@ornexus/neocortex 4.60.72 → 4.60.73

package/packages/client/dist/runner/project-identity.js

@@ -1 +1,106 @@
-import{createHash as h}from"node:crypto";import{isAbsolute as f,resolve as _}from"node:path";const R=12,y=24,s="project",A="workspace",a=/(?:@|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|password|passwd|secret|token|api[_-]?key|license[_-]?key|private[_-]?key|credential|customer[_-]?pii|\bpii\b)/i;function B(e){const t=typeof e=="string"?e:"",n=T(t)??_(t||"."),r=g(n),o=g(t||"."),i=I(z(o),s),p=m(i,s,r),c=$(o),l=C(r),d=c?I(c,A):i,L=c&&l?m(d,A,l):p;return{projectId:p,projectLabel:i,workspaceId:L,workspaceLabel:d,publicSafe:!0}}function g(e){let t=e.replace(/\\/g,"/").replace(/\/+$/g,"");return t||(t="/"),t=t.replace(/^([A-Z]):\//,(n,r)=>`${r.toLowerCase()}:/`),t}function z(e){const t=u(e);return t[t.length-1]??s}function b(e){return e.normalize("NFKD").replace(/[\u0300-\u036f]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,y).replace(/-+$/g,"")||s}function m(e,t,n){const r=E(n),o=`${e}-${r}`;return a.test(o)?`${t}-${r}`:o}function E(e){return h("sha256").update(e).digest("hex").slice(0,R)}function I(e,t){if(a.test(e))return t;const n=b(e);return a.test(n)?t:n}function $(e){const t=u(e);if(t.length<2)return;const n=t[t.length-2];if(!/^[A-Za-z]:$/.test(n))return n}function C(e){const t=u(e);if(t.length<2||/^[A-Za-z]:$/.test(t[t.length-2]??""))return;const n=t.slice(0,-1);return/^[A-Za-z]:$/.test(n[0]??"")?n.join("/"):e.startsWith("/")?`/${n.join("/")}`:n.join("/")}function u(e){return e.split("/").filter(Boolean)}function T(e){if(!e||/[\r\n\0]/.test(e))return null;const t=f(e)?e:_(e);return f(t)?t:null}export{R as PROJECT_IDENTITY_HASH_CHARS,y as PROJECT_IDENTITY_LABEL_CHARS,z as basenameForIdentity,B as deriveProjectIdentity,g as normalizeIdentityRoot,b as sanitizeProjectBasename};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * P197.01 -- shared client-local project identity derivation.
+ */
+import { createHash } from 'node:crypto';
+import { isAbsolute, resolve } from 'node:path';
+export const PROJECT_IDENTITY_HASH_CHARS = 12;
+export const PROJECT_IDENTITY_LABEL_CHARS = 24;
+const FALLBACK_PROJECT_LABEL = 'project';
+const FALLBACK_WORKSPACE_LABEL = 'workspace';
+const SECRET_OR_PII_LOOKING_PATTERN = /(?:@|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|password|passwd|secret|token|api[_-]?key|license[_-]?key|private[_-]?key|credential|customer[_-]?pii|\bpii\b)/i;
+export function deriveProjectIdentity(projectRoot) {
+    const inputRoot = typeof projectRoot === 'string' ? projectRoot : '';
+    const absoluteRoot = safeAbsolutePath(inputRoot) ?? resolve(inputRoot || '.');
+    const normalizedRoot = normalizeIdentityRoot(absoluteRoot);
+    const labelRoot = normalizeIdentityRoot(inputRoot || '.');
+    const projectLabel = sanitizeIdentityLabel(basenameForIdentity(labelRoot), FALLBACK_PROJECT_LABEL);
+    const projectId = identityId(projectLabel, FALLBACK_PROJECT_LABEL, normalizedRoot);
+    const parentLabelSource = parentBasenameForIdentity(labelRoot);
+    const parentRoot = parentRootForIdentity(normalizedRoot);
+    const workspaceLabel = parentLabelSource
+        ? sanitizeIdentityLabel(parentLabelSource, FALLBACK_WORKSPACE_LABEL)
+        : projectLabel;
+    const workspaceId = parentLabelSource && parentRoot
+        ? identityId(workspaceLabel, FALLBACK_WORKSPACE_LABEL, parentRoot)
+        : projectId;
+    return {
+        projectId,
+        projectLabel,
+        workspaceId,
+        workspaceLabel,
+        publicSafe: true,
+    };
+}
+export function normalizeIdentityRoot(value) {
+    let normalized = value.replace(/\\/g, '/').replace(/\/+$/g, '');
+    if (!normalized)
+        normalized = '/';
+    normalized = normalized.replace(/^([A-Z]):\//, (_match, drive) => `${drive.toLowerCase()}:/`);
+    return normalized;
+}
+export function basenameForIdentity(normalizedRoot) {
+    const segments = identitySegments(normalizedRoot);
+    return segments[segments.length - 1] ?? FALLBACK_PROJECT_LABEL;
+}
+export function sanitizeProjectBasename(value) {
+    const normalized = value
+        .normalize('NFKD')
+        .replace(/[\u0300-\u036f]/g, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, PROJECT_IDENTITY_LABEL_CHARS)
+        .replace(/-+$/g, '');
+    return normalized || FALLBACK_PROJECT_LABEL;
+}
+function identityId(label, fallback, normalizedRoot) {
+    const hash = shortIdentityHash(normalizedRoot);
+    const candidate = `${label}-${hash}`;
+    // A safe label such as "task" becomes "task-<hash>", which contains the
+    // secret-looking "sk-" substring. Screen the composed value as well as the
+    // label; retain the same path hash so the fallback stays deterministic.
+    return SECRET_OR_PII_LOOKING_PATTERN.test(candidate) ? `${fallback}-${hash}` : candidate;
+}
+function shortIdentityHash(value) {
+    return createHash('sha256').update(value).digest('hex').slice(0, PROJECT_IDENTITY_HASH_CHARS);
+}
+function sanitizeIdentityLabel(value, fallback) {
+    if (SECRET_OR_PII_LOOKING_PATTERN.test(value))
+        return fallback;
+    const label = sanitizeProjectBasename(value);
+    if (SECRET_OR_PII_LOOKING_PATTERN.test(label))
+        return fallback;
+    return label;
+}
+function parentBasenameForIdentity(normalizedRoot) {
+    const segments = identitySegments(normalizedRoot);
+    if (segments.length < 2)
+        return undefined;
+    const parent = segments[segments.length - 2];
+    if (/^[A-Za-z]:$/.test(parent))
+        return undefined;
+    return parent;
+}
+function parentRootForIdentity(normalizedRoot) {
+    const segments = identitySegments(normalizedRoot);
+    if (segments.length < 2)
+        return undefined;
+    if (/^[A-Za-z]:$/.test(segments[segments.length - 2] ?? ''))
+        return undefined;
+    const parentSegments = segments.slice(0, -1);
+    if (/^[A-Za-z]:$/.test(parentSegments[0] ?? ''))
+        return parentSegments.join('/');
+    return normalizedRoot.startsWith('/') ? `/${parentSegments.join('/')}` : parentSegments.join('/');
+}
+function identitySegments(normalizedRoot) {
+    return normalizedRoot.split('/').filter(Boolean);
+}
+function safeAbsolutePath(value) {
+    if (!value || /[\r\n\0]/.test(value))
+        return null;
+    const resolved = isAbsolute(value) ? value : resolve(value);
+    return isAbsolute(resolved) ? resolved : null;
+}