of r.paths){let a=Xe(e,{action:r.action,path:o,now:n});a&&(!s||i[a.rule.effect]>i[s.rule.effect])&&(s=a)}for(let o of r.roots){let a=Je(e,o,r.action,n);a&&a.rule.effect!=="allow"&&(!s||i[a.rule.effect]>i[s.rule.effect])&&(s=a)}return s}function Fi(e){let t;try{t=typeof e=="string"?e:JSON.stringify(e??"")}catch{return{}}if(!t)return{};t=t.slice(0,2*1024*1024);let r={};for(let n of j()){let i=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g"),s=(t.match(i)??[]).length;s&&(r[n.id]=(r[n.id]??0)+s)}return r}function Hi(e){let t=Object.keys(e);if(t.length===0)return null;let r=t.reduce((i,s)=>i+e[s],0),n=[...new Set(t.map(i=>{let s=Ge(i);return s.url?`${s.provider}: ${s.url}`:s.provider}))];return`NoData \xB7 A CREDENTIAL IS IN THIS OUTPUT (${r}: ${t.join(", ")}). It is now in this conversation and was sent to the AI model. Do not repeat, quote, shorten, mask-by-hand or reuse it \u2014 not in your answer, not in a command, not in a file. Tell the user in one line that a key was shown here and should be replaced at its provider (${n.join(" \xB7 ")}); nodata_scan_folder gives the full steps. Next time, run commands that need secrets through nodata_run: the output comes back with every value blanked.`+(D()==="he"?" Answer the user in Hebrew.":"")}function Oi(e,t,r){let n=(e==="Bash"||e==="PowerShell")&&typeof t.command=="string"?t.command:"",i=e==="Grep"&&typeof t.path=="string"?t.path:e==="Read"&&typeof t.file_path=="string"?t.file_path:"";return n&&mi(n)||i&&G(N(i)?i:k(r,i))||Zt(e,t,r).some(G)?_("NoData \u05D7\u05E1\u05DD: \u05D6\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05E4\u05EA\u05D7 \u05E9\u05DC NoData (\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8, \u05D4\u05DB\u05E1\u05E4\u05EA \u05D0\u05D5 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF). \u05DE\u05D9 \u05E9\u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E4\u05EA\u05D5\u05D7 \u05DB\u05DC \u05E7\u05D5\u05D1\u05E5 \u05E0\u05E2\u05D5\u05DC, \u05D5\u05DC\u05DB\u05DF \u05D0\u05E3 \u05E1\u05D5\u05DB\u05DF \u05DC\u05D0 \u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC-NoData \u05D0\u05D9\u05DF \u05E2\u05D5\u05EA\u05E7 \u05E9\u05DC \u05D4\u05DE\u05E4\u05EA\u05D7 \u05D5\u05D0\u05D9\u05DF \u05D3\u05E8\u05DA \u05DC\u05E9\u05D7\u05D6\u05E8 \u05D0\u05D5\u05EA\u05D5: \u05D4\u05D2\u05D9\u05D1\u05D5\u05D9 \u05E9\u05DC\u05DA \u05D4\u05D5\u05D0 \u05D4\u05D3\u05E8\u05DA \u05D4\u05D9\u05D7\u05D9\u05D3\u05D4. \u05DC\u05D2\u05D9\u05D1\u05D5\u05D9, \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC \u05D5\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8: npx -y @nodatachat/mcp@latest key-backup E: (E: = \u05D4\u05D3\u05D9\u05E1\u05E7-\u05D0\u05D5\u05DF-\u05E7\u05D9).","NoData refused: this is one of NoData's own key files (the device key, the vault login or the org credential). Whoever reads it can open every sealed file, so no agent reads it \u2014 not even with approval. NoData holds no copy of this key and cannot recover it: your backup is the only recovery. To back it up, in a terminal (not the chat): npx -y @nodatachat/mcp@latest key-backup E: (E: = your USB drive). Do not suggest other recovery routes \u2014 there are none."):null}function ji(e,t,r,n){let i=Oi(e,t,r);if(i)return{decision:"deny",reason:i};let s=Ei(e,t,r);if(s){let u=_(`NoData: \u05D4\u05E4\u05E7\u05D5\u05D3\u05D4 \u05D4\u05D6\u05D5 \u05DE\u05E6\u05D9\u05D2\u05D4 ${s}. \u05DE\u05D4 \u05E9\u05D4\u05D9\u05D0 \u05DE\u05D3\u05E4\u05D9\u05E1\u05D4 \u05E0\u05DB\u05E0\u05E1 \u05DC\u05E9\u05D9\u05D7\u05D4 \u05D5\u05E0\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA, \u05D5\u05DE\u05E4\u05EA\u05D7 \u05E9\u05E0\u05E8\u05D0\u05D4 \u05DB\u05D0\u05DF \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D7\u05DC\u05D9\u05E3.
