@open-mercato/cli 0.6.8-develop.6910.1.560e304de2 → 0.6.8-develop.6912.1.36161dc9ac

package/dist/agentic/shared/ai/skills/om-share-this-session/scripts/export-codex-session.mjs

@@ -0,0 +1,213 @@
+#!/usr/bin/env node
+
+import { spawn } from 'node:child_process'
+import {
+  closeSync,
+  existsSync,
+  lstatSync,
+  openSync,
+  realpathSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs'
+import { basename, dirname, resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+const MAX_PROTOCOL_BYTES = 25 * 1024 * 1024
+const MAX_EXPORT_BYTES = 20 * 1024 * 1024
+const THREAD_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+function fail(message) {
+  throw new Error(message)
+}
+
+function parseArguments(argumentsList) {
+  const allowed = new Set(['thread-id', 'out'])
+  const values = new Map()
+  for (let index = 0; index < argumentsList.length; index += 1) {
+    const argument = argumentsList[index]
+    if (!argument.startsWith('--')) fail('Every argument must use a named --flag.')
+    const key = argument.slice(2)
+    if (!allowed.has(key)) fail(`Unknown argument: --${key}`)
+    if (values.has(key)) fail(`Duplicate argument: --${key}`)
+    const value = argumentsList[index + 1]
+    if (!value || value.startsWith('--')) fail(`Missing value for --${key}.`)
+    values.set(key, value)
+    index += 1
+  }
+  for (const required of allowed) {
+    if (!values.has(required)) fail(`Missing required argument: --${required}.`)
+  }
+  return Object.fromEntries(values)
+}
+
+function validateThread(thread, expectedThreadId) {
+  if (!thread || typeof thread !== 'object' || Array.isArray(thread)) {
+    fail('Codex app-server returned no thread object.')
+  }
+  const returnedIds = [thread.id, thread.sessionId].filter((value) => typeof value === 'string')
+  if (!returnedIds.includes(expectedThreadId)) {
+    fail('Codex app-server returned a different thread than requested.')
+  }
+  if (!Array.isArray(thread.turns) || thread.turns.length === 0) {
+    fail('Codex app-server returned a thread without turns.')
+  }
+  return thread
+}
+
+function readThreadFromAppServer(threadId, timeoutMilliseconds = 30_000) {
+  return new Promise((resolveThread, rejectThread) => {
+    const server = spawn('codex', ['app-server', '--stdio'], {
+      stdio: ['pipe', 'pipe', 'ignore'],
+    })
+    let settled = false
+    let initialized = false
+    let protocolBytes = 0
+    let stdoutBuffer = ''
+
+    const settle = (error, thread) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timeout)
+      server.stdin.end()
+      if (server.exitCode === null && !server.killed) server.kill()
+      if (error) rejectThread(error)
+      else resolveThread(thread)
+    }
+
+    const send = (message) => {
+      if (!server.stdin.destroyed) server.stdin.write(`${JSON.stringify(message)}\n`)
+    }
+
+    const handleMessage = (line) => {
+      if (!line.trim()) return
+      let message
+      try {
+        message = JSON.parse(line)
+      } catch {
+        settle(new Error('Codex app-server returned malformed JSON.'))
+        return
+      }
+
+      if (message.id === 1) {
+        if (message.error || !message.result || initialized) {
+          settle(new Error('Codex app-server initialization failed.'))
+          return
+        }
+        initialized = true
+        send({ method: 'initialized', params: {} })
+        send({ id: 2, method: 'thread/read', params: { threadId, includeTurns: true } })
+        return
+      }
+
+      if (message.id === 2) {
+        if (message.error) {
