@osovv/vv-opencode 1.1.5 → 1.2.0

package/dist/plugins/hashline-edit/tool-description.d.ts

@@ -1 +1 @@
-export declare const HASHLINE_EDIT_DESCRIPTION = "Edit files using exact hash-anchored line references from the latest Read output.\n\n<must>\n1. SNAPSHOT: All edits in one call reference the ORIGINAL file state. Do NOT adjust line numbers for prior edits in the same batch \u2014 the system applies them bottom-up automatically.\n2. replace replaces ONE line at pos. It does NOT accept end. For multi-line replacement, use replace_range.\n3. replace_range with pos+end replaces ALL lines FROM pos THROUGH end (BOTH INCLUSIVE). The end line WILL BE replaced. If you set end to a line that belongs to the next function/method/statement, that line is DELETED.\n   CORRECT: pos on the first line to replace, end on the LAST line to replace \u2014 not the line after.\n4. lines must contain ONLY the content that belongs inside the replaced range. Lines AFTER end survive unchanged \u2014 do NOT include them in lines. If you do, they will appear twice.\n5. Tags MUST be copied exactly from read output or >>> mismatch output. NEVER guess or reconstruct tags.\n6. Batch = multiple operations in edits[], NOT one big replace covering everything. Each operation targets the smallest possible change.\n7. lines must contain plain replacement text only (no LINE#HASH#ANCHOR| prefixes, no diff + markers).\n8. CRITICAL: Double-quote characters inside lines strings MUST be escaped as \\\". Unescaped \\\" inside a JSON string will break the parser. Example: [\"const x = \\\"hello\\\";\"] \u2014 NOT [\"const x = \"hello\";\"]. Single quotes and backticks do NOT need escaping.\n</must>\n\n<operations>\nANCHOR FORMAT:\n  Each anchor is `{line_number}#{hash_id}#{anchor_hash}` from read output like `42#VK#AB|content`.\n  Backward-compatible `{line}#{hash}` also accepted.\n\nOPERATION CHOICE:\n  replace with pos -> replace ONE line at pos (end is rejected)\n  replace_range with pos+end -> replace range pos..end INCLUSIVE (both lines replaced)\n  append with pos -> insert lines AFTER the anchored line (use when you need to ADD lines, not replace)\n  prepend with pos -> insert lines BEFORE the anchored line\n  append/prepend without pos -> EOF/BOF insertion (also creates missing files)\n\nCONTENT FORMAT:\n  lines: string (single line) or string[] (multi-line, preferred)\n  lines: null or lines: [] with replace -> DELETE those lines\n\nFILE MODES:\n  delete=true deletes file and requires edits=[] with no rename\n  rename moves final content to a new path and removes old path\n<operations>\n\n<examples>\nGiven this file after read:\n  10#VK#AB|function hello() {\n  11#XJ#CD|  console.log(\"hi\");\n  12#MB#EF|  console.log(\"bye\");\n  13#QR#GH|} // end of hello()\n\nSingle-line replace (change line 11):\n  { op: \"replace\", pos: \"11#XJ#CD\", lines: [\"  console.log(\"hello\");\"] }\n  Result: line 11 replaced. Lines 10, 12-13 unchanged.\n\nRange replace (replace lines 11-12, function body):\n  { op: \"replace_range\", pos: \"11#XJ#CD\", end: \"12#MB#EF\", lines: [\"  return \"hello world\";\"] }\n  Result: lines 11-12 removed, replaced by 1 new line. Lines 10, 13 unchanged.\n\nBAD - end is one line too far (DELETES closing brace):\n  { op: \"replace_range\", pos: \"11#XJ#CD\", end: \"13#QR#GH\", lines: [\"  return \"hello world\";\"] }\n  Result: line 13 (closing brace) is REPLACED too \u2014 function is broken!\n  CORRECT: use end: \"12#MB#EF\" \u2014 only replace lines 11-12, keep line 13 unchanged.\n\nBAD - lines extend past end (DUPLICATES line 13):\n  { op: \"replace_range\", pos: \"11#XJ#CD\", end: \"12#MB#EF\", lines: [\"  return \"hi\";\", \"}\"] }\n  Line 13 is \"}\" which already exists after end. Including it in lines duplicates it.\n  CORRECT: { op: \"replace_range\", pos: \"11#XJ#CD\", end: \"12#MB#EF\", lines: [\"  return \"hi\";\"] }\n\nAppend after a line (insert between functions):\n  { op: \"append\", pos: \"13#QR#GH\", lines: [\"\", \"function added() {\", \"  return true;\", \"}\"] }\n  Result: 4 lines inserted after line 13. All existing lines unchanged.\n</examples>\n\n<auto>\nBuilt-in autocorrect (you do NOT need to handle these):\n  Merged lines are auto-expanded back to original line count.\n  Indentation is auto-restored from original lines.\n  BOM and CRLF line endings are preserved automatically.\n  Hashline prefixes and diff markers in text are auto-stripped.\n  Boundary echo lines (duplicating adjacent surviving lines) are auto-stripped.\n</auto>\n\nRecovery:\n- If you get a hash mismatch error, copy the updated anchors shown in that error or re-read the file before retrying.";
+export declare const HASHLINE_EDIT_DESCRIPTION = "Edit files using exact hash-anchored line references from the latest Read output.\n\n<must>\n1. SNAPSHOT: All edits in one call reference the ORIGINAL file state. Do NOT adjust line numbers for prior edits in the same batch \u2014 the system applies them bottom-up automatically.\n2. replace replaces ONE line at pos. It does NOT accept end. For multi-line replacement, use replace_range.\n3. replace_range with pos+end replaces ALL lines FROM pos THROUGH end (BOTH INCLUSIVE). The end line WILL BE replaced. If you set end to a line that belongs to the next function/method/statement, that line is DELETED.\n   CORRECT: pos on the first line to replace, end on the LAST line to replace \u2014 not the line after.\n4. lines must contain ONLY the content that belongs inside the replaced range. Lines AFTER end survive unchanged \u2014 do NOT include them in lines. If you do, they will appear twice.\n5. Tags MUST be copied exactly from read output or >>> mismatch output. NEVER guess or reconstruct tags.\n6. Batch = multiple operations in edits[], NOT one big replace covering everything. Each operation targets the smallest possible change.\n7. lines must contain plain replacement text only (no LINE#HASH#ANCHOR| prefixes, no diff + markers).\n8. CRITICAL: Double-quote characters inside lines strings MUST be escaped as \\\". Unescaped \\\" inside a JSON string will break the parser. Example: [\"const x = \\\"hello\\\";\"] \u2014 NOT [\"const x = \"hello\";\"]. Single quotes and backticks do NOT need escaping.\n</must>\n\n<operations>\nANCHOR FORMAT:\n  Each anchor is `{line_number}#{hash_id}#{anchor_hash}` from read output like `42#VK#AB|content`.\n  Backward-compatible `{line}#{hash}` also accepted.\n\nOPERATION CHOICE:\n  replace with pos -> replace ONE line at pos (end is rejected)\n  replace_range with pos+end -> replace range pos..end INCLUSIVE (both lines replaced)\n  append with pos -> insert lines AFTER the anchored line (use when you need to ADD lines, not replace)\n  prepend with pos -> insert lines BEFORE the anchored line\n  append/prepend without pos -> EOF/BOF insertion (also creates missing files)\n\nCONTENT FORMAT:\n  lines: string (single line) or string[] (multi-line, preferred)\n  lines: null or lines: [] with replace -> DELETE those lines\n\nFILE MODES:\n  delete=true deletes file and requires edits=[] with no rename\n  rename moves final content to a new path and removes old path\n<operations>\n\n<examples>\nGiven this file after read:\n  10#VK#AB|function hello() {\n  11#XJ#CD|  console.log(\"hi\");\n  12#MB#EF|  console.log(\"bye\");\n  13#QR#GH|} // end of hello()\n\nSingle-line replace (change line 11):\n  { op: \"replace\", pos: \"11#XJ#CD\", lines: [\"  console.log(\"hello\");\"] }\n  Result: line 11 replaced. Lines 10, 12-13 unchanged.\n\nRange replace (replace lines 11-12, function body):\n  { op: \"replace_range\", pos: \"11#XJ#CD\", end: \"12#MB#EF\", lines: [\"  return \"hello world\";\"] }\n  Result: lines 11-12 removed, replaced by 1 new line. Lines 10, 13 unchanged.\n\nBAD - end is one line too far (DELETES closing brace):\n  { op: \"replace_range\", pos: \"11#XJ#CD\", end: \"13#QR#GH\", lines: [\"  return \"hello world\";\"] }\n  Result: line 13 (closing brace) is REPLACED too \u2014 function is broken!\n  CORRECT: use end: \"12#MB#EF\" \u2014 only replace lines 11-12, keep line 13 unchanged.\n\nBAD - lines extend past end (DUPLICATES line 13):\n  { op: \"replace_range\", pos: \"11#XJ#CD\", end: \"12#MB#EF\", lines: [\"  return \"hi\";\", \"}\"] }\n  Line 13 is \"}\" which already exists after end. Including it in lines duplicates it.\n  CORRECT: { op: \"replace_range\", pos: \"11#XJ#CD\", end: \"12#MB#EF\", lines: [\"  return \"hi\";\"] }\n\nAppend after a line (insert between functions):\n  { op: \"append\", pos: \"13#QR#GH\", lines: [\"\", \"function added() {\", \"  return true;\", \"}\"] }\n  Result: 4 lines inserted after line 13. All existing lines unchanged.\n</examples>\n\n<auto>\nBuilt-in autocorrect (you do NOT need to handle these):\n  Merged lines are auto-expanded back to original line count.\n  Indentation is auto-restored from original lines.\n  BOM and CRLF line endings are preserved automatically.\n  Hashline prefixes and diff markers in text are auto-stripped.\n  Boundary echo lines exactly duplicating adjacent surviving lines are auto-stripped.\n</auto>\n\nRecovery:\n- If you get a hash mismatch error, copy the updated anchors shown in that error or re-read the file before retrying.";

