@osovv/vv-opencode 1.1.6 → 1.2.0

package/dist/plugins/secrets-redaction/index.js

@@ -2,9 +2,9 @@
 // VERSION: 1.0.0
 // START_MODULE_CONTRACT
 //   PURPOSE: OpenCode plugin that redacts secrets from messages before LLM requests and restores them after.
-//   SCOPE: Startup vvoc config snapshot use plus 3 hook handlers — chat.messages.transform, text.complete, tool.execute.before
+//   SCOPE: Startup vvoc config snapshot use plus 3 hook handlers — chat.messages.transform (text, reasoning, and tool-part state redaction), text.complete, tool.execute.before
 //   DEPENDS: src/lib/config-layers.ts, src/lib/plugin-toggle-config.ts, session, engine, patterns, restore, deep, config
-//   LINKS: knowledge-graph://plugins/secrets-redaction
+//   LINKS: [M-PLUGIN-SECRETS-REDACTION]
 //   ROLE: RUNTIME
 //   MAP_MODE: EXPORTS
 // END_MODULE_CONTRACT
@@ -14,6 +14,7 @@
 // END_MODULE_MAP
 //
 // START_CHANGE_SUMMARY
+//   LAST_CHANGE: [v1.3.0 - Fixed a redaction bypass: tool-part payloads (ToolPart.state input/output/error/metadata) are now deep-redacted in chat.messages.transform; removed the dead msg.info.state path that never matched the SDK message shape.]
 //   LAST_CHANGE: [v1.2.0 - Used the shared startup vvoc config snapshot for plugin toggles and redaction settings.]
 //   LAST_CHANGE: [v0.0.0 - Initial GRACE compliance: added missing CHANGE_SUMMARY.]
 // END_CHANGE_SUMMARY
@@ -32,6 +33,9 @@ function isTextPart(part) {
 function isReasoningPart(part) {
     return part.type === "reasoning";
 }
+function isToolPart(part) {
+    return part.type === "tool";
+}
 function redactMessageParts(parts, patternSet, session) {
     for (const part of parts) {
         if (isTextPart(part)) {
@@ -42,22 +46,14 @@ function redactMessageParts(parts, patternSet, session) {
             const result = redactText(part.text, patternSet, session);
             part.text = result.text;
         }
-    }
-}
-function redactAssistantState(msg, patternSet, session) {
-    const state = msg.state;
-    if (state) {
-        if (state.input) {
-            redactDeep(state.input, patternSet, session);
-        }
-        if (state.output) {
-            redactDeep(state.output, patternSet, session);
-        }
-        if (state.error) {
-            redactDeep(state.error, patternSet, session);
-        }
-        if (state.raw) {
-            redactDeep(state.raw, patternSet, session);
+        if (isToolPart(part)) {
+            // Tool inputs/outputs/errors/metadata are the primary secret vector
+            // (file contents from `read`, command output from `bash`, env vars).
+            // They live in part.state per the SDK ToolPart shape, not msg.info.state.
+            redactDeep(part.state, patternSet, session);
+            if (part.metadata) {
+                redactDeep(part.metadata, patternSet, session);
+            }
         }
     }
 }
@@ -116,9 +112,6 @@ export const SecretsRedactionPlugin = async (ctx) => {
         },
         "experimental.chat.messages.transform": async (_input, output) => {
             for (const msg of output.messages) {
-                if (msg.info.role === "assistant") {
-                    redactAssistantState(msg.info, patternSet, session);
-                }
                 redactMessageParts(msg.parts, patternSet, session);
             }
         },

package/dist/plugins/secrets-redaction/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/index.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,iBAAiB;AACjB,wBAAwB;AACxB,6GAA6G;AAC7G,+HAA+H;AAC/H,yHAAyH;AACzH,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,0DAA0D;AAC1D,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,oHAAoH;AACpH,oFAAoF;AACpF,qBAAqB;AAErB,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAIxE,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C,SAAS,UAAU,CAAC,IAAU;IAC5B,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,IAAU;IACjC,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;AACnC,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAa,EACb,UAA8C,EAC9C,OAA2B;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAY,EACZ,UAA8C,EAC9C,OAA2B;IAE3B,MAAM,KAAK,GAAI,GAA2C,CAAC,KAAK,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAW,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,oCAAoC,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,OAAgB;gBACvB,OAAO,EAAE,uBAAuB,IAAI,IAAI,MAAM,EAAE;aACjD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,MAAe;gBACtB,OAAO,EAAE,OAAO;aACjB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACrC,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACrB,WAAW,CACT,GAAG,EAAE;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACjB,IAAI,EAAE;wBACJ,OAAO,EAAE,mBAAmB;wBAC5B,KAAK,EAAE,OAAgB;wBACvB,OAAO,EAAE,WAAW,OAAO,uBAAuB;qBACnD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACtB,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACrB,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC9C,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,sCAAsC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC/D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAClC,oBAAoB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;gBACtD,CAAC;gBACD,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACrD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/index.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,iBAAiB;AACjB,wBAAwB;AACxB,6GAA6G;AAC7G,gLAAgL;AAChL,yHAAyH;AACzH,wCAAwC;AACxC,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,0DAA0D;AAC1D,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,uPAAuP;AACvP,oHAAoH;AACpH,oFAAoF;AACpF,qBAAqB;AAErB,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAIxE,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C,SAAS,UAAU,CAAC,IAAU;IAC5B,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,IAAU;IACjC,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;AAC9B,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAa,EACb,UAA8C,EAC9C,OAA2B;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,oEAAoE;YACpE,qEAAqE;YACrE,0EAA0E;YAC1E,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAW,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,oCAAoC,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,OAAgB;gBACvB,OAAO,EAAE,uBAAuB,IAAI,IAAI,MAAM,EAAE;aACjD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,MAAe;gBACtB,OAAO,EAAE,OAAO;aACjB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACrC,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACrB,WAAW,CACT,GAAG,EAAE;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACjB,IAAI,EAAE;wBACJ,OAAO,EAAE,mBAAmB;wBAC5B,KAAK,EAAE,OAAgB;wBACvB,OAAO,EAAE,WAAW,OAAO,uBAAuB;qBACnD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACtB,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACrB,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC9C,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,sCAAsC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC/D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACrD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/plugins/secrets-redaction/patterns.js

