@oh-my-pi/pi-coding-agent 17.2.1 → 17.2.2

package/src/secrets/index.ts

@@ -1,6 +1,7 @@
 import * as crypto from "node:crypto";
-import * as fs from "node:fs/promises";
+import * as fs from "node:fs";
 import * as path from "node:path";
+import { SENSITIVE_TOKEN_RE } from "@oh-my-pi/pi-ai/providers/transform-messages";
 import { getAgentDir, isEnoent, logger } from "@oh-my-pi/pi-utils";
 import { YAML } from "bun";
 import { regexHasUnresolvableShortMatchFallback, type SecretEntry, sanitizeSecretFriendlyName } from "./obfuscator";
@@ -31,9 +32,9 @@ export async function getSecretPlaceholderKey(keyDir: string = getAgentDir()): P
 	}
 
 	const generated = crypto.randomBytes(32).toString("base64url");
-	await fs.mkdir(keyDir, { recursive: true });
+	await fs.promises.mkdir(keyDir, { recursive: true });
 	try {
-		await fs.writeFile(keyPath, generated, { flag: "wx", mode: 0o600 });
+		await fs.promises.writeFile(keyPath, generated, { flag: "wx", mode: 0o600 });
 		cachedPlaceholderKeys.set(keyPath, generated);
 		return generated;
 	} catch (err) {
@@ -71,6 +72,60 @@ export async function getExistingSecretPlaceholderKey(keyDir: string = getAgentD
 	return existing;
 }
 
+// Process-stable fallback for the sync lazy path when the key file cannot be
+// persisted (e.g. unwritable config root on a headless run). Memoized so
+// re-obfuscation within the process stays idempotent; placeholders simply lose
+// cross-session stability, matching `defaultPlaceholderKey()` in obfuscator.ts.
+let ephemeralSyncPlaceholderKey: string | undefined;
+
+/**
+ * Synchronous variant of `getSecretPlaceholderKey` for the lazy key provider
+ * `SecretObfuscator` invokes inside its synchronous `obfuscate()` path when a
+ * built-in credential-pattern entry first matches session content. Never
+ * throws: an unreadable or unwritable key file degrades to a process-ephemeral
+ * key (with a warning) instead of breaking the session.
+ */
+export function getSecretPlaceholderKeySync(keyDir: string = getAgentDir()): string {
+	const keyPath = path.join(keyDir, "secret-placeholder.key");
+	const cached = cachedPlaceholderKeys.get(keyPath);
+	if (cached !== undefined) return cached;
+	try {
+		const existing = fs.readFileSync(keyPath, "utf8").trim();
+		if (PLACEHOLDER_KEY_RE.test(existing)) {
+			cachedPlaceholderKeys.set(keyPath, existing);
+			return existing;
+		}
+	} catch {
+		// Missing or unreadable — attempt creation below.
+	}
+	const generated = crypto.randomBytes(32).toString("base64url");
+	try {
+		fs.mkdirSync(keyDir, { recursive: true });
+		fs.writeFileSync(keyPath, generated, { flag: "wx", mode: 0o600 });
+		cachedPlaceholderKeys.set(keyPath, generated);
+		return generated;
+	} catch (err) {
+		if ((err as NodeJS.ErrnoException).code === "EEXIST") {
+			// Another process won the create race; accept its key if valid.
+			try {
+				const winner = fs.readFileSync(keyPath, "utf8").trim();
+				if (PLACEHOLDER_KEY_RE.test(winner)) {
+					cachedPlaceholderKeys.set(keyPath, winner);
+					return winner;
+				}
+			} catch {
+				// Fall through to the ephemeral key.
+			}
+		}
+		logger.warn("Could not persist secret placeholder key, using a process-ephemeral key", {
+			path: keyPath,
+			error: String(err),
+		});
+		ephemeralSyncPlaceholderKey ??= crypto.randomBytes(32).toString("base64url");
+		return ephemeralSyncPlaceholderKey;
+	}
+}
+
 /** Read and validate the key file, optionally retrying briefly until a valid key lands. */
 async function readPlaceholderKeyFile(keyPath: string, retry: boolean): Promise<string | undefined> {
 	const attempts = retry ? 50 : 1;
@@ -145,6 +200,31 @@ export function collectEnvSecrets(): SecretEntry[] {
 	return entries;
 }
 