package/dist/plugins/hashline-edit/tool-description.js

@@ -1,5 +1,5 @@
 // FILE: src/plugins/hashline-edit/tool-description.ts
-// VERSION: 0.4.0
+// VERSION: 0.6.0
 // START_MODULE_CONTRACT
 //   PURPOSE: Provide the LLM-facing tool description for the hash-anchored edit override.
 //   SCOPE: Stable instructions for read-then-edit workflow, anchor usage, operation choice, and stale-anchor recovery.
@@ -13,6 +13,7 @@
 //   HASHLINE_EDIT_DESCRIPTION - Canonical LLM-facing description for the hashline-backed `edit` tool.
 // END_MODULE_MAP
 // START_CHANGE_SUMMARY
+//   LAST_CHANGE: [v0.6.0 - Clarified that automatic range-boundary echo stripping applies only to exact adjacent-line duplicates.]
 //   LAST_CHANGE: [v0.5.0 - Split replace into replace (single line) and replace_range (range) to prevent accidental end-boundary errors.]
 // END_CHANGE_SUMMARY
 export const HASHLINE_EDIT_DESCRIPTION = `Edit files using exact hash-anchored line references from the latest Read output.
@@ -86,7 +87,7 @@ Built-in autocorrect (you do NOT need to handle these):
   Indentation is auto-restored from original lines.
   BOM and CRLF line endings are preserved automatically.
   Hashline prefixes and diff markers in text are auto-stripped.
-  Boundary echo lines (duplicating adjacent surviving lines) are auto-stripped.
+  Boundary echo lines exactly duplicating adjacent surviving lines are auto-stripped.
 </auto>
 
 Recovery:

package/dist/plugins/hashline-edit/tool-description.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-description.js","sourceRoot":"","sources":["../../../src/plugins/hashline-edit/tool-description.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,iBAAiB;AACjB,wBAAwB;AACxB,0FAA0F;AAC1F,uHAAuH;AACvH,gBAAgB;AAChB,oCAAoC;AACpC,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,sGAAsG;AACtG,iBAAiB;AACjB,uBAAuB;AACvB,0IAA0I;AAC1I,qBAAqB;AACrB,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sHA2E6E,CAAC"}
+{"version":3,"file":"tool-description.js","sourceRoot":"","sources":["../../../src/plugins/hashline-edit/tool-description.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,iBAAiB;AACjB,wBAAwB;AACxB,0FAA0F;AAC1F,uHAAuH;AACvH,gBAAgB;AAChB,oCAAoC;AACpC,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,sGAAsG;AACtG,iBAAiB;AACjB,uBAAuB;AACvB,mIAAmI;AACnI,0IAA0I;AAC1I,qBAAqB;AACrB,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sHA2E6E,CAAC"}