@@ -1,5 +1,5 @@
 // FILE: src/plugins/secrets-redaction/patterns.ts
-// VERSION: 1.0.0
+// VERSION: 1.0.2
 // START_MODULE_CONTRACT
 //   PURPOSE: Builds the internal pattern set from config — keywords, regex rules, and builtin patterns.
 //   SCOPE: pattern parsing, normalization, deduplication
@@ -16,9 +16,9 @@
 //   PatternSet - Group of related pattern rules.
 //   PatternsConfig - Patterns configuration schema.
 // END_MODULE_MAP
-// END_MODULE_MAP
 //
 // START_CHANGE_SUMMARY
+//   LAST_CHANGE: [v1.0.2 - Deduplicated combined regex flags so an inline (?i) pattern no longer produces an invalid duplicate flag set at startup.]
 //   LAST_CHANGE: [v1.0.1 - Tightened bearer_token lookahead to exclude . _ - after match, preventing false positives on long filenames with extension.]
 // END_CHANGE_SUMMARY
 const BUILTIN_PATTERNS = new Map([
@@ -69,7 +69,7 @@ function peelFlags(pattern) {
 }
 function buildRegex(pattern, defaultFlags = "gi") {
     const { pattern: raw, flags: peeled } = peelFlags(pattern);
-    const flags = peeled ? `${defaultFlags}${peeled}` : defaultFlags;
+    const flags = [...new Set(`${defaultFlags}${peeled}`)].join("");
     return new RegExp(raw, flags);
 }
 export function buildPatternSet(config) {

package/dist/plugins/secrets-redaction/patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/patterns.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,iBAAiB;AACjB,wBAAwB;AACxB,wGAAwG;AACxG,yDAAyD;AACzD,uCAAuC;AACvC,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,4DAA4D;AAC5D,6DAA6D;AAC7D,oDAAoD;AACpD,iDAAiD;AACjD,oDAAoD;AACpD,iBAAiB;AACjB,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,wJAAwJ;AACxJ,qBAAqB;AAmBrB,MAAM,gBAAgB,GAAuD,IAAI,GAAG,CAAC;IACnF,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACnF;QACE,MAAM;QACN;YACE,OAAO,EACL,0FAA0F;YAC5F,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACtF;QACE,cAAc;QACd,EAAE,OAAO,EAAE,4CAA4C,EAAE,QAAQ,EAAE,cAAc,EAAE;KACpF;IACD,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC/E,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC/E;QACE,cAAc;QACd,EAAE,OAAO,EAAE,sDAAsD,EAAE,QAAQ,EAAE,cAAc,EAAE;KAC9F;IACD,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5F,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACvE;QACE,WAAW;QACX,EAAE,OAAO,EAAE,gDAAgD,EAAE,QAAQ,EAAE,WAAW,EAAE;KACrF;CACF,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,OAAO,CAAC;IAEhB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,YAAY,GAAG,IAAI;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IACjE,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAEhC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,SAAS,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAEtD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/patterns.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,iBAAiB;AACjB,wBAAwB;AACxB,wGAAwG;AACxG,yDAAyD;AACzD,uCAAuC;AACvC,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,4DAA4D;AAC5D,6DAA6D;AAC7D,oDAAoD;AACpD,iDAAiD;AACjD,oDAAoD;AACpD,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,qJAAqJ;AACrJ,wJAAwJ;AACxJ,qBAAqB;AAmBrB,MAAM,gBAAgB,GAAuD,IAAI,GAAG,CAAC;IACnF,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACnF;QACE,MAAM;QACN;YACE,OAAO,EACL,0FAA0F;YAC5F,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACtF;QACE,cAAc;QACd,EAAE,OAAO,EAAE,4CAA4C,EAAE,QAAQ,EAAE,cAAc,EAAE;KACpF;IACD,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC/E,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC/E;QACE,cAAc;QACd,EAAE,OAAO,EAAE,sDAAsD,EAAE,QAAQ,EAAE,cAAc,EAAE;KAC9F;IACD,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5F,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACvE;QACE,WAAW;QACX,EAAE,OAAO,EAAE,gDAAgD,EAAE,QAAQ,EAAE,WAAW,EAAE;KACrF;CACF,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,OAAO,CAAC;IAEhB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,YAAY,GAAG,IAAI;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAEhC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,SAAS,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAEtD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/plugins/secrets-redaction/session.js

