@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.5

package/node_modules/@oscharko-dev/keiko-server/dist/local-knowledge-handlers.js

@@ -1,12 +1,12 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { statSync } from "node:fs";
 import { basename, dirname } from "node:path";
 import { addSourceToCapsule, composeCapsules, CompositionError, createSqliteAuditSink, createDefaultParserRegistry, createCapsule, deleteCapsule, getCapsule, listCapsuleSets, listCapsuleSources, listCapsules, openKnowledgeStore, removeSourceFromCapsule, resolveKnowledgeStorePath, runIndexingJob, updateCapsuleDetails, updateCapsuleState, } from "@oscharko-dev/keiko-local-knowledge";
 import { KnowledgeNotFoundError, KnowledgeStoreError } from "@oscharko-dev/keiko-local-knowledge";
-import { CAPSULE_SET_MAX_MEMBERS, validateKnowledgeSourceScope, } from "@oscharko-dev/keiko-contracts";
+import { CAPSULE_SET_MAX_MEMBERS, isSafeDisplaySummary, validateCapsuleReindexRequest, validateKnowledgeSourceScope, } from "@oscharko-dev/keiko-contracts";
 import { currentGatewayConfig } from "./deps.js";
 import { errorBody } from "./routes.js";
-import { findConfiguredCapability, requestOpenAIEmbedding, } from "@oscharko-dev/keiko-model-gateway";
+import { findConfiguredCapability, requestOpenAIEmbedding, verifyEmbeddingCapability, } from "@oscharko-dev/keiko-model-gateway";
 import { nodeWorkspaceFs } from "@oscharko-dev/keiko-workspace/internal/fs";
 import { isDenied } from "@oscharko-dev/keiko-workspace";
 import { localKnowledgeIndexingRegistry } from "./local-knowledge-indexing-registry.js";
@@ -15,6 +15,7 @@ const MAX_BODY_BYTES = 32_000;
 // thousands of parser diagnostics / job rows cannot inflate a single JSON response.
 const MAX_DIAGNOSTICS_PER_RESPONSE = 500;
 const MAX_JOBS_PER_RESPONSE = 500;
+const LOCAL_KNOWLEDGE_STORE_UNAVAILABLE_MESSAGE = "Local knowledge storage is unavailable. Check the local runtime state and try again.";
 class InvalidRequest extends Error {
     constructor(message) {
         super(message);
@@ -208,7 +209,12 @@ function configuredEmbeddingProvider(config, modelId) {
     return isConfiguredEmbeddingModel(config, provider.modelId) ? provider : undefined;
 }
 function configuredProviderForCapsule(deps, capsule) {
-    return configuredEmbeddingProvider(currentGatewayConfig(deps), capsule.embeddingModelIdentity.modelId);
+    const provider = configuredEmbeddingProvider(currentGatewayConfig(deps), capsule.embeddingModelIdentity.modelId);
+    if (provider === undefined)
+        return undefined;
+    return storedProviderMatchesConfiguredProvider(capsule.embeddingModelIdentity.provider, provider)
+        ? provider
+        : undefined;
 }
 function embeddingCompatibilityReason(config, capsule) {
     if (config === undefined)
@@ -217,9 +223,13 @@ function embeddingCompatibilityReason(config, capsule) {
     if (!config.providers.some((entry) => entry.modelId === modelId)) {
         return "The configured embedding model no longer matches this capsule.";
     }
-    if (configuredEmbeddingProvider(config, modelId) === undefined) {
+    const provider = configuredEmbeddingProvider(config, modelId);
+    if (provider === undefined) {
         return "The configured model for this capsule cannot serve embeddings.";
     }
+    if (!storedProviderMatchesConfiguredProvider(capsule.embeddingModelIdentity.provider, provider)) {
+        return "The configured embedding gateway no longer matches this capsule.";
+    }
     return undefined;
 }
 function vectorCompatibility(deps, capsule) {
@@ -243,14 +253,15 @@ function vectorCompatibility(deps, capsule) {
 function loadSourceStats(store, capsuleId) {