package/dist/plugins/secrets-redaction/config.d.ts

@@ -1,7 +1,12 @@
 import { type VvocConfigSnapshot } from "../../lib/config-layers.js";
-import { type SecretsRedactionConfig } from "../../lib/vvoc-config.js";
+import { type SecretsRedactionConfig, type VvocConfig } from "../../lib/vvoc-config.js";
 export type { SecretsRedactionConfig };
 export declare const DEFAULT_CONFIG: SecretsRedactionConfig;
+/** Exact-value keyword rules for configured web apiKey fields. Environment credentials are excluded. */
+export declare function webApiKeyKeywordRules(config: VvocConfig): Array<{
+    value: string;
+    category: "WEB_API_KEY";
+}>;
 export declare function getConfigCandidates(directory: string): Promise<string[]>;
 export declare function resolveSecretsRedactionRuntimeConfig(loaded: Pick<VvocConfigSnapshot, "config" | "source" | "warnings">, env?: NodeJS.ProcessEnv): {
     config: SecretsRedactionConfig;

package/dist/plugins/secrets-redaction/config.js

@@ -1,8 +1,8 @@
 // FILE: src/plugins/secrets-redaction/config.ts
-// VERSION: 1.1.0
+// VERSION: 1.4.0
 // START_MODULE_CONTRACT
 //   PURPOSE: Resolve secrets-redaction settings from the shared startup vvoc config snapshot with environment variable substitution.
-//   SCOPE: startup vvoc config snapshot consumption, env substitution, fallback defaults
+//   SCOPE: startup vvoc config snapshot consumption, env substitution, fallback defaults, and exact-value web apiKey keyword rules
 //   DEPENDS: src/lib/config-layers.ts, src/lib/vvoc-config.ts
 //   LINKS: knowledge-graph://plugins/secrets-redaction
 //   ROLE: RUNTIME
@@ -11,6 +11,7 @@
 //
 // START_MODULE_MAP
 //   DEFAULT_CONFIG - Default secrets-redaction section used when vvoc.json is missing or incomplete
+//   webApiKeyKeywordRules - returns deduplicated exact-value rules for configured web apiKey fields
 //   resolveSecretsRedactionRuntimeConfig - returns normalized config from a loaded vvoc config snapshot
 //   loadConfig - backward-compatible wrapper around loadVvocConfig plus resolveSecretsRedactionRuntimeConfig
 //   getConfigCandidates - returns the effective vvoc.json path candidate when one is selected
@@ -18,6 +19,7 @@
 // END_MODULE_MAP
 //
 // START_CHANGE_SUMMARY
+//   LAST_CHANGE: [C-UNIFIED-WEB-TOOLS - Added exact-value redaction rules for configured web apiKey fields.]
 //   LAST_CHANGE: [v1.3.0 - Resolved secrets-redaction settings from the shared startup vvoc config snapshot.]
 //   LAST_CHANGE: [v1.2.0 - Loaded secrets-redaction config from the effective vvoc source.]
 //   LAST_CHANGE: [v1.1.0 - Switched secrets-redaction config loading to the canonical vvoc.json file.]
@@ -26,6 +28,19 @@ import { loadVvocConfig, resolveVvocConfigSource, } from "../../lib/config-layer
 import { createDefaultSecretsRedactionConfig, } from "../../lib/vvoc-config.js";
 import { generateFallbackSecret } from "./session.js";
 export const DEFAULT_CONFIG = createDefaultSecretsRedactionConfig();
+/** Exact-value keyword rules for configured web apiKey fields. Environment credentials are excluded. */
+export function webApiKeyKeywordRules(config) {
+    const rules = [];
+    const seen = new Set();
+    for (const value of [config.web?.search?.apiKey, config.web?.fetch?.apiKey]) {
+        if (typeof value !== "string" || value.length === 0 || seen.has(value)) {
+            continue;
+        }
+        seen.add(value);
+        rules.push({ value, category: "WEB_API_KEY" });
+    }
+    return rules;
+}
 function substituteEnvVars(value, env) {
     return value.replace(/\$\{([^}]+)\}/g, (_, varName) => {
         return env[varName] ?? "";
@@ -42,20 +57,30 @@ export async function getConfigCandidates(directory) {
 export function resolveSecretsRedactionRuntimeConfig(loaded, env = process.env) {
     const warnings = [...loaded.warnings];
     let finalSecret = substituteEnvVars(loaded.config.secretsRedaction.secret, env);
+    const configured = loaded.config.secretsRedaction;
+    const keywordValues = new Set(configured.patterns.keywords.map((rule) => rule.value));
+    const webKeywords = webApiKeyKeywordRules(loaded.config).filter((rule) => !keywordValues.has(rule.value));
+    const configWithWebKeys = {
+        ...configured,
+        patterns: {
+            ...configured.patterns,
+            keywords: [...configured.patterns.keywords, ...webKeywords],
+        },
+    };
     if (!finalSecret) {
         finalSecret = generateFallbackSecret();
         warnings.push(`No VVOC_SECRET env var set - using random fallback secret. Secrets will not be reversible across restarts.`);
     }
     if (loaded.source.kind !== "default") {
         return {
-            config: { ...loaded.config.secretsRedaction, secret: finalSecret },
+            config: { ...configWithWebKeys, secret: finalSecret },
             path: loaded.source.path ?? null,
             warnings,
         };
     }
     warnings.push(`No vvoc config found - using secrets-redaction defaults with a random secret.`);
     return {
-        config: { ...DEFAULT_CONFIG, secret: finalSecret },
+        config: { ...configWithWebKeys, secret: finalSecret },
         path: null,
         warnings,
     };