@@ -17,7 +17,6 @@
 //   PlaceholderEntry - Individual placeholder mapping entry.
 //   generateFallbackSecret - Generate fallback secret string.
 // END_MODULE_MAP
-// END_MODULE_MAP
 //
 // START_CHANGE_SUMMARY
 //   LAST_CHANGE: [v0.0.0 - Initial GRACE compliance: added missing CHANGE_SUMMARY.]

package/dist/plugins/secrets-redaction/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/session.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,iBAAiB;AACjB,wBAAwB;AACxB,4GAA4G;AAC5G,+FAA+F;AAC/F,iDAAiD;AACjD,yBAAyB;AACzB,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,iFAAiF;AACjF,0EAA0E;AAC1E,+DAA+D;AAC/D,6DAA6D;AAC7D,8DAA8D;AAC9D,iBAAiB;AACjB,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,oFAAoF;AACpF,qBAAqB;AAErB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgBtD,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAS;IACf,KAAK,CAAS;IACd,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,OAAO,GAAkC,IAAI,GAAG,EAAE,CAAC;IACnD,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IACzC,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE1D,YAAY,OAAkC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAEO,WAAW,CAAC,QAAgB;QAClC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,sBAAsB,CAAC,QAAgB,EAAE,QAAgB;QACvD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,IAAI,CAAC;QAE1D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,IAAI,OAAO,IAAI,CAAC;gBACjE,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAqB;YAC9B,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAE1C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,WAAmB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO;QAEjD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,aAAa,GAAG,QAAQ,CAAC;QAE7B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;gBAC9B,aAAa,GAAG,SAAS,CAAC;gBAC1B,iBAAiB,GAAG,WAAW,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAClD,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACvC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,kCAAkC,EAAE,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/plugins/secrets-redaction/session.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,iBAAiB;AACjB,wBAAwB;AACxB,4GAA4G;AAC5G,+FAA+F;AAC/F,iDAAiD;AACjD,yBAAyB;AACzB,uDAAuD;AACvD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,iFAAiF;AACjF,0EAA0E;AAC1E,+DAA+D;AAC/D,6DAA6D;AAC7D,8DAA8D;AAC9D,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,oFAAoF;AACpF,qBAAqB;AAErB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgBtD,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAS;IACf,KAAK,CAAS;IACd,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,OAAO,GAAkC,IAAI,GAAG,EAAE,CAAC;IACnD,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IACzC,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE1D,YAAY,OAAkC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAEO,WAAW,CAAC,QAAgB;QAClC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,sBAAsB,CAAC,QAAgB,EAAE,QAAgB;QACvD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,IAAI,CAAC;QAE1D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,IAAI,OAAO,IAAI,CAAC;gBACjE,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAqB;YAC9B,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAE1C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,WAAmB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO;QAEjD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,aAAa,GAAG,QAAQ,CAAC;QAE7B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;gBAC9B,aAAa,GAAG,SAAS,CAAC;gBAC1B,iBAAiB,GAAG,WAAW,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAClD,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACvC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,kCAAkC,EAAE,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/plugins/web-tools/config.d.ts

@@ -0,0 +1,43 @@
+import type { VvocConfigSnapshot } from "../../lib/config-layers.js";
+import type { VvocWebRegion } from "../../lib/vvoc-config.js";
+/** A resolved credential. The value must never be logged or printed. */
+export type WebProviderCredential = {
+    value: string;
+    source: "env" | "config";
+};
+export type ResolvedWebSearchConfig = {
+    provider: "exa" | "brave";
+    envVar: "EXA_API_KEY" | "BRAVE_API_KEY";
+    configField: "web.search.apiKey";
+    credential?: WebProviderCredential;
+} | {
+    provider: "zai";
+    region: VvocWebRegion;
+    envVar: "ZAI_API_KEY";
+    configField: "web.search.apiKey";
+    credential?: WebProviderCredential;
+};
+export type ResolvedWebFetchConfig = {
+    provider: "native" | "spider" | "zai";
+    region?: VvocWebRegion;
+    envVar?: "SPIDER_API_KEY" | "ZAI_API_KEY";
+    configField?: "web.fetch.apiKey";
+    credential?: WebProviderCredential;
+};
+export type ResolvedWebConfig = {
+    search: ResolvedWebSearchConfig;
+    fetch: ResolvedWebFetchConfig;
+    /** Non-fatal diagnostics safe to display; never contain key values. */
+    warnings: string[];
+};
+/** Injectable command runner for testability. Returns the process exit status. */
+export type CommandRunner = (cmd: string[], cwd: string) => {
+    status: number;
+};
+export declare function resolveWebRuntimeConfig(loaded: Pick<VvocConfigSnapshot, "config" | "source" | "warnings">, env?: NodeJS.ProcessEnv): ResolvedWebConfig;
+/**
+ * Best-effort warning when a project-layer vvoc config file that stores an apiKey is tracked by git.
+ * Returns a warning that names the file, or undefined when there is nothing to warn about.
+ * Never includes the key value. Git failures are swallowed and produce no warning.
+ */
+export declare function warnIfSecretBearingProjectConfigTracked(input: Pick<VvocConfigSnapshot, "config" | "source">, run?: CommandRunner): string | undefined;