+/**
+ * Built-in entries covering credential-shaped tokens (GitHub/GitLab/OpenAI-style
+ * API keys) that are NOT configured via secrets.yml or the environment. Without
+ * these, such a token in a tool result falls through to pi-ai's irreversible
+ * provider-boundary redaction (`[openai_token_redacted]`); the model then echoes
+ * that placeholder into edit-tool `old_text`, which can never match the real
+ * bytes on disk (issue #6968). Routing the same shapes through the obfuscator
+ * mints reversible keyed placeholders that `deobfuscateToolArguments` restores
+ * before tool execution, keeping exact-match edits working while the credential
+ * bytes still never reach the provider. Unlike the pi-ai redaction there is no
+ * entropy gate here — a false positive only over-obfuscates, which stays
+ * transparent because the round trip is lossless.
+ */
+export function builtinCredentialSecretEntries(): SecretEntry[] {
+	return [
+		{
+			type: "regex",
+			content: SENSITIVE_TOKEN_RE.source,
+			flags: "i",
+			mode: "obfuscate",
+			friendlyName: "Credential",
+		},
+	];
+}
+
 async function loadSecretsFile(filePath: string): Promise<SecretEntry[]> {
 	try {
 		const text = await Bun.file(filePath).text();

package/src/secrets/obfuscator.ts

@@ -594,18 +594,22 @@ export class SecretObfuscator {
 	/** Whether any secrets were configured */
 	#hasAny: boolean;
 
-	/** Private per-install (or per-process) key for the keyed placeholder digest. */
-	readonly #key: string;
+	/**
+	 * Private per-install (or per-process) key for the keyed placeholder digest.
+	 * Resolved lazily when the constructor received a key PROVIDER: the first
+	 * placeholder mint or keyed fallback marker triggers resolution, so callers
+	 * can defer persisting `secret-placeholder.key` until a dynamic regex entry
+	 * actually matches session content.
+	 */
+	#key: string | undefined;
+	#keyProvider: (() => string) | undefined;
 
-	constructor(entries: SecretEntry[], key: string = defaultPlaceholderKey()) {
-		this.#key = key;
-		// The keyed-hash key makes obfuscate-mode placeholder bases un-dictionaryable,
-		// but it can be persisted in a user-readable file (`secret-placeholder.key`).
-		// A prompt-injected tool read (read/bash) could otherwise surface it to the
-		// provider verbatim and undo that protection, so redact the key itself from
-		// obfuscated (provider-visible) output as a one-way secret.
-		this.#replaceMappings.set(key, this.#generateSecretReplacement(key));
-		this.#configuredSecretValues.add(key);
+	constructor(entries: SecretEntry[], key: string | (() => string) = defaultPlaceholderKey()) {
+		if (typeof key === "function") {
+			this.#keyProvider = key;
+		} else {
+			this.#setPlaceholderKey(key);
+		}
 		// Collect every configured plain-secret literal AND compile every regex
 		// entry BEFORE minting any placeholder below, so a placeholder's friendly
 		// name (checked against both in `#createPlaceholder`) can never embed a
@@ -671,6 +675,44 @@ export class SecretObfuscator {
 		this.#hasAny = hasRealSec;
 	}
 
+	/**
+	 * The keyed-hash key makes obfuscate-mode placeholder bases un-dictionaryable,
+	 * but it can be persisted in a user-readable file (`secret-placeholder.key`).
+	 * A prompt-injected tool read (read/bash) could otherwise surface it to the
+	 * provider verbatim and undo that protection, so redact the key itself from
+	 * obfuscated (provider-visible) output as a one-way secret.
+	 */
+	#setPlaceholderKey(key: string): void {
+		this.#key = key;
+		this.#replaceMappings.set(key, this.#generateSecretReplacement(key));
+		this.#configuredSecretValues.add(key);
+	}
+
+	/** Resolve the placeholder key once, minting its self-redaction on first use. */
+	#getKey(): string {
+		let key = this.#key;
+		if (key === undefined) {
+			key = this.#keyProvider?.() ?? defaultPlaceholderKey();
+			this.#keyProvider = undefined;
+			this.#setPlaceholderKey(key);
+		}
+		return key;
+	}
+
+	/** Whether this pass will mint a keyed placeholder from a regex match. */
+	#willMintRegexPlaceholder(secretValues: ReadonlySet<string>): boolean {
+		for (const entry of this.#regexEntries) {
+			if (entry.mode !== "obfuscate") continue;
+			for (const value of secretValues) {
+				entry.regex.lastIndex = 0;
+				const matches = entry.regex.test(value);
+				entry.regex.lastIndex = 0;
+				if (matches) return true;
+			}
+		}
+		return false;
+	}
+
 	hasSecrets(): boolean {
 		return this.#hasAny;
 	}
@@ -682,6 +724,13 @@ export class SecretObfuscator {
 		for (const secretValue of sharedRegexSecretValues ?? []) {
 			this.#currentRegexSecretValues.add(secretValue);
 		}
+		// Resolve a lazy key before the replace phase whenever this pass will mint
+		// a regex placeholder. The key registers itself as a replace-mode secret;
+		// resolving it later, while processing the regex match, would expose key
+		// bytes already present in this same provider-visible input.
+		if (this.#keyProvider !== undefined && this.#willMintRegexPlaceholder(this.#currentRegexSecretValues)) {
+			this.#getKey();
+		}
 		let result = text;
 		// `origin` runs parallel to `result` (one tag char per result char): "I" for
 		// bytes carried from the INPUT (placeholders from a PRIOR obfuscate() call)
@@ -937,7 +986,9 @@ export class SecretObfuscator {
 		// remainder bytes that merely look sentinel-shaped (e.g. `ZZZZ`) cannot equal
 		// the marker and are still redacted instead of passed through.
 		const replacement =
-			chunk.length <= 2 ? "Z".repeat(chunk.length) : `ZZ${buildKeyedReplacementRun(this.#key, chunk.length - 2)}`;
+			chunk.length <= 2
+				? "Z".repeat(chunk.length)
+				: `ZZ${buildKeyedReplacementRun(this.#getKey(), chunk.length - 2)}`;
 		this.#generatedReplaceChunks.add(replacement);
 		return replacement;
 	}
@@ -1023,7 +1074,9 @@ export class SecretObfuscator {
 			// the ordinary keyed-run fallback #generateReplacement already uses.
 			replacement =
 				stable ??
-				(value.length <= 2 ? buildKeyedReplacementRun(this.#key, value.length) : this.#generateReplacement(value));
+				(value.length <= 2
+					? buildKeyedReplacementRun(this.#getKey(), value.length)
+					: this.#generateReplacement(value));
 			regex.lastIndex = 0;
 		}
 		this.#generatedReplaceChunks.add(replacement);
@@ -1183,7 +1236,9 @@ export class SecretObfuscator {
 