     const rows = store._internal.db
         .prepare([
-        "SELECT s.id AS source_id, s.display_name, s.scope_kind, s.scope_json,",
+        "SELECT s.id AS source_id, ks.display_name, ks.scope_kind, ks.scope_json,",
         "  SUM(CASE WHEN d.status = 'extracted' THEN 1 ELSE 0 END) AS indexed_count,",
         "  SUM(CASE WHEN d.status = 'failed' THEN 1 ELSE 0 END) AS failed_count,",
         "  SUM(CASE WHEN d.status IN ('skipped', 'unsupported') THEN 1 ELSE 0 END) AS skipped_count",
         "FROM capsule_sources AS s",
+        "JOIN knowledge_sources AS ks ON ks.id = s.id",
         "LEFT JOIN documents AS d ON d.capsule_id = s.capsule_id AND d.source_id = s.id",
         "WHERE s.capsule_id = :c",
-        "GROUP BY s.id, s.display_name, s.scope_kind, s.scope_json",
+        "GROUP BY s.id, ks.display_name, ks.scope_kind, ks.scope_json",
         "ORDER BY s.created_at ASC, s.id ASC",
     ].join(" "))
         .all({ c: capsuleId });
@@ -407,6 +418,7 @@ function buildCapsuleHealth(deps, store, dbPath, capsule) {
     const unsupportedGuidance = unsupportedDocuments > 0 ? loadUnsupportedGuidance(store, capsule.id) : [];
     return {
         capsuleId: capsule.id,
+        sourceIds: capsule.sourceIds,
         lifecycleState: capsule.lifecycleState,
         storageSizeBytes: storageSizeBytes(dbPath),
         documentCount,
@@ -466,9 +478,24 @@ function canonicalizeCapsuleSourceRoots(store, capsule) {
     const now = store._internal.now();
     for (const source of listCapsuleSources(store, capsule.id)) {
         const canonicalScope = canonicalizeScopeRoot(source.scope);
+        // Re-validate the deny-list against the canonical (realpath-resolved) root at index time,
+        // not only at connect time. A folder that was safe when connected can later be moved or
+        // symlink-swapped so its realpath resolves into a denied location (e.g. ~/.ssh); refuse to
+        // index it rather than walking credential files inside it. Runs for every source, including
+        // already-canonical ones, so it must precede the no-op skip below.
+        if (isDenied(connectScopeRootPath(canonicalScope))) {
+            throw new InvalidRequest("Source path is in a denied location and cannot be indexed.");
+        }
         if (JSON.stringify(canonicalScope) === JSON.stringify(source.scope)) {
             continue;
         }
+        store._internal.db
+            .prepare("UPDATE knowledge_sources SET scope_json = :scope_json, updated_at = :updated_at WHERE id = :id")
+            .run({
+            scope_json: scopeToJson(canonicalScope),
+            updated_at: now,
+            id: source.id,
+        });
         store._internal.db
             .prepare("UPDATE capsule_sources SET scope_json = :scope_json, updated_at = :updated_at WHERE capsule_id = :c AND id = :id")
             .run({
@@ -518,60 +545,51 @@ function parseCapsuleId(ctx) {
     }
     return capsuleId;
 }
-function parseReindexMode(body) {
-    const mode = body.mode;
-    if (mode === undefined || mode === "changed-files" || mode === "repair-failed") {
-        return mode;
+function requireSafeDisplayText(field, value) {
+    const trimmed = value.trim();
+    if (trimmed.length === 0 || !isSafeDisplaySummary(trimmed)) {
+        throw new InvalidRequest(`Field "${field}" must be a browser-safe non-empty string.`);
     }
-    throw new InvalidRequest('Field "mode" must be "changed-files" or "repair-failed".');
+    return trimmed;
 }
-// O2-GAP-1 (Epic #189): reindex callers can opt into a forced re-embed. Plumbed
-// through to runIndexingJob so a capsule whose embedding model rotated can be
-// rebuilt without manual store surgery.
