@osovv/vv-opencode 0.2.4 → 0.3.0

package/dist/plugins/secrets-redaction/restore.js

@@ -0,0 +1,25 @@
+// FILE: src/plugins/secrets-redaction/restore.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Restores placeholders in a single string back to original secret values.
+//   SCOPE: single-string placeholder → original lookup
+//   DEPENDS: session
+//   LINKS: knowledge-graph://plugins/secrets-redaction
+//   ROLE: RUNTIME
+//   MAP_MODE: EXPORTS
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   restoreText - restores all placeholders in a string to original values
+// END_MODULE_MAP
+import { getPlaceholderRegex } from "./session.js";
+export function restoreText(input, session) {
+    if (!input)
+        return input;
+    const regex = getPlaceholderRegex(session["prefix"]);
+    return input.replace(regex, (placeholder) => {
+        const original = session.lookup(placeholder);
+        return original ?? placeholder;
+    });
+}
+//# sourceMappingURL=restore.js.map

package/dist/plugins/secrets-redaction/restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/restore.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,iBAAiB;AACjB,wBAAwB;AACxB,sFAAsF;AACtF,uDAAuD;AACvD,qBAAqB;AACrB,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,2EAA2E;AAC3E,iBAAiB;AAGjB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,OAA2B;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAsB,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,EAAE;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7C,OAAO,QAAQ,IAAI,WAAW,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/plugins/secrets-redaction/session.d.ts

@@ -0,0 +1,30 @@
+export interface PlaceholderSessionOptions {
+    prefix: string;
+    ttlMs: number;
+    maxMappings: number;
+    secret: string;
+}
+export interface PlaceholderEntry {
+    original: string;
+    placeholder: string;
+    category: string;
+    createdAt: number;
+}
+export declare class PlaceholderSession {
+    private readonly prefix;
+    private readonly ttlMs;
+    private readonly maxMappings;
+    private readonly secret;
+    private readonly forward;
+    private readonly reverse;
+    private readonly created;
+    constructor(options: PlaceholderSessionOptions);
+    private computeHash;
+    getOrCreatePlaceholder(original: string, category: string): string;
+    lookup(placeholder: string): string | undefined;
+    cleanup(now: number): number;
+    private evictIfNeeded;
+    get size(): number;
+}
+export declare function getPlaceholderRegex(prefix: string): RegExp;
+export declare function generateFallbackSecret(): string;

package/dist/plugins/secrets-redaction/session.js

@@ -0,0 +1,113 @@
+// FILE: src/plugins/secrets-redaction/session.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Manages placeholder lifecycle for secret redaction — generates stable HMAC-based placeholders,
+//            maintains forward/reverse mappings, handles TTL eviction and max-mappings limits.
+//   SCOPE: placeholder creation, lookup, cleanup
+//   DEPENDS: node:crypto
+//   LINKS: knowledge-graph://plugins/secrets-redaction
+//   ROLE: RUNTIME
+//   MAP_MODE: EXPORTS
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   PlaceholderSession - manages secret → placeholder mappings with HMAC hashing
+//   getPlaceholderRegex - returns RegExp to find all placeholders in text
+// END_MODULE_MAP
+import { createHmac, randomBytes } from "node:crypto";
+export class PlaceholderSession {
+    prefix;
+    ttlMs;
+    maxMappings;
+    secret;
+    forward = new Map();
+    reverse = new Map();
+    created = new Map();
+    constructor(options) {
+        this.prefix = options.prefix;
+        this.ttlMs = options.ttlMs;
+        this.maxMappings = options.maxMappings;
+        this.secret = Buffer.from(options.secret, "utf-8");
+    }
+    computeHash(original) {
+        return createHmac("sha256", this.secret).update(original, "utf-8").digest("hex");
+    }
+    getOrCreatePlaceholder(original, category) {
+        if (this.reverse.has(original)) {
+            return this.reverse.get(original);
+        }
+        this.evictIfNeeded();
+        const hash = this.computeHash(original);
+        const hash12 = hash.substring(0, 12);
+        let placeholder = `${this.prefix}${category}_${hash12}__`;
+        if (this.forward.has(placeholder)) {
+            let counter = 1;
+            while (this.forward.has(placeholder)) {
+                placeholder = `${this.prefix}${category}_${hash12}_${counter}__`;
+                counter++;
+            }
+        }
+        const entry = {
+            original,
+            placeholder,
+            category,
+            createdAt: Date.now(),
+        };
+        this.forward.set(placeholder, entry);
+        this.reverse.set(original, placeholder);
+        this.created.set(placeholder, Date.now());
+        return placeholder;
+    }
+    lookup(placeholder) {
+        return this.forward.get(placeholder)?.original;
+    }
+    cleanup(now) {
+        let evicted = 0;
+        const expired = [];
+        for (const [placeholder, createdAt] of this.created) {
+            if (now - createdAt > this.ttlMs) {
+                expired.push(placeholder);
+            }
+        }
+        for (const placeholder of expired) {
+            const entry = this.forward.get(placeholder);
+            if (entry) {
+                this.reverse.delete(entry.original);
+                this.forward.delete(placeholder);
+                this.created.delete(placeholder);
+                evicted++;
+            }
+        }
+        return evicted;
+    }
+    evictIfNeeded() {
+        if (this.forward.size < this.maxMappings)
+            return;
+        let oldestPlaceholder = null;
+        let oldestCreated = Infinity;
+        for (const [placeholder, createdAt] of this.created) {
+            if (createdAt < oldestCreated) {
+                oldestCreated = createdAt;
+                oldestPlaceholder = placeholder;
+            }
+        }
+        if (oldestPlaceholder) {
+            const entry = this.forward.get(oldestPlaceholder);
+            if (entry) {
+                this.reverse.delete(entry.original);
+                this.forward.delete(oldestPlaceholder);
+                this.created.delete(oldestPlaceholder);
+            }
+        }
+    }
+    get size() {
+        return this.forward.size;
+    }
+}
+export function getPlaceholderRegex(prefix) {
+    return new RegExp(`${prefix}[A-Z_]+_[0-9a-f]{12}(?:_\\d+)?__`, "g");
+}
+export function generateFallbackSecret() {
+    return randomBytes(32).toString("hex");
+}
+//# sourceMappingURL=session.js.map

