@principles/core 1.75.0 → 1.77.0

package/dist/runtime-v2/__tests__/feedback/redact-sensitive.test.js

@@ -0,0 +1,231 @@
+// redact-sensitive.test.ts
+// ERR-001/005: no `as` casts on untrusted input.
+// ERR-002: structured return with reason/nextAction.
+// ERR-003: segment-exact key matching, never substring.
+// ERR-014/016/017: bounded output, BigInt-safe, no throws on non-string.
+import { describe, it, expect } from 'vitest';
+import { redactAbsolutePaths, redactTokenLikeValues, redactEnvLikeValues, redactStackTrace, redactSensitiveFields, REDACTED_PATH, REDACTED_VALUE, } from '../../feedback/redact-sensitive.js';
+describe('redactAbsolutePaths', () => {
+    it('replaces Windows-style absolute paths with <redacted-path>', () => {
+        const text = 'See C:\\Users\\alice\\project\\file.ts for details';
+        const result = redactAbsolutePaths(text);
+        expect(result).toContain(REDACTED_PATH);
+        expect(result).not.toContain('C:\\Users\\alice');
+    });
+    it('replaces POSIX absolute paths with <redacted-path>', () => {
+        const text = 'Config at /home/alice/.config/app/settings.json';
+        const result = redactAbsolutePaths(text);
+        expect(result).toContain(REDACTED_PATH);
+        expect(result).not.toContain('/home/alice');
+    });
+    it('leaves relative paths alone', () => {
+        const text = 'Open src/index.ts and ./relative/path.ts please';
+        const result = redactAbsolutePaths(text);
+        expect(result).toBe(text);
+    });
+    it('handles multiple absolute paths in one string', () => {
+        const text = 'From C:\\a\\b.ts to D:\\c\\d.ts works';
+        const result = redactAbsolutePaths(text);
+        const matches = result.match(new RegExp(REDACTED_PATH.replace(/[<>]/g, '\\$&'), 'g'));
+        expect(matches?.length ?? 0).toBeGreaterThanOrEqual(2);
+    });
+});
+describe('redactTokenLikeValues', () => {
+    it('redacts OpenAI-style sk- tokens', () => {
+        const text = 'My key is sk-abcdefghijklmnopqrstuvwxyz0123456789ABCDEF and it works';
+        const result = redactTokenLikeValues(text);
+        expect(result).toContain(REDACTED_VALUE);
+        expect(result).not.toContain('sk-abcdefghijklmnopqrstuvwxyz');
+    });
+    it('redacts GitHub-style ghp_ tokens', () => {
+        const text = 'Token: ghp_1234567890abcdefghijklmnopqrstuvwxyzABCD';
+        const result = redactTokenLikeValues(text);
+        expect(result).toContain(REDACTED_VALUE);
+        expect(result).not.toContain('ghp_1234567890');
+    });
+    it('redacts "Bearer xxx" headers', () => {
+        const text = 'Authorization: Bearer abc123.def456.ghi789';
+        const result = redactTokenLikeValues(text);
+        expect(result).toContain(REDACTED_VALUE);
+        expect(result).not.toContain('abc123.def456.ghi789');
+    });
+    it('redacts api_key= and token= style assignments', () => {
+        const text = 'config: api_key=mysecretvalue and token=othertokenvalue';
+        const result = redactTokenLikeValues(text);
+        expect(result).toContain(REDACTED_VALUE);
+        expect(result).not.toContain('mysecretvalue');
+        expect(result).not.toContain('othertokenvalue');
+    });
+    it('leaves normal text alone', () => {
+        const text = 'This is a normal sentence with no tokens inside.';
+        const result = redactTokenLikeValues(text);
+        expect(result).toBe(text);
+    });
+});
+describe('redactEnvLikeValues', () => {
+    it('redacts KEY=value patterns', () => {
+        const text = 'Run with API_KEY=verysecretvalue and continue';
+        const result = redactEnvLikeValues(text);
+        expect(result).toContain(REDACTED_VALUE);
+        expect(result).not.toContain('verysecretvalue');
+    });
+    it('redacts KEY="value" quoted patterns', () => {
+        const text = 'export DATABASE_URL="postgres://user:pass@host/db"';
+        const result = redactEnvLikeValues(text);
+        expect(result).toContain(REDACTED_VALUE);
+        expect(result).not.toContain('user:pass@host');
+    });
+    it('leaves normal text alone', () => {
+        const text = 'There is no env var assignment in this sentence.';
+        const result = redactEnvLikeValues(text);
+        expect(result).toBe(text);
+    });
+});
+describe('redactStackTrace', () => {
+    it('returns error name + bounded top frame for full stack', () => {
+        const text = [
+            'TypeError: cannot read property foo of undefined',
+            '    at doWork (C:\\Users\\alice\\project\\src\\a.ts:10:5)',
+            '    at callIt (C:\\Users\\alice\\project\\src\\b.ts:25:3)',
+            '    at handle (C:\\Users\\alice\\project\\src\\c.ts:99:1)',
+        ].join('\n');
+        const result = redactStackTrace(text, 1);
