@piagent/platform 1.5.5 → 1.6.1

package/packages/piagent-core/security/sensitive-source-formats.js

@@ -0,0 +1,394 @@
+import {
+  REDACTION,
+  keyLooksSensitive,
+  redactSensitiveTextInternal
+} from "./sensitive-text.js";
+import {
+  balancedSourceExpression,
+  hasStandaloneKeywordSourceLiteral,
+  hasStandaloneNumericSourceLiteral,
+  maskSourceLookupStrings,
+  rewriteSensitiveSegment,
+  rewriteSensitiveStarts,
+  sourceReference
+} from "./sensitive-source-expression.js";
+
+function nextSourceComment(source, cursor, { hashComments }) {
+  let quote = "", escaped = false;
+  for (let index = cursor; index < source.length; index += 1) {
+    const character = source[index], next = source[index + 1] ?? "";
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === quote) quote = "";
+      continue;
+    }
+    if (character === "\"" || character === "'" || character === "`") {
+      quote = character;
+      continue;
+    }
+    if (character === "/" && next === "*") return { index, kind: "block" };
+    if (character === "/" && next === "/") return { index, kind: "line" };
+    if (((hashComments && character === "#") || (character === "-" && next === "-"))
+      && (index === cursor || /\s/.test(source[index - 1] ?? ""))) return { index, kind: "line" };
+  }
+  return undefined;
+}
+
+function shieldExecutableSourceReferences(input, { shellOnly = false, hashComments = true } = {}) {
+  const references = [];
+  let nonce = 0;
+  let markerPrefix;
+  do {
+    markerPrefix = `__PIAGENT_DSR_${nonce}_`;
+    nonce += 1;
+  } while (String(input ?? "").includes(markerPrefix));
+  const placeholder = (value) => {
+    const id = `${markerPrefix}${references.length}__`;
+    references.push({ id, value });
+    return id;
+  };
+  const rewriteCode = (segment) => rewriteSensitiveSegment(segment, {
+    allowDynamic: true, shellOnly, placeholder
+  });
+  const rewriteComment = (segment) => rewriteSensitiveSegment(segment, {
+    allowDynamic: false, shellOnly, placeholder
+  });
+  const source = String(input ?? "");
+  let result = "", cursor = 0, blockComment = false;
+  while (cursor < source.length) {
+    if (blockComment) {
+      const end = source.indexOf("*/", cursor);
+      if (end < 0) {
+        result += rewriteComment(source.slice(cursor));
+        cursor = source.length;
+      } else {
+        const body = rewriteComment(source.slice(cursor, end));
+        result += `${body}*/`;
+        cursor = end + 2;
+        blockComment = false;
+      }
+      continue;
+    }
+    const comment = nextSourceComment(source, cursor, { hashComments });
+    if (!comment) {
+      result += rewriteCode(source.slice(cursor));
+      cursor = source.length;
+      continue;
+    }
+    result += rewriteCode(source.slice(cursor, comment.index));
+    if (comment.kind === "line") {
+      const lineEnd = source.indexOf("\n", comment.index);
+      const end = lineEnd < 0 ? source.length : lineEnd;
+      result += rewriteComment(source.slice(comment.index, end));
+      if (lineEnd >= 0) result += "\n";
+      cursor = lineEnd < 0 ? source.length : lineEnd + 1;
+    } else {
+      result += "/*";
+      cursor = comment.index + 2;
+      blockComment = true;
+    }
+  }
+  return {
+    text: result,
+    restore(value) {
+      let restored = value;
+      for (const reference of references) restored = restored.replaceAll(reference.id, reference.value);
+      return restored;
+    }
+  };
+}
+
