@ornexus/neocortex 4.60.73 → 4.60.74

package/packages/client/dist/runner/project-identity.js

@@ -1,106 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * P197.01 -- shared client-local project identity derivation.
- */
-import { createHash } from 'node:crypto';
-import { isAbsolute, resolve } from 'node:path';
-export const PROJECT_IDENTITY_HASH_CHARS = 12;
-export const PROJECT_IDENTITY_LABEL_CHARS = 24;
-const FALLBACK_PROJECT_LABEL = 'project';
-const FALLBACK_WORKSPACE_LABEL = 'workspace';
-const SECRET_OR_PII_LOOKING_PATTERN = /(?:@|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|password|passwd|secret|token|api[_-]?key|license[_-]?key|private[_-]?key|credential|customer[_-]?pii|\bpii\b)/i;
-export function deriveProjectIdentity(projectRoot) {
-    const inputRoot = typeof projectRoot === 'string' ? projectRoot : '';
-    const absoluteRoot = safeAbsolutePath(inputRoot) ?? resolve(inputRoot || '.');
-    const normalizedRoot = normalizeIdentityRoot(absoluteRoot);
-    const labelRoot = normalizeIdentityRoot(inputRoot || '.');
-    const projectLabel = sanitizeIdentityLabel(basenameForIdentity(labelRoot), FALLBACK_PROJECT_LABEL);
-    const projectId = identityId(projectLabel, FALLBACK_PROJECT_LABEL, normalizedRoot);
-    const parentLabelSource = parentBasenameForIdentity(labelRoot);
-    const parentRoot = parentRootForIdentity(normalizedRoot);
-    const workspaceLabel = parentLabelSource
-        ? sanitizeIdentityLabel(parentLabelSource, FALLBACK_WORKSPACE_LABEL)
-        : projectLabel;
-    const workspaceId = parentLabelSource && parentRoot
-        ? identityId(workspaceLabel, FALLBACK_WORKSPACE_LABEL, parentRoot)
-        : projectId;
-    return {
-        projectId,
-        projectLabel,
-        workspaceId,
-        workspaceLabel,
-        publicSafe: true,
-    };
-}
-export function normalizeIdentityRoot(value) {
-    let normalized = value.replace(/\\/g, '/').replace(/\/+$/g, '');
-    if (!normalized)
-        normalized = '/';
-    normalized = normalized.replace(/^([A-Z]):\//, (_match, drive) => `${drive.toLowerCase()}:/`);
-    return normalized;
-}
-export function basenameForIdentity(normalizedRoot) {
-    const segments = identitySegments(normalizedRoot);
-    return segments[segments.length - 1] ?? FALLBACK_PROJECT_LABEL;
-}
-export function sanitizeProjectBasename(value) {
-    const normalized = value
-        .normalize('NFKD')
-        .replace(/[\u0300-\u036f]/g, '')
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '')
-        .slice(0, PROJECT_IDENTITY_LABEL_CHARS)
-        .replace(/-+$/g, '');
-    return normalized || FALLBACK_PROJECT_LABEL;
-}
-function identityId(label, fallback, normalizedRoot) {
-    const hash = shortIdentityHash(normalizedRoot);
-    const candidate = `${label}-${hash}`;
-    // A safe label such as "task" becomes "task-<hash>", which contains the
-    // secret-looking "sk-" substring. Screen the composed value as well as the
-    // label; retain the same path hash so the fallback stays deterministic.
-    return SECRET_OR_PII_LOOKING_PATTERN.test(candidate) ? `${fallback}-${hash}` : candidate;
-}
-function shortIdentityHash(value) {
-    return createHash('sha256').update(value).digest('hex').slice(0, PROJECT_IDENTITY_HASH_CHARS);
-}
-function sanitizeIdentityLabel(value, fallback) {
-    if (SECRET_OR_PII_LOOKING_PATTERN.test(value))
-        return fallback;
-    const label = sanitizeProjectBasename(value);
-    if (SECRET_OR_PII_LOOKING_PATTERN.test(label))
-        return fallback;
-    return label;
-}
-function parentBasenameForIdentity(normalizedRoot) {
-    const segments = identitySegments(normalizedRoot);
-    if (segments.length < 2)
-        return undefined;
-    const parent = segments[segments.length - 2];
-    if (/^[A-Za-z]:$/.test(parent))
-        return undefined;
-    return parent;
-}
-function parentRootForIdentity(normalizedRoot) {
-    const segments = identitySegments(normalizedRoot);
-    if (segments.length < 2)
-        return undefined;
-    if (/^[A-Za-z]:$/.test(segments[segments.length - 2] ?? ''))
-        return undefined;
-    const parentSegments = segments.slice(0, -1);
-    if (/^[A-Za-z]:$/.test(parentSegments[0] ?? ''))
-        return parentSegments.join('/');
-    return normalizedRoot.startsWith('/') ? `/${parentSegments.join('/')}` : parentSegments.join('/');
-}
-function identitySegments(normalizedRoot) {
-    return normalizedRoot.split('/').filter(Boolean);
-}
-function safeAbsolutePath(value) {
-    if (!value || /[\r\n\0]/.test(value))
-        return null;
-    const resolved = isAbsolute(value) ? value : resolve(value);
-    return isAbsolute(resolved) ? resolved : null;
-}
+import{createHash as h}from"node:crypto";import{isAbsolute as f,resolve as _}from"node:path";const R=12,y=24,s="project",A="workspace",a=/(?:@|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|password|passwd|secret|token|api[_-]?key|license[_-]?key|private[_-]?key|credential|customer[_-]?pii|\bpii\b)/i;function B(e){const t=typeof e=="string"?e:"",n=T(t)??_(t||"."),r=g(n),o=g(t||"."),i=I(z(o),s),p=m(i,s,r),c=$(o),l=C(r),d=c?I(c,A):i,L=c&&l?m(d,A,l):p;return{projectId:p,projectLabel:i,workspaceId:L,workspaceLabel:d,publicSafe:!0}}function g(e){let t=e.replace(/\\/g,"/").replace(/\/+$/g,"");return t||(t="/"),t=t.replace(/^([A-Z]):\//,(n,r)=>`${r.toLowerCase()}:/`),t}function z(e){const t=u(e);return t[t.length-1]??s}function b(e){return e.normalize("NFKD").replace(/[\u0300-\u036f]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,y).replace(/-+$/g,"")||s}function m(e,t,n){const r=E(n),o=`${e}-${r}`;return a.test(o)?`${t}-${r}`:o}function E(e){return h("sha256").update(e).digest("hex").slice(0,R)}function I(e,t){if(a.test(e))return t;const n=b(e);return a.test(n)?t:n}function $(e){const t=u(e);if(t.length<2)return;const n=t[t.length-2];if(!/^[A-Za-z]:$/.test(n))return n}function C(e){const t=u(e);if(t.length<2||/^[A-Za-z]:$/.test(t[t.length-2]??""))return;const n=t.slice(0,-1);return/^[A-Za-z]:$/.test(n[0]??"")?n.join("/"):e.startsWith("/")?`/${n.join("/")}`:n.join("/")}function u(e){return e.split("/").filter(Boolean)}function T(e){if(!e||/[\r\n\0]/.test(e))return null;const t=f(e)?e:_(e);return f(t)?t:null}export{R as PROJECT_IDENTITY_HASH_CHARS,y as PROJECT_IDENTITY_LABEL_CHARS,z as basenameForIdentity,B as deriveProjectIdentity,g as normalizeIdentityRoot,b as sanitizeProjectBasename};