+          settle(new Error('Codex app-server could not read the requested thread.'))
+          return
+        }
+        try {
+          settle(null, validateThread(message.result?.thread, threadId))
+        } catch (error) {
+          settle(error)
+        }
+      }
+    }
+
+    const timeout = setTimeout(() => {
+      settle(new Error('Timed out while reading the Codex thread.'))
+    }, timeoutMilliseconds)
+
+    server.on('error', () => {
+      settle(new Error('Could not start the Codex app-server.'))
+    })
+    server.stdin.on('error', () => {
+      if (!settled) settle(new Error('Codex app-server closed its input before returning the thread.'))
+    })
+    server.on('close', () => {
+      if (!settled) settle(new Error('Codex app-server exited before returning the thread.'))
+    })
+    server.stdout.setEncoding('utf8')
+    server.stdout.on('data', (chunk) => {
+      protocolBytes += Buffer.byteLength(chunk)
+      if (protocolBytes > MAX_PROTOCOL_BYTES) {
+        settle(new Error('Codex app-server response exceeds the allowed size.'))
+        return
+      }
+      stdoutBuffer += chunk
+      while (stdoutBuffer.includes('\n')) {
+        const newlineIndex = stdoutBuffer.indexOf('\n')
+        const line = stdoutBuffer.slice(0, newlineIndex)
+        stdoutBuffer = stdoutBuffer.slice(newlineIndex + 1)
+        handleMessage(line)
+        if (settled) return
+      }
+    })
+
+    send({
+      id: 1,
+      method: 'initialize',
+      params: {
+        clientInfo: { name: 'om-share-this-session', version: '1.0.0' },
+        capabilities: { experimentalApi: true },
+      },
+    })
+  })
+}
+
+function writeExport(outputPath, thread) {
+  const serialized = `${JSON.stringify(thread, null, 2)}\n`
+  if (Buffer.byteLength(serialized) > MAX_EXPORT_BYTES) {
+    fail('Codex thread export exceeds the allowed size.')
+  }
+  const descriptor = openSync(outputPath, 'wx', 0o600)
+  let complete = false
+  try {
+    writeFileSync(descriptor, serialized, 'utf8')
+    complete = true
+  } finally {
+    closeSync(descriptor)
+    if (!complete && existsSync(outputPath)) unlinkSync(outputPath)
+  }
+}
+
+export async function exportCodexSession({ threadId, outputPath }) {
+  if (!THREAD_ID_PATTERN.test(threadId)) fail('Codex thread ID must be a UUID.')
+  const resolvedOutputPath = resolve(outputPath)
+  if (basename(resolvedOutputPath) === '.' || existsSync(resolvedOutputPath)) {
+    fail('Output path already exists; use a new temporary file.')
+  }
+  const outputParent = dirname(resolvedOutputPath)
+  let parentStat
+  try {
+    parentStat = lstatSync(outputParent)
+    realpathSync(outputParent)
+  } catch {
+    fail('Output parent must be an existing real directory.')
+  }
+  if (!parentStat.isDirectory() || parentStat.isSymbolicLink()) {
+    fail('Output parent must be an existing real directory.')
+  }
+
+  const thread = await readThreadFromAppServer(threadId)
+  writeExport(resolvedOutputPath, thread)
+  return { turns: thread.turns.length }
+}
+
+async function main() {
+  const argumentsMap = parseArguments(process.argv.slice(2))
+  const result = await exportCodexSession({
+    threadId: argumentsMap['thread-id'],
+    outputPath: argumentsMap.out,
+  })
+  process.stdout.write(`${JSON.stringify({ status: 'exported', turns: result.turns })}\n`)
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    await main()
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Unknown Codex session-export failure.'
+    process.stderr.write(`Codex session was not exported: ${message}\n`)
+    process.exitCode = 1
+  }
+}