+const SENSITIVE_SOURCE_QUOTED_HEREDOC_PATTERN = /(^[ \t]*(?:(?:const|let|var)\s+)?([$@%]?[A-Za-z_$][A-Za-z0-9_$]*)\s*(?:=|<-|:=)\s*)<<[-~]?(["'])([A-Za-z_][A-Za-z0-9_]*)\3[^\r\n]*(?:\r\n|\n|\r)([\s\S]*?)(^[ \t]*\4[ \t]*$)/gm;
+const SENSITIVE_SOURCE_BARE_HEREDOC_PATTERN = /(^[ \t]*(?:(?:const|let|var)\s+)?([$@%]?[A-Za-z_$][A-Za-z0-9_$]*)\s*(?:=|<-|:=)\s*)<<[-~]?([A-Za-z_][A-Za-z0-9_]*)[^\r\n]*(?:\r\n|\n|\r)([\s\S]*?)(^[ \t]*\3[ \t]*$)/gm;
+
+function redactSensitiveSourceHeredocs(input) {
+  const redactMatch = (match, prefix, key) => {
+    if (!keyLooksSensitive(key)) return match;
+    const secretPayload = match.slice(prefix.length);
+    const lineEndings = secretPayload.match(/\r\n|\n|\r/g) ?? [];
+    return `${prefix}${REDACTION}${lineEndings.join("")}`;
+  };
+  const quoted = input.replace(SENSITIVE_SOURCE_QUOTED_HEREDOC_PATTERN, redactMatch);
+  return quoted.replace(SENSITIVE_SOURCE_BARE_HEREDOC_PATTERN, redactMatch);
+}
+
+function redactSourceText(input, options) {
+  if (typeof input !== "string") return { text: "", redacted: false };
+  const heredocRedacted = options?.shellOnly ? input : redactSensitiveSourceHeredocs(input);
+  const shielded = shieldExecutableSourceReferences(heredocRedacted, options);
+  const redacted = redactSensitiveTextInternal(shielded.text);
+  const text = shielded.restore(redacted.text);
+  return { text, redacted: text !== input };
+}
+
+function restorableMarkers(input, domain) {
+  const references = [];
+  let nonce = 0;
+  let prefix;
+  do {
+    prefix = `__PIAGENT_${domain}_${nonce}_`;
+    nonce += 1;
+  } while (input.includes(prefix));
+  return {
+    protect(value) {
+      const id = `${prefix}${references.length}__`;
+      references.push({ id, value });
+      return id;
+    },
+    restore(value) {
+      let restored = value;
+      for (const reference of references) restored = restored.replaceAll(reference.id, reference.value);
+      return restored;
+    }
+  };
+}
+
+function unquotedConfigurationValue(value) {
+  const clean = String(value ?? "").trim();
+  if (clean.length >= 2 && ((clean.startsWith("\"") && clean.endsWith("\""))
+    || (clean.startsWith("'") && clean.endsWith("'")))) return clean.slice(1, -1).trim();
+  return clean;
+}
+
+function pureConfigurationReference(value, { allowBareIdentifier = false } = {}) {
+  const clean = unquotedConfigurationValue(value);
+  if (!clean) return false;
+  if (/^(?:\$[A-Za-z_][A-Za-z0-9_]*|\$\{[A-Za-z_][A-Za-z0-9_]*\}|\*[A-Za-z_][A-Za-z0-9_.-]*|!Ref\s+[A-Za-z_][A-Za-z0-9_.:-]*)$/.test(clean)) return true;
+  const template = /^(?:\$?\{\{)([\s\S]+)\}\}$/.exec(clean);
+  if (template) return sourceReference(template[1], false);
+  if (/^(?:var|env|attr)\(\s*(?:--)?[A-Za-z_$][A-Za-z0-9_$.-]*\s*\)$/i.test(clean)) return true;
+  if (!sourceReference(clean, false)) return false;
+  return allowBareIdentifier || /(?:\.|->|::|\?\.|\(|\[)/.test(clean)
+    || /^(?:await\s+|this\b|self\b|super\b|[$@%])/.test(clean)
+    || /_(?:REF|VAR|ENV)$/.test(clean);
+}
+
+function yamlValueParts(value) {
+  let quote = "", escaped = false;
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index];
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === quote) quote = "";
+      continue;
+    }
+    if (character === "\"" || character === "'") quote = character;
+    else if (character === "#" && (index === 0 || /\s/.test(value[index - 1]))) {
+      return { value: value.slice(0, index).trimEnd(), comment: value.slice(index) };
+    }
+  }
+  return { value: value.trimEnd(), comment: "" };
+}
+
