@oked/scan 0.0.0-stage → 0.6.25

package/dist/read.js

@@ -0,0 +1,370 @@
+import { createReadStream, readdirSync, statSync } from "node:fs";
+import { createInterface } from "node:readline";
+import { basename, dirname, join } from "node:path";
+import { argvToShell } from "./redact.js";
+import { SHELL_TOOL_NAMES } from "./rules.js";
+const CODEX_LINE_TYPES = new Set(["session_meta", "response_item", "turn_context", "event_msg"]);
+const CLAUDE_LINE_TYPES = new Set([
+    "assistant",
+    "user",
+    "summary",
+    "system",
+    "attachment",
+    "progress",
+    "file-history-snapshot",
+]);
+function isDir(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function isFile(path) {
+    try {
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function walkFiles(dir, accept) {
+    const out = [];
+    const stack = [dir];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (!current)
+            break;
+        let entries;
+        try {
+            entries = readdirSync(current, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (entry.isSymbolicLink())
+                continue;
+            const path = join(current, entry.name);
+            if (entry.isDirectory())
+                stack.push(path);
+            else if (entry.isFile() && accept(entry.name))
+                out.push(path);
+        }
+    }
+    return out;
+}
+function parseTime(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return value < 1e12 ? value * 1000 : value;
+    if (typeof value === "string" && value.trim()) {
+        const parsed = Date.parse(value);
+        return Number.isFinite(parsed) ? parsed : null;
+    }
+    return null;
+}
+function timestampString(value) {
+    const ms = parseTime(value);
+    if (ms === null)
+        return null;
+    return new Date(ms).toISOString();
+}
+function inWindow(timestamp, sinceMs, nowMs) {
+    if (sinceMs === null)
+        return true;
+    if (timestamp === null)
+        return true;
+    const ms = Date.parse(timestamp);
+    if (!Number.isFinite(ms))
+        return true;
+    return ms >= nowMs - sinceMs;
+}
+async function readJsonl(file, onRecord) {
+    const stream = createReadStream(file, { encoding: "utf8" });
+    const lines = createInterface({ input: stream, crlfDelay: Infinity });
+    let bad = 0;
+    let lineNo = 0;
+    try {
+        for await (const line of lines) {
+            lineNo += 1;
+            const trimmed = line.replace(/^\uFEFF/, "").trim();
+            if (!trimmed)
+                continue;
+            try {
+                onRecord(JSON.parse(trimmed), lineNo);
+            }
+            catch {
+                bad += 1;
+            }
+        }
+    }
+    finally {
+        lines.close();
+    }
+    return bad;
+}
+function asObject(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    return value;
+}
+function parseJsonObject(value) {
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        if (!trimmed.startsWith("{"))
+            return null;
+        try {
+            return asObject(JSON.parse(trimmed));
+        }
+        catch {
+            return null;
+        }
+    }
+    return asObject(value);
+}
+function commandFromFields(record) {
+    const raw = record.command ?? record.cmd;
+    if (typeof raw === "string" && raw.trim())
+        return raw;
+    if (Array.isArray(raw) && raw.length > 0 && raw.every((part) => typeof part === "string")) {
+        const command = argvToShell(raw);
+        return command.trim() ? command : null;
+    }
+    return null;
+}
+function locate(root) {
+    const claudeDir = join(root, ".claude", "projects");
+    const codexDir = join(root, ".codex", "sessions");
+    const claudePresent = isDir(claudeDir);
+    const codexPresent = isDir(codexDir);
+    if (claudePresent || codexPresent) {
+        return { claudeDir, codexDir, claudePresent, codexPresent, sniff: false };
+    }
+    if (basename(root) === "projects" && basename(dirname(root)) === ".claude" && isDir(root)) {
+        return { claudeDir: root, codexDir, claudePresent: true, codexPresent: false, sniff: false };
+    }
+    if (basename(root) === "sessions" && isDir(root)) {
+        return { claudeDir, codexDir: root, claudePresent: false, codexPresent: true, sniff: false };
+    }
+    return { claudeDir, codexDir, claudePresent: false, codexPresent: false, sniff: true };
+}
+function hostFromText(text) {
+    const lines = text.split(/\n/).slice(0, 40);
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            const value = asObject(JSON.parse(trimmed));
+            const type = typeof value?.type === "string" ? value.type : "";
+            if (CODEX_LINE_TYPES.has(type))
+                return "codex";
+            if (CLAUDE_LINE_TYPES.has(type))
+                return "claude-code";
+        }
+        catch {
+            // Keep scanning. A bad first line does not decide the file.
+        }
+    }
+    return null;
+}
+async function sniffHostAsync(file) {
+    const stream = createReadStream(file, { encoding: "utf8", start: 0, end: 65535 });
+    let text = "";
+    try {
+        for await (const chunk of stream)
+            text += chunk;
+    }
+    catch {
+        return null;
+    }
+    return hostFromText(text);
+}
+function contentBlocks(message) {
+    const content = message.content;
+    if (Array.isArray(content)) {
+        return content.filter((block) => block && typeof block === "object");
+    }
+    const one = asObject(content);
+    return one ? [one] : [];
+}
+function claudeCommandsFrom(value, file, lineNo) {
+    const entry = asObject(value);
+    if (!entry)
+        return [];
+    const type = typeof entry.type === "string" ? entry.type : "";
+    const message = asObject(entry.message);
+    const role = typeof message?.role === "string" ? message.role : "";
+    if (type !== "assistant" && role !== "assistant" && type !== "tool_use")
+        return [];
+    const timestamp = timestampString(entry.timestamp);
+    const blocks = [];
+    if (type === "tool_use")
+        blocks.push(entry);
+    if (message)
+        blocks.push(...contentBlocks(message));