package/dist/plugins/web-tools/config.js

@@ -0,0 +1,134 @@
+// FILE: src/plugins/web-tools/config.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Resolve the optional vvoc web section into concrete provider choices, explicit Z.AI regions, and credentials for the web tools plugin.
+//   SCOPE: Provider defaults, fail-closed Z.AI region resolution, credential resolution with environment precedence over config apiKey fields, credential source reporting, and a best-effort git-tracked project-config warning helper.
+//   DEPENDS: [src/lib/config-layers.ts, src/lib/vvoc-config.ts, node:path]
+//   LINKS: [M-WEB-CONFIG, M-PLUGIN-WEB-TOOLS, M-CLI-CONFIG]
+//   ROLE: RUNTIME
+//   MAP_MODE: EXPORTS
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   WebProviderCredential - Resolved credential value plus its source (env or config).
+//   ResolvedWebSearchConfig - Resolved search provider, credential locations, and credential.
+//   ResolvedWebFetchConfig - Resolved fetch provider, credential locations, and credential.
+//   ResolvedWebConfig - Resolved search and fetch configuration plus non-fatal warnings.
+//   CommandRunner - Injectable command runner used by the git-tracked warning helper.
+//   resolveWebRuntimeConfig - Resolves providers and credentials from a vvoc snapshot and environment.
+//   warnIfSecretBearingProjectConfigTracked - Best-effort warning when a tracked project config stores an apiKey.
+// END_MODULE_MAP
+//
+// START_CHANGE_SUMMARY
+//   LAST_CHANGE: [C-ZAI-DIRECT-WEB-PROVIDERS - Resolved direct Z.AI search and fetch regions with shared ZAI_API_KEY precedence.]
+//   LAST_CHANGE: [v1.0.0 - Initial runtime web config and credential resolver for the unified web tools plugin.]
+// END_CHANGE_SUMMARY
+import { basename, dirname } from "node:path";
+const SEARCH_ENV_VARS = {
+    exa: "EXA_API_KEY",
+    brave: "BRAVE_API_KEY",
+    zai: "ZAI_API_KEY",
+};
+// START_BLOCK_CREDENTIAL_RESOLUTION
+function resolveCredential(envValue, configValue) {
+    if (typeof envValue === "string" && envValue.length > 0) {
+        return { value: envValue, source: "env" };
+    }
+    if (typeof configValue === "string" && configValue.length > 0) {
+        return { value: configValue, source: "config" };
+    }
+    return undefined;
+}
+function requireZaiRegion(value, field) {
+    if (value === "international" || value === "china") {
+        return value;
+    }
+    throw new Error(`${field} is required when provider is zai`);
+}
+// END_BLOCK_CREDENTIAL_RESOLUTION
+// START_CONTRACT: resolveWebRuntimeConfig
+//   PURPOSE: Resolve providers and credentials from the startup vvoc snapshot.
+//   INPUTS: { loaded: vvoc snapshot subset with config, source, warnings; env: process environment override }
+//   OUTPUTS: { ResolvedWebConfig - providers default to exa and native; environment wins over config apiKey }
+//   SIDE_EFFECTS: none; missing credentials are not resolution-time errors
+//   LINKS: M-PLUGIN-WEB-TOOLS
+// END_CONTRACT: resolveWebRuntimeConfig
+export function resolveWebRuntimeConfig(loaded, env = process.env) {
+    const web = loaded.config.web;
+    const searchProvider = web?.search?.provider ?? "exa";
+    const fetchProvider = web?.fetch?.provider ?? "native";
+    const search = searchProvider === "zai"
+        ? {
+            provider: "zai",
+            region: requireZaiRegion(web?.search?.region, "web.search.region"),
+            envVar: "ZAI_API_KEY",
+            configField: "web.search.apiKey",
+            credential: resolveCredential(env.ZAI_API_KEY, web?.search?.apiKey),
+        }
+        : {
+            provider: searchProvider,
+            envVar: SEARCH_ENV_VARS[searchProvider],
+            configField: "web.search.apiKey",
+            credential: resolveCredential(env[SEARCH_ENV_VARS[searchProvider]], web?.search?.apiKey),
+        };
+    const fetch = fetchProvider === "zai"
+        ? {
+            provider: "zai",
+            region: requireZaiRegion(web?.fetch?.region, "web.fetch.region"),
+            envVar: "ZAI_API_KEY",
+            configField: "web.fetch.apiKey",
+            credential: resolveCredential(env.ZAI_API_KEY, web?.fetch?.apiKey),
+        }
+        : fetchProvider === "spider"
+            ? {
+                provider: "spider",
+                envVar: "SPIDER_API_KEY",
+                configField: "web.fetch.apiKey",
+                credential: resolveCredential(env.SPIDER_API_KEY, web?.fetch?.apiKey),
+            }
+            : { provider: "native" };
+    return { search, fetch, warnings: [...loaded.warnings] };
+}
+// START_BLOCK_GIT_TRACKED_WARNING
+function defaultCommandRunner(cmd, cwd) {
+    try {
+        const proc = Bun.spawnSync(cmd, { cwd, stdout: "ignore", stderr: "ignore" });
+        return { status: proc.exitCode };
+    }
+    catch {
+        return { status: 1 };
+    }
+}
+/**
+ * Best-effort warning when a project-layer vvoc config file that stores an apiKey is tracked by git.
+ * Returns a warning that names the file, or undefined when there is nothing to warn about.
+ * Never includes the key value. Git failures are swallowed and produce no warning.
+ */
+export function warnIfSecretBearingProjectConfigTracked(input, run = defaultCommandRunner) {
+    const source = input.source;
+    if (source.kind !== "project") {
+        return undefined;
+    }
+    const hasApiKey = Boolean(input.config.web?.search?.apiKey || input.config.web?.fetch?.apiKey);
+    if (!hasApiKey) {
+        return undefined;
+    }
+    const configPath = source.path;
+    if (!configPath) {
+        return undefined;
+    }
+    let status = 1;
+    try {
+        status = run(["git", "ls-files", "--error-unmatch", basename(configPath)], dirname(configPath)).status;
+    }
+    catch {
+        return undefined;
+    }
+    if (status !== 0) {
+        return undefined;
+    }
+    return (`vvoc config ${configPath} stores a web apiKey and is tracked by git; ` +
+        "consider moving the key to the global layer or an environment variable.");
+}
+// END_BLOCK_GIT_TRACKED_WARNING
+//# sourceMappingURL=config.js.map