+        expect(result).toContain('TypeError');
+        expect(result).toContain(REDACTED_PATH);
+        expect(result).not.toContain('b.ts');
+        expect(result).not.toContain('c.ts');
+    });
+    it('returns "<no-stack>" for empty input', () => {
+        expect(redactStackTrace('', 3)).toBe('<no-stack>');
+    });
+});
+describe('redactSensitiveFields', () => {
+    it('redacts exact sensitive keys (password, token, secret, apiKey, authorization)', () => {
+        const input = {
+            username: 'alice',
+            password: 'supersecret',
+            token: 'tok_abc123',
+            apiKey: 'ak_live_123',
+            authorization: 'Bearer xyz',
+        };
+        const result = redactSensitiveFields(input);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        const redacted = result.value;
+        expect(redacted.username).toBe('alice');
+        expect(redacted.password).toBe(REDACTED_VALUE);
+        expect(redacted.token).toBe(REDACTED_VALUE);
+        expect(redacted.apiKey).toBe(REDACTED_VALUE);
+        expect(redacted.authorization).toBe(REDACTED_VALUE);
+        expect(result.notes.length).toBeGreaterThan(0);
+    });
+    it('uses segment-exact key matching (not substring) — "author" should NOT match "auth"', () => {
+        const input = { author: 'alice', authenticated: true, authtoken: 'should-redact' };
+        const result = redactSensitiveFields(input);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        const redacted = result.value;
+        expect(redacted.author).toBe('alice');
+        expect(redacted.authenticated).toBe(true);
+        // "authtoken" is not a sensitive segment; only exact "authorization" / "auth_token" / "authtoken" forms should match
+        // We test that "author" (containing "auth") is NOT redacted (substring pattern is the bug)
+        expect(redacted.author).not.toBe(REDACTED_VALUE);
+    });
+    it('handles circular references without throwing', () => {
+        const input = { name: 'root' };
+        input.self = input;
+        const result = redactSensitiveFields(input);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        const redacted = result.value;
+        expect(redacted.name).toBe('root');
+        // The circular self-reference should be marked as a redaction note
+        expect(result.notes.some((n) => n.includes('circular') || n.includes('cycle'))).toBe(true);
+    });
+    it('does NOT throw on non-object input — returns structured error', () => {
+        const result = redactSensitiveFields(42);
+        expect(result.ok).toBe(false);
+        if (result.ok)
+            return;
+        expect(result.error).toBeDefined();
+        expect(result.nextAction).toBeDefined();
+    });
+    it('does NOT throw on null — returns structured error', () => {
+        const result = redactSensitiveFields(null);
+        expect(result.ok).toBe(false);
+    });
+    it('handles arrays without throwing', () => {
+        const input = [{ password: 'secret1' }, { name: 'safe' }];
+        const result = redactSensitiveFields(input);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        const arr = result.value;
+        expect(arr[0]?.password).toBe(REDACTED_VALUE);
+        expect(arr[1]?.name).toBe('safe');
+    });
+    it('BigInt values are stringified safely, not thrown', () => {
+        const input = { count: BigInt('9999999999999999'), password: 'secret' };
+        const result = redactSensitiveFields(input);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        const redacted = result.value;
+        expect(redacted.password).toBe(REDACTED_VALUE);
+        expect(typeof redacted.count).toBe('string');
+    });
+    it('records redaction note when string value contains token-like pattern', () => {
+        const input = { buildLog: 'Build started. API key sk-ant-1234567890abcdef1234567890 used.' };
+        const result = redactSensitiveFields(input);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        const redacted = result.value;
+        expect(redacted.buildLog).not.toContain('sk-ant-');
+        expect(result.notes.some((n) => n.includes('redacted'))).toBe(true);
+    });
+    it('records redaction note when string value contains absolute path', () => {
+        const input = { cwd: 'Working in C:\\Users\\alice\\secret-project\\src' };
+        const result = redactSensitiveFields(input);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        const redacted = result.value;
+        expect(redacted.cwd).not.toContain('alice');
+        expect(result.notes.some((n) => n.includes('redacted'))).toBe(true);
+    });
+    it('records redaction note when string value is truncated', () => {