28
+ `,{mode:384}),e}var ti=(e,t)=>Ur("sha256",t).update(JSON.stringify(e)).digest("hex");function Ot(){if(!ue(Ft()))return{rules:[],tampered:!1};try{let e=JSON.parse(Ze(Ft(),"utf8")),t=Array.isArray(e.rules)?e.rules:[],r=ue(de())&&typeof e.mac=="string"&&e.mac===ti(t,ei());return{rules:t,tampered:!r}}catch{return{rules:[],tampered:!0}}}var W=e=>{let t=Yr(e.replace(/^~(?=[\\/]|$)/,V())).replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t};function $(e,t){if(e.startsWith("**/")){let n=e.slice(3).replace(/\\/g,"/").replace(/\/+$/,"").toLowerCase(),i=W(t).toLowerCase();return i.endsWith("/"+n)||i.includes("/"+n+"/")}let r=qr(W(e),W(t));return r===""||!r.startsWith("..")&&!Jr(r)}function jt(e,t){let r=Qr[e.field];if(!r)return!1;let n=r.extract(t);return e.op==="exists"?n!==void 0&&n!=="":n===void 0?!1:r.cardinality==="set"?Nt(Array.isArray(n)?n:[],e.op,e.value):Dt(n,e.op,e.value)}function Xe(e,t){let r=e.map((n,i)=>({rule:n,n:i+1})).filter(n=>$(n.rule.path,t.path)).sort((n,i)=>W(i.rule.path).length-W(n.rule.path).length||n.n-i.n);for(let n of r)if((n.rule.when??[]).every(i=>jt(i,t)))return{...n,touched:t.path};return null}function Je(e,t,r,n){let i=null;for(let[s,o]of e.entries())$(o.path,t)||(o.path.startsWith("**/")?!ni(t,o.path):!$(t,o.path))||(o.when??[]).every(a=>jt(a,{action:r,path:o.path,now:n}))&&(!i||Ht[o.effect]>Ht[i.rule.effect])&&(i={rule:o,n:s+1,touched:o.path});return i}function ni(e,t){let r=0,n=(i,s)=>{if(s>5||r>4e3)return!1;let o;try{o=Kr(i,{withFileTypes:!0})}catch{return!1}for(let a of o){if(++r>4e3||!a.isDirectory()||a.name==="node_modules"||a.name===".git")continue;let l=K(i,a.name);if($(t,l)||n(l,s+1))return!0}return!1};return n(e,0)}var ri={allow:["allowed","\u05DE\u05D5\u05EA\u05E8"],ask:["ask the person","\u05DC\u05E9\u05D0\u05D5\u05DC \u05D0\u05D5\u05EA\u05DA"],clean_copy:["clean copy only","\u05E8\u05E7 \u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9"],deny:["not allowed","\u05D0\u05E1\u05D5\u05E8"]};var Mt=(e,t=!1)=>ri[e][t?1:0];function zt(){try{let e=K(V(),".nodata","org-mandate.json");if(!ue(e))return[];let t=JSON.parse(Ze(e,"utf8"));return Array.isArray(t.folder_rules)?t.folder_rules:[]}catch{return[]}}var li=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),di=50*1024*1024,ui=8,pi={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function et(e){let t=Qe(e).toLowerCase();return li.has(Kt(t))||L.test(t)}var fi=/^(reports|receipts)(\/|$)|^(prefs|consent|flagged|statusline-prev|key-backup|connection)\.json$|^(gate|status)\.mjs$|^(gate|answers)\.log$/i,hi=/\.nodata[\\/]+(device-key\.json|secrets\.json|credentials\.json|issuer-ed25519\.json|capsule\.json|capsule-key|shares|approvals|fabric-key\.json|machine-salt|pending-link\.json)\b/i;function G(e){let t=fe(Z(),".nodata").replace(/\\/g,"/").toLowerCase();if(!e.replace(/\\/g,"/").toLowerCase().startsWith(t+"/"))return!1;let n=e.replace(/\\/g,"/").slice(t.length+1);return n!==""&&!fi.test(n)}function mi(e){return hi.test(e)}var Bt=/(\.claude[\\/]+settings(\.local)?\.json|node_modules[\\/]+@nodatachat[\\/])/i,gi=/(>|\bsed\s+-i|\btee\b|\b(rm|del|erase|mv|move|cp|copy|ren|rename)\b|Set-Content|Add-Content|Out-File|Remove-Item|Move-Item|Copy-Item|Rename-Item|WriteAllText|writeFileSync|unlinkSync)/i;function yi(e,t,r){if(e==="Bash"||e==="PowerShell"){let i=typeof t.command=="string"?t.command:"";return Bt.test(i)&&gi.test(i)}let n=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return n?Bt.test((N(n)?n:k(r,n)).replace(/\\/g,"/")):!1}function bi(e){return et(e)||le(e)!