@primitive.ai/prim 0.1.0-alpha.68 → 0.1.0-alpha.69

package/dist/chunk-FI3LIRCB.js

@@ -0,0 +1,262 @@
+import {
+  boundedHealthError
+} from "./chunk-LEMX3IOG.js";
+import {
+  terminalSafeLine
+} from "./chunk-Z7YPFWAZ.js";
+
+// src/hooks/redact.ts
+import { existsSync, readFileSync, statSync } from "fs";
+import { join } from "path";
+import { Worker } from "worker_threads";
+var USER_HOME_RULES = [
+  {
+    pattern: /\/Users\/[^/\\\s"'`]+/g,
+    reason: "user-home-path",
+    replacement: "/Users/__redacted_user__"
+  },
+  {
+    pattern: /\/home\/[^/\\\s"'`]+/g,
+    reason: "user-home-path",
+    replacement: "/home/__redacted_user__"
+  },
+  {
+    pattern: /([A-Za-z]:\\Users\\)[^/\\\s"'`]+/gi,
+    reason: "user-home-path",
+    replacement: "$1__redacted_user__"
+  },
+  {
+    pattern: /\/root(?=\/|$)/g,
+    reason: "user-home-path",
+    replacement: "/__redacted_user__"
+  }
+];
+var DEFAULT_RULES = [
+  { pattern: /Bearer\s+[A-Za-z0-9._~+/=-]+/gi, reason: "bearer-token" },
+  {
+    pattern: /\bsk-(?:(?:ant|proj)-)?[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    reason: "sk-api-key"
+  },
+  {
+    pattern: /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]+?-----END [A-Z ]+PRIVATE KEY-----/g,
+    reason: "private-key"
+  },
+  { pattern: /xox[abprs]-[A-Za-z0-9-]{10,}/g, reason: "slack-token" },
+  {
+    pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{50,})\b/g,
+    reason: "github-pat"
+  },
+  { pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, reason: "aws-access-key" },
+  {
+    pattern: /\bAWS_(?:SECRET_ACCESS_KEY|SESSION_TOKEN)"?\s*[:=]\s*["']?[A-Za-z0-9/+=]{20,}["']?/gi,
+    reason: "aws-secret"
+  },
+  { pattern: /\bAIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])/g, reason: "gcp-api-key" },
+  {
+    pattern: /\bya29\.[0-9A-Za-z_-]{20,}(?![0-9A-Za-z_-])/g,
+    reason: "gcp-oauth-token"
+  },
+  {
+    pattern: /\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*(?![A-Za-z0-9_-])/g,
+    reason: "jwt"
+  },
+  { pattern: /\bBasic\s+[A-Za-z0-9+/]+={0,2}/gi, reason: "basic-auth" },
+  { pattern: /\bhttps?:\/\/[^/\s:@]+:[^/\s@]+@/gi, reason: "basic-auth" },
+  ...USER_HOME_RULES
+];
+var MAX_SCRUB_LEN = 256e3;
+var MAX_WORKSPACE_CONFIG_BYTES = 64 * 1024;
+var MAX_WORKSPACE_RULES = 32;
+var MAX_WORKSPACE_PATTERN_LENGTH = 512;
+var MAX_WORKSPACE_REASON_LENGTH = 64;
+var WORKSPACE_RULE_TIMEOUT_MS = 250;
+var WORKSPACE_FILE = ".prim/redaction.json";
+var SAFE_REASON_RE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/u;
+var SAFE_WORKSPACE_FLAGS_RE = /^[gimsu]*$/u;
+function debugRedaction(message) {
+  writeHookDebug(`redaction: ${message}`);
+}
+function normalizedWorkspaceFlags(value) {
+  if (value !== void 0 && typeof value !== "string") return null;
+  const requested = value ?? "";
+  if (!SAFE_WORKSPACE_FLAGS_RE.test(requested)) return null;
+  return [...new Set(`g${requested}`)].sort().join("");
+}
+function loadWorkspaceRules(cwd) {
+  const path = join(cwd, WORKSPACE_FILE);
+  if (!existsSync(path)) return [];
+  let cfg;
+  try {
+    if (statSync(path).size > MAX_WORKSPACE_CONFIG_BYTES) {
+      debugRedaction(`ignoring oversized ${WORKSPACE_FILE}`);
+      return [];
+    }
+    cfg = JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    debugRedaction(`ignoring unparseable ${WORKSPACE_FILE}`);
+    return [];
+  }
+  if (!Array.isArray(cfg.rules)) return [];
+  const compiled = [];
+  for (const candidate of cfg.rules.slice(0, MAX_WORKSPACE_RULES)) {
+    if (!candidate || typeof candidate !== "object") continue;
+    const { pattern, reason } = candidate;
+    const flags = normalizedWorkspaceFlags(candidate.flags);
+    if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > MAX_WORKSPACE_PATTERN_LENGTH || typeof reason !== "string" || reason.length === 0 || reason.length > MAX_WORKSPACE_REASON_LENGTH || !SAFE_REASON_RE.test(reason) || flags === null) {
+      debugRedaction("skipping invalid workspace rule metadata");
+      continue;
+    }
+    try {
+      compiled.push({ pattern: new RegExp(pattern, flags), reason });
+    } catch {
+      debugRedaction(`skipping invalid workspace rule ${reason}`);
+    }
+  }
+  return compiled;
+}
+function applyRules(input, rules) {
+  if (input.length > MAX_SCRUB_LEN) return "<REDACTED:oversized>";
+  let out = input;
+  for (const rule of rules) {
+    out = out.replace(rule.pattern, rule.replacement ?? `<REDACTED:${rule.reason}>`);
+  }
+  return out;
+}
+var REDACTED_OBJECT_KEY = "<REDACTED:object-key>";
+function redactedObjectKey(input, transform) {
