@oh-my-pi/pi-coding-agent 17.0.9 → 17.1.1

package/src/secrets/index.ts

@@ -1,9 +1,99 @@
+import * as crypto from "node:crypto";
+import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { isEnoent, logger } from "@oh-my-pi/pi-utils";
+import { getAgentDir, isEnoent, logger } from "@oh-my-pi/pi-utils";
 import { YAML } from "bun";
-import type { SecretEntry } from "./obfuscator";
+import { regexHasUnresolvableShortMatchFallback, type SecretEntry, sanitizeSecretFriendlyName } from "./obfuscator";
 import { compileSecretRegex } from "./regex";
 
+const PLACEHOLDER_KEY_RE = /^[A-Za-z0-9_-]{43}$/;
+const cachedPlaceholderKeys = new Map<string, string>();
+
+/**
+ * Per-install secret key for the placeholder digest. Persisted under the agent
+ * config directory and never sent to a provider, so model-visible placeholders
+ * cannot be reversed by dictionary-hashing candidate secrets. Stable across
+ * sessions so persisted transcripts deobfuscate consistently. Defaults to
+ * `getAgentDir()` — the same directory `createAgentSession()` passes as
+ * `agentDir` — so a caller relying on the default reads/writes the identical
+ * key file live sessions use, per `~/.omp/agent/secret-placeholder.key` in
+ * docs/secrets.md.
+ */
+export async function getSecretPlaceholderKey(keyDir: string = getAgentDir()): Promise<string> {
+	const keyPath = path.join(keyDir, "secret-placeholder.key");
+	const cached = cachedPlaceholderKeys.get(keyPath);
+	if (cached !== undefined) return cached;
+
+	const existing = await readPlaceholderKeyFile(keyPath, false);
+	if (existing !== undefined) {
+		cachedPlaceholderKeys.set(keyPath, existing);
+		return existing;
+	}
+
+	const generated = crypto.randomBytes(32).toString("base64url");
+	await fs.mkdir(keyDir, { recursive: true });
+	try {
+		await fs.writeFile(keyPath, generated, { flag: "wx", mode: 0o600 });
+		cachedPlaceholderKeys.set(keyPath, generated);
+		return generated;
+	} catch (err) {
+		if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err;
+		// Another process won the create race but may still be mid-write: `wx`
+		// creates the file empty before the bytes land. Wait for non-empty content
+		// instead of caching an empty key (which would be a known, dictionaryable
+		// key and would not match tokens other processes persist with the real key).
+		const winner = await readPlaceholderKeyFile(keyPath, true);
+		if (winner === undefined) {
+			throw new Error(`secret placeholder key at ${keyPath} exists but is empty or unreadable`);
+		}
+		cachedPlaceholderKeys.set(keyPath, winner);
+		return winner;
+	}
+}
+
+/** Return an existing placeholder key for redaction without creating a new key file. */
+export async function getExistingSecretPlaceholderKey(keyDir: string = getAgentDir()): Promise<string | undefined> {
+	const keyPath = path.join(keyDir, "secret-placeholder.key");
+	const cached = cachedPlaceholderKeys.get(keyPath);
+	if (cached !== undefined) return cached;
+	// Redaction-only: this key is loaded solely to redact an existing key file from
+	// provider-visible tool output, never to mint placeholders. A truncated/corrupt
+	// or unreadable key must NOT block startup for replace-only/no-secret sessions —
+	// an invalid key is not a usable HMAC anyway, and a tool reading the same file
+	// gets the same bytes, so there is nothing sensitive to redact.
+	let existing: string | undefined;
+	try {
+		existing = await readPlaceholderKeyFile(keyPath, true);
+	} catch {
+		return undefined;
+	}
+	if (existing !== undefined) cachedPlaceholderKeys.set(keyPath, existing);
+	return existing;
+}
+
+/** Read and validate the key file, optionally retrying briefly until a valid key lands. */
+async function readPlaceholderKeyFile(keyPath: string, retry: boolean): Promise<string | undefined> {
+	const attempts = retry ? 50 : 1;
+	let invalidValue: string | undefined;
+	for (let attempt = 0; attempt < attempts; attempt++) {
+		if (attempt > 0) await Bun.sleep(10);
+		try {
+			const value = (await Bun.file(keyPath).text()).trim();
+			if (PLACEHOLDER_KEY_RE.test(value)) return value;
+			if (value.length > 0) invalidValue = value;
+		} catch (err) {
+			if (isEnoent(err)) return undefined;
+			throw err;
+		}
+	}
+	if (invalidValue !== undefined) {
+		throw new Error(`secret placeholder key at ${keyPath} is invalid`);
+	}
+	return undefined;
+}
+
+type RawSecretEntry = Omit<SecretEntry, "friendlyName"> & { friendlyName?: unknown };
+
 export {
 	deobfuscateSessionContext,
 	deobfuscateToolArguments,
@@ -11,6 +101,8 @@ export {
 	obfuscateProviderContext,
 	type SecretEntry,
 	SecretObfuscator,
+	secretEntriesNeedPlaceholderKey,
+	secretEntryNeedsPlaceholderKey,
 } from "./obfuscator";
 