-function parseReindexForce(body) {
-    const force = body.force;
-    if (force === undefined)
-        return false;
-    if (typeof force !== "boolean") {
-        throw new InvalidRequest('Field "force" must be a boolean when provided.');
+function safeOptionalDisplayText(field, value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new InvalidRequest(`Field "${field}" must be a string when provided.`);
+    }
+    const trimmed = value.trim();
+    if (trimmed.length === 0) {
+        return undefined;
+    }
+    if (!isSafeDisplaySummary(trimmed)) {
+        throw new InvalidRequest(`Field "${field}" must be browser-safe when provided.`);
     }
-    return force;
+    return trimmed;
 }
 function parseCreateCapsuleInput(body) {
-    const displayName = typeof body.displayName === "string" ? body.displayName.trim() : undefined;
-    if (displayName === undefined || displayName.length === 0) {
+    if (typeof body.displayName !== "string") {
         throw new InvalidRequest('Field "displayName" must be a non-empty string.');
     }
-    const descriptionRaw = body.description;
-    if (descriptionRaw === undefined) {
-        return { displayName };
-    }
-    if (typeof descriptionRaw !== "string") {
-        throw new InvalidRequest('Field "description" must be a string when provided.');
-    }
-    const description = descriptionRaw.trim();
-    return description.length === 0 ? { displayName } : { displayName, description };
-}
-// Issue #621: derive native vector dimensions from the embedding model id rather than
-// hardcoding 1536, which is wrong for text-embedding-3-large (native: 3072).
-function derivedVectorDimensions(modelId) {
-    const lower = modelId.toLowerCase();
-    if (lower.includes("text-embedding-3-large"))
-        return 3072;
-    if (lower.includes("text-embedding-3-small"))
-        return 1536;
-    if (lower.includes("text-embedding-ada-002"))
-        return 1536;
-    // Conservative default for unknown embedding models.
-    return 1536;
-}
-function defaultEmbeddingIdentity(modelId) {
-    return {
-        provider: "openai",
-        modelId,
-        vectorDimensions: derivedVectorDimensions(modelId),
-        vectorMetric: "cosine",
-    };
+    const displayName = requireSafeDisplayText("displayName", body.displayName);
+    const description = safeOptionalDisplayText("description", body.description);
+    return description === undefined ? { displayName } : { displayName, description };
+}
+function normalizedEndpointFingerprint(baseUrl) {
+    const normalized = baseUrl.trim().replace(/\/+$/, "");
+    return createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+}
+function embeddingProviderIdentity(provider) {
+    return `openai-compatible:${normalizedEndpointFingerprint(provider.baseUrl)}`;
+}
+function storedProviderMatchesConfiguredProvider(storedProvider, provider) {
+    // Legacy capsules created before #192 audit fixes stored the generic "openai" label.
+    // Keep those usable; new capsules store a non-secret endpoint fingerprint so future
+    // gateway swaps mark them incompatible instead of mixing unrelated vector spaces.
+    if (!storedProvider.startsWith("openai-compatible:"))
+        return true;
+    return storedProvider === embeddingProviderIdentity(provider);
 }
 // Issue #621 / #677: select the first provider whose resolved capability is embedding-capable.
 // Falling back to a chat model creates capsules that can never index successfully.
@@ -584,6 +602,45 @@ export function selectEmbeddingModelId(config) {
 function createCapsuleStorageReference(capsuleId) {
     return `capsules/${capsuleId}`;
 }
+async function verifiedNewCapsuleEmbeddingIdentity(deps, provider) {
+    const adapter = createEmbeddingAdapter(provider, requestEmbeddingImpl(deps));
+    try {
+        const result = await verifyEmbeddingCapability(adapter, {
+            modelId: provider.modelId,
+            provider: embeddingProviderIdentity(provider),
+            vectorMetric: "cosine",
+            timeoutMs: provider.timeoutMs,
+        });
+        if (result.ok) {
+            return { ok: true, identity: result.identity };
+        }
+        return { ok: false, result: conflict(result.safeMessage) };
+    }
+    catch {
+        return {
+            ok: false,
+            result: conflict("embedding capability preflight failed before capsule creation"),
+        };
+    }
+}
+async function resolveNewCapsuleEmbeddingIdentity(deps) {
+    const config = currentGatewayConfig(deps);
+    const configuredModelId = selectEmbeddingModelId(config);
