@opengeni/core 6.7.0 → 6.7.1-canary.41759707569001

package/dist/domain/session-secret-redaction-matchers.d.ts

@@ -21,6 +21,10 @@ export declare function secretRedactionReferenceLabel(reference: Pick<SecretRefe
  * so a run with a one-character or all-blank "secret" can never rewrite
  * everything. Also null for a value holding marker-shaped text, which the
  * scrub could never find.
+ *
+ * A person asked for this value to be removed from stored history, so a
+ * weak value (a word, a host) is removed wherever it appears too, not only
+ * in credential positions as live masking does.
  */
 export declare function secretRedactionMatcherForValue(value: string, label: string): SecretRedactionMatcher | null;
 export declare function maskInPatternWindows(text: string, mask: (window: string) => string, windowChars?: number): string;

package/dist/domain/vaults/plain-field-hints.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The save-time nudge for plain fields (docs/secrets.md, Field kinds). A
+ * value that looks like a secret in a field that would be saved as `text`
+ * is saved as `concealed` when nobody chose the kind (a new field whose
+ * default is text), and kept as text with a note when `text` was asked for,
+ * the field already is text, or it is a standard text field of the item's
+ * type (a login's `username`). Only saves that report notes (the agent's
+ * `secret_save`) are nudged: without `notes` the kind is unchanged, so a
+ * kind never changes silently. Nothing here refuses a save.
+ */
+import { type SecretSaveFieldNote, type VaultFieldKind } from "@opengeni/contracts";
+export declare function plainFieldKind(input: {
+    name: string;
+    value: string;
+    kind: VaultFieldKind;
+    chosen: boolean;
+}, notes: SecretSaveFieldNote[] | undefined): VaultFieldKind;

package/dist/domain/vaults/provider-writes.d.ts

@@ -1,4 +1,4 @@
-import { type VaultFieldInput, type VaultFieldKind, type VaultItemType, type VaultProviderOperations } from "@opengeni/contracts";
+import { type SecretSaveFieldNote, type VaultFieldInput, type VaultFieldKind, type VaultItemType, type VaultProviderOperations } from "@opengeni/contracts";
 import { VaultError, type Database, type VaultDbContext, type VaultFieldRow, type VaultRow } from "@opengeni/db";
 import { type ProviderCallBudget, type VaultProvider, type VaultProviderRegistry } from "@opengeni/vaults";
 import { type ProviderVaultSyncResult } from "./provider-sync.js";
@@ -96,6 +96,8 @@ export declare function writeProviderVaultItemOutcome(deps: ProviderWriteDeps, i
     change: ProviderItemChange;
     /** Receives the names of fields whose values were generated. */
     generated?: string[];
+    /** Receives a note for each plain field whose value looks like a secret. */
+    fieldNotes?: SecretSaveFieldNote[];
 }): Promise<ProviderWriteOutcome>;
 /** Thrown when a confirmed provider write is not listed yet: it must not be saved again. */
 export declare function savedNotListedError(vault: VaultRow, itemName: string, outcome: Extract<ProviderWriteOutcome, {