+    const found = [];
+    for (const block of blocks) {
+        if (block.type !== "tool_use")
+            continue;
+        if (block.name !== "Bash")
+            continue;
+        const input = parseJsonObject(block.input) ?? {};
+        const command = commandFromFields(input);
+        if (!command)
+            continue;
+        const toolId = typeof block.id === "string" && block.id ? block.id : `${file}:${lineNo}:${found.length}`;
+        found.push({
+            host: "claude-code",
+            command,
+            timestamp,
+            id: `claude:${toolId}`,
+        });
+    }
+    return found;
+}
+function codexCommandFrom(value, file, lineNo) {
+    const entry = asObject(value);
+    if (!entry)
+        return null;
+    const payload = asObject(entry.payload) ?? entry;
+    const payloadType = typeof payload.type === "string" ? payload.type : "";
+    const lineType = typeof entry.type === "string" ? entry.type : "";
+    let name = "";
+    let fields = null;
+    let callId = "";
+    if (lineType === "response_item" && payloadType === "function_call") {
+        name = typeof payload.name === "string" ? payload.name : "";
+        fields = parseJsonObject(payload.arguments);
+        callId = typeof payload.call_id === "string" ? payload.call_id : "";
+    }
+    else if (lineType === "response_item" && payloadType === "local_shell_call") {
+        name = "local_shell";
+        const action = asObject(payload.action);
+        fields = action;
+        callId = typeof payload.call_id === "string" ? payload.call_id : "";
+    }
+    else if (lineType === "event_msg" && (payloadType === "exec_command_begin" || payloadType === "exec_start")) {
+        name = "exec_command";
+        fields = payload;
+        callId = typeof payload.call_id === "string" ? payload.call_id : "";
+    }
+    else {
+        return null;
+    }
+    if (!SHELL_TOOL_NAMES.has(name) || !fields)
+        return null;
+    const command = commandFromFields(fields);
+    if (!command)
+        return null;
+    const timestamp = timestampString(entry.timestamp ?? payload.timestamp);
+    const id = callId ? `codex:${callId}` : `codex:${file}:${lineNo}`;
+    return { host: "codex", command, timestamp, id };
+}
+function pushUnique(target, seen, command, sinceMs, nowMs) {
+    if (!inWindow(command.timestamp, sinceMs, nowMs))
+        return;
+    if (seen.has(command.id))
+        return;
+    seen.add(command.id);
+    target.push(command);
+}
+async function readClaudeFile(file, target, seen, sinceMs, nowMs) {
+    const pending = [];
+    const bad = await readJsonl(file, (value, lineNo) => {
+        for (const command of claudeCommandsFrom(value, file, lineNo))
+            pending.push(command);
+    });
+    for (const command of pending)
+        pushUnique(target, seen, command, sinceMs, nowMs);
+    return { bad };
+}
+async function readCodexFile(file, target, seen, sinceMs, nowMs) {
+    const pending = [];
+    const bad = await readJsonl(file, (value, lineNo) => {
+        const command = codexCommandFrom(value, file, lineNo);
+        if (command)
+            pending.push(command);
+    });
+    for (const command of pending)
+        pushUnique(target, seen, command, sinceMs, nowMs);
+    return { bad };
+}
+export async function collectCommands(options) {
+    const located = locate(options.root);
+    const seen = new Set();
+    const commands = [];
+    let badLines = 0;
+    let unreadableFiles = 0;
+    let claudeFiles = 0;
+    let codexFiles = 0;
+    const take = async (file, host) => {
+        const before = commands.length;
+        try {
+            const result = host === "claude-code"
+                ? await readClaudeFile(file, commands, seen, options.sinceMs, options.nowMs)
+                : await readCodexFile(file, commands, seen, options.sinceMs, options.nowMs);
+            badLines += result.bad;
+            if (host === "claude-code")
+                claudeFiles += 1;
+            else
+                codexFiles += 1;
+        }
+        catch {
+            commands.length = before;
+            unreadableFiles += 1;
+        }
+    };
+    if (located.claudePresent) {
+        for (const file of walkFiles(located.claudeDir, (name) => name.endsWith(".jsonl"))) {
+            await take(file, "claude-code");
+        }
+    }
+    if (located.codexPresent) {
+        for (const file of walkFiles(located.codexDir, (name) => name.startsWith("rollout-") && name.endsWith(".jsonl"))) {
+            await take(file, "codex");
+        }
+    }
+    if (located.sniff && options.explicitRoot) {
+        const files = isFile(options.root)
+            ? options.root.endsWith(".jsonl")
+                ? [options.root]
+                : []
+            : isDir(options.root)
+                ? walkFiles(options.root, (name) => name.endsWith(".jsonl"))
+                : [];
+        for (const file of files) {
+            const host = await sniffHostAsync(file);
+            if (host)
+                await take(file, host);
+        }
+        if (files.length > 0) {
+            if (claudeFiles > 0)
+                located.claudePresent = true;
+            if (codexFiles > 0)
+                located.codexPresent = true;
+        }
+    }
+    const claudeCommands = commands.filter((command) => command.host === "claude-code").length;
+    const codexCommands = commands.filter((command) => command.host === "codex").length;
+    return {
+        commands,
+        badLines,
+        unreadableFiles,
+        hosts: {
+            "claude-code": {
+                directory: located.claudePresent && located.sniff ? options.root : located.claudeDir,
+                present: located.claudePresent,
+                files: claudeFiles,
+                commands: claudeCommands,
+            },
+            codex: {
+                directory: located.codexPresent && located.sniff ? options.root : located.codexDir,
+                present: located.codexPresent,
+                files: codexFiles,
+                commands: codexCommands,
+            },
+        },
+    };
+}