+function redactSensitiveYamlText(input) {
+  const markers = restorableMarkers(input, "YAML_REF");
+  const parts = input.split(/(\r\n|\n|\r)/);
+  let blockIndent = -1;
+  for (let index = 0; index < parts.length; index += 2) {
+    const line = parts[index];
+    const indentation = (line.match(/^[ \t]*/) ?? [""])[0].replaceAll("\t", "  ").length;
+    if (blockIndent >= 0) {
+      if (!line.trim() || indentation > blockIndent) {
+        parts[index] = line.trim() ? (line.match(/^[ \t]*/) ?? [""])[0] : line;
+        continue;
+      }
+      blockIndent = -1;
+    }
+    const match = /^([ \t]*(?:-[ \t]+)?((?:"(?:\\.|[^"])*"|'(?:''|[^'])*'|[A-Za-z_$][A-Za-z0-9_$.-]*))[ \t]*:[ \t]*)(.*)$/.exec(line);
+    if (!match || !keyLooksSensitive(match[2])) continue;
+    const rhs = yamlValueParts(match[3]);
+    if (rhs.value && pureConfigurationReference(rhs.value)) {
+      const comment = rhs.comment ? ` ${redactSensitiveTextInternal(rhs.comment.trimStart()).text}` : "";
+      parts[index] = `${markers.protect(`${match[1]}${rhs.value}`)}${comment}`;
+      continue;
+    }
+    parts[index] = `${match[1]}${REDACTION}${rhs.comment ? ` ${rhs.comment.trimStart()}` : ""}`;
+    if (!rhs.value || /^[>|][+-]?(?:\d+)?$/.test(rhs.value.trim())) blockIndent = indentation;
+  }
+  const structured = parts.join("");
+  const generic = redactSensitiveTextInternal(structured);
+  const text = markers.restore(generic.text);
+  return { text, redacted: text !== input };
+}
+
+function markupLookupKey(attributes) {
+  const match = /\b(?:key|name)\s*=\s*(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)'|([^\s>]+))/i.exec(attributes);
+  return match ? (match[1] ?? match[2] ?? match[3] ?? "") : "";
+}
+
+function redactMarkupAttributes(tag, markers) {
+  if (/^<\s*\//.test(tag)) return tag;
+  const lookupKey = markupLookupKey(tag);
+  return tag.replace(/(\s)([A-Za-z_:][A-Za-z0-9_.:-]*)(\s*=\s*)(?:(["'])((?:\\.|(?!\4)[\s\S])*?)\4|([^\s>]+))/g,
+    (match, spacing, key, separator, quote, quotedValue, bareValue) => {
+      const value = quotedValue ?? bareValue ?? "";
+      const sensitive = keyLooksSensitive(key)
+        || (keyLooksSensitive(lookupKey) && ["value", "content"].includes(key.toLowerCase()));
+      if (!sensitive) return match;
+      const expressionBinding = key.startsWith(":") || key.toLowerCase().startsWith("v-bind:");
+      if (pureConfigurationReference(value, { allowBareIdentifier: expressionBinding })) {
+        return `${spacing}${markers.protect(match.slice(spacing.length))}`;
+      }
+      return `${spacing}${key}${separator}${quote ? `${quote}${REDACTION}${quote}` : REDACTION}`;
+    });
+}
+
+function markupTags(input) {
+  const tags = [];
+  for (let start = input.indexOf("<"); start >= 0; start = input.indexOf("<", start + 1)) {
+    let quote = "", escaped = false, end = start + 1;
+    for (; end < input.length; end += 1) {
+      const character = input[end];
+      if (quote) {
+        if (escaped) escaped = false;
+        else if (character === "\\") escaped = true;
+        else if (character === quote) quote = "";
+      } else if (character === "\"" || character === "'") quote = character;
+      else if (character === ">") break;
+    }
+    if (end >= input.length) break;
+    const text = input.slice(start, end + 1);
+    const parsed = /^<\s*(\/)?\s*([A-Za-z_][A-Za-z0-9_.:-]*)\b([\s\S]*?)>$/.exec(text);
+    if (parsed) tags.push({ start, end: end + 1, text, closing: Boolean(parsed[1]), name: parsed[2], attributes: parsed[3] });