package/dist/plugins/secrets-redaction/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/config.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,iBAAiB;AACjB,wBAAwB;AACxB,qIAAqI;AACrI,yFAAyF;AACzF,8DAA8D;AAC9D,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,oGAAoG;AACpG,wGAAwG;AACxG,6GAA6G;AAC7G,8FAA8F;AAC9F,mEAAmE;AACnE,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,8GAA8G;AAC9G,4FAA4F;AAC5F,uGAAuG;AACvG,qBAAqB;AAErB,OAAO,EACL,cAAc,EACd,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,GAEpC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAItD,MAAM,CAAC,MAAM,cAAc,GAA2B,mCAAmC,EAAE,CAAC;AAE5F,SAAS,iBAAiB,CAAC,KAAa,EAAE,GAAsB;IAC9D,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;QACpD,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC3C,KAAK,EAAE,WAAW;QAClB,GAAG,EAAE,SAAS;QACd,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,MAAkE,EAClE,MAAyB,OAAO,CAAC,GAAG;IAMpC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,sBAAsB,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CACX,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO;YACL,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE;YAClE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;YAChC,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAE/F,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE;QAClD,IAAI,EAAE,IAAI;QACV,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG;IAMpC,OAAO,oCAAoC,CAAC,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/config.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,iBAAiB;AACjB,wBAAwB;AACxB,qIAAqI;AACrI,mIAAmI;AACnI,8DAA8D;AAC9D,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,oGAAoG;AACpG,oGAAoG;AACpG,wGAAwG;AACxG,6GAA6G;AAC7G,8FAA8F;AAC9F,mEAAmE;AACnE,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,6GAA6G;AAC7G,8GAA8G;AAC9G,4FAA4F;AAC5F,uGAAuG;AACvG,qBAAqB;AAErB,OAAO,EACL,cAAc,EACd,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,GAGpC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAItD,MAAM,CAAC,MAAM,cAAc,GAA2B,mCAAmC,EAAE,CAAC;AAE5F,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CACnC,MAAkB;IAElB,MAAM,KAAK,GAAsD,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,GAAsB;IAC9D,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;QACpD,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC3C,KAAK,EAAE,WAAW;QAClB,GAAG,EAAE,SAAS;QACd,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,MAAkE,EAClE,MAAyB,OAAO,CAAC,GAAG;IAMpC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAClD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CACzC,CAAC;IACF,MAAM,iBAAiB,GAA2B;QAChD,GAAG,UAAU;QACb,QAAQ,EAAE;YACR,GAAG,UAAU,CAAC,QAAQ;YACtB,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC;SAC5D;KACF,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,sBAAsB,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CACX,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO;YACL,MAAM,EAAE,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE;YACrD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;YAChC,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAE/F,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI;QACV,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG;IAMpC,OAAO,oCAAoC,CAAC,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7F,CAAC"}

package/dist/plugins/secrets-redaction/engine.js

@@ -1,10 +1,10 @@
 // FILE: src/plugins/secrets-redaction/engine.ts
-// VERSION: 1.1.0
+// VERSION: 1.2.0
 // START_MODULE_CONTRACT
 //   PURPOSE: Core redaction engine — performs find/replace of secrets with placeholders in text.
-//   SCOPE: text scanning, overlap resolution, match sorting, and replacement
+//   SCOPE: text scanning, overlap resolution, match sorting, zero-width match guard, and replacement
 //   DEPENDS: session, patterns
-//   LINKS: knowledge-graph://plugins/secrets-redaction
+//   LINKS: [M-PLUGIN-SECRETS-REDACTION]
 //   ROLE: RUNTIME
 //   MAP_MODE: EXPORTS
 // END_MODULE_CONTRACT
@@ -14,9 +14,9 @@
 //   Match - Regex match result.
 //   RedactResult - Overall redaction operation result.
 // END_MODULE_MAP
-// END_MODULE_MAP
 //
 // START_CHANGE_SUMMARY
+//   LAST_CHANGE: [v1.2.0 - Guarded the scan loop against zero-width regex matches (lookahead/anchor patterns) to prevent an infinite loop on user-configured patterns.]
 //   LAST_CHANGE: [v1.1.0 - Fixed overlap handling so first and wider earlier matches redact correctly instead of being skipped entirely.]
 // END_CHANGE_SUMMARY
 function sortByPositionAsc(rules, text) {
@@ -25,6 +25,12 @@ function sortByPositionAsc(rules, text) {
         const re = new RegExp(rule.pattern.source, rule.pattern.flags.includes("g") ? rule.pattern.flags : `${rule.pattern.flags}g`);
         let match;
         while ((match = re.exec(text)) !== null) {
+            if (match[0].length === 0) {
+                // Zero-width match: advance manually to avoid an infinite loop; an
+                // empty match has nothing to redact, so skip it.
+                re.lastIndex += 1;
+                continue;
+            }
             allMatches.push({ rule, match: match });
         }
     }

package/dist/plugins/secrets-redaction/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/engine.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,iBAAiB;AACjB,wBAAwB;AACxB,iGAAiG;AACjG,6EAA6E;AAC7E,+BAA+B;AAC/B,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,+FAA+F;AAC/F,gCAAgC;AAChC,uDAAuD;AACvD,iBAAiB;AACjB,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,0IAA0I;AAC1I,qBAAqB;AAkBrB,SAAS,iBAAiB,CACxB,KAAoB,EACpB,IAAY;IAEZ,MAAM,UAAU,GAA0D,EAAE,CAAC;IAE7E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CACjF,CAAC;QACF,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAyB,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,KAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,KAAM,CAAC;QAC9B,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,GAAG,MAAM,CAAC;QAC9C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,QAAiB;IACxD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,UAAsB,EACtB,OAA2B;IAE3B,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAY,EAAE,CAAC;IAE5B,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAM,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEvB,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,IAAI,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,CAAC,WAAW,CAAC;QACxB,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/engine.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,iBAAiB;AACjB,wBAAwB;AACxB,iGAAiG;AACjG,qGAAqG;AACrG,+BAA+B;AAC/B,wCAAwC;AACxC,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,+FAA+F;AAC/F,gCAAgC;AAChC,uDAAuD;AACvD,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,wKAAwK;AACxK,0IAA0I;AAC1I,qBAAqB;AAkBrB,SAAS,iBAAiB,CACxB,KAAoB,EACpB,IAAY;IAEZ,MAAM,UAAU,GAA0D,EAAE,CAAC;IAE7E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CACjF,CAAC;QACF,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,mEAAmE;gBACnE,iDAAiD;gBACjD,EAAE,CAAC,SAAS,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAyB,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,KAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,KAAM,CAAC;QAC9B,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,GAAG,MAAM,CAAC;QAC9C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,QAAiB;IACxD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,UAAsB,EACtB,OAA2B;IAE3B,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAY,EAAE,CAAC;IAE5B,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAM,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEvB,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,IAAI,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,CAAC,WAAW,CAAC;QACxB,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC"}