package/dist/redact.d.ts

@@ -0,0 +1,20 @@
+/** Display length for one command in the report. */
+export declare const COMMAND_DISPLAY_MAX = 120;
+/**
+ * Replace secrets-looking tokens with `[redacted]`.
+ * The command text is kept so the report still shows what would have paused.
+ */
+export declare function redactSecrets(command: string): string;
+/** Show a home directory as `~` so a pasted report does not include the account name. */
+export declare function replaceHome(command: string, home?: string): string;
+export declare function displayPath(path: string, home?: string): string;
+/** Redact, then truncate. Redaction runs on the full string so a cut cannot leave a token prefix. */
+export declare function displayCommand(command: string, home?: string): string;
+/** Quote one argv element the way a shell would, so `classify()` sees the same words. */
+export declare function quoteArg(value: string): string;
+/**
+ * Turn a Codex argv into one shell string.
+ * A single element is already the command (it may contain spaces).
+ * Several elements are argv: `["bash","-lc","rm -rf /var"]` becomes `bash -lc 'rm -rf /var'`.
+ */
+export declare function argvToShell(argv: readonly string[]): string;

package/dist/redact.js

@@ -0,0 +1,69 @@
+import { homedir } from "node:os";
+/** Display length for one command in the report. */
+export const COMMAND_DISPLAY_MAX = 120;
+const TOKEN_PATTERNS = [
+    /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+    /\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+    /\bglpat-[A-Za-z0-9_-]{20,}/g,
+    /\bnpm_[A-Za-z0-9]{20,}/g,
+    /\bsk-ant-[A-Za-z0-9_-]{10,}/g,
+    /\bsk-[A-Za-z0-9]{20,}/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\bASIA[0-9A-Z]{16}\b/g,
+    /\bxox[baprs]-[A-Za-z0-9-]{10,}/g,
+    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+];
+/**
+ * Replace secrets-looking tokens with `[redacted]`.
+ * The command text is kept so the report still shows what would have paused.
+ */
+export function redactSecrets(command) {
+    let out = command;
+    out = out.replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi, "Bearer [redacted]");
+    // Greedy userinfo so a password that itself contains @ is still covered.
+    // `https://example.com/a@b` has no userinfo: the host cannot include a slash.
+    out = out.replace(/([a-z][a-z0-9+.-]*:\/\/)([^/\s]+)@/gi, "$1[redacted]@");
+    for (const pattern of TOKEN_PATTERNS)
+        out = out.replace(pattern, "[redacted]");
+    out = out.replace(/(^|[\s;|&])((?:[A-Za-z_][A-Za-z0-9_]*?)(?:key|token|secret|password|passwd|credential)[A-Za-z0-9_]*)=(?:"[^"]*"|'[^']*'|[^\s]+)/gi, "$1$2=[redacted]");
+    out = out.replace(/(^|\s)(--(?:password|token|api-key|api_key|secret|auth|authorization))(?:=|\s+)(?:"[^"]*"|'[^']*'|[^\s]+)/gi, "$1$2 [redacted]");
+    return out;
+}
+/** Show a home directory as `~` so a pasted report does not include the account name. */
+export function replaceHome(command, home = homedir()) {
+    if (!home || home === "/" || !command.includes(home))
+        return command;
+    return command.split(home).join("~");
+}
+export function displayPath(path, home = homedir()) {
+    if (!home || home === "/" || !path.startsWith(home))
+        return path;
+    const rest = path.slice(home.length);
+    if (!rest)
+        return "~";
+    return rest.startsWith("/") ? `~${rest}` : `~/${rest}`;
+}
+/** Redact, then truncate. Redaction runs on the full string so a cut cannot leave a token prefix. */
+export function displayCommand(command, home = homedir()) {
+    const redacted = redactSecrets(replaceHome(command, home));