+    if (configuredModelId === undefined) {
+        return {
+            ok: false,
+            result: conflict("No configured embedding-capable model is available for new capsules. Configure the Model Gateway first."),
+        };
+    }
+    const provider = configuredEmbeddingProvider(config, configuredModelId);
+    if (provider === undefined) {
+        return {
+            ok: false,
+            result: conflict("No configured embedding-capable model is available for new capsules. Configure the Model Gateway first."),
+        };
+    }
+    return verifiedNewCapsuleEmbeddingIdentity(deps, provider);
+}
 function latestRunningJobId(store, capsuleId) {
     const row = store._internal.db
         .prepare([
@@ -625,6 +682,13 @@ function disconnectCapsuleSources(store, capsuleId) {
     }
     updateCapsuleState(store, capsuleId, "draft");
 }
+function resolveIndexingSourceSelection(store, capsule, mode) {
+    if (mode !== "repair-failed") {
+        return { shouldRun: true };
+    }
+    const sourceIds = failedSourceIds(store, capsule.id);
+    return sourceIds.length === 0 ? { shouldRun: false } : { shouldRun: true, sourceIds };
+}
 // LK-001 (Epic #189): both the start and refresh handlers map a terminal IndexingTerminal
 // to the same 3-way response — cancelled → 409 cancelled, failed → 409 failed-message,
 // any other (completed or absent) → 200 ok. Extracted so each handler stays under the
@@ -645,13 +709,16 @@ async function runCapsuleIndexingJob(deps, store, capsule, options) {
     }
     canonicalizeCapsuleSourceRoots(store, capsule);
     const adapter = createEmbeddingAdapter(provider, requestEmbeddingImpl(deps));
-    const sourceIds = options.mode === "repair-failed" ? failedSourceIds(store, capsule.id) : undefined;
+    const sourceSelection = resolveIndexingSourceSelection(store, capsule, options.mode);
+    if (!sourceSelection.shouldRun) {
+        return undefined;
+    }
     const controller = localKnowledgeIndexingRegistry.start(String(capsule.id));
     let terminal;
     try {
         for await (const event of runIndexingJob({
             capsuleId: capsule.id,
-            ...(sourceIds !== undefined ? { sourceIds } : {}),
+            ...(sourceSelection.sourceIds !== undefined ? { sourceIds: sourceSelection.sourceIds } : {}),
             parserRegistry: createDefaultParserRegistry(),
             workspaceFs: nodeWorkspaceFs,
             embeddingAdapter: adapter,
@@ -704,7 +771,7 @@ async function runHandler(worker) {
             return notFound(error.message);
         }
         if (error instanceof KnowledgeStoreError) {
-            return serviceUnavailable(error.message);
+            return serviceUnavailable(LOCAL_KNOWLEDGE_STORE_UNAVAILABLE_MESSAGE);
         }
         throw error;
     }
@@ -767,14 +834,12 @@ function parseSetCapsuleIds(raw) {
     return capsuleIds;
 }
 function parseCreateCapsuleSetInput(body) {
-    const displayName = typeof body.displayName === "string" ? body.displayName.trim() : "";
-    if (displayName.length === 0) {
+    if (typeof body.displayName !== "string") {
         throw new InvalidRequest('Field "displayName" must be a non-empty string.');
     }
+    const displayName = requireSafeDisplayText("displayName", body.displayName);
     const capsuleIds = parseSetCapsuleIds(body.capsuleIds);
-    const description = typeof body.description === "string" && body.description.trim().length > 0
-        ? body.description.trim()
-        : undefined;
+    const description = safeOptionalDisplayText("description", body.description);
     return description === undefined
         ? { displayName, capsuleIds }
         : { displayName, description, capsuleIds };
@@ -823,16 +888,20 @@ function parseUpdateCapsuleInput(body) {
     }
     const patch = {};
     if (body.displayName !== undefined) {
-        if (typeof body.displayName !== "string" || body.displayName.trim().length === 0) {
+        if (typeof body.displayName !== "string") {
             throw new InvalidRequest('Field "displayName" must be a non-empty string when provided.');
         }
-        patch.displayName = body.displayName.trim();
+        patch.displayName = requireSafeDisplayText("displayName", body.displayName);
     }
     if (body.description !== undefined) {
         if (typeof body.description !== "string") {
             throw new InvalidRequest('Field "description" must be a string when provided.');
         }
-        patch.description = body.description.trim();
+        const trimmed = body.description.trim();