package/dist/plugins/secrets-redaction/index.js

@@ -2,9 +2,9 @@
 // VERSION: 1.0.0
 // START_MODULE_CONTRACT
 //   PURPOSE: OpenCode plugin that redacts secrets from messages before LLM requests and restores them after.
-//   SCOPE: Startup vvoc config snapshot use plus 3 hook handlers — chat.messages.transform, text.complete, tool.execute.before
+//   SCOPE: Startup vvoc config snapshot use plus 3 hook handlers — chat.messages.transform (text, reasoning, and tool-part state redaction), text.complete, tool.execute.before
 //   DEPENDS: src/lib/config-layers.ts, src/lib/plugin-toggle-config.ts, session, engine, patterns, restore, deep, config
-//   LINKS: knowledge-graph://plugins/secrets-redaction
+//   LINKS: [M-PLUGIN-SECRETS-REDACTION]
 //   ROLE: RUNTIME
 //   MAP_MODE: EXPORTS
 // END_MODULE_CONTRACT
@@ -14,6 +14,7 @@
 // END_MODULE_MAP
 //
 // START_CHANGE_SUMMARY
+//   LAST_CHANGE: [v1.3.0 - Fixed a redaction bypass: tool-part payloads (ToolPart.state input/output/error/metadata) are now deep-redacted in chat.messages.transform; removed the dead msg.info.state path that never matched the SDK message shape.]
 //   LAST_CHANGE: [v1.2.0 - Used the shared startup vvoc config snapshot for plugin toggles and redaction settings.]
 //   LAST_CHANGE: [v0.0.0 - Initial GRACE compliance: added missing CHANGE_SUMMARY.]
 // END_CHANGE_SUMMARY
@@ -32,6 +33,9 @@ function isTextPart(part) {
 function isReasoningPart(part) {
     return part.type === "reasoning";
 }
+function isToolPart(part) {
+    return part.type === "tool";
+}
 function redactMessageParts(parts, patternSet, session) {
     for (const part of parts) {
         if (isTextPart(part)) {
@@ -42,22 +46,14 @@ function redactMessageParts(parts, patternSet, session) {
             const result = redactText(part.text, patternSet, session);
             part.text = result.text;
         }
-    }
-}
-function redactAssistantState(msg, patternSet, session) {
-    const state = msg.state;
-    if (state) {
-        if (state.input) {
-            redactDeep(state.input, patternSet, session);
-        }
-        if (state.output) {
-            redactDeep(state.output, patternSet, session);
-        }
-        if (state.error) {
-            redactDeep(state.error, patternSet, session);
-        }
-        if (state.raw) {
-            redactDeep(state.raw, patternSet, session);
+        if (isToolPart(part)) {
+            // Tool inputs/outputs/errors/metadata are the primary secret vector
+            // (file contents from `read`, command output from `bash`, env vars).
+            // They live in part.state per the SDK ToolPart shape, not msg.info.state.
+            redactDeep(part.state, patternSet, session);
+            if (part.metadata) {
+                redactDeep(part.metadata, patternSet, session);
+            }
         }
     }
 }
@@ -116,9 +112,6 @@ export const SecretsRedactionPlugin = async (ctx) => {
         },
         "experimental.chat.messages.transform": async (_input, output) => {
             for (const msg of output.messages) {
-                if (msg.info.role === "assistant") {
-                    redactAssistantState(msg.info, patternSet, session);
-                }
                 redactMessageParts(msg.parts, patternSet, session);
             }
         },

package/dist/plugins/secrets-redaction/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/index.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,iBAAiB;AACjB,wBAAwB;AACxB,6GAA6G;AAC7G,+HAA+H;AAC/H,yHAAyH;AACzH,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,0DAA0D;AAC1D,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,oHAAoH;AACpH,oFAAoF;AACpF,qBAAqB;AAErB,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAIxE,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C,SAAS,UAAU,CAAC,IAAU;IAC5B,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,IAAU;IACjC,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;AACnC,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAa,EACb,UAA8C,EAC9C,OAA2B;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAY,EACZ,UAA8C,EAC9C,OAA2B;IAE3B,MAAM,KAAK,GAAI,GAA2C,CAAC,KAAK,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAW,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,oCAAoC,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,OAAgB;gBACvB,OAAO,EAAE,uBAAuB,IAAI,IAAI,MAAM,EAAE;aACjD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,MAAe;gBACtB,OAAO,EAAE,OAAO;aACjB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACrC,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACrB,WAAW,CACT,GAAG,EAAE;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACjB,IAAI,EAAE;wBACJ,OAAO,EAAE,mBAAmB;wBAC5B,KAAK,EAAE,OAAgB;wBACvB,OAAO,EAAE,WAAW,OAAO,uBAAuB;qBACnD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACtB,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACrB,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC9C,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,sCAAsC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC/D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAClC,oBAAoB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;gBACtD,CAAC;gBACD,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACrD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/index.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,iBAAiB;AACjB,wBAAwB;AACxB,6GAA6G;AAC7G,gLAAgL;AAChL,yHAAyH;AACzH,wCAAwC;AACxC,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,0DAA0D;AAC1D,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,uPAAuP;AACvP,oHAAoH;AACpH,oFAAoF;AACpF,qBAAqB;AAErB,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAIxE,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C,SAAS,UAAU,CAAC,IAAU;IAC5B,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,IAAU;IACjC,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;AAC9B,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAa,EACb,UAA8C,EAC9C,OAA2B;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,oEAAoE;YACpE,qEAAqE;YACrE,0EAA0E;YAC1E,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAW,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,oCAAoC,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,OAAgB;gBACvB,OAAO,EAAE,uBAAuB,IAAI,IAAI,MAAM,EAAE;aACjD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,MAAe;gBACtB,OAAO,EAAE,OAAO;aACjB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACrC,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACrB,WAAW,CACT,GAAG,EAAE;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACjB,IAAI,EAAE;wBACJ,OAAO,EAAE,mBAAmB;wBAC5B,KAAK,EAAE,OAAgB;wBACvB,OAAO,EAAE,WAAW,OAAO,uBAAuB;qBACnD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACtB,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACrB,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC9C,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,sCAAsC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC/D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACrD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/plugins/secrets-redaction/patterns.js