package/dist/plugins/web-tools/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/plugins/web-tools/config.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,iBAAiB;AACjB,wBAAwB;AACxB,oJAAoJ;AACpJ,yOAAyO;AACzO,2EAA2E;AAC3E,4DAA4D;AAC5D,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,uFAAuF;AACvF,8FAA8F;AAC9F,4FAA4F;AAC5F,yFAAyF;AACzF,sFAAsF;AACtF,uGAAuG;AACvG,kHAAkH;AAClH,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,kIAAkI;AAClI,iHAAiH;AACjH,qBAAqB;AAErB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2C9C,MAAM,eAAe,GAAG;IACtB,GAAG,EAAE,aAAa;IAClB,KAAK,EAAE,eAAe;IACtB,GAAG,EAAE,aAAa;CACV,CAAC;AAEX,oCAAoC;AACpC,SAAS,iBAAiB,CACxB,QAA4B,EAC5B,WAA+B;IAE/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;AAC/D,CAAC;AACD,kCAAkC;AAElC,0CAA0C;AAC1C,+EAA+E;AAC/E,8GAA8G;AAC9G,8GAA8G;AAC9G,2EAA2E;AAC3E,8BAA8B;AAC9B,wCAAwC;AACxC,MAAM,UAAU,uBAAuB,CACrC,MAAkE,EAClE,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAA8B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IACzD,MAAM,cAAc,GAAG,GAAG,EAAE,MAAM,EAAE,QAAQ,IAAI,KAAK,CAAC;IACtD,MAAM,aAAa,GAAG,GAAG,EAAE,KAAK,EAAE,QAAQ,IAAI,QAAQ,CAAC;IAEvD,MAAM,MAAM,GACV,cAAc,KAAK,KAAK;QACtB,CAAC,CAAC;YACE,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC;YAClE,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,mBAAmB;YAChC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;SACpE;QACH,CAAC,CAAC;YACE,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,eAAe,CAAC,cAAc,CAAC;YACvC,WAAW,EAAE,mBAAmB;YAChC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;SACzF,CAAC;IAER,MAAM,KAAK,GACT,aAAa,KAAK,KAAK;QACrB,CAAC,CAAC;YACE,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC;YAChE,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,kBAAkB;YAC/B,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;SACnE;QACH,CAAC,CAAC,aAAa,KAAK,QAAQ;YAC1B,CAAC,CAAC;gBACE,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,kBAAkB;gBAC/B,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;aACtE;YACH,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAE/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,kCAAkC;AAClC,SAAS,oBAAoB,CAAC,GAAa,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uCAAuC,CACrD,KAAoD,EACpD,MAAqB,oBAAoB;IAEzC,MAAM,MAAM,GAAiB,KAAK,CAAC,MAAM,CAAC;IAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAC/B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CACV,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EAC5D,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC,MAAM,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,CACL,eAAe,UAAU,8CAA8C;QACvE,yEAAyE,CAC1E,CAAC;AACJ,CAAC;AACD,gCAAgC"}