package/dist/agentic/shared/ai/skills/om-share-this-session/scripts/prepare-share-bundle.mjs

@@ -161,14 +161,17 @@ function sanitizeString(input, key, state) {
   value = replaceMatches(value, /\b(Authorization\s*:\s*)[^\s,;]+/gi, (_match, prefix) => `${prefix}«redacted:authorization»`, state, 'secrets')
   value = replaceMatches(value, /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s@]+@/gi, (_match, prefix) => `${prefix}«redacted:credential»@`, state, 'secrets')
   value = replaceMatches(value, /\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|password|passwd|secret|client[_-]?secret)\s*[:=]\s*)[^\s,;"']+/gi, (_match, prefix) => `${prefix}«redacted:secret»`, state, 'secrets')
-  value = redactHighEntropy(value, state)
+  if (key !== 'generated-file-path') value = redactHighEntropy(value, state)
 
   value = replaceMatches(value, /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, '«redacted:email»', state, 'pii')
   value = replaceMatches(value, /\b(?:\d{1,3}\.){3}\d{1,3}\b/g, '«redacted:ip»', state, 'pii')
   value = replaceMatches(value, /\b(?:[A-F0-9]{1,4}:){2,7}[A-F0-9]{1,4}\b/gi, '«redacted:ip»', state, 'pii')
   value = replaceMatches(value, /\b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/gi, '«redacted:identifier»', state, 'identifiers')
   value = replaceMatches(value, /\b[0-9a-f]{64,}\b/gi, '«redacted:hex-secret»', state, 'secrets')
-  value = value.replace(/\+?\d[\d ()-]{7,}\d/g, (candidate) => {
+  const phonePattern = key === 'generated-file-path'
+    ? /(?<![A-Za-z0-9_])\+?\d[\d ()-]{7,}\d(?![A-Za-z0-9_])/g
+    : /\+?\d[\d ()-]{7,}\d/g
+  value = value.replace(phonePattern, (candidate) => {
     const digits = candidate.replace(/\D/g, '')
     if (digits.length < 9 || digits.length > 15) return candidate
     countReplacement(state, 'pii')
@@ -183,6 +186,10 @@ function sanitizeNode(value, key, state) {
   if (Array.isArray(value)) return value.map((item) => sanitizeNode(item, '', state))
   if (!value || typeof value !== 'object') return value
 
+  const redactsBrowserTabListing = value.type === 'mcpToolCall'
+    && typeof value.arguments?.code === 'string'
+    && /\.user\.openTabs\s*\(/.test(value.arguments.code)
+
   for (const [candidateKey, candidateValue] of Object.entries(value)) {
     if (pathKeyPattern.test(candidateKey) && typeof candidateValue === 'string' && isDangerousPath(candidateValue)) {
       countReplacement(state, 'dangerous')
@@ -194,6 +201,11 @@ function sanitizeNode(value, key, state) {
   for (const [childKey, childValue] of Object.entries(value)) {
     const sanitizedKey = sanitizeString(childKey, 'object-key', state)
     if (Object.hasOwn(output, sanitizedKey)) fail('Sanitization produced duplicate object keys.')
+    if (redactsBrowserTabListing && childKey === 'result') {
+      countReplacement(state, 'pii')
+      output[sanitizedKey] = { redacted: 'browser-tab-list' }
+      continue
+    }
     output[sanitizedKey] = sanitizeNode(childValue, childKey, state)
   }
   return output
@@ -203,10 +215,19 @@ function inferRole(value) {
   if (!value || typeof value !== 'object') return null
   for (const candidate of [value.type, value.role, value.message?.role]) {
     if (candidate === 'user' || candidate === 'assistant') return candidate
+    if (candidate === 'userMessage') return 'user'
+    if (candidate === 'agentMessage') return 'assistant'
   }
   return null
 }
 
+function inferRoles(value) {
+  const directRole = inferRole(value)
+  if (directRole) return [directRole]
+  if (!value || typeof value !== 'object' || !Array.isArray(value.items)) return []
+  return [...new Set(value.items.map(inferRole).filter(Boolean))]
+}
+
 function analyzeSession(session) {
   let entries
   let collectionName
@@ -224,7 +245,7 @@ function analyzeSession(session) {
   }
   if (!entries) fail('Session JSON has no recognizable turn/event collection.')
 
-  const roles = entries.map(inferRole).filter(Boolean)
+  const roles = entries.flatMap(inferRoles)
   const userTurns = roles.filter((role) => role === 'user').length
   const assistantTurns = roles.filter((role) => role === 'assistant').length
   if (userTurns === 0 || assistantTurns === 0) {

package/dist/mercato.js

@@ -2,7 +2,7 @@ import { registerWorkerShutdownHook, runWorker } from "@open-mercato/queue/worke
 import { getCliModules, hasCliModules, registerCliModules } from "./registry.js";
 import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
 import { getSslConfig } from "@open-mercato/shared/lib/db/ssl";
-import { getRedisUrl, getRedisUrlOrThrow } from "@open-mercato/shared/lib/redis/connection";
+import { getRedisUrl, getRedisUrlOrThrow, REDIS_WIRE_PROTOCOL } from "@open-mercato/shared/lib/redis/connection";
 import { resolveInitDerivedSecrets } from "./lib/init-secrets.js";
 import {
   resolveAutoSpawnWorkersMode,
@@ -764,7 +764,8 @@ async function run(argv = process.argv) {
             connectTimeout: 3e3,
             maxRetriesPerRequest: 1,
             retryStrategy: () => null,
-            enableOfflineQueue: false
+            enableOfflineQueue: false,
+            protocol: REDIS_WIRE_PROTOCOL
           });
           redis.on("error", () => {
           });