package/dist/index.js

@@ -7537,6 +7537,7 @@ import {
   isDirectModelId,
   MESSAGE_TIME_ZONE_METADATA_KEY,
   messageSentByPerson,
+  ModelPolicyRefusedError,
   ModelUnavailableError,
   normalizeMessageTimeZone
 } from "@opengeni/contracts";
@@ -15952,8 +15953,10 @@ async function assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model
     chargesCredits: policyChargesCreditsForModel(settings, canonicalModel)
   });
   if (!verdict.allowed) {
+    const message = verdict.reason === "credits" ? `model "${canonicalModel}" uses credits, which are turned off in this workspace. Choose a model paid by a subscription or API key, or ask a workspace admin to turn credits back on` : verdict.reason === "provider" ? `model "${canonicalModel}" is not allowed by this workspace's model policy: provider "${providerId}" is not in the allowed providers` : `model "${canonicalModel}" is not allowed by this workspace's model policy`;
     throw new HTTPException24(422, {
-      message: verdict.reason === "credits" ? `model "${canonicalModel}" uses credits, which are turned off in this workspace. Choose a model paid by a subscription or API key, or ask a workspace admin to turn credits back on` : verdict.reason === "provider" ? `model "${canonicalModel}" is not allowed by this workspace's model policy: provider "${providerId}" is not in the allowed providers` : `model "${canonicalModel}" is not allowed by this workspace's model policy`
+      message,
+      cause: new ModelPolicyRefusedError(canonicalModel, verdict.reason, message)
     });
   }
 }
@@ -17125,7 +17128,10 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
         ...claudeProviderAccountAuthoritySnapshot ? { claudeAuthoritySnapshot: claudeProviderAccountAuthoritySnapshot } : {}
       });
       if (!admissibleWorkspaceModel(selections, model)) {
-        throw new HTTPException24(422, { message: `model is not selectable: ${model}` });
+        throw new HTTPException24(422, {
+          message: `model is not selectable: ${model}`,
+          cause: new ModelUnavailableError(model)
+        });
       }
     }
   });
@@ -19693,7 +19699,7 @@ function secretRedactionMatcherForValue(value, label) {
   if (containsSecretRedactionMarker(value)) return null;
   if (secretValueForms(value, { minChars: SECRET_VALUE_MASK_MIN_CHARS }).length === 0) return null;
   const marker = secretRedactionMarker(label);
-  const masks = compileSecretValueMasks([{ value, label: marker }]);
+  const masks = compileSecretValueMasks([{ value, label: marker }], { weakValues: "anywhere" });
   return { marker, redact: (text5) => maskSecretValuesInText(text5, masks) };
 }
 var GITHUB_TOKEN = /^(?:gh[pousr]_[A-Za-z0-9]{30,255}|github_pat_[A-Za-z0-9_]{30,255})$/u;
@@ -23774,6 +23780,32 @@ import {
   readProviderItemInventory as readProviderItemInventory2
 } from "@opengeni/vaults";
 