==null}var he=class extends Error{};function _i(e){let t=Kt(e).toLowerCase(),r=ai(e),n,i;if(t===".csv"||t===".tsv")i=r.toString("utf8"),n=We(i,t===".tsv"?" ":void 0).counts;else if(t===".xlsx"||t===".xlsm"||t===".docx"||t===".pptx"||t===".pdf"){let o=t===".xlsx"||t===".xlsm"?Ve(r):null,a=ae(r,t);if(!a&&!o)throw new he;i=a?.text??"",n=o?o.counts:A(i).counts}else i=r.toString("utf8"),n=A(i).counts;let s=Y.filter(o=>o.pattern.test(i)).length;return L.test(Qe(e).toLowerCase())&&(s=Math.max(s,Ke(i))),s&&(n.secret=Math.max(n.secret??0,s)),n}var ki={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function Gt(e){let t=D()==="he",r=n=>(t?ki[n]:pi[n])??n;return Object.entries(e).sort((n,i)=>i[1]-n[1]).map(([n,i])=>`${i} ${n.startsWith("column:")?`${r(n.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:r(n)}`).join(", ")}function vi(e){return Gt(e)}function Zt(e,t,r){let n=s=>N(s)?s:k(r,s),i=s=>{try{return Ye(s).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[n(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&i(n(t.path)))return[n(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let s=t.command,o=[...[...s.matchAll(/"([^"]*)"/g)].map(l=>l[1]),...[...s.matchAll(/'([^']*)'/g)].map(l=>l[1]),...s.split(/[\s|;&<>(),=`]+/)],a=[];for(let l of o){let c=l.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,Z()).replace(/^\/([a-zA-Z])\//,(d,p)=>process.platform==="win32"?`${p}:/`:d);if(!c)continue;let u=n(c);if(!(!et(c)&&!G(u)&&le(u)===null)&&(i(u)&&!a.includes(u)&&a.push(u),a.length>=ui))break}return a}return[]}function R(e){return e.replace(/\\+/g,"/")}function xi(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function Xt(e,t,r){let n=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&xi(t.command))return n;for(let i of Zt(e,t,r)){if(!bi(i)||Ct(i)||!Vt(i))continue;let s,o=et(i)?null:le(i);if(o){s=`${R(i)}: ${_("\u05E7\u05D5\u05D3 \u05E9\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05E1\u05D9\u05DE\u05E0\u05D4","code your last scan flagged")} \u2014 ${vi(o)}`,n.push(s);continue}try{if(Ye(i).size>di)s=`${R(i)}: too large to check here (over 50 MB)`;else{let a=_i(i);if(Object.keys(a).length===0)continue;s=`${R(i)}: ${Gt(a)}`}}catch(a){s=a instanceof he?`${R(i)}: ${_("\u05DC\u05D0 \u05E0\u05D9\u05EA\u05DF \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05D8\u05E7\u05E1\u05D8 (\u05E1\u05E8\u05D9\u05E7\u05D4, \u05D4\u05E6\u05E4\u05E0\u05D4 \u05D0\u05D5 \u05D2\u05D5\u05E4\u05DF \u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA) \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","its text could not be read (a scan, encryption or an unsupported font) \u2014 NOT checked, treat it as sensitive")}`:`${R(i)}: could not be checked`}n.push(s)}return n}var qe=/(?:\.aws[\\/]+credentials|\.npmrc|\.yarnrc\.yml|\.pypirc|[._]netrc|\.git-credentials|\.pgpass|\.docker[\\/]+config\.json|\.kube[\\/]+config|gh[\\/]+hosts\.yml|\.supabase[\\/]+access-token|application_default_credentials\.json|gcloud[\\/]+(?:credentials|access_tokens)\.db|\.azure[\\/]+(?:msal_token_cache|accessTokens)|com\.vercel\.cli[\\/]+auth\.json|\.ssh[\\/]+id_(?:rsa|ed25519|ecdsa|dsa)(?![\w.]))