 /**
@@ -65,12 +157,14 @@ async function loadSecretsFile(filePath: string): Promise<SecretEntry[]> {
 		for (let i = 0; i < raw.length; i++) {
 			const entry = raw[i];
 			if (!validateEntry(entry, filePath, i)) continue;
+			const friendlyName = loadFriendlyName(entry, filePath, i);
 			entries.push({
 				type: entry.type,
 				content: entry.content,
 				mode: entry.mode ?? "obfuscate",
 				replacement: entry.replacement,
 				flags: entry.flags,
+				friendlyName,
 			});
 		}
 		return entries;
@@ -81,7 +175,27 @@ async function loadSecretsFile(filePath: string): Promise<SecretEntry[]> {
 	}
 }
 
-function validateEntry(entry: unknown, filePath: string, index: number): entry is SecretEntry {
+// Validates the friendlyName but returns it UNSANITIZED: `SecretObfuscator`'s
+// own `#createPlaceholder` sanitizes it again and, critically, needs the raw
+// string for `#friendlyNameCollidesWithSecret`'s regex-collision check — a
+// case-sensitive/punctuated regex pattern (e.g. `tok_[a-z0-9]+`) only matches
+// the label as it was actually written, not an already-uppercased,
+// separator-stripped rendering of it. Pre-sanitizing here would silently
+// defeat that check for every `secrets.yml`-loaded entry.
+function loadFriendlyName(entry: RawSecretEntry, filePath: string, index: number): string | undefined {
+	if (entry.friendlyName === undefined) return undefined;
+	if (typeof entry.friendlyName !== "string") {
+		logger.warn(`secrets.yml[${index}]: friendlyName must be a string`, { path: filePath });
+		return undefined;
+	}
+	if (sanitizeSecretFriendlyName(entry.friendlyName) === undefined) {
+		logger.warn(`secrets.yml[${index}]: friendlyName must contain at least one letter or digit`, { path: filePath });
+		return undefined;
+	}
+	return entry.friendlyName;
+}
+
+function validateEntry(entry: unknown, filePath: string, index: number): entry is RawSecretEntry {
 	if (entry === null || typeof entry !== "object") {
 		logger.warn(`secrets.yml[${index}]: entry must be an object`, { path: filePath });
 		return false;
@@ -108,8 +222,9 @@ function validateEntry(entry: unknown, filePath: string, index: number): entry i
 		return false;
 	}
 	if (e.type === "regex") {
+		let regex: RegExp;
 		try {
-			compileSecretRegex(e.content as string, e.flags as string | undefined);
+			regex = compileSecretRegex(e.content as string, e.flags as string | undefined);
 		} catch (error) {
 			logger.warn(`secrets.yml[${index}]: invalid regex pattern`, {
 				path: filePath,
@@ -118,6 +233,14 @@ function validateEntry(entry: unknown, filePath: string, index: number): entry i
 			});
 			return false;
 		}
+		const mode = (e.mode as "obfuscate" | "replace" | undefined) ?? "obfuscate";
+		if (mode === "replace" && e.replacement === undefined && regexHasUnresolvableShortMatchFallback(regex)) {
+			logger.warn(
+				`secrets.yml[${index}]: regex matches every 1-2 character candidate with no custom replacement, so a match can never be redacted distinctly from itself`,
+				{ path: filePath, pattern: e.content },
+			);
+			return false;
+		}
 	}
 	return true;
 }