+        if (!isSafeDisplaySummary(trimmed)) {
+            throw new InvalidRequest('Field "description" must be browser-safe when provided.');
+        }
+        patch.description = trimmed;
     }
     if (patch.displayName === undefined && patch.description === undefined) {
         throw new InvalidRequest("Patch must include displayName or description.");
@@ -861,9 +930,9 @@ export async function handleCreateLocalKnowledgeCapsule(ctx, deps) {
         const input = parseCreateCapsuleInput(await readJsonObject(ctx.req));
         const env = openStoreForDeps(deps);
         try {
-            const configuredModelId = selectEmbeddingModelId(currentGatewayConfig(deps));
-            if (configuredModelId === undefined) {
-                return conflict("No configured embedding-capable model is available for new capsules. Configure the Model Gateway first.");
+            const embeddingIdentity = await resolveNewCapsuleEmbeddingIdentity(deps);
+            if (!embeddingIdentity.ok) {
+                return embeddingIdentity.result;
             }
             const capsuleId = randomUUID();
             const capsule = createCapsule(env.store, {
@@ -874,7 +943,7 @@ export async function handleCreateLocalKnowledgeCapsule(ctx, deps) {
                 retrievalEffort: "default",
                 outputMode: "snippets",
                 answerGroundingPolicy: "require-citations",
-                embeddingModelIdentity: defaultEmbeddingIdentity(configuredModelId),
+                embeddingModelIdentity: embeddingIdentity.identity,
                 lifecycleState: "draft",
                 storageReference: createCapsuleStorageReference(capsuleId),
             }, createSqliteAuditSink(env.store));
@@ -979,8 +1048,11 @@ function parseConnectSourceInput(body) {
     assertScopeShape(scope);
     const displayNameRaw = body.displayName;
     const displayName = typeof displayNameRaw === "string" && displayNameRaw.trim().length > 0
-        ? displayNameRaw.trim()
+        ? requireSafeDisplayText("displayName", displayNameRaw)
         : basename(connectScopeRootPath(scope));
+    if (!isSafeDisplaySummary(displayName)) {
+        throw new InvalidRequest('Field "displayName" must be browser-safe when provided.');
+    }
     return { scope, displayName };
 }
 // Canonicalize (realpath) then refuse denied locations and non-directory roots BEFORE
@@ -1003,6 +1075,36 @@ function guardConnectorSourcePath(scope) {
     }
     return canonical;
 }
+// Stable identity for connect-time dedup. Field-by-field (not JSON.stringify of the raw
+// object) so the request body's key order cannot defeat the comparison, and built on the
+// canonicalized scope so trailing-slash and symlink-alias spellings of the same folder fold
+// together. Scopes that differ in globs, recursion, or file lists stay distinct sources.
+//
+// files scope: the array order has no logical meaning (unlike includeGlobs/excludeGlobs on
+// folder/repository scopes where first-match-wins makes order semantically significant), so
+// we sort before serializing. This ensures [a,b] and [b,a] map to the same identity and the
+// idempotency check fires correctly on permuted re-connects.
+function scopeIdentity(scope) {
+    const canonical = canonicalizeScopeRoot(scope);
+    if (canonical.kind === "folder") {
+        return JSON.stringify([
+            "folder",
+            canonical.rootPath,
+            canonical.recursive,
+            canonical.includeGlobs ?? null,
+            canonical.excludeGlobs ?? null,
+        ]);
+    }
+    if (canonical.kind === "repository") {
+        return JSON.stringify([
+            "repository",
+            canonical.repositoryRoot,
+            canonical.includeGlobs ?? null,
+            canonical.excludeGlobs ?? null,
+        ]);
+    }
+    return JSON.stringify(["files", canonical.rootPath, [...canonical.files].sort()]);
+}
 export async function handleConnectLocalKnowledgeCapsule(ctx, deps) {
     return runHandler(async () => {
         const capsuleId = parseCapsuleId(ctx);
@@ -1014,6 +1116,17 @@ export async function handleConnectLocalKnowledgeCapsule(ctx, deps) {
             if (capsule === undefined) {
                 return notFound(`Capsule not found: ${capsuleId}`);
             }
+            // Idempotent connect: re-connecting an identical scope (double-click, trailing-slash or
+            // symlink-alias spelling of the same folder) must not create a second source row — a
+            // duplicate would double-index every document and double every grounded citation.