/i,me=/(?:TOKEN|SECRET|PASSW(?:OR)?D|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIAL|SERVICE_ROLE|_KEY$)/i,wi=[[/^(?:env|set|export\s+-p|declare\s+-x|get-childitem\s+env:\S*|gci\s+env:\S*|dir\s+env:\S*|ls\s+env:\S*)\s*$/i,"every environment variable"],[/^gh\s+auth\s+(?:token\b|status\b.*(?:\s-t\b|--show-token))/i,"the GitHub login token"],[/^gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token\b/i,"a Google Cloud access token"],[/^az\s+account\s+get-access-token\b/i,"an Azure access token"],[/^aws\s+(?:configure\s+(?:get\s+\S*(?:secret|token)\S*|export-credentials)|sts\s+get-session-token|ecr\s+get-login-password)\b/i,"AWS credentials"],[/^supabase\s+projects\s+api-keys\b/i,"the project's Supabase keys (incl. service_role)"],[/^heroku\s+auth:token\b/i,"the Heroku login token"],[/^op\s+(?:read|item\s+get)\b/i,"a 1Password secret"],[/^vault\s+(?:kv\s+get|read)\b/i,"a Vault secret"],[/^doppler\s+secrets\b/i,"Doppler secrets"],[/^security\s+find-(?:generic|internet)-password\b.*\s-w\b/i,"a keychain password"],[/^git\s+credential\s+fill\b/i,"a saved Git password"],[/^(?:npx\s+(?:-y\s+)?@nodatachat\/mcp(?:@\S+)?|nodata-mcp)\s+(?:secrets-run|secrets-login)\b|^node\s+\S*nodata-pull\.mjs\b/i,"the vault's secrets, outside nodata_run's approval and each key's policy"],[/^kubectl\s+get\s+secrets?\b.*\s-o\b/i,"Kubernetes secrets"]],Si=/^(?:echo|printf|print|write-output|write-host|say)\b/i,Jt=/^(?:cat|type|get-content|gc|more|less|head|tail|bat|nl|strings|xxd|od|hexdump|grep|egrep|rg|select-string|sls|awk|sed|jq|yq|python\d*|py|node|ruby|perl)\b/i,Ai=/\$\{?env:([A-Za-z_][\w]*)|\$\{?([A-Za-z_][\w]*)|%([A-Za-z_][\w]*)%|GetEnvironmentVariable\(\s*['"]([^'"]+)['"]/g;function Ei(e,t,r){let n=e==="Read"&&typeof t.file_path=="string"?t.file_path:e==="Grep"&&typeof t.path=="string"?t.path:"";if(n&&qe.test((N(n)?n:k(r,n)).replace(/\\/g,"/")))return`a saved login (${Qe(n)})`;if(e!=="Bash"&&e!=="PowerShell"||typeof t.command!="string")return null;let i=t.command.split(/(\|\||&&|[;|\n])/);for(let s=0;s<i.length;s+=2){let o=i[s+1]==="|",a=i[s].trim().replace(/^(?:sudo\s+|cmd(?:\.exe)?\s+\/c\s+|powershell(?:\.exe)?\s+(?:-command\s+)?|pwsh\s+(?:-c(?:ommand)?\s+)?)+/i,"").replace(/^["']|["']$/g,"");if(Jt.test(a)&&qe.test(a))return"a saved login file";for(let[c,u]of wi)if(c.test(a))return u;let l=a.match(/^printenv(?:\s+(\S+))?\s*$/i);if(l&&(!l[1]||me.test(l[1])))return l[1]?`the variable ${l[1]}`:"every environment variable";if(!o&&(Si.test(a)||/GetEnvironmentVariable/i.test(a)))for(let c of a.matchAll(Ai)){let u=c[1]??c[2]??c[3]??c[4]??"";if(me.test(u))return`the variable ${u}`}}return null}var qt=/^(?:grep|egrep|fgrep|rg|ag|ack|git\s+grep|findstr|select-string|sls)\b/i,Ii=/(?:^|\s)(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive|--dereference-recursive|\/s|-recurse)(?=\s|$)/i,$i=new Set(["node_modules",".git",".next","dist","build",".venv","venv","__pycache__",".cache"]),Ut=4e3,Ri=5;function Ti(e){let t=0,r=0,n=(i,s)=>{if(s>Ri||t>Ut)return;let o;try{o=oi(i,{withFileTypes:!0})}catch{return}for(let a of o){if(++t>Ut)return;let l=fe(i,a.name);a.isDirectory()?