@@ -1,5 +1,5 @@
 // FILE: src/plugins/secrets-redaction/patterns.ts
-// VERSION: 1.0.0
+// VERSION: 1.0.2
 // START_MODULE_CONTRACT
 //   PURPOSE: Builds the internal pattern set from config — keywords, regex rules, and builtin patterns.
 //   SCOPE: pattern parsing, normalization, deduplication
@@ -16,9 +16,9 @@
 //   PatternSet - Group of related pattern rules.
 //   PatternsConfig - Patterns configuration schema.
 // END_MODULE_MAP
-// END_MODULE_MAP
 //
 // START_CHANGE_SUMMARY
+//   LAST_CHANGE: [v1.0.2 - Deduplicated combined regex flags so an inline (?i) pattern no longer produces an invalid duplicate flag set at startup.]
 //   LAST_CHANGE: [v1.0.1 - Tightened bearer_token lookahead to exclude . _ - after match, preventing false positives on long filenames with extension.]
 // END_CHANGE_SUMMARY
 const BUILTIN_PATTERNS = new Map([
@@ -69,7 +69,7 @@ function peelFlags(pattern) {
 }
 function buildRegex(pattern, defaultFlags = "gi") {
     const { pattern: raw, flags: peeled } = peelFlags(pattern);
-    const flags = peeled ? `${defaultFlags}${peeled}` : defaultFlags;
+    const flags = [...new Set(`${defaultFlags}${peeled}`)].join("");
     return new RegExp(raw, flags);
 }
 export function buildPatternSet(config) {

package/dist/plugins/secrets-redaction/patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/patterns.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,iBAAiB;AACjB,wBAAwB;AACxB,wGAAwG;AACxG,yDAAyD;AACzD,uCAAuC;AACvC,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,4DAA4D;AAC5D,6DAA6D;AAC7D,oDAAoD;AACpD,iDAAiD;AACjD,oDAAoD;AACpD,iBAAiB;AACjB,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,wJAAwJ;AACxJ,qBAAqB;AAmBrB,MAAM,gBAAgB,GAAuD,IAAI,GAAG,CAAC;IACnF,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACnF;QACE,MAAM;QACN;YACE,OAAO,EACL,0FAA0F;YAC5F,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACtF;QACE,cAAc;QACd,EAAE,OAAO,EAAE,4CAA4C,EAAE,QAAQ,EAAE,cAAc,EAAE;KACpF;IACD,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC/E,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC/E;QACE,cAAc;QACd,EAAE,OAAO,EAAE,sDAAsD,EAAE,QAAQ,EAAE,cAAc,EAAE;KAC9F;IACD,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5F,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACvE;QACE,WAAW;QACX,EAAE,OAAO,EAAE,gDAAgD,EAAE,QAAQ,EAAE,WAAW,EAAE;KACrF;CACF,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,OAAO,CAAC;IAEhB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,YAAY,GAAG,IAAI;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IACjE,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAEhC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,SAAS,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAEtD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/patterns.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,iBAAiB;AACjB,wBAAwB;AACxB,wGAAwG;AACxG,yDAAyD;AACzD,uCAAuC;AACvC,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,4DAA4D;AAC5D,6DAA6D;AAC7D,oDAAoD;AACpD,iDAAiD;AACjD,oDAAoD;AACpD,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,qJAAqJ;AACrJ,wJAAwJ;AACxJ,qBAAqB;AAmBrB,MAAM,gBAAgB,GAAuD,IAAI,GAAG,CAAC;IACnF,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACnF;QACE,MAAM;QACN;YACE,OAAO,EACL,0FAA0F;YAC5F,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACtF;QACE,cAAc;QACd,EAAE,OAAO,EAAE,4CAA4C,EAAE,QAAQ,EAAE,cAAc,EAAE;KACpF;IACD,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC/E,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC/E;QACE,cAAc;QACd,EAAE,OAAO,EAAE,sDAAsD,EAAE,QAAQ,EAAE,cAAc,EAAE;KAC9F;IACD,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5F,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACvE;QACE,WAAW;QACX,EAAE,OAAO,EAAE,gDAAgD,EAAE,QAAQ,EAAE,WAAW,EAAE;KACrF;CACF,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,OAAO,CAAC;IAEhB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,YAAY,GAAG,IAAI;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAEhC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,SAAS,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAEtD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/plugins/secrets-redaction/session.js

@@ -17,7 +17,6 @@
 //   PlaceholderEntry - Individual placeholder mapping entry.
 //   generateFallbackSecret - Generate fallback secret string.
 // END_MODULE_MAP
-// END_MODULE_MAP
 //
 // START_CHANGE_SUMMARY
 //   LAST_CHANGE: [v0.0.0 - Initial GRACE compliance: added missing CHANGE_SUMMARY.]

package/dist/plugins/secrets-redaction/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/session.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,iBAAiB;AACjB,wBAAwB;AACxB,4GAA4G;AAC5G,+FAA+F;AAC/F,iDAAiD;AACjD,yBAAyB;AACzB,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,iFAAiF;AACjF,0EAA0E;AAC1E,+DAA+D;AAC/D,6DAA6D;AAC7D,8DAA8D;AAC9D,iBAAiB;AACjB,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,oFAAoF;AACpF,qBAAqB;AAErB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgBtD,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAS;IACf,KAAK,CAAS;IACd,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,OAAO,GAAkC,IAAI,GAAG,EAAE,CAAC;IACnD,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IACzC,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE1D,YAAY,OAAkC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAEO,WAAW,CAAC,QAAgB;QAClC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,sBAAsB,CAAC,QAAgB,EAAE,QAAgB;QACvD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,IAAI,CAAC;QAE1D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,IAAI,OAAO,IAAI,CAAC;gBACjE,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAqB;YAC9B,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAE1C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,WAAmB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO;QAEjD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,aAAa,GAAG,QAAQ,CAAC;QAE7B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;gBAC9B,aAAa,GAAG,SAAS,CAAC;gBAC1B,iBAAiB,GAAG,WAAW,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAClD,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACvC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,kCAAkC,EAAE,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/session.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,iBAAiB;AACjB,wBAAwB;AACxB,4GAA4G;AAC5G,+FAA+F;AAC/F,iDAAiD;AACjD,yBAAyB;AACzB,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,iFAAiF;AACjF,0EAA0E;AAC1E,+DAA+D;AAC/D,6DAA6D;AAC7D,8DAA8D;AAC9D,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,oFAAoF;AACpF,qBAAqB;AAErB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgBtD,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAS;IACf,KAAK,CAAS;IACd,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,OAAO,GAAkC,IAAI,GAAG,EAAE,CAAC;IACnD,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IACzC,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE1D,YAAY,OAAkC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAEO,WAAW,CAAC,QAAgB;QAClC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,sBAAsB,CAAC,QAAgB,EAAE,QAAgB;QACvD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,IAAI,CAAC;QAE1D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,IAAI,OAAO,IAAI,CAAC;gBACjE,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAqB;YAC9B,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAE1C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,WAAmB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO;QAEjD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,aAAa,GAAG,QAAQ,CAAC;QAE7B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;gBAC9B,aAAa,GAAG,SAAS,CAAC;gBAC1B,iBAAiB,GAAG,WAAW,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAClD,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACvC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,kCAAkC,EAAE,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/plugins/web-tools/config.d.ts