+  return transform(input) === input ? input : REDACTED_OBJECT_KEY;
+}
+function uniqueObjectKey(output, key) {
+  let candidate = key;
+  let suffix = 2;
+  while (Object.hasOwn(output, candidate)) candidate = `${key}_${suffix++}`;
+  return candidate;
+}
+function mapStrings(value, transform) {
+  if (typeof value === "string") return transform(value);
+  if (Array.isArray(value)) return value.map((item) => mapStrings(item, transform));
+  if (value && typeof value === "object") {
+    const out = /* @__PURE__ */ Object.create(null);
+    for (const [key, item] of Object.entries(value)) {
+      out[uniqueObjectKey(out, redactedObjectKey(key, transform))] = mapStrings(item, transform);
+    }
+    return out;
+  }
+  return value;
+}
+function scrub(value, rules = DEFAULT_RULES) {
+  return mapStrings(value, (input) => applyRules(input, rules));
+}
+function debugDetail(value) {
+  try {
+    return String(value instanceof Error ? value.message : value);
+  } catch {
+    return "unprintable detail";
+  }
+}
+function writeHookDebug(context, ...details) {
+  if (!process.env.PRIM_HOOK_DEBUG) return;
+  const raw = details.length > 0 ? `${context}: ${details.map(debugDetail).join(": ")}` : context;
+  const normalized = terminalSafeLine(raw);
+  const message = boundedHealthError(scrub(normalized, DEFAULT_RULES)) ?? context;
+  process.stderr.write(`[prim-hook] ${message === `${context}:` ? context : message}
+`);
+}
+function redactEveryString(value, reason) {
+  return mapStrings(value, () => `<REDACTED:${reason}>`);
+}
+var WORKSPACE_REDACTION_WORKER = String.raw`
+  const { parentPort, workerData } = require("node:worker_threads");
+  const REDACTED_OBJECT_KEY = "<REDACTED:object-key>";
+  const rules = workerData.rules.map((rule) => ({
+    pattern: new RegExp(rule.source, rule.flags),
+    reason: rule.reason,
+  }));
+  function redact(input) {
+      let output = input;
+      for (const rule of rules) {
+        output = output.replace(rule.pattern, "<REDACTED:" + rule.reason + ">");
+      }
+      return output;
+  }
+  function objectKey(input) {
+    return redact(input) === input ? input : REDACTED_OBJECT_KEY;
+  }
+  function uniqueKey(output, key) {
+    let candidate = key;
+    let suffix = 2;
+    while (Object.hasOwn(output, candidate)) candidate = key + "_" + suffix++;
+    return candidate;
+  }
+  function walk(value) {
+    if (typeof value === "string") {
+      return redact(value);
+    }
+    if (Array.isArray(value)) return value.map(walk);
+    if (value && typeof value === "object") {
+      const output = Object.create(null);
+      for (const [key, item] of Object.entries(value)) {
+        output[uniqueKey(output, objectKey(key))] = walk(item);
+      }
+      return output;
+    }
+    return value;
+  }
+  parentPort.postMessage(walk(workerData.value));
+`;
+function applyWorkspaceRules(value, rules) {
+  const serialized = rules.map(({ pattern, reason }) => ({
+    source: pattern.source,
+    flags: pattern.flags,
+    reason
+  }));
+  return new Promise((resolve) => {
+    let worker;
+    try {
+      worker = new Worker(WORKSPACE_REDACTION_WORKER, {
+        eval: true,
+        workerData: { value, rules: serialized }
+      });
+    } catch {
+      resolve(redactEveryString(value, "workspace-rule-failed"));
+      return;
+    }
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      void worker.terminate();
+      resolve(result);
+    };
+    const failClosed = () => finish(redactEveryString(value, "workspace-rule-failed"));
+    const timer = setTimeout(failClosed, WORKSPACE_RULE_TIMEOUT_MS);
+    worker.once("message", finish);
+    worker.once("error", failClosed);
+    worker.once("exit", (code) => {
+      if (code !== 0) failClosed();
+    });
+  });
+}
+async function scrubFromCwd(value, cwd) {
+  const defaultScrubbed = scrub(value, DEFAULT_RULES);
+  const workspaceRules = loadWorkspaceRules(cwd);
+  return workspaceRules.length === 0 ? defaultScrubbed : await applyWorkspaceRules(defaultScrubbed, workspaceRules);
+}
+function scrubEnvironmentPaths(environment) {
+  const scrubPath = (value) => value === void 0 ? void 0 : applyRules(value, USER_HOME_RULES);
+  return {
+    ...environment,
+    cwd: scrubPath(environment.cwd) ?? environment.cwd,
+    ...environment.repoRoot === void 0 ? {} : { repoRoot: scrubPath(environment.repoRoot) },
+    ...environment.gitRoot === void 0 ? {} : { gitRoot: scrubPath(environment.gitRoot) }
+  };
+}
+
+export {
+  DEFAULT_RULES,
+  scrub,
+  writeHookDebug,
+  scrubFromCwd,
+  scrubEnvironmentPaths
+};