+        const longValue = 'x'.repeat(3000);
+        const input = { bigField: longValue };
+        const result = redactSensitiveFields(input);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        const redacted = result.value;
+        expect(redacted.bigField.length).toBeLessThan(longValue.length);
+        expect(result.notes.some((n) => n.includes('truncated'))).toBe(true);
+    });
+    it('records redaction note when string value contains env-like assignment', () => {
+        const input = { envDump: 'DATABASE_URL=postgres://user:pass@host:5432/db' };
+        const result = redactSensitiveFields(input);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        const redacted = result.value;
+        expect(redacted.envDump).not.toContain('postgres://user:pass');
+        expect(result.notes.some((n) => n.includes('redacted'))).toBe(true);
+    });
+    it('does NOT record redaction note for clean string values', () => {
+        const input = { message: 'hello world', name: 'test' };
+        const result = redactSensitiveFields(input);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        expect(result.notes.some((n) => n.includes('string value redacted'))).toBe(false);
+        expect(result.notes.some((n) => n.includes('truncated'))).toBe(false);
+    });
+});
+//# sourceMappingURL=redact-sensitive.test.js.map

package/dist/runtime-v2/__tests__/feedback/redact-sensitive.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-sensitive.test.js","sourceRoot":"","sources":["../../../../src/runtime-v2/__tests__/feedback/redact-sensitive.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,iDAAiD;AACjD,qDAAqD;AACrD,wDAAwD;AACxD,yEAAyE;AAEzE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,cAAc,GACf,MAAM,oCAAoC,CAAC;AAE5C,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,IAAI,GAAG,oDAAoD,CAAC;QAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,IAAI,GAAG,iDAAiD,CAAC;QAC/D,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,IAAI,GAAG,iDAAiD,CAAC;QAC/D,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,uCAAuC,CAAC;QACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,IAAI,GAAG,sEAAsE,CAAC;QACpF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,IAAI,GAAG,qDAAqD,CAAC;QACnE,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,IAAI,GAAG,4CAA4C,CAAC;QAC1D,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,yDAAyD,CAAC;QACvE,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,kDAAkD,CAAC;QAChE,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,IAAI,GAAG,+CAA+C,CAAC;QAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,oDAAoD,CAAC;QAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,kDAAkD,CAAC;QAChE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,IAAI,GAAG;YACX,kDAAkD;YAClD,2DAA2D;YAC3D,2DAA2D;YAC3D,2DAA2D;SAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,KAAK,GAAG;YACZ,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,YAAY;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAgC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7C,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;QACnF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAgC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,qHAAqH;QACrH,2FAA2F;QAC3F,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,KAAK,GAA4B,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;QACnB,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAgC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,mEAAmE;QACnE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO;QACtB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAkC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAgC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,gEAAgE,EAAE,CAAC;QAC7F,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAgC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,kDAAkD,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAgC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAgC,CAAC;QACzD,MAAM,CAAE,QAAQ,CAAC,QAAmB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAgC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1F,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/runtime-v2/__tests__/feedback/render-github-url.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=render-github-url.test.d.ts.map

package/dist/runtime-v2/__tests__/feedback/render-github-url.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-github-url.test.d.ts","sourceRoot":"","sources":["../../../../src/runtime-v2/__tests__/feedback/render-github-url.test.ts"],"names":[],"mappings":""}

package/dist/runtime-v2/__tests__/feedback/render-github-url.test.js

@@ -0,0 +1,102 @@
+// render-github-url.test.ts
+// ERR-001/005: no `as FeedbackType` cast; use isFeedbackType validator.