+    start = end;
+  }
+  return tags;
+}
+
+function rewriteMarkupTags(input, rewriter) {
+  let result = "", cursor = 0;
+  for (const tag of markupTags(input)) {
+    result += `${input.slice(cursor, tag.start)}${rewriter(tag.text)}`;
+    cursor = tag.end;
+  }
+  return `${result}${input.slice(cursor)}`;
+}
+
+function redactMarkupPairs(input, markers) {
+  const stack = [];
+  const replacements = [];
+  for (const tag of markupTags(input)) {
+    const tagName = tag.name.toLowerCase();
+    if (!tag.closing && !/\/\s*>$/.test(tag.text)) {
+      stack.push({
+        tagName,
+        contentStart: tag.end,
+        sensitive: keyLooksSensitive(tagName.split(":").at(-1) ?? tagName)
+          || keyLooksSensitive(markupLookupKey(tag.attributes))
+      });
+      continue;
+    }
+    if (!tag.closing) continue;
+    let openIndex = stack.length - 1;
+    while (openIndex >= 0 && stack[openIndex].tagName !== tagName) openIndex -= 1;
+    if (openIndex < 0) continue;
+    const open = stack[openIndex];
+    stack.length = openIndex;
+    if (!open.sensitive) continue;
+    const content = input.slice(open.contentStart, tag.start);
+    replacements.push({
+      start: open.contentStart,
+      end: tag.start,
+      value: pureConfigurationReference(content)
+        ? markers.protect(content)
+        : `${REDACTION}${(content.match(/\r\n|\n|\r/g) ?? []).join("")}`
+    });
+  }
+
+  // An outer sensitive element supersedes any replacement wholly inside it.
+  const selected = replacements.filter((candidate) => !replacements.some((other) => other !== candidate
+    && other.start <= candidate.start && other.end >= candidate.end));
+  let result = input;
+  for (const replacement of selected.sort((left, right) => right.start - left.start)) {
+    result = `${result.slice(0, replacement.start)}${replacement.value}${result.slice(replacement.end)}`;
+  }
+  return result;
+}
+
+function redactSensitiveMarkupText(input) {
+  const markers = restorableMarkers(input, "MARKUP_REF");
+  const paired = redactMarkupPairs(input, markers);
+  const structured = rewriteMarkupTags(paired, (tag) => redactMarkupAttributes(tag, markers));
+  const generic = redactSensitiveTextInternal(structured);
+  const text = markers.restore(generic.text);
+  return { text, redacted: text !== input };
+}
+
+function redactSensitiveCssText(input) {
+  const markers = restorableMarkers(input, "CSS_REF");
+  const structured = input.replace(/(^|[;{}\r\n])([ \t]*(--)?([A-Za-z_$][A-Za-z0-9_$-]*)[ \t]*:[ \t\r\n]*)([^;}]*)(?=;|}|$)/g,
+    (match, boundary, prefix, _custom, key, value) => {
+      if (!keyLooksSensitive(key)) return match;
+      if (pureConfigurationReference(value)) return `${boundary}${markers.protect(`${prefix}${value}`)}`;
+      return `${boundary}${prefix}${REDACTION}${(value.match(/\r\n|\n|\r/g) ?? []).join("")}`;
+    });
+  const generic = redactSensitiveTextInternal(structured);
+  const text = markers.restore(generic.text);
+  return { text, redacted: text !== input };
+}
+
+const SOURCE_OBJECTIVE_C_TYPED_ASSIGNMENT_START_PATTERN = /(^|[\r\n;{])([ \t]*(?:(?:const|static|extern|volatile|__strong|__weak|nullable|nonnull|unsigned|signed|long|short)\s+)*(?:[A-Za-z_$][A-Za-z0-9_$]*(?:\s*<[^>\r\n;=]+>)?\s+)*[A-Za-z_$][A-Za-z0-9_$]*(?:\s*<[^>\r\n;=]+>)?\s*\*+\s*(#?[A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*)/g;
+const SOURCE_OBJECTIVE_C_DICTIONARY_START_PATTERN = /(^|[\s{[(;,])((?:@")([A-Za-z_$][A-Za-z0-9_$.-]*)(?:"\s*:\s*))/g;
+