 		for (let attempt = 0; ; attempt++) {
 			const base =
-				attempt === 0 ? buildHashBase(this.#key, baseKey) : buildHashBase(this.#key, `${baseKey}\0${attempt}`);
+				attempt === 0
+					? buildHashBase(this.#getKey(), baseKey)
+					: buildHashBase(this.#getKey(), `${baseKey}\0${attempt}`);
 			const owner = this.#placeholderBaseOwners.get(base);
 			if (owner !== undefined && owner !== baseKey) continue;
 			this.#placeholderBaseOwners.set(base, baseKey);
@@ -1195,7 +1250,7 @@ export class SecretObfuscator {
 	#reserveFallbackPlaceholderBase(baseKey: string, startAttempt: number): string {
 		for (let attempt = startAttempt; ; attempt++) {
 			const owner = `${baseKey}\0collision\0${attempt}`;
-			const base = buildHashBase(this.#key, `${baseKey}\0collision\0${attempt}`);
+			const base = buildHashBase(this.#getKey(), `${baseKey}\0collision\0${attempt}`);
 			if (this.#placeholderBaseOwners.has(base)) continue;
 			this.#placeholderBaseOwners.set(base, owner);
 			return base;

package/src/session/agent-session-types.ts

@@ -35,6 +35,7 @@ import type { FileSlashCommand } from "../extensibility/slash-commands";
 import type { SecretObfuscator } from "../secrets/obfuscator";
 import type { ConfiguredThinkingLevel } from "../thinking";
 import type { XdevState } from "../tools/xdev";
+import type { CodexAutoRedeemCoordinator } from "./codex-auto-reset";
 import type { SessionManager } from "./session-manager";
 
 /** Maximum time the interactive shutdown path waits for Mnemopi consolidation. */
@@ -173,6 +174,8 @@ export interface AgentSessionConfig {
 	initialAdvisorCosts?: ReadonlyMap<string, number>;
 	/** Prefer websocket transport for OpenAI Codex requests when supported. */
 	preferWebsockets?: boolean;
+	/** Codex saved-reset coordinator; defaults to the process-wide singleton so concurrent sessions can't double-spend. Inject a fresh one in tests. */
+	codexResetCoordinator?: CodexAutoRedeemCoordinator;
 	/** Provider payload hook used by the active session request path. */
 	onPayload?: SimpleStreamOptions["onPayload"];
 	/** Provider response hook used by the active session request path. */
@@ -184,7 +187,10 @@ export interface AgentSessionConfig {
 	/** Current session message-to-LLM conversion pipeline. */
 	convertToLlm?: (messages: AgentMessage[]) => Message[] | Promise<Message[]>;
 	/** System prompt builder that can consider tool availability. */
-	rebuildSystemPrompt?: (toolNames: string[], tools: Map<string, AgentTool>) => Promise<{ systemPrompt: string[] }>;
+	rebuildSystemPrompt?: (
+		toolNames: string[],
+		tools: Map<string, AgentTool>,
+	) => Promise<{ systemPrompt: string[]; xdevCatalogNames?: readonly string[] }>;
 	/** Local calendar date provider used by prompt-cache invalidation. */
 	getLocalCalendarDate?: () => string;
 	/** Tools mounted under `xd://`, for `/tools` display. */