+// ERR-014/016: correct '\n' newlines, bounded body.
+// Redacts title before embedding in URL.
+import { describe, it, expect } from 'vitest';
+import { buildGitHubIssueDraftUrl, MAX_URL_BODY_LENGTH, GITHUB_REPO, } from '../../feedback/render-github-url.js';
+describe('buildGitHubIssueDraftUrl', () => {
+    it('returns a valid GitHub issue URL with type prefix in title', () => {
+        const result = buildGitHubIssueDraftUrl('Cannot open page', 'bug', 'short summary');
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        expect(result.url).toContain(`https://github.com/${GITHUB_REPO}/issues/new`);
+        expect(result.url).toContain('title=');
+        expect(result.url).toContain('bug');
+        expect(result.url).toContain('Cannot%20open%20page');
+    });
+    it('redacts absolute paths in title before embedding', () => {
+        const result = buildGitHubIssueDraftUrl('Error at C:\\Users\\alice\\secret\\path.ts', 'bug', 'short summary');
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        // The raw path should NOT be in the URL
+        expect(result.url).not.toContain('C%3A%5CUsers%5Calice');
+        // The redacted marker should be present
+        expect(result.url).toContain('redacted-path');
+    });
+    it('binds the body to MAX_URL_BODY_LENGTH', () => {
+        const longSummary = 'x'.repeat(5000);
+        const result = buildGitHubIssueDraftUrl('title', 'bug', longSummary);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        // The body=... portion of the URL must not exceed the bound
+        const bodyMatch = /[?&]body=([^&]*)/.exec(result.url);
+        expect(bodyMatch).not.toBeNull();
+        if (bodyMatch === null)
+            return;
+        const raw = bodyMatch[1] ?? '';
+        const bodyValue = decodeURIComponent(raw);
+        expect(bodyValue.length).toBeLessThanOrEqual(MAX_URL_BODY_LENGTH);
+    });
+    it('preserves \\n newlines in body (encoded as %0A) instead of literal \\n', () => {
+        const summary = 'line one\nline two\nline three';
+        const result = buildGitHubIssueDraftUrl('title', 'bug', summary);
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        // The body must contain %0A (encoded newline), not literal \n chars
+        expect(result.url).toContain('%0A');
+        expect(result.url).not.toMatch(/(?<!\\)\\\\n/); // no escaped backslash-n
+    });
+    it('returns structured error for invalid type — does NOT throw or use `as` cast', () => {
+        const result = buildGitHubIssueDraftUrl('title', 'not-a-valid-type', 'summary');
+        expect(result.ok).toBe(false);
+        if (result.ok)
+            return;
+        expect(result.error).toBeDefined();
+        expect(result.nextAction).toBeDefined();
+        expect(typeof result.nextAction).toBe('string');
+    });
+    it('handles empty summary without throwing', () => {
+        const result = buildGitHubIssueDraftUrl('title', 'bug', '');
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        expect(result.url).toContain('https://github.com/');
+    });
+    it('redacts env-like values in title (OPENAI_API_KEY=sk-... does not appear in URL)', () => {
+        const result = buildGitHubIssueDraftUrl('Crash with OPENAI_API_KEY=sk-abc1234567890123456789abcdef in env', 'bug', 'short summary');
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        // The secret value must be redacted; the key name may remain but the token must not
+        expect(result.url).not.toContain('sk-abc1234567890123456789abcdef');
+        expect(result.url).toContain('%5BREDACTED%5D');
+    });
+    it('redacts env-like values in body (OPENAI_API_KEY=sk-... does not appear in URL)', () => {
+        const result = buildGitHubIssueDraftUrl('title', 'bug', 'details: OPENAI_API_KEY=sk-abc1234567890123456789abcdef leaked');