+            const targetIdentity = scopeIdentity(guarded);
+            const alreadyConnected = listCapsuleSources(env.store, capsule.id).some((source) => scopeIdentity(source.scope) === targetIdentity);
+            if (alreadyConnected) {
+                return {
+                    status: 200,
+                    body: buildCapsuleResponseBody(deps, env.store, env.dbPath, capsule),
+                };
+            }
             addSourceToCapsule(env.store, capsule.id, {
                 id: randomUUID(),
                 displayName,
@@ -1067,8 +1180,12 @@ export async function handleReindexLocalKnowledgeCapsule(ctx, deps) {
     return runHandler(async () => {
         const capsuleId = parseCapsuleId(ctx);
         const body = await readJsonObject(ctx.req);
-        const mode = parseReindexMode(body);
-        const force = parseReindexForce(body);
+        const reindexRequest = validateCapsuleReindexRequest({ ...body, capsuleId });
+        if (!reindexRequest.ok) {
+            throw new InvalidRequest(reindexRequest.errors.join(" "));
+        }
+        const mode = reindexRequest.value.mode;
+        const force = reindexRequest.value.force ?? false;
         const env = openStoreForDeps(deps);
         try {
             const capsule = getCapsule(env.store, capsuleId);

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/connectorErrors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connectorErrors.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/connectorErrors.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,GACtB,+BAA+B,GAC/B,aAAa,CAAC;AAElB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnF;AAYD,eAAO,MAAM,oBAAoB,GAAI,MAAM,oBAAoB,KAAG,oBAEhE,CAAC;AAmBH,eAAO,MAAM,4BAA4B,GAAI,OAAO,MAAM,KAAG,OAK5D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,GAC9C,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KACzC,OAKF,CAAC"}
+{"version":3,"file":"connectorErrors.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/connectorErrors.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,GACtB,+BAA+B,GAC/B,aAAa,CAAC;AAElB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnF;AAYD,eAAO,MAAM,oBAAoB,GAAI,MAAM,oBAAoB,KAAG,oBAEhE,CAAC;AAqBH,eAAO,MAAM,4BAA4B,GAAI,OAAO,MAAM,KAAG,OAM5D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,GAC9C,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KACzC,OAKF,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/connectorErrors.js

@@ -19,22 +19,25 @@ export const qiConnectorErrorBody = (code) => ({
 /**
  * Defence-in-depth scrub: detect substrings that would indicate the caller is trying to
  * smuggle credentials or a header pair through a connector payload. Pure, no IO.
+ *
+ * Comparison is case-insensitive so that variants like "BEARER ", "API_KEY", or
+ * "AUTHORIZATION:" are detected regardless of casing (prior case-variant list was
+ * incomplete and bypassed by non-listed casings — Issue #281).
  */
 const FORBIDDEN_SUBSTRINGS = [
-    "Authorization:",
-    "Bearer ",
-    "Basic ",
+    "authorization:",
+    "bearer ",
+    "basic ",
     "apikey",
-    "apiKey",
     "api_key",
-    "Cookie:",
-    "Set-Cookie",
+    "cookie:",
+    "set-cookie",
     "x-api-key",
-    "X-Api-Key",
 ];
 export const containsForbiddenSecretShape = (value) => {
+    const lower = value.toLowerCase();
     for (const forbidden of FORBIDDEN_SUBSTRINGS) {
-        if (value.includes(forbidden))
+        if (lower.includes(forbidden))
             return true;
     }
     return false;

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/editRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"editRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/editRoutes.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA+PhD,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAmBtB;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,eAAe,EAMzD,CAAC"}
+{"version":3,"file":"editRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/editRoutes.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAgQhD,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAmBtB;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,eAAe,EAMzD,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/editRoutes.js

@@ -200,6 +200,7 @@ function recordEdit(runId, edit, evidenceDir, deps) {
             candidateId: edit.candidateId,
             reviewerLabel: edit.editorLabel,
             now: new Date().toISOString(),
+            redact: deps.redactor,
         });
     }
     return {

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/exportRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exportRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/exportRoutes.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAsKhD,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAuBjG;AAgHD,eAAO,MAAM,qBAAqB,EAAE,SAAS,eAAe,EAE3D,CAAC"}
+{"version":3,"file":"exportRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/exportRoutes.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAyNhD,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CA2BjG;AA+HD,eAAO,MAAM,qBAAqB,EAAE,SAAS,eAAe,EAE3D,CAAC"}