$i.has(a.name)||n(l,s+1):(L.test(a.name.toLowerCase())||qe.test(l.replace(/\\/g,"/"))||G(l))&&r++}};return n(e,0),r}var ge=e=>{try{return Ye(e).isDirectory()}catch{return!1}};function Ci(e,t){let r=ci(k(t),k(e));return r===""||!r.startsWith("..")&&!N(r)}function Pi(e,t,r){let n=s=>k(r,s.replace(/^~(?=[\\/]|$)/,Z())),i=[];if(e==="Grep"){let s=typeof t.path=="string"&&t.path?n(t.path):k(r);if(ge(s)){let o=[t.pattern,t.glob,t.type].filter(a=>typeof a=="string").join(" ");i.push({roots:[s],bySecret:me.test(o)||/\.env|env\b/i.test(String(t.glob??""))})}}else if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string")for(let s of t.command.split(/\|\||&&|[;|\n]/)){let o=s.trim().replace(/^(?:sudo\s+|xargs\s+(?:-\S+\s+)*)/i,"");if(!/^find\b.*-exec\s+(?:grep|egrep|rg|cat)\b/i.test(o)&&!(qt.test(o)&&(Ii.test(o)||/^(?:rg|ag|ack|git\s+grep)\b/i.test(o))))continue;let c=o.split(/\s+/).slice(1).map(u=>u.replace(/^['"]|['"]$/g,"")).filter(u=>u&&!u.startsWith("-")&&!/^\/[a-z]$/i.test(u)).map(n).filter(ge);i.push({roots:c.length?c:[k(r)],bySecret:me.test(o)||/\.env\b/i.test(o)})}for(let s of i)for(let o of s.roots){if(!s.bySecret&&Ci(o,r))continue;let a=Ti(o);if(a>0)return{why:s.bySecret?"by_name":"outside",root:o,keyFiles:a}}return null}var pe=new Set(["Write","Edit","MultiEdit","NotebookEdit"]);function Li(e,t,r){let n=i=>k(r,i.replace(/^~(?=[\\/]|$)/,Z()));if(e==="Read"&&typeof t.file_path=="string")return{action:"read",paths:[n(t.file_path)],roots:[]};if(pe.has(e)){let i=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return i?{action:"write",paths:[n(i)],roots:[]}:null}if(e==="Grep"){let i=typeof t.path=="string"&&t.path?n(t.path):k(r);return{action:"search",paths:[i],roots:ge(i)?[i]:[]}}if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let i=t.command,o=[...[...i.matchAll(/"([^"]*)"/g)].map(c=>c[1]),...[...i.matchAll(/'([^']*)'/g)].map(c=>c[1]),...i.split(/[\s|;&<>(),=`]+/)].map(c=>c.trim()).filter(c=>c&&!c.startsWith("-")&&/[\\/.~]/.test(c)).map(n).filter(c=>Vt(c)),a=i.split(/\|\||&&|[;|\n]/).some(c=>qt.test(c.trim())||/^find\b/i.test(c.trim())),l=o.filter(ge);return{action:a?"search":Jt.test(i.trim())?"read":"run",paths:[k(r),...o],roots:a?l.length?l:[k(r)]:[]}}return null}function Di(e,t,r,n=new Date){let i=Li(e,t,r);if(!i)return null;let{rules:s,tampered:o}=Ot(),a=zt();if(!s.length&&!a.length)return null;let l={allow:0,ask:1,clean_copy:2,deny:3},c=null;for(let d of i.paths){let p=Xe(a,{action:i.action,path:d,now:n});p&&(!c||l[p.rule.effect]>l[c.rule.effect])&&(c={...p,org:!0})}for(let d of i.roots){let p=Je(a,d,i.action,n);p&&p.rule.effect!=="allow"&&(!c||l[p.rule.effect]>l[c.rule.effect])&&(c={...p,org:!0})}let u=Ni(s,o,i,n,l);return c&&(!u||l[c.rule.effect]>=l[u.rule.effect])?c:u}function Ni(e,t,r,n,i){if(!e.length)return null;if(t){for(let o of r.paths){let a=e.find(l=>$(l.path,o)||$(o,l.path));if(a)return{rule:{...a,effect:"deny",when:[]},n:e.indexOf(a)+1,touched:o,tampered:!0}}return null}let s=null;for(let o of r.paths){let a=Xe(e,{action:r.action,path:o,now:n});a&&(!s||i[a.rule.effect]>i[s.rule.effect])&&(s=a)}for(let o of r.roots){let a=Je(e,o,r.action,n);a&&a.rule.effect!=="allow"&&(!s||i[a.rule.effect]>i[s.rule.effect])&&(s=a)}return s}function Fi(e){let t;try{t=typeof e=="string"?e:JSON.stringify(e??"")}catch{return{}}if(!t)return{};t=t.slice(0,2*1024*1024);let r={};for(let n of j()){let i=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g"),s=(t.match(i)??