+        expect(result.ok).toBe(true);
+        if (!result.ok)
+            return;
+        // The secret value must be redacted; the key name may remain but the token must not
+        expect(result.url).not.toContain('sk-abc1234567890123456789abcdef');
+        expect(result.url).toContain('%5BREDACTED%5D');
+    });
+    it('returns structured error when shortSummary is not a string', () => {
+        const nullResult = buildGitHubIssueDraftUrl('title', 'bug', null);
+        expect(nullResult.ok).toBe(false);
+        if (nullResult.ok)
+            return;
+        expect(nullResult.error).toBe('shortSummary must be a string');
+        expect(nullResult.nextAction).toBe('provide a string value for shortSummary');
+        const numResult = buildGitHubIssueDraftUrl('title', 'bug', 42);
+        expect(numResult.ok).toBe(false);
+        if (numResult.ok)
+            return;
+        expect(numResult.error).toBe('shortSummary must be a string');
+        expect(numResult.nextAction).toBe('provide a string value for shortSummary');
+    });
+});
+//# sourceMappingURL=render-github-url.test.js.map

package/dist/runtime-v2/__tests__/feedback/render-github-url.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-github-url.test.js","sourceRoot":"","sources":["../../../../src/runtime-v2/__tests__/feedback/render-github-url.test.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,wEAAwE;AACxE,oDAAoD;AACpD,yCAAyC;AAEzC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,WAAW,GACZ,MAAM,qCAAqC,CAAC;AAE7C,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,MAAM,GAAG,wBAAwB,CAAC,kBAAkB,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,sBAAsB,WAAW,aAAa,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,wBAAwB,CACrC,4CAA4C,EAC5C,KAAK,EACL,eAAe,CAChB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,wCAAwC;QACxC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACzD,wCAAwC;QACxC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,4DAA4D;QAC5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,OAAO,GAAG,gCAAgC,CAAC;QACjD,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,oEAAoE;QACpE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,yBAAyB;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,kBAAsC,EAAE,SAAS,CAAC,CAAC;QACpG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO;QACtB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,MAAM,GAAG,wBAAwB,CACrC,kEAAkE,EAClE,KAAK,EACL,eAAe,CAChB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,oFAAoF;QACpF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,MAAM,GAAG,wBAAwB,CACrC,OAAO,EACP,KAAK,EACL,gEAAgE,CACjE,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,oFAAoF;QACpF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAyB,CAAC,CAAC;QACvF,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,UAAU,CAAC,EAAE;YAAE,OAAO;QAC1B,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC/D,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAE9E,MAAM,SAAS,GAAG,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAuB,CAAC,CAAC;QACpF,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,SAAS,CAAC,EAAE;YAAE,OAAO;QACzB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9D,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/runtime-v2/__tests__/feedback/render-markdown.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=render-markdown.test.d.ts.map

package/dist/runtime-v2/__tests__/feedback/render-markdown.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-markdown.test.d.ts","sourceRoot":"","sources":["../../../../src/runtime-v2/__tests__/feedback/render-markdown.test.ts"],"names":[],"mappings":""}

package/dist/runtime-v2/__tests__/feedback/render-markdown.test.js

@@ -0,0 +1,130 @@
+// render-markdown.test.ts
+// ERR-014/016/017: bounded output, correct '\n' newlines (not '\\n'), BigInt-safe.