package/dist/plugins/web-tools/fetch-service.d.ts

@@ -0,0 +1,14 @@
+import { type ToolDefinition } from "@opencode-ai/plugin";
+import type { ResolvedWebFetchConfig } from "./config.js";
+export declare const WEB_FETCH_DEFAULT_TIMEOUT_SECONDS = 30;
+export declare const WEB_FETCH_MAX_TIMEOUT_SECONDS = 120;
+/**
+ * Create the web_fetch tool bound to the resolved fetch configuration.
+ * execute validates http or https schemes, asks permission key web_fetch with patterns [url],
+ * routes textual extraction to native, Spider, or direct Z.AI reader, returns media as attachments with a short
+ * Markdown summary in the same ToolResult, and reports metadata
+ * { provider, format, credentialSource?, status?, durationMs? }.
+ * Native fetch requires no credential; Spider and Z.AI validate credentials at execution time
+ * with actionable messages naming the environment variable and web.fetch.apiKey.
+ */
+export declare function createWebFetchTool(resolved: ResolvedWebFetchConfig): ToolDefinition;

package/dist/plugins/web-tools/fetch-service.js

@@ -0,0 +1,166 @@
+// FILE: src/plugins/web-tools/fetch-service.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Build the provider-neutral web_fetch tool: input validation, permission request, provider dispatch, and structured text or attachment results.
+//   SCOPE: web_fetch ToolDefinition factory; delegates retrieval and conversion to the native, Spider, and direct Z.AI adapters.
+//   DEPENDS: [@opencode-ai/plugin, src/plugins/web-tools/config.ts, src/plugins/web-tools/providers/native-fetch.ts, src/plugins/web-tools/providers/spider.ts, src/plugins/web-tools/providers/zai.ts, src/plugins/web-tools/providers/exa.ts]
+//   LINKS: M-WEB-FETCH-SERVICE, M-WEB-NATIVE-FETCH, M-WEB-SPIDER, M-WEB-ZAI, M-WEB-MEDIA-LOADER, M-PLUGIN-WEB-TOOLS
+//   ROLE: RUNTIME
+//   MAP_MODE: EXPORTS
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   WEB_FETCH_DEFAULT_TIMEOUT_SECONDS - Default per-call timeout in seconds.
+//   WEB_FETCH_MAX_TIMEOUT_SECONDS - Maximum model-configurable timeout in seconds.
+//   createWebFetchTool - Create the web_fetch ToolDefinition bound to a resolved fetch config.
+// END_MODULE_MAP
+//
+// START_CHANGE_SUMMARY
+//   LAST_CHANGE: [C-ZAI-DIRECT-WEB-PROVIDERS - Routed canonical web_fetch calls through the explicit-region direct Z.AI reader adapter.]
+//   LAST_CHANGE: [v1.0.0 - Initial web_fetch tool service.]
+// END_CHANGE_SUMMARY
+import { tool, } from "@opencode-ai/plugin";
+import { WebProviderError } from "./providers/exa.js";
+import { fetchNative } from "./providers/native-fetch.js";
+import { scrapeSpider } from "./providers/spider.js";
+import { fetchZai } from "./providers/zai.js";
+const z = tool.schema;
+export const WEB_FETCH_DEFAULT_TIMEOUT_SECONDS = 30;
+export const WEB_FETCH_MAX_TIMEOUT_SECONDS = 120;
+// START_BLOCK_RESULT_MAPPING
+function mediaSummary(attachment) {
+    const name = attachment.filename ? `\`${attachment.filename}\`` : "the requested resource";
+    return `Fetched ${name} as a ${attachment.mime} attachment.`;
+}
+function nativeResult(url, format, outcome) {
+    if (outcome.kind === "media") {
+        return {
+            title: `web_fetch: ${url}`,
+            output: mediaSummary(outcome.attachment),
+            attachments: [outcome.attachment],
+            metadata: { provider: "native", format, status: outcome.status },
+        };
+    }
+    return {
+        title: `web_fetch: ${url}`,
+        output: outcome.content,
+        metadata: { provider: "native", format, status: outcome.status },
+    };
+}
+function spiderResult(url, format, credentialSource, outcome) {
+    const metadata = {
+        provider: "spider",
+        format,
+        credentialSource,
+        ...outcome.metadata,
+    };
+    if (outcome.kind === "media") {
+        return {
+            title: `web_fetch: ${url}`,
+            output: mediaSummary(outcome.attachment),
+            attachments: [outcome.attachment],
+            metadata,
+        };
+    }
+    return { title: `web_fetch: ${url}`, output: outcome.content, metadata };
+}
+function zaiResult(url, format, region, credentialSource, outcome) {
+    const metadata = {
+        provider: "zai",
+        region,
+        format,
+        credentialSource,
+        ...outcome.metadata,
+    };
+    if (outcome.kind === "media") {
+        return {
+            title: `web_fetch: ${url}`,
+            output: mediaSummary(outcome.attachment),
+            attachments: [outcome.attachment],
+            metadata,
+        };
+    }
+    return { title: `web_fetch: ${url}`, output: outcome.content, metadata };
+}
+// END_BLOCK_RESULT_MAPPING
+/**
+ * Create the web_fetch tool bound to the resolved fetch configuration.
+ * execute validates http or https schemes, asks permission key web_fetch with patterns [url],
+ * routes textual extraction to native, Spider, or direct Z.AI reader, returns media as attachments with a short
+ * Markdown summary in the same ToolResult, and reports metadata
+ * { provider, format, credentialSource?, status?, durationMs? }.
+ * Native fetch requires no credential; Spider and Z.AI validate credentials at execution time
+ * with actionable messages naming the environment variable and web.fetch.apiKey.
+ */
+export function createWebFetchTool(resolved) {
+    return tool({
+        description: "Fetch a known HTTP or HTTPS URL using the configured provider. Returns Markdown, text, raw HTML, or an image/PDF attachment.",
+        args: {
+            url: z.string().min(1).describe("The HTTP or HTTPS URL to retrieve."),
+            format: z
+                .enum(["markdown", "text", "html"])
+                .default("markdown")
+                .describe("Output format for textual resources; defaults to markdown."),
+            timeout: z
+                .number()
+                .positive()
+                .max(WEB_FETCH_MAX_TIMEOUT_SECONDS)
+                .default(WEB_FETCH_DEFAULT_TIMEOUT_SECONDS)
+                .describe("Timeout in seconds, greater than 0 and at most 120."),
+        },
+        async execute(args, context) {
+            let parsedUrl;
+            try {
+                parsedUrl = new URL(args.url);
+            }
+            catch {
+                throw new Error("web_fetch requires a valid HTTP or HTTPS URL");
+            }
+            if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+                throw new Error(`web_fetch supports only HTTP and HTTPS URLs; received ${parsedUrl.protocol || "unknown scheme"}`);
+            }
+            await context.ask({
+                permission: "web_fetch",
+                patterns: [args.url],
+                always: [],
+                metadata: { provider: resolved.provider, format: args.format },
+            });
+            const timeoutMs = args.timeout * 1000;
+            if (resolved.provider === "native") {
+                const outcome = await fetchNative({
+                    url: args.url,
+                    format: args.format,
+                    abort: context.abort,
+                    timeoutMs,
+                });
+                return nativeResult(args.url, args.format, outcome);
+            }
+            if (!resolved.credential) {
+                throw new WebProviderError(resolved.provider, "MISSING_CREDENTIAL", `missing credential for ${resolved.provider}: set ${resolved.envVar ?? "SPIDER_API_KEY"} or ${resolved.configField ?? "web.fetch.apiKey"}`);
+            }
+            if (resolved.provider === "zai") {
+                if (!resolved.region) {
+                    throw new Error("web.fetch.region is required when provider is zai");
+                }
+                const outcome = await fetchZai({
+                    url: args.url,
+                    format: args.format,
+                    region: resolved.region,
+                    credential: resolved.credential,
+                    abort: context.abort,
+                    timeoutMs,
+                });
+                return zaiResult(args.url, args.format, resolved.region, resolved.credential.source, outcome);
+            }
+            const outcome = await scrapeSpider({
+                url: args.url,
+                format: args.format,
+                credential: resolved.credential,
+                abort: context.abort,
+                timeoutMs,
+            });
+            return spiderResult(args.url, args.format, resolved.credential.source, outcome);
+        },
+    });
+}
+//# sourceMappingURL=fetch-service.js.map