[]).length;s&&(r[n.id]=(r[n.id]??0)+s)}return r}function Hi(e){let t=Object.keys(e);if(t.length===0)return null;let r=t.reduce((i,s)=>i+e[s],0),n=[...new Set(t.map(i=>{let s=Ge(i);return s.url?`${s.provider}: ${s.url}`:s.provider}))];return`NoData \xB7 A CREDENTIAL IS IN THIS OUTPUT (${r}: ${t.join(", ")}). It is now in this conversation and was sent to the AI model. Do not repeat, quote, shorten, mask-by-hand or reuse it \u2014 not in your answer, not in a command, not in a file. Tell the user in one line that a key was shown here and should be replaced at its provider (${n.join(" \xB7 ")}); nodata_scan_folder gives the full steps. Next time, run commands that need secrets through nodata_run: the output comes back with every value blanked.`+(D()==="he"?" Answer the user in Hebrew.":"")}function Oi(e,t,r){let n=(e==="Bash"||e==="PowerShell")&&typeof t.command=="string"?t.command:"",i=e==="Grep"&&typeof t.path=="string"?t.path:e==="Read"&&typeof t.file_path=="string"?t.file_path:"";return n&&mi(n)||i&&G(N(i)?i:k(r,i))||Zt(e,t,r).some(G)?_("NoData \u05D7\u05E1\u05DD: \u05D6\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05E4\u05EA\u05D7 \u05E9\u05DC NoData (\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8, \u05D4\u05DB\u05E1\u05E4\u05EA \u05D0\u05D5 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF). \u05DE\u05D9 \u05E9\u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E4\u05EA\u05D5\u05D7 \u05DB\u05DC \u05E7\u05D5\u05D1\u05E5 \u05E0\u05E2\u05D5\u05DC, \u05D5\u05DC\u05DB\u05DF \u05D0\u05E3 \u05E1\u05D5\u05DB\u05DF \u05DC\u05D0 \u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC-NoData \u05D0\u05D9\u05DF \u05E2\u05D5\u05EA\u05E7 \u05E9\u05DC \u05D4\u05DE\u05E4\u05EA\u05D7 \u05D5\u05D0\u05D9\u05DF \u05D3\u05E8\u05DA \u05DC\u05E9\u05D7\u05D6\u05E8 \u05D0\u05D5\u05EA\u05D5: \u05D4\u05D2\u05D9\u05D1\u05D5\u05D9 \u05E9\u05DC\u05DA \u05D4\u05D5\u05D0 \u05D4\u05D3\u05E8\u05DA \u05D4\u05D9\u05D7\u05D9\u05D3\u05D4. \u05DC\u05D2\u05D9\u05D1\u05D5\u05D9, \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC \u05D5\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8: npx -y @nodatachat/mcp@latest key-backup E: (E: = \u05D4\u05D3\u05D9\u05E1\u05E7-\u05D0\u05D5\u05DF-\u05E7\u05D9).","NoData refused: this is one of NoData's own key files (the device key, the vault login or the org credential). Whoever reads it can open every sealed file, so no agent reads it \u2014 not even with approval. NoData holds no copy of this key and cannot recover it: your backup is the only recovery. To back it up, in a terminal (not the chat): npx -y @nodatachat/mcp@latest key-backup E: (E: = your USB drive). Do not suggest other recovery routes \u2014 there are none."):null}function ji(e,t,r,n){let i=Oi(e,t,r);if(i)return{decision:"deny",reason:i};let s=Ei(e,t,r);if(s){let u=_(`NoData: \u05D4\u05E4\u05E7\u05D5\u05D3\u05D4 \u05D4\u05D6\u05D5 \u05DE\u05E6\u05D9\u05D2\u05D4 ${s}. \u05DE\u05D4 \u05E9\u05D4\u05D9\u05D0 \u05DE\u05D3\u05E4\u05D9\u05E1\u05D4 \u05E0\u05DB\u05E0\u05E1 \u05DC\u05E9\u05D9\u05D7\u05D4 \u05D5\u05E0\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA, \u05D5\u05DE\u05E4\u05EA\u05D7 \u05E9\u05E0\u05E8\u05D0\u05D4 \u05DB\u05D0\u05DF \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D7\u05DC\u05D9\u05E3.