+import { describe, it, expect } from 'vitest';
+import { renderReportMarkdown, MAX_MARKDOWN_LENGTH } from '../../feedback/render-markdown.js';
+function makeReport(overrides = {}) {
+    return {
+        id: 'fb-test-1',
+        createdAt: '2026-06-01T00:00:00.000Z',
+        type: 'bug',
+        title: 'Cannot open pain page',
+        userText: {
+            description: 'Clicking the pain link throws TypeError',
+            stepsToReproduce: '1. Go to Overview\n2. Click Pain',
+            expectedBehavior: 'Page should open',
+            actualBehavior: 'Page throws error',
+            userSeverity: 'high',
+        },
+        diagnosticSummary: {
+            versions: { '@principles/core': '1.0.0' },
+            platform: { os: 'darwin', node: '20.0.0' },
+            featureFlags: { 'mvp-core': true },
+            canary: { status: 'available', summary: 'healthy' },
+            recentEvents: [
+                { type: 'pain_signal', at: '2026-06-01T00:00:00.000Z', summary: 'pain detected' },
+            ],
+        },
+        contextRefs: [{ kind: 'page', id: 'overview' }],
+        privacy: {
+            includedSections: ['versions', 'platform', 'featureFlags', 'canary', 'userText'],
+            excludedByDefault: ['rawPrompt', 'rawChat', 'fileContents', 'envVars', 'tokens', 'fullPaths', 'stackTraces'],
+            redactionNotes: [],
+        },
+        outputs: { markdown: '', emailText: '', githubIssueUrl: '' },
+        ...overrides,
+    };
+}
+describe('renderReportMarkdown', () => {
+    it('uses real \\n newlines, not literal \\n', () => {
+        const report = makeReport();
+        const md = renderReportMarkdown(report);
+        // The markdown must contain actual newline characters separating sections
+        expect(md.split('\n').length).toBeGreaterThan(5);
+        // The rendered output must NOT contain escaped \n (which would render as backslash-n)
+        expect(md).not.toMatch(/\\n/);
+    });
+    it('contains the type, title, and user-entered text', () => {
+        const report = makeReport();
+        const md = renderReportMarkdown(report);
+        expect(md).toContain('bug');
+        expect(md).toContain('Cannot open pain page');
+        expect(md).toContain('Clicking the pain link throws TypeError');
+    });
+    it('contains diagnostics sections (versions, platform, canary)', () => {
+        const report = makeReport();
+        const md = renderReportMarkdown(report);
+        expect(md).toContain('versions');
+        expect(md).toContain('platform');
+        expect(md).toContain('canary');
+    });
+    it('contains context refs', () => {
+        const report = makeReport();
+        const md = renderReportMarkdown(report);
+        expect(md).toContain('overview');
+    });
+    it('is bounded to MAX_MARKDOWN_LENGTH characters', () => {
+        const hugeSteps = 'step '.repeat(2000);
+        const hugeDescription = 'desc '.repeat(2000);
+        const report = makeReport({
+            userText: {
+                description: hugeDescription,
+                stepsToReproduce: hugeSteps,
+                expectedBehavior: 'x',
+                actualBehavior: 'y',
+                userSeverity: 'low',
+            },
+        });
+        const md = renderReportMarkdown(report);
+        expect(md.length).toBeLessThanOrEqual(MAX_MARKDOWN_LENGTH);
+    });
+    it('truncates oversized fields and records a redaction note in privacy.redactionNotes', () => {
+        const hugeSteps = 'step '.repeat(2000);
+        const report = makeReport({
+            userText: {
+                description: 'short',
+                stepsToReproduce: hugeSteps,
+                expectedBehavior: 'x',
+                actualBehavior: 'y',
+                userSeverity: 'low',
+            },
+        });
+        const md = renderReportMarkdown(report);
+        expect(md.length).toBeLessThanOrEqual(MAX_MARKDOWN_LENGTH);
+        expect(report.privacy.redactionNotes.some((n) => n.includes('truncat') || n.includes('truncated'))).toBe(true);
+    });
+    it('BigInt values in diagnostics do not throw (ERR-017)', () => {