package/dist/plugins/web-tools/fetch-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-service.js","sourceRoot":"","sources":["../../../src/plugins/web-tools/fetch-service.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,iBAAiB;AACjB,wBAAwB;AACxB,4JAA4J;AAC5J,iIAAiI;AACjI,gPAAgP;AAChP,oHAAoH;AACpH,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,6EAA6E;AAC7E,mFAAmF;AACnF,+FAA+F;AAC/F,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,yIAAyI;AACzI,4DAA4D;AAC5D,qBAAqB;AAErB,OAAO,EACL,IAAI,GAIL,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,WAAW,EAA2B,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,YAAY,EAAsB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAyB,MAAM,oBAAoB,CAAC;AAErE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;AAEtB,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AACpD,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAIjD,6BAA6B;AAC7B,SAAS,YAAY,CAAC,UAA0B;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC;IAC3F,OAAO,WAAW,IAAI,SAAS,UAAU,CAAC,IAAI,cAAc,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,MAAmB,EACnB,OAA2B;IAE3B,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,cAAc,GAAG,EAAE;YAC1B,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC;YACxC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;YACjC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;SACjE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,cAAc,GAAG,EAAE;QAC1B,MAAM,EAAE,OAAO,CAAC,OAAO;QACvB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,MAAmB,EACnB,gBAAkC,EAClC,OAAsB;IAEtB,MAAM,QAAQ,GAAG;QACf,QAAQ,EAAE,QAAQ;QAClB,MAAM;QACN,gBAAgB;QAChB,GAAG,OAAO,CAAC,QAAQ;KACpB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,cAAc,GAAG,EAAE;YAC1B,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC;YACxC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;YACjC,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,cAAc,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAChB,GAAW,EACX,MAAmB,EACnB,MAAiC,EACjC,gBAAkC,EAClC,OAAyB;IAEzB,MAAM,QAAQ,GAAG;QACf,QAAQ,EAAE,KAAK;QACf,MAAM;QACN,MAAM;QACN,gBAAgB;QAChB,GAAG,OAAO,CAAC,QAAQ;KACpB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,cAAc,GAAG,EAAE;YAC1B,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC;YACxC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;YACjC,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,cAAc,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC3E,CAAC;AACD,2BAA2B;AAE3B;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgC;IACjE,OAAO,IAAI,CAAC;QACV,WAAW,EACT,8HAA8H;QAChI,IAAI,EAAE;YACJ,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YACrE,MAAM,EAAE,CAAC;iBACN,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;iBAClC,OAAO,CAAC,UAAU,CAAC;iBACnB,QAAQ,CAAC,4DAA4D,CAAC;YACzE,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,GAAG,CAAC,6BAA6B,CAAC;iBAClC,OAAO,CAAC,iCAAiC,CAAC;iBAC1C,QAAQ,CAAC,qDAAqD,CAAC;SACnE;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO;YACzB,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CACb,yDAAyD,SAAS,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAClG,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;gBACpB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aAC/D,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACtC,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;oBAChC,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS;iBACV,CAAC,CAAC;gBACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACzB,MAAM,IAAI,gBAAgB,CACxB,QAAQ,CAAC,QAAQ,EACjB,oBAAoB,EACpB,0BAA0B,QAAQ,CAAC,QAAQ,SAAS,QAAQ,CAAC,MAAM,IAAI,gBAAgB,OAAO,QAAQ,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAC3I,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACvE,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;oBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS;iBACV,CAAC,CAAC;gBACH,OAAO,SAAS,CACd,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,MAAM,EACX,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,UAAU,CAAC,MAAM,EAC1B,OAAO,CACR,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;gBACjC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS;aACV,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/plugins/web-tools/html-markdown.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Convert an HTML document to GitHub-flavored Markdown.
+ * Removes script and style content, keeps links as [text](href),
+ * and preserves headings, lists, and code blocks.
+ * Returns an empty string for empty or whitespace-only input.
+ */
+export declare function convertHtmlToMarkdown(html: string): string;
+/**
+ * Extract visible text from an HTML document.
+ * Removes script and style content, decodes entities, and collapses whitespace runs.
+ * Returns an empty string for empty or whitespace-only input.
+ */
+export declare function convertHtmlToText(html: string): string;