+function objectiveCReference(value) {
+  if (sourceReference(value, false)) return true;
+  const clean = String(value ?? "").trim();
+  const masked = maskSourceLookupStrings(clean);
+  return Boolean(masked && /^\[[A-Za-z_$]/.test(masked)
+    && /^[A-Za-z0-9_$@%?.()[\]{},!:\s|&+*/<>=-]+$/.test(masked)
+    && balancedSourceExpression(masked)
+    && !hasStandaloneNumericSourceLiteral(masked)
+    && !hasStandaloneKeywordSourceLiteral(masked));
+}
+
+function redactSensitiveObjectiveCText(input) {
+  let source = rewriteSensitiveStarts(input, SOURCE_OBJECTIVE_C_TYPED_ASSIGNMENT_START_PATTERN, {
+    allowDynamic: true,
+    shellOnly: false,
+    placeholder: (value) => value,
+    reference: objectiveCReference
+  });
+  source = rewriteSensitiveStarts(source, SOURCE_OBJECTIVE_C_DICTIONARY_START_PATTERN, {
+    allowDynamic: true,
+    shellOnly: false,
+    placeholder: (value) => value,
+    reference: objectiveCReference
+  });
+  source = source.replace(/(^|[^A-Za-z0-9_$])((#?[A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*)@"((?:\\.|[^"\\\r\n])*)"/g,
+    (match, boundary, prefix, key) => keyLooksSensitive(key)
+      ? `${boundary}${prefix}@"${REDACTION}"`
+      : match);
+  source = source.replace(/(^|[^A-Za-z0-9_$])((#?[A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*)(@?(?:0[xX][0-9A-Fa-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?|YES|NO|nil|NULL))(?=[\s;,)])/g,
+    (match, boundary, prefix, key) => keyLooksSensitive(key)
+      ? `${boundary}${prefix}${REDACTION}`
+      : match);
+  source = source.replace(/(@"((?:\\.|[^"\\\r\n])*)"\s*:\s*)@"((?:\\.|[^"\\\r\n])*)"/g,
+    (match, prefix, key) => keyLooksSensitive(key)
+      ? `${prefix}@"${REDACTION}"`
+      : match);
+  source = source.replace(/(@"((?:\\.|[^"\\\r\n])*)"\s*:\s*)(@?(?:0[xX][0-9A-Fa-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?|YES|NO|nil|NULL))(?=[\s,}])/g,
+    (match, prefix, key) => keyLooksSensitive(key)
+      ? `${prefix}${REDACTION}`
+      : match);
+  const result = redactSourceText(source, { shellOnly: false, hashComments: false });
+  return { text: result.text, redacted: result.text !== input };
+}
+
+export function redactSensitiveSourceText(input) {
+  return redactSourceText(input, { shellOnly: false, hashComments: true });
+}
+
+export function redactSensitiveShellSourceText(input) {
+  return redactSourceText(input, { shellOnly: true });
+}
+
+
+export {
+  redactSensitiveCssText,
+  redactSensitiveMarkupText,
+  redactSensitiveObjectiveCText,
+  redactSensitiveYamlText,
+  redactSourceText
+};

package/packages/piagent-core/security/sensitive-text.js

@@ -0,0 +1,234 @@
+const REDACTION = "[REDACTED_SECRET]";
+
+const TOKEN_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /\bAKIA[0-9A-Z]{16}\b/g,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+  /\bgh[opsru]_[A-Za-z0-9_]{20,}\b/g,
+  /\bsk-(?:(?:proj|svcacct|admin|ant)-)?[A-Za-z0-9_-]{20,}\b/g,
+  /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/g,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
+  // An npm token was recognised only where something named it -- `NPM_TOKEN=...`
+  // caught the assignment, a field called `token` caught the field -- so the one
+  // place it actually appears was missed: `//registry.npmjs.org/:_authToken=npm_…`
+  // is the whole of an `.npmrc`, and a `cat` of that file or a failing publish log
+  // carried the credential through unredacted. Every other provider here is
+  // recognised by the shape of its token; npm was the gap.