29
29
  \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: \u05DC\u05D4\u05E8\u05D9\u05E5 \u05D0\u05D5\u05EA\u05D4 \u05D1\u05E2\u05E6\u05DE\u05DA \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC (\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8), \u05D0\u05D5 nodata_run \u2014 \u05E9\u05DE\u05E8\u05D9\u05E5 \u05E4\u05E7\u05D5\u05D3\u05D4 \u05E2\u05DD \u05D4\u05E1\u05D5\u05D3\u05D5\u05EA \u05D5\u05DE\u05D7\u05D6\u05D9\u05E8 \u05D0\u05EA \u05D4\u05E4\u05DC\u05D8 \u05DB\u05E9\u05DB\u05DC \u05E2\u05E8\u05DA \u05DE\u05D5\u05E1\u05EA\u05E8.`+(n?"":" \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData: this shows ${s}. Whatever it prints enters the conversation and goes to the AI model, and a key seen there has to be replaced.
30
30
  Instead: run it yourself in a terminal (not the chat), or nodata_run \u2014 it runs a command with the secrets and returns the output with every value blanked.`+(n?"":" Allow anyway?"));return{decision:n?"deny":"ask",reason:u}}if((pe.has(e)||e==="Bash"||e==="PowerShell")&&yi(e,t,r))return{decision:"ask",reason:_("NoData: \u05D4\u05E4\u05E2\u05D5\u05DC\u05D4 \u05D4\u05D6\u05D5 \u05DE\u05E9\u05E0\u05D4 \u05D0\u05EA \u05DE\u05D4 \u05E9\u05DE\u05E4\u05E2\u05D9\u05DC \u05D0\u05EA \u05D4\u05E9\u05E2\u05E8 \u2014 \u05D4\u05D4\u05D2\u05D3\u05E8\u05D5\u05EA \u05E9\u05DC Claude Code \u05D0\u05D5 \u05D4\u05E7\u05D5\u05D3 \u05D4\u05DE\u05D5\u05EA\u05E7\u05DF \u05E9\u05DC NoData. \u05D0\u05D7\u05E8\u05D9 \u05E9\u05D9\u05E0\u05D5\u05D9 \u05DB\u05D6\u05D4 \u05D9\u05D9\u05EA\u05DB\u05DF \u05E9\u05D4\u05E9\u05E2\u05E8 \u05DC\u05D0 \u05D9\u05D1\u05D3\u05D5\u05E7 \u05D9\u05D5\u05EA\u05E8. \u05DC\u05D0\u05E9\u05E8 \u05E8\u05E7 \u05D0\u05DD \u05D0\u05EA\u05D4 \u05D1\u05D9\u05E7\u05E9\u05EA \u05D0\u05EA \u05D6\u05D4.","NoData: this changes what runs the gate \u2014 Claude Code's settings or NoData's installed code. After such a change the gate may stop checking. Approve only if you asked for it.")};if(pe.has(e)){let u=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";if(u&&G(N(u)?u:k(r,u)))return{decision:"deny",reason:_("NoData \u05D7\u05E1\u05DD: \u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 ~/.nodata \u05E1\u05D2\u05D5\u05E8\u05D4 \u05DC\u05E1\u05D5\u05DB\u05E0\u05D9\u05DD, \u05D2\u05DD \u05DC\u05DB\u05EA\u05D9\u05D1\u05D4 (\u05DB\u05DC\u05DC\u05D9\u05DD, \u05DE\u05E4\u05EA\u05D7\u05D5\u05EA, \u05D0\u05D9\u05E9\u05D5\u05E8\u05D9\u05DD).","NoData refused: ~/.nodata is closed to agents, writes included (rules, keys, approvals).")}}let o=Di(e,t,r);if(o&&o.rule.effect!=="allow"){let u=D()==="he",d=o.tampered?_("\u05E7\u05D5\u05D1\u05E5 \u05D4\u05DB\u05DC\u05DC\u05D9\u05DD \u05E9\u05D5\u05E0\u05D4 \u05E9\u05DC\u05D0 \u05D3\u05E8\u05DA nodata_rules, \u05D5\u05DC\u05DB\u05DF \u05DB\u05DC \u05E0\u05EA\u05D9\u05D1 \u05E9\u05D4\u05D5\u05D0 \u05DE\u05D6\u05DB\u05D9\u05E8 \u05E1\u05D2\u05D5\u05E8 \u05E2\u05D3 \u05E9\u05EA\u05E9\u05DE\u05D5\u05E8 \u05D0\u05EA \u05D4\u05DB\u05DC\u05DC\u05D9\u05DD \u05DE\u05D7\u05D3\u05E9.","the rules file was changed outside nodata_rules, so every path it names is closed until you save the rules again."):`${o.org?