package/dist/plugins/web-tools/html-markdown.js

@@ -0,0 +1,82 @@
+// FILE: src/plugins/web-tools/html-markdown.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Convert HTML locally to Markdown or plain text for the native fetch provider.
+//   SCOPE: Turndown-based Markdown conversion and htmlparser2-based text extraction, both stripping script and style content.
+//   DEPENDS: [turndown, htmlparser2]
+//   LINKS: [M-WEB-HTML-MARKDOWN, M-WEB-NATIVE-FETCH]
+//   ROLE: RUNTIME
+//   MAP_MODE: EXPORTS
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   convertHtmlToMarkdown - Convert an HTML document to GitHub-flavored Markdown.
+//   convertHtmlToText - Extract visible text from an HTML document.
+// END_MODULE_MAP
+//
+// START_CHANGE_SUMMARY
+//   LAST_CHANGE: [v1.0.0 - Initial local HTML to Markdown and text conversion for the native fetch provider.]
+// END_CHANGE_SUMMARY
+import { Parser } from "htmlparser2";
+import TurndownService from "turndown";
+// START_BLOCK_MARKDOWN
+let sharedTurndown;
+function getTurndown() {
+    if (!sharedTurndown) {
+        sharedTurndown = new TurndownService({
+            headingStyle: "atx",
+            codeBlockStyle: "fenced",
+            bulletListMarker: "-",
+        });
+        sharedTurndown.remove(["script", "style"]);
+    }
+    return sharedTurndown;
+}
+/**
+ * Convert an HTML document to GitHub-flavored Markdown.
+ * Removes script and style content, keeps links as [text](href),
+ * and preserves headings, lists, and code blocks.
+ * Returns an empty string for empty or whitespace-only input.
+ */
+export function convertHtmlToMarkdown(html) {
+    if (!html || html.trim() === "") {
+        return "";
+    }
+    return getTurndown().turndown(html).trim();
+}
+// END_BLOCK_MARKDOWN
+// START_BLOCK_TEXT
+/**
+ * Extract visible text from an HTML document.
+ * Removes script and style content, decodes entities, and collapses whitespace runs.
+ * Returns an empty string for empty or whitespace-only input.
+ */
+export function convertHtmlToText(html) {
+    if (!html || html.trim() === "") {
+        return "";
+    }
+    let text = "";
+    let skipDepth = 0;
+    const parser = new Parser({
+        onopentag(name) {
+            if (name === "script" || name === "style") {
+                skipDepth += 1;
+            }
+        },
+        ontext(data) {
+            if (skipDepth === 0) {
+                text += data;
+            }
+        },
+        onclosetag(name) {
+            if (name === "script" || name === "style") {
+                skipDepth = Math.max(0, skipDepth - 1);
+            }
+        },
+    }, { decodeEntities: true });
+    parser.write(html);
+    parser.end();
+    return text.replace(/\s+/g, " ").trim();
+}
+// END_BLOCK_TEXT
+//# sourceMappingURL=html-markdown.js.map