package/dist/{chunk-CPSE3Y3T.js → chunk-H64F6QHV.js}

@@ -1,9 +1,12 @@
 import {
   isCanonicalWorkspaceId
 } from "./chunk-UVIWZWM6.js";
+import {
+  scrubEnvironmentPaths
+} from "./chunk-FI3LIRCB.js";
 import {
   isValidRepoSyncId
-} from "./chunk-TDRXHBEX.js";
+} from "./chunk-TJTVHDJ5.js";
 
 // src/hooks/prim-hook-core.ts
 import { createHash, randomUUID } from "crypto";
@@ -69,14 +72,30 @@ function toMove(parsed, cliVersion, agent = "claude_code", workspaceId, reposito
   const sessionId = parsed.session_id ?? "";
   const eventType = parsed.hook_event_name ?? "unknown";
   const toolOutcome = toolOutcomeFor(parsed, agent);
-  const moveId = CORRELATED_TOOL_EVENTS.has(eventType) && sessionId && invocationId ? `posttool:v1:${createHash("sha256").update(JSON.stringify([agent, sessionId, eventType, invocationId])).digest("hex")}` : randomUUID();
+  let moveId;
+  if (CORRELATED_TOOL_EVENTS.has(eventType) && sessionId && invocationId) {
+    moveId = `posttool:v1:${createHash("sha256").update(JSON.stringify([agent, sessionId, eventType, invocationId])).digest("hex")}`;
+  } else if (CORRELATED_TOOL_EVENTS.has(eventType) && sessionId) {
+    moveId = `posttool:fallback:v1:${createHash("sha256").update(
+      JSON.stringify([
+        agent,
+        sessionId,
+        eventType,
+        parsed.turn_id ?? null,
+        parsed.tool_name ?? null,
+        parsed.tool_input ?? null
+      ])
+    ).digest("hex")}`;
+  } else {
+    moveId = randomUUID();
+  }
   return {
     moveId,
     capturedAt: Date.now(),
     sessionId,
     eventType,
     payload: parsed,
-    env: {
+    env: scrubEnvironmentPaths({
       cwd: parsed.cwd ?? process.cwd(),
       cliVersion,
       osPlatform: platform(),
@@ -88,7 +107,7 @@ function toMove(parsed, cliVersion, agent = "claude_code", workspaceId, reposito
         repoSyncId: repository.repoSyncId
       } : {},
       ...workspaceId ? { workspaceId } : {}
-    },
+    }),
     envelopeVersion: AGENT_ENVELOPE_VERSION,
     producer: agent,
     ...invocationId ? { invocationId } : {},
@@ -135,7 +154,7 @@ function toCommitMove(commit, cliVersion, cwd, context = {}) {
       changedFiles: commit.files,
       changedFilesComplete: commit.filesComplete
     },
-    env: {
+    env: scrubEnvironmentPaths({
       cwd,
       cliVersion,
       osPlatform: platform(),
@@ -147,7 +166,7 @@ function toCommitMove(commit, cliVersion, cwd, context = {}) {
       ...repoFullName ? { repoFullName } : {},
       ...validatedRepoSyncId ? { repoSyncId: validatedRepoSyncId } : {},
       ...validatedWorkspaceId ? { workspaceId: validatedWorkspaceId } : {}
-    }
+    })
   };
   return validatedAttribution ? {
     ...base,
@@ -194,7 +213,7 @@ function toRewriteMove(rewrite, cliVersion, cwd, context) {
         pairs: sortedPairs,
         ...branch ? { branch } : {}
       },
-      env: {
+      env: scrubEnvironmentPaths({
         cwd,
         cliVersion,
         osPlatform: platform(),
@@ -206,7 +225,7 @@ function toRewriteMove(rewrite, cliVersion, cwd, context) {
         ...repoFullName ? { repoFullName } : {},
         repoSyncId,
         workspaceId
-      },
+      }),
       envelopeVersion: ENVELOPE_VERSION
     });
   }