_("\u05DB\u05DC\u05DC \u05E9\u05DC \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF","organisation rule"):_("\u05DB\u05DC\u05DC","rule")} ${o.n}: ${o.rule.path.startsWith("**/")?o.rule.path:R(o.rule.path)} \u2192 ${Mt(o.rule.effect,u)}${o.rule.note?` (${o.rule.note})`:""}`,p=o.rule.effect==="clean_copy"?_(`NoData: ${d}. \u05D4\u05E1\u05D5\u05DB\u05DF \u05E2\u05D5\u05D1\u05D3 \u05DB\u05D0\u05DF \u05E8\u05E7 \u05E2\u05DC \u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9: nodata_redact \u05D9\u05D5\u05E6\u05E8 \u05D0\u05D5\u05EA\u05D5 (\u05DE\u05D6\u05D4\u05D9\u05DD \u05DE\u05D5\u05D7\u05DC\u05E4\u05D9\u05DD, \u05E0\u05D1\u05D3\u05E7 \u05DC\u05E4\u05E0\u05D9 \u05E9\u05D9\u05DE\u05D5\u05E9).`,`NoData: ${d}. The agent works here on a clean copy only: nodata_redact makes one (identifiers replaced, checked before use).`):o.rule.effect==="ask"?_(`NoData: ${d}. \u05DC\u05D0\u05E9\u05E8?`,`NoData: ${d}. Allow?`):_(`NoData: ${d}. \u05D4\u05DB\u05DC\u05DC\u05D9\u05DD \u05E9\u05DC \u05D4\u05E7\u05D1\u05E6\u05D9\u05DD \u05D5\u05D4\u05EA\u05D9\u05E7\u05D9\u05D5\u05EA \u05E9\u05DC\u05DA: nodata_rules.`,`NoData: ${d}. Your file and folder rules: nodata_rules.`);return{decision:o.rule.effect==="ask"?"ask":"deny",reason:p}}if(pe.has(e))return{decision:"allow"};let a=Pi(e,t,r);if(a){let u=R(a.root),d=_(`NoData: \u05D6\u05D4 ${a.why==="by_name"?"\u05D7\u05D9\u05E4\u05D5\u05E9 \u05E1\u05D5\u05D3 \u05DC\u05E4\u05D9 \u05E9\u05DD":"\u05D7\u05D9\u05E4\u05D5\u05E9 \u05DE\u05D7\u05D5\u05E5 \u05DC\u05E4\u05E8\u05D5\u05D9\u05E7\u05D8"}, \u05D1\u05EA\u05D5\u05DA ${u}, \u05E9\u05D9\u05E9 \u05D1\u05D4 ${a.keyFiles} \u05E7\u05D1\u05E6\u05D9 \u05DE\u05E4\u05EA\u05D7\u05D5\u05EA (.env, \u05D4\u05EA\u05D7\u05D1\u05E8\u05D5\u05D9\u05D5\u05EA). \u05DE\u05D4 \u05E9\u05D4\u05D7\u05D9\u05E4\u05D5\u05E9 \u05D9\u05DE\u05E6\u05D0 \u05E0\u05DB\u05E0\u05E1 \u05DC\u05E9\u05D9\u05D7\u05D4, \u05D5\u05DE\u05E4\u05EA\u05D7 \u05E9\u05E0\u05DE\u05E6\u05D0 \u05DB\u05DA \u05D9\u05DB\u05D5\u05DC \u05DC\u05E9\u05DE\u05E9 \u05D0\u05EA \u05D4\u05E1\u05D5\u05DB\u05DF \u2014 \u05D2\u05DD \u05DC\u05E4\u05E2\u05D5\u05DC\u05D5\u05EA \u05E9\u05E2\u05D5\u05DC\u05D5\u05EA \u05DB\u05E1\u05E3 \u2014 \u05D1\u05DC\u05D9 \u05E9\u05D0\u05D9\u05E9\u05E8\u05EA \u05D0\u05D5\u05EA\u05D5.
31
31
  \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: \u05DC\u05D7\u05E4\u05E9 \u05D1\u05EA\u05D5\u05DA \u05D4\u05E4\u05E8\u05D5\u05D9\u05E7\u05D8, \u05D0\u05D5 nodata_run \u05E2\u05DD \u05D4\u05DE\u05E4\u05EA\u05D7\u05D5\u05EA \u05DE\u05D4\u05DB\u05E1\u05E4\u05EA (\u05DB\u05DC \u05E4\u05E7\u05D5\u05D3\u05D4 \u05DE\u05D0\u05D5\u05E9\u05E8\u05EA \u05DB\u05DE\u05D5 \u05E9\u05D4\u05D9\u05D0).`+(n?"":" \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData: this is ${a.why==="by_name"?"a search for a secret by name":"a search outside this project"}, over ${u}, where ${a.keyFiles} key file(s) (.env, logins) are. Whatever it finds enters the conversation, and a key found this way can be used by the agent \u2014 for paid calls too \u2014 without you approving it.