+  /\bnpm_[A-Za-z0-9]{30,}\b/g,
+  /\bAIza[0-9A-Za-z_-]{20,}\b/g,
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g
+];
+
+const CONNECTION_URL_PATTERN = /\b((?:https?|ftp|postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/"']+:)([^@\s/"']+)(@[^\s"'<>]+)/gi;
+const BEARER_PATTERN = /\b(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})\b/gi;
+const BASIC_AUTH_PATTERN = /\b(Basic\s+)([A-Za-z0-9+/]{12,}={0,2})(?=$|[\s,;}])/gi;
+// The value is one whitespace-free token, not the rest of the line. Taking the
+// rest of the line made the result depend on where the header sat among the
+// arguments: `curl URL -H "Authorization: Token abc123"` yielded `abc123"`, short
+// enough to keep, while moving the header before the URL swept the URL into the
+// value and pushed it past the length bar. Same header, same credential, opposite
+// outcome. Credentials carry no spaces, so stopping at the first one also keeps
+// prose like "Authorization: not required for local runs" intact.
+const AUTHORIZATION_HEADER_PATTERN = /\b(Authorization\s*:\s*)([A-Za-z][A-Za-z0-9_-]{0,31})(\s+)([^\s\r\n"'`]+)/gi;
+
+// A credential passed as a command-line option, which is how most CLIs take one.
+// The assignment patterns below require a key starting with a letter, so every
+// `--token=...` and `--token ...` walked straight past them.
+const CLI_OPTION_SECRET_PATTERN = /(^|[\s({[])(--[A-Za-z][A-Za-z0-9_.-]{0,80})(=|\s+)("[^"\r\n]*"|'[^'\r\n]*'|[^\s"'`;,)}]+)/g;
+
+// Under one of these schemes the header carries an opaque credential, so its
+// length says nothing. Anything else after `Authorization:` is more likely prose
+// — "Authorization: not required" — and keeps the ambiguous-syntax length bar.
+const AUTHORIZATION_SCHEMES = new Set([
+  "bearer", "basic", "token", "digest", "negotiate", "ntlm",
+  "oauth", "hawk", "signature", "apikey", "jwt", "aws4-hmac-sha256"
+]);
+const QUERY_SECRET_PATTERN = /([?&])([A-Za-z][A-Za-z0-9_.-]{0,80})(=)([^&#\s]+)/gi;
+const DOUBLE_QUOTED_SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?[$@%]?[A-Za-z][A-Za-z0-9_.-]{0,80}(?:"|')?\s*)(:=|:|=(?!=))\s*"((?:\\.|[^"\\\r\n])*)"/gim;
+const SINGLE_QUOTED_SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?[$@%]?[A-Za-z][A-Za-z0-9_.-]{0,80}(?:"|')?\s*)(:=|:|=(?!=))\s*'((?:\\.|[^'\\\r\n])*)'/gim;
+const SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?[$@%]?[A-Za-z][A-Za-z0-9_.-]{0,80}(?:"|')?\s*)(:=|:|=(?!=))\s*([^"'\s,;}]+)/gim;
+const WHITESPACE_SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?(?:aws_)?secret_access_key(?:"|')?\s+)(["']?)([A-Za-z0-9/+=]{20,})/gim;
+
+const SENSITIVE_KEY_TERMS = [
+  "api_key",
+  "token",
+  "password",
+  "passwd",
+  "pwd",
+  "secret",
+  "credential",
+  "client_secret",
+  "access_token",
+  "refresh_token",
+  "secret_access_key",
+  "passphrase",
+  "private_key",
+  "signing_key",
+  "authorization"
+];
+const SENSITIVE_PLURAL_KEYS = new Set([
+  "tokens",
+  "api_keys",
+  "passwords",
+  "secrets",
+  "credentials",
+  "client_secrets",
+  "access_tokens",
+  "refresh_tokens",
+  "session_tokens",
+  "passphrases",
+  "private_keys",
+  "signing_keys",
+  "authorizations"
+]);
+
+function normalizeSecretValue(value) {
+  return String(value ?? "")
+    .trim()
+    .replace(/^[`"']|[`"']$/g, "")
+    .replace(/[.;)]+$/g, "");
+}
+
+function patternMatches(pattern, value) {
+  pattern.lastIndex = 0;
+  return pattern.test(value);
+}
+
+function looksLikeKnownSecret(value) {
+  return TOKEN_PATTERNS.some((pattern) => patternMatches(pattern, value))
+    || patternMatches(CONNECTION_URL_PATTERN, value)
+    || patternMatches(BEARER_PATTERN, value);
+}
+
+function normalizeSecretKey(key) {
+  return String(key ?? "")
+    .trim()
+    .replace(/^["']|["']$/g, "")
+    .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+    .replace(/[^A-Za-z0-9]+/g, "_")