+    if (redacted.length <= COMMAND_DISPLAY_MAX)
+        return redacted;
+    return `${redacted.slice(0, COMMAND_DISPLAY_MAX - 3)}...`;
+}
+/** Quote one argv element the way a shell would, so `classify()` sees the same words. */
+export function quoteArg(value) {
+    if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(value))
+        return value;
+    return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+/**
+ * Turn a Codex argv into one shell string.
+ * A single element is already the command (it may contain spaces).
+ * Several elements are argv: `["bash","-lc","rm -rf /var"]` becomes `bash -lc 'rm -rf /var'`.
+ */
+export function argvToShell(argv) {
+    if (argv.length === 1)
+        return argv[0];
+    return argv.map(quoteArg).join(" ");
+}

package/dist/report.d.ts

@@ -0,0 +1,84 @@
+import type { RiskTier } from "@oked/sdk";
+import { type Host } from "./rules.js";
+export declare function tierLabel(tier: RiskTier): string;
+export declare function categoryLabel(category: string): string;
+export declare class ScanUsageError extends Error {
+    constructor(message: string);
+}
+export interface CommandRow {
+    host: Host;
+    tier: RiskTier;
+    /** Plain words for `tier`. `--json` keeps `tier` as the machine name. */
+    tierLabel: string;
+    category: string;
+    /** Plain words for `category`. `--json` keeps `category` as the machine name. */
+    categoryLabel: string;
+    /** Redacted and truncated. Safe to paste. */
+    command: string;
+    paused: boolean;
+    /**
+     * True when Claude Code would ask only because the Bash sandbox is off.
+     * Test runners and scripts. Kept out of the closing paused count.
+     */
+    routine: boolean;
+    timestamp: string | null;
+}
+export interface RiskyGroup {
+    host: Host;
+    tier: RiskTier;
+    tierLabel: string;
+    category: string;
+    categoryLabel: string;
+    command: string;
+    count: number;
+}
+export interface HostSummary {
+    directory: string;
+    present: boolean;
+    files: number;
+    commands: number;
+}
+export interface ScanReport {
+    version: string;
+    classifier: string;
+    localOnly: true;
+    network: false;
+    telemetry: false;
+    generatedAt: string;
+    sinceDays: number | null;
+    hosts: Record<Host, HostSummary>;
+    totals: {
+        commands: number;
+        paused: number;
+        byTier: Record<RiskTier, number>;
+        byCategory: Record<string, number>;
+    };
+    pausedByCategory: Record<string, number>;
+    topRisky: RiskyGroup[];
+    /** Every classified command, redacted. Grouped duplicates are listed once in `topRisky`. */
+    commands: CommandRow[];
+    badLines: number;
+    unreadableFiles: number;
+    notes: string[];
+    /** Shell command that installs the host hook for the history that was found. */
+    next: string;
+}
+export interface ScanOptions {
+    /** Home directory, or a transcript root when `explicitRoot` is set. Defaults to the user home. */
+    root?: string;
+    explicitRoot?: boolean;
+    /** Only commands timestamped within this many days. Undated commands stay. */
+    sinceDays?: number;
+    now?: Date;
+    home?: string;
+}
+export interface FormatReportOptions {
+    /** Print the classification notes. The default text report leaves them out. */
+    verbose?: boolean;
+}
+export declare function nextStep(hosts: {
+    claude: boolean;
+    codex: boolean;
+}): string;
+export declare function formatReport(report: ScanReport, options?: FormatReportOptions): string;
+export declare function scan(options?: ScanOptions): Promise<ScanReport>;