package/dist/plugins/secrets-redaction/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/session.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,iBAAiB;AACjB,wBAAwB;AACxB,4GAA4G;AAC5G,+FAA+F;AAC/F,iDAAiD;AACjD,yBAAyB;AACzB,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,iFAAiF;AACjF,0EAA0E;AAC1E,iBAAiB;AAEjB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgBtD,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAS;IACf,KAAK,CAAS;IACd,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,OAAO,GAAkC,IAAI,GAAG,EAAE,CAAC;IACnD,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IACzC,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE1D,YAAY,OAAkC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAEO,WAAW,CAAC,QAAgB;QAClC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,sBAAsB,CAAC,QAAgB,EAAE,QAAgB;QACvD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,IAAI,CAAC;QAE1D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,IAAI,OAAO,IAAI,CAAC;gBACjE,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAqB;YAC9B,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAE1C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,WAAmB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO;QAEjD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,aAAa,GAAG,QAAQ,CAAC;QAE7B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;gBAC9B,aAAa,GAAG,SAAS,CAAC;gBAC1B,iBAAiB,GAAG,WAAW,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAClD,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACvC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,kCAAkC,EAAE,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/plugins/secrets-redaction.d.ts

@@ -0,0 +1 @@
+export { SecretsRedactionPlugin } from "./secrets-redaction/index.js";

package/dist/plugins/secrets-redaction.js

@@ -0,0 +1,16 @@
+// FILE: src/plugins/secrets-redaction.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Re-export barrel for SecretsRedactionPlugin
+//   SCOPE: plugin re-exports
+//   DEPENDS: secrets-redaction/index
+//   LINKS: knowledge-graph://plugins/secrets-redaction
+//   ROLE: BARREL
+//   MAP_MODE: SUMMARY
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   SecretsRedactionPlugin - main plugin export
+// END_MODULE_MAP
+export { SecretsRedactionPlugin } from "./secrets-redaction/index.js";
+//# sourceMappingURL=secrets-redaction.js.map

package/dist/plugins/secrets-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-redaction.js","sourceRoot":"","sources":["../../src/plugins/secrets-redaction.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,iBAAiB;AACjB,wBAAwB;AACxB,yDAAyD;AACzD,6BAA6B;AAC7B,qCAAqC;AACrC,uDAAuD;AACvD,iBAAiB;AACjB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,gDAAgD;AAChD,iBAAiB;AAEjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@osovv/vv-opencode",
-  "version": "0.2.4",
-  "description": "Portable OpenCode workflow plugins and CLI tooling.",
+  "version": "0.3.0",
+  "description": "Portable OpenCode workflow plugins, explicit memory, and CLI tooling.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -15,6 +15,8 @@
     "workflow",
     "guardian",
     "memory",
+    "xdg",
+    "grace",
     "bun",
     "citty"
   ],
@@ -47,6 +49,7 @@
     "fmt:check": "oxfmt --check src",
     "test": "bun test",
     "check": "bun run typecheck && bun run lint && bun run fmt:check && bun test",
+    "pack:check": "npm pack --dry-run",
     "prepare": "lefthook install --force"
   },
   "dependencies": {