+// src/domain/vaults/plain-field-hints.ts
+import {
+  plainFieldSecretHint
+} from "@opengeni/contracts";
+function plainFieldKind(input, notes) {
+  if (notes === void 0 || input.kind !== "text") return input.kind;
+  const hint = plainFieldSecretHint(input.name, input.value);
+  if (!hint) return input.kind;
+  if (input.chosen) {
+    notes?.push({
+      field: input.name,
+      kind: "text",
+      reason: hint.reason,
+      message: `${hint.message} Kept as text; save it with kind "concealed" if it is a secret.`
+    });
+    return "text";
+  }
+  notes?.push({
+    field: input.name,
+    kind: "concealed",
+    reason: hint.reason,
+    message: `${hint.message} Saved as concealed; save it with kind "text" if it is not a secret.`
+  });
+  return "concealed";
+}
+
 // src/domain/vaults/typed-fields.ts
 import {
   VAULT_ITEM_TYPE_FIELDS,
@@ -24020,7 +24052,7 @@ function fileContent(input, current) {
   const name = input.fileName ?? current?.fileName ?? input.name;
   return { name, bytes };
 }
-async function providerFieldValues(planned, resolveReference, generated) {
+async function providerFieldValues(type, planned, resolveReference, generated, fieldNotes) {
   const writes = [];
   for (const { input, base, kind, current } of planned) {
     if (input.remove) {
@@ -24048,7 +24080,16 @@ async function providerFieldValues(planned, resolveReference, generated) {
       }
       value = value.trim();
     }
-    writes.push({ ...base, value });
+    const saved = plainFieldKind(
+      {
+        name: input.name,
+        value,
+        kind,
+        chosen: input.kind !== void 0 || current !== void 0 || standardFieldKind(type, input.name) === "text"
+      },
+      fieldNotes
+    );
+    writes.push({ ...base, kind: saved, value });
   }
   return writes;
 }
@@ -24173,7 +24214,13 @@ async function writeProviderVaultItemOutcome(deps, input) {
     ),
     existing?.fields ?? []
   );
-  const fields = await providerFieldValues(planned, deps.resolveReference, input.generated ?? []);
+  const fields = await providerFieldValues(
+    type,
+    planned,
+    deps.resolveReference,
+    input.generated ?? [],
+    input.fieldNotes
+  );
   const name = change.name ?? existing?.name ?? "";
   const category = change.category !== void 0 ? change.category : existing?.category ?? null;
   let written;
@@ -24610,7 +24657,7 @@ function defaultFieldKind(type, name) {
 }
 function createVaultService(deps) {
   const clock = deps.clock ?? systemSecretClock;
-  async function fieldWrite(input, existing, type, resolveReference, generated) {
+  async function fieldWrite(input, existing, type, resolveReference, generated, fieldNotes) {
     const current = existing?.fields.find(
       (field) => input.fieldId !== void 0 && field.id === input.fieldId || secretNameKey5(field.name) === secretNameKey5(input.name)
     );
@@ -24641,6 +24688,15 @@ function createVaultService(deps) {
       plaintext = input.value ?? "";
       size = utf8Size(plaintext);
     }
+    kind = plainFieldKind(
+      {
+        name: input.name,
+        value: plaintext,
+        kind,
+        chosen: input.kind !== void 0 || current !== void 0 || standardFieldKind(type, input.name) === "text"
+      },
+      fieldNotes
+    );
     if (kind === "totp") {
       if (!isValidTotpInput3(plaintext)) {
         throw new VaultError4(
@@ -24706,7 +24762,7 @@ function createVaultService(deps) {
     if (value.material.type === "bytes") return Buffer.from(value.material.value).toString("utf8");
     return totpCodeSync(value.material.params, clock.now());
   }
-  async function itemWrite(req, existing, resolveReference, createdBy, generated = []) {
+  async function itemWrite(req, existing, resolveReference, createdBy, generated = [], fieldNotes) {
     const write = { createdByKind: createdBy };
     if (req.name !== void 0) write.name = req.name;
     if (req.type !== void 0) write.type = req.type;
@@ -24719,7 +24775,9 @@ function createVaultService(deps) {
       const fields = await prepareTypedFields(type, req.fields, resolveReference, generated);
       write.fields = [];
       for (const field of fields) {
-        write.fields.push(await fieldWrite(field, existing, type, resolveReference, generated));
+        write.fields.push(
+          await fieldWrite(field, existing, type, resolveReference, generated, fieldNotes)
+        );
       }
     }
     return write;
@@ -25498,6 +25556,8 @@ function createVaultService(deps) {
         fields.unshift({ name: "username", kind: "text", value: input.username });
       }
       const generated = [];
+      const fieldNotes = [];
+      const notes = () => fieldNotes.length > 0 ? { fieldNotes } : {};
       if (vault.source !== "opengeni") {
         const itemId = await writeProviderVaultItem(
           {
@@ -25523,14 +25583,16 @@ function createVaultService(deps) {
               ...input.websites !== void 0 ? { websites: input.websites } : {},
               fields
             },
-            generated
+            generated,
+            fieldNotes
           }
         );
         const saved = await getVaultItem2(deps.db, context, { itemId });
         return {
           item: toVaultItemSummary(saved, key()),
           references: vaultItemReferences(saved),
-          generatedFields: generated
+          generatedFields: generated,
+          ...notes()
         };
       }
       const write = await itemWrite(
@@ -25543,7 +25605,8 @@ function createVaultService(deps) {
         fullExisting,
         (raw) => resolveTextReference(principal, raw, "secret_save"),
         "agent",
-        generated
+        generated,
+        fieldNotes
       );
       const row = await upsertVaultItem(
         deps.db,
@@ -25551,7 +25614,12 @@ function createVaultService(deps) {
         fullExisting ? { ...write, itemId: fullExisting.id } : { ...write, vaultId: vault.id, mode: "create" }
       );
       const summary = toVaultItemSummary(row, key());
-      return { item: summary, references: vaultItemReferences(row), generatedFields: generated };
+      return {
+        item: summary,
+        references: vaultItemReferences(row),
+        generatedFields: generated,
+        ...notes()
+      };
     },
     async captureForAgent(principal, input) {
       if (principal.kind !== "attempt") {