+        const report = makeReport({
+            diagnosticSummary: {
+                versions: { count: BigInt(9999999999999) },
+                platform: { os: 'linux' },
+                featureFlags: {},
+                canary: { status: 'unavailable', unavailableReason: 'offline' },
+                recentEvents: [],
+            },
+        });
+        let thrown = null;
+        try {
+            const md = renderReportMarkdown(report);
+            expect(md).toBeDefined();
+        }
+        catch (e) {
+            thrown = e;
+        }
+        expect(thrown).toBeNull();
+    });
+    it('reflects canary unavailable status in output without throwing', () => {
+        const report = makeReport({
+            diagnosticSummary: {
+                versions: {},
+                platform: { os: 'linux' },
+                featureFlags: {},
+                canary: { status: 'unavailable', unavailableReason: 'no network' },
+                recentEvents: [],
+            },
+        });
+        const md = renderReportMarkdown(report);
+        expect(md).toContain('unavailable');
+        expect(md).toContain('no network');
+    });
+});
+//# sourceMappingURL=render-markdown.test.js.map

package/dist/runtime-v2/__tests__/feedback/render-markdown.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-markdown.test.js","sourceRoot":"","sources":["../../../../src/runtime-v2/__tests__/feedback/render-markdown.test.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,mFAAmF;AAEnF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAG9F,SAAS,UAAU,CAAC,YAAqC,EAAE;IACzD,OAAO;QACL,EAAE,EAAE,WAAW;QACf,SAAS,EAAE,0BAA0B;QACrC,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE;YACR,WAAW,EAAE,yCAAyC;YACtD,gBAAgB,EAAE,kCAAkC;YACpD,gBAAgB,EAAE,kBAAkB;YACpC,cAAc,EAAE,mBAAmB;YACnC,YAAY,EAAE,MAAM;SACrB;QACD,iBAAiB,EAAE;YACjB,QAAQ,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE;YACzC,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1C,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;YAClC,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE;YACnD,YAAY,EAAE;gBACZ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,0BAA0B,EAAE,OAAO,EAAE,eAAe,EAAE;aAClF;SACF;QACD,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;QAC/C,OAAO,EAAE;YACP,gBAAgB,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC;YAChF,iBAAiB,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC;YAC5G,cAAc,EAAE,EAAE;SACnB;QACD,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;QAC5D,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACxC,0EAA0E;QAC1E,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACjD,sFAAsF;QACtF,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC9C,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,QAAQ,EAAE;gBACR,WAAW,EAAE,eAAe;gBAC5B,gBAAgB,EAAE,SAAS;gBAC3B,gBAAgB,EAAE,GAAG;gBACrB,cAAc,EAAE,GAAG;gBACnB,YAAY,EAAE,KAAK;aACpB;SACF,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,QAAQ,EAAE;gBACR,WAAW,EAAE,OAAO;gBACpB,gBAAgB,EAAE,SAAS;gBAC3B,gBAAgB,EAAE,GAAG;gBACrB,cAAc,EAAE,GAAG;gBACnB,YAAY,EAAE,KAAK;aACpB;SACF,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,iBAAiB,EAAE;gBACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,CAAsB,EAAE;gBAC/D,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;gBACzB,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE;gBAC/D,YAAY,EAAE,EAAE;aACjB;SACF,CAAC,CAAC;QACH,IAAI,MAAM,GAAY,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,iBAAiB,EAAE;gBACjB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;gBACzB,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE;gBAClE,YAAY,EAAE,EAAE;aACjB;SACF,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/runtime-v2/__tests__/workspace-guidance-migration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=workspace-guidance-migration.test.d.ts.map

package/dist/runtime-v2/__tests__/workspace-guidance-migration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-guidance-migration.test.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/__tests__/workspace-guidance-migration.test.ts"],"names":[],"mappings":""}