+    .replace(/^_+|_+$/g, "")
+    .toLowerCase();
+}
+
+function keyLooksSensitive(key) {
+  const normalized = normalizeSecretKey(key);
+  return SENSITIVE_PLURAL_KEYS.has(normalized) || SENSITIVE_KEY_TERMS.some((term) => normalized === term
+    || normalized.endsWith(`_${term}`));
+}
+
+function valueLooksPlaceholder(value) {
+  const clean = normalizeSecretValue(value);
+  if (!clean) return true;
+  if (/^(?:null|undefined|none|false|true|0|""|'')$/i.test(clean)) return true;
+  if (/^<[^>\n]{1,80}>$/.test(clean)) return true;
+  if (/^\[REDACTED_SECRET\]$/i.test(clean)) return true;
+  if (/^(?:not-set|unset|placeholder|example|changeme|change-me|redacted|xxx|\*{3,})$/i.test(clean)) return true;
+  if (/^your[-_][a-z0-9][a-z0-9_-]*$/i.test(clean)) return true;
+  return false;
+}
+
+// Length is only evidence where the syntax is ambiguous, and `=` is not.
+//
+// A short value used to be kept in the clear whatever the syntax, so `TOKEN=hunter2`
+// and `PASSWORD=short7` went into the ledger verbatim. Every name in
+// SENSITIVE_KEY_TERMS states outright what it holds — there is no `key` or `id`
+// among them — so under an `=`, or inside quotes, a non-placeholder value is the
+// secret the key says it is, at any length.
+//
+// A bare `:` is the ambiguous case, because English uses it too: `password: short`
+// and `The secret: always run tests` are prose, and `Authorization: Token abc123`
+// puts the scheme name where a value would go. Those keep a length bar.
+const SHORT_VALUE_MIN_LENGTH = 8;
+const AMBIGUOUS_VALUE_MIN_LENGTH = 12;
+
+function valueLooksSensitive(key, value, syntax = "unquoted-colon") {
+  const clean = normalizeSecretValue(value);
+  if (!clean || valueLooksPlaceholder(clean)) return false;
+  if (looksLikeKnownSecret(clean)) return true;
+  if (!keyLooksSensitive(key)) return false;
+  if (syntax !== "unquoted-colon") return true;
+  return clean.length >= (keyNamesASecretOutright(key) ? SHORT_VALUE_MIN_LENGTH : AMBIGUOUS_VALUE_MIN_LENGTH);
+}
+
+// Under a bare `:`, these names carry enough intent on their own to redact a short
+// value; the broader terms wait for length before touching prose.
+function keyNamesASecretOutright(key) {
+  const normalized = normalizeSecretKey(key);
+  return ["password", "passwd", "pwd", "secret", "credential", "passphrase", "private_key", "signing_key"]
+    .some((term) => normalized === term || normalized.endsWith(`_${term}`))
+    || ["passwords", "secrets", "credentials", "passphrases", "private_keys", "signing_keys"].includes(normalized);
+}
+
+function assignmentSyntax(separator) {
+  return separator.includes("=") || separator.includes("<-") ? "assignment" : "unquoted-colon";
+}
+
+function redactSensitiveTextInternal(input) {
+  if (typeof input !== "string") return { text: "", redacted: false };
+  let text = input;
+
+  text = text.replace(CONNECTION_URL_PATTERN, (_match, prefix, _password, suffix) => `${prefix}${REDACTION}${suffix}`);
+  text = text.replace(BEARER_PATTERN, (_match, prefix) => `${prefix}${REDACTION}`);
+  text = text.replace(BASIC_AUTH_PATTERN, (_match, prefix) => `${prefix}${REDACTION}`);
+  text = text.replace(AUTHORIZATION_HEADER_PATTERN, (match, prefix, scheme, spacing, value) => {
+    const syntax = AUTHORIZATION_SCHEMES.has(scheme.toLowerCase()) ? "assignment" : "unquoted-colon";
+    if (!valueLooksSensitive("authorization", value, syntax)) return match;
+    return `${prefix}${scheme}${spacing}${REDACTION}`;
+  });
+
+  // Over-redaction is the safe direction here: a flag whose name says "secret"
+  // and whose argument is a plain name — `docker service create --secret build` —
+  // loses that name from the record and cannot serve as verify evidence. Reading
+  // the name as the credential it is called is the cheaper mistake.