@@ -0,0 +1,43 @@
+import type { VvocConfigSnapshot } from "../../lib/config-layers.js";
+import type { VvocWebRegion } from "../../lib/vvoc-config.js";
+/** A resolved credential. The value must never be logged or printed. */
+export type WebProviderCredential = {
+    value: string;
+    source: "env" | "config";
+};
+export type ResolvedWebSearchConfig = {
+    provider: "exa" | "brave";
+    envVar: "EXA_API_KEY" | "BRAVE_API_KEY";
+    configField: "web.search.apiKey";
+    credential?: WebProviderCredential;
+} | {
+    provider: "zai";
+    region: VvocWebRegion;
+    envVar: "ZAI_API_KEY";
+    configField: "web.search.apiKey";
+    credential?: WebProviderCredential;
+};
+export type ResolvedWebFetchConfig = {
+    provider: "native" | "spider" | "zai";
+    region?: VvocWebRegion;
+    envVar?: "SPIDER_API_KEY" | "ZAI_API_KEY";
+    configField?: "web.fetch.apiKey";
+    credential?: WebProviderCredential;
+};
+export type ResolvedWebConfig = {
+    search: ResolvedWebSearchConfig;
+    fetch: ResolvedWebFetchConfig;
+    /** Non-fatal diagnostics safe to display; never contain key values. */
+    warnings: string[];
+};
+/** Injectable command runner for testability. Returns the process exit status. */
+export type CommandRunner = (cmd: string[], cwd: string) => {
+    status: number;
+};
+export declare function resolveWebRuntimeConfig(loaded: Pick<VvocConfigSnapshot, "config" | "source" | "warnings">, env?: NodeJS.ProcessEnv): ResolvedWebConfig;
+/**
+ * Best-effort warning when a project-layer vvoc config file that stores an apiKey is tracked by git.
+ * Returns a warning that names the file, or undefined when there is nothing to warn about.
+ * Never includes the key value. Git failures are swallowed and produce no warning.
+ */
+export declare function warnIfSecretBearingProjectConfigTracked(input: Pick<VvocConfigSnapshot, "config" | "source">, run?: CommandRunner): string | undefined;

package/dist/plugins/web-tools/config.js

@@ -0,0 +1,134 @@
+// FILE: src/plugins/web-tools/config.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Resolve the optional vvoc web section into concrete provider choices, explicit Z.AI regions, and credentials for the web tools plugin.
+//   SCOPE: Provider defaults, fail-closed Z.AI region resolution, credential resolution with environment precedence over config apiKey fields, credential source reporting, and a best-effort git-tracked project-config warning helper.
+//   DEPENDS: [src/lib/config-layers.ts, src/lib/vvoc-config.ts, node:path]
+//   LINKS: [M-WEB-CONFIG, M-PLUGIN-WEB-TOOLS, M-CLI-CONFIG]
+//   ROLE: RUNTIME
+//   MAP_MODE: EXPORTS
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   WebProviderCredential - Resolved credential value plus its source (env or config).
+//   ResolvedWebSearchConfig - Resolved search provider, credential locations, and credential.
+//   ResolvedWebFetchConfig - Resolved fetch provider, credential locations, and credential.
+//   ResolvedWebConfig - Resolved search and fetch configuration plus non-fatal warnings.
+//   CommandRunner - Injectable command runner used by the git-tracked warning helper.
+//   resolveWebRuntimeConfig - Resolves providers and credentials from a vvoc snapshot and environment.
+//   warnIfSecretBearingProjectConfigTracked - Best-effort warning when a tracked project config stores an apiKey.
+// END_MODULE_MAP
+//
+// START_CHANGE_SUMMARY
+//   LAST_CHANGE: [C-ZAI-DIRECT-WEB-PROVIDERS - Resolved direct Z.AI search and fetch regions with shared ZAI_API_KEY precedence.]
+//   LAST_CHANGE: [v1.0.0 - Initial runtime web config and credential resolver for the unified web tools plugin.]
+// END_CHANGE_SUMMARY
+import { basename, dirname } from "node:path";
+const SEARCH_ENV_VARS = {
+    exa: "EXA_API_KEY",
+    brave: "BRAVE_API_KEY",
+    zai: "ZAI_API_KEY",
+};
+// START_BLOCK_CREDENTIAL_RESOLUTION
+function resolveCredential(envValue, configValue) {
+    if (typeof envValue === "string" && envValue.length > 0) {
+        return { value: envValue, source: "env" };
+    }
+    if (typeof configValue === "string" && configValue.length > 0) {
+        return { value: configValue, source: "config" };
+    }
+    return undefined;
+}
+function requireZaiRegion(value, field) {
+    if (value === "international" || value === "china") {
+        return value;
+    }
+    throw new Error(`${field} is required when provider is zai`);
+}
+// END_BLOCK_CREDENTIAL_RESOLUTION
+// START_CONTRACT: resolveWebRuntimeConfig
+//   PURPOSE: Resolve providers and credentials from the startup vvoc snapshot.
+//   INPUTS: { loaded: vvoc snapshot subset with config, source, warnings; env: process environment override }
+//   OUTPUTS: { ResolvedWebConfig - providers default to exa and native; environment wins over config apiKey }
+//   SIDE_EFFECTS: none; missing credentials are not resolution-time errors
+//   LINKS: M-PLUGIN-WEB-TOOLS
+// END_CONTRACT: resolveWebRuntimeConfig
+export function resolveWebRuntimeConfig(loaded, env = process.env) {
+    const web = loaded.config.web;
+    const searchProvider = web?.search?.provider ?? "exa";
+    const fetchProvider = web?.fetch?.provider ?? "native";
+    const search = searchProvider === "zai"
+        ? {
+            provider: "zai",
+            region: requireZaiRegion(web?.search?.region, "web.search.region"),
+            envVar: "ZAI_API_KEY",
+            configField: "web.search.apiKey",
+            credential: resolveCredential(env.ZAI_API_KEY, web?.search?.apiKey),
+        }
+        : {
+            provider: searchProvider,
+            envVar: SEARCH_ENV_VARS[searchProvider],
+            configField: "web.search.apiKey",
+            credential: resolveCredential(env[SEARCH_ENV_VARS[searchProvider]], web?.search?.apiKey),
+        };
+    const fetch = fetchProvider === "zai"
+        ? {
+            provider: "zai",
+            region: requireZaiRegion(web?.fetch?.region, "web.fetch.region"),
+            envVar: "ZAI_API_KEY",
+            configField: "web.fetch.apiKey",
+            credential: resolveCredential(env.ZAI_API_KEY, web?.fetch?.apiKey),
+        }
+        : fetchProvider === "spider"
+            ? {
+                provider: "spider",
+                envVar: "SPIDER_API_KEY",
+                configField: "web.fetch.apiKey",
+                credential: resolveCredential(env.SPIDER_API_KEY, web?.fetch?.apiKey),
+            }
+            : { provider: "native" };
+    return { search, fetch, warnings: [...loaded.warnings] };
+}
+// START_BLOCK_GIT_TRACKED_WARNING
+function defaultCommandRunner(cmd, cwd) {
+    try {
+        const proc = Bun.spawnSync(cmd, { cwd, stdout: "ignore", stderr: "ignore" });
+        return { status: proc.exitCode };
+    }
+    catch {
+        return { status: 1 };
+    }
+}
+/**
+ * Best-effort warning when a project-layer vvoc config file that stores an apiKey is tracked by git.
+ * Returns a warning that names the file, or undefined when there is nothing to warn about.
+ * Never includes the key value. Git failures are swallowed and produce no warning.
+ */
+export function warnIfSecretBearingProjectConfigTracked(input, run = defaultCommandRunner) {
+    const source = input.source;
+    if (source.kind !== "project") {
+        return undefined;
+    }
+    const hasApiKey = Boolean(input.config.web?.search?.apiKey || input.config.web?.fetch?.apiKey);
+    if (!hasApiKey) {
+        return undefined;
+    }
+    const configPath = source.path;
+    if (!configPath) {
+        return undefined;
+    }
+    let status = 1;
+    try {
+        status = run(["git", "ls-files", "--error-unmatch", basename(configPath)], dirname(configPath)).status;
+    }
+    catch {
+        return undefined;
+    }
+    if (status !== 0) {
+        return undefined;
+    }
+    return (`vvoc config ${configPath} stores a web apiKey and is tracked by git; ` +
+        "consider moving the key to the global layer or an environment variable.");
+}
+// END_BLOCK_GIT_TRACKED_WARNING
+//# sourceMappingURL=config.js.map

package/dist/plugins/web-tools/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/plugins/web-tools/config.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,iBAAiB;AACjB,wBAAwB;AACxB,oJAAoJ;AACpJ,yOAAyO;AACzO,2EAA2E;AAC3E,4DAA4D;AAC5D,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,uFAAuF;AACvF,8FAA8F;AAC9F,4FAA4F;AAC5F,yFAAyF;AACzF,sFAAsF;AACtF,uGAAuG;AACvG,kHAAkH;AAClH,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,kIAAkI;AAClI,iHAAiH;AACjH,qBAAqB;AAErB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2C9C,MAAM,eAAe,GAAG;IACtB,GAAG,EAAE,aAAa;IAClB,KAAK,EAAE,eAAe;IACtB,GAAG,EAAE,aAAa;CACV,CAAC;AAEX,oCAAoC;AACpC,SAAS,iBAAiB,CACxB,QAA4B,EAC5B,WAA+B;IAE/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;AAC/D,CAAC;AACD,kCAAkC;AAElC,0CAA0C;AAC1C,+EAA+E;AAC/E,8GAA8G;AAC9G,8GAA8G;AAC9G,2EAA2E;AAC3E,8BAA8B;AAC9B,wCAAwC;AACxC,MAAM,UAAU,uBAAuB,CACrC,MAAkE,EAClE,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAA8B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IACzD,MAAM,cAAc,GAAG,GAAG,EAAE,MAAM,EAAE,QAAQ,IAAI,KAAK,CAAC;IACtD,MAAM,aAAa,GAAG,GAAG,EAAE,KAAK,EAAE,QAAQ,IAAI,QAAQ,CAAC;IAEvD,MAAM,MAAM,GACV,cAAc,KAAK,KAAK;QACtB,CAAC,CAAC;YACE,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC;YAClE,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,mBAAmB;YAChC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;SACpE;QACH,CAAC,CAAC;YACE,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,eAAe,CAAC,cAAc,CAAC;YACvC,WAAW,EAAE,mBAAmB;YAChC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;SACzF,CAAC;IAER,MAAM,KAAK,GACT,aAAa,KAAK,KAAK;QACrB,CAAC,CAAC;YACE,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC;YAChE,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,kBAAkB;YAC/B,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;SACnE;QACH,CAAC,CAAC,aAAa,KAAK,QAAQ;YAC1B,CAAC,CAAC;gBACE,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,kBAAkB;gBAC/B,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;aACtE;YACH,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAE/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,kCAAkC;AAClC,SAAS,oBAAoB,CAAC,GAAa,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uCAAuC,CACrD,KAAoD,EACpD,MAAqB,oBAAoB;IAEzC,MAAM,MAAM,GAAiB,KAAK,CAAC,MAAM,CAAC;IAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAC/B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CACV,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EAC5D,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC,MAAM,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,CACL,eAAe,UAAU,8CAA8C;QACvE,yEAAyE,CAC1E,CAAC;AACJ,CAAC;AACD,gCAAgC"}

package/dist/plugins/web-tools/fetch-service.d.ts

@@ -0,0 +1,14 @@
+import { type ToolDefinition } from "@opencode-ai/plugin";
+import type { ResolvedWebFetchConfig } from "./config.js";
+export declare const WEB_FETCH_DEFAULT_TIMEOUT_SECONDS = 30;
+export declare const WEB_FETCH_MAX_TIMEOUT_SECONDS = 120;
+/**
+ * Create the web_fetch tool bound to the resolved fetch configuration.
+ * execute validates http or https schemes, asks permission key web_fetch with patterns [url],
+ * routes textual extraction to native, Spider, or direct Z.AI reader, returns media as attachments with a short
+ * Markdown summary in the same ToolResult, and reports metadata
+ * { provider, format, credentialSource?, status?, durationMs? }.
+ * Native fetch requires no credential; Spider and Z.AI validate credentials at execution time
+ * with actionable messages naming the environment variable and web.fetch.apiKey.
+ */
+export declare function createWebFetchTool(resolved: ResolvedWebFetchConfig): ToolDefinition;