+  text = text.replace(CLI_OPTION_SECRET_PATTERN, (match, prefix, flag, separator, value) => {
+    // A following option is the next flag, not this flag's argument.
+    if (separator !== "=" && value.startsWith("-")) return match;
+    if (!keyLooksSensitive(flag) || !valueLooksSensitive(flag, value, "assignment")) return match;
+    return `${prefix}${flag}${separator === "=" ? "= " : " "}${REDACTION}`;
+  });
+
+  for (const pattern of TOKEN_PATTERNS) text = text.replace(pattern, REDACTION);
+
+  text = text.replace(QUERY_SECRET_PATTERN, (match, prefix, key, separator, value) => {
+    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, "assignment")) return match;
+    return `${prefix}${key}${separator}${REDACTION}`;
+  });
+
+  text = text.replace(DOUBLE_QUOTED_SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, separator, value) => {
+    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, "quoted")) return match;
+    return `${prefix}${key}${separator} "${REDACTION}"`;
+  });
+
+  text = text.replace(SINGLE_QUOTED_SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, separator, value) => {
+    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, "quoted")) return match;
+    return `${prefix}${key}${separator} '${REDACTION}'`;
+  });
+
+  text = text.replace(SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, separator, value) => {
+    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, assignmentSyntax(separator))) return match;
+    return `${prefix}${key}${separator} ${REDACTION}`;
+  });
+
+  text = text.replace(WHITESPACE_SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, quote, value) => {
+    if (!valueLooksSensitive(key, value)) return match;
+    return `${prefix}${key}${quote}${REDACTION}`;
+  });
+
+  return { text, redacted: text !== input };
+}
+
+export function redactSensitiveText(input) {
+  return redactSensitiveTextInternal(input);
+}
+
+export {
+  REDACTION,
+  SENSITIVE_KEY_TERMS,
+  SENSITIVE_PLURAL_KEYS,
+  keyLooksSensitive,
+  looksLikeKnownSecret,
+  normalizeSecretKey,
+  redactSensitiveTextInternal,
+  valueLooksPlaceholder,
+  valueLooksSensitive
+};

package/packages/piagent-core/subagents/piagent-oracle.md

@@ -4,13 +4,15 @@ description: Piagent second-opinion advisor for risky plans and architecture dec
 tools: read, grep, find, ls
 thinking: high
 systemPromptMode: replace
-inheritProjectContext: true
+inheritProjectContext: false
 inheritSkills: false
-defaultContext: fork
+defaultContext: fresh
+turnBudget: {"maxTurns":8,"graceTurns":0}
 defaultProgress: true
 acceptance: {"level":"attested"}
 acceptanceRole: read-only
 rolePolicyVersion: role-policy-v1
+helperRequestSchemaVersion: 2
 outputSchema: oracle-result-v1
 ---
 
@@ -18,7 +20,7 @@ You are `piagent-oracle`, a second-opinion subagent.
 
 Your job is to challenge assumptions before implementation. Do not edit files. Focus on risks, missed constraints, simpler alternatives, and verification strategy.
 
-The parent must supply a bounded HelperRequest v1. This is one optional second opinion, not a mandatory phase. Stay inside its read/tool/budget/stopping boundaries and never perform or request external writes, destructive actions, or permission expansion.
+The parent must supply a bounded HelperRequest v2 with `isolated-minimal` context transfer. This is the sole optional helper, not a mandatory phase. Stay inside its read/tool/budget/stopping boundaries and never perform or request external writes, destructive actions, permission expansion, another helper, or a retry.
 
 Return a concise recommendation: