@psiclawops/hypermem 0.9.0 → 0.9.1

package/dist/schema.js

@@ -1,327 +0,0 @@
-/**
- * hypermem Agent Message Schema
- *
- * Per-agent database: ~/.openclaw/hypermem/agents/{agentId}/messages.db
- * Write-heavy, temporal, rotatable.
- * Contains ONLY conversation data — structured knowledge lives in library.db.
- */
-export const LATEST_SCHEMA_VERSION = 11;
-function nowIso() {
-    return new Date().toISOString();
-}
-/**
- * V1–V3: Legacy schema (monolithic agent DB with facts/knowledge/episodes).
- * Kept for migration detection — if we open an old DB, we know what version it is.
- */
-/**
- * V4: Messages-only schema.
- * Facts, knowledge, episodes, topics moved to library.db.
- * Agent DB now contains only conversations, messages, summaries, and agent metadata.
- */
-function applyV4MessagesOnly(db) {
-    // -- Agent metadata (kept here for self-identification) --
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS agent_meta (
-      id TEXT PRIMARY KEY,
-      display_name TEXT,
-      tier TEXT,
-      org TEXT,
-      config TEXT,
-      created_at TEXT NOT NULL,
-      updated_at TEXT NOT NULL
-    )
-  `);
-    // -- Conversations (sessions) --
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS conversations (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      session_key TEXT NOT NULL UNIQUE,
-      session_id TEXT,
-      agent_id TEXT NOT NULL,
-      channel_type TEXT NOT NULL,
-      channel_id TEXT,
-      provider TEXT,
-      model TEXT,
-      status TEXT DEFAULT 'active',
-      message_count INTEGER DEFAULT 0,
-      token_count_in INTEGER DEFAULT 0,
-      token_count_out INTEGER DEFAULT 0,
-      created_at TEXT NOT NULL,
-      updated_at TEXT NOT NULL,
-      ended_at TEXT
-    )
-  `);
-    db.exec('CREATE INDEX IF NOT EXISTS idx_conv_agent ON conversations(agent_id, status, updated_at DESC)');
-    db.exec('CREATE INDEX IF NOT EXISTS idx_conv_channel ON conversations(agent_id, channel_type, channel_id)');
-    // -- Messages (provider-neutral, structured) --
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS messages (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      conversation_id INTEGER NOT NULL REFERENCES conversations(id),
-      agent_id TEXT NOT NULL,
-      role TEXT NOT NULL,
-      text_content TEXT,
-      tool_calls TEXT,
-      tool_results TEXT,
-      metadata TEXT,
-      token_count INTEGER,
-      message_index INTEGER NOT NULL,
-      is_heartbeat INTEGER DEFAULT 0,
-      created_at TEXT NOT NULL
-    )
-  `);
-    db.exec('CREATE INDEX IF NOT EXISTS idx_msg_conv ON messages(conversation_id, message_index)');
-    db.exec('CREATE INDEX IF NOT EXISTS idx_msg_agent_time ON messages(agent_id, created_at DESC)');
-    // -- FTS5 for message full-text search --
-    db.exec(`
-    CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
-      text_content,
-      content='messages',
-      content_rowid='id'
-    )
-  `);
-    db.exec(`
-    CREATE TRIGGER IF NOT EXISTS msg_fts_ai AFTER INSERT ON messages BEGIN
-      INSERT INTO messages_fts(rowid, text_content) VALUES (new.id, new.text_content);
-    END
-  `);
-    db.exec(`
-    CREATE TRIGGER IF NOT EXISTS msg_fts_ad AFTER DELETE ON messages BEGIN
-      INSERT INTO messages_fts(messages_fts, rowid, text_content) VALUES('delete', old.id, old.text_content);
-    END
-  `);
-    db.exec(`
-    CREATE TRIGGER IF NOT EXISTS msg_fts_au AFTER UPDATE ON messages BEGIN
-      INSERT INTO messages_fts(messages_fts, rowid, text_content) VALUES('delete', old.id, old.text_content);
-      INSERT INTO messages_fts(rowid, text_content) VALUES (new.id, new.text_content);
-    END
-  `);
-    // -- Summaries (hierarchical compaction) --
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS summaries (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      conversation_id INTEGER NOT NULL REFERENCES conversations(id),
-      agent_id TEXT NOT NULL,
-      depth INTEGER NOT NULL DEFAULT 0,
-      content TEXT NOT NULL,
-      token_count INTEGER,
-      created_at TEXT NOT NULL,
-      updated_at TEXT NOT NULL
-    )
-  `);
-    db.exec('CREATE INDEX IF NOT EXISTS idx_summaries_conv ON summaries(conversation_id, depth)');
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS summary_messages (
-      summary_id INTEGER NOT NULL REFERENCES summaries(id),
-      message_id INTEGER NOT NULL REFERENCES messages(id),
-      PRIMARY KEY (summary_id, message_id)
-    )
-  `);
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS summary_parents (
-      parent_summary_id INTEGER NOT NULL REFERENCES summaries(id),
-      child_summary_id INTEGER NOT NULL REFERENCES summaries(id),
-      PRIMARY KEY (parent_summary_id, child_summary_id)
-    )
-  `);
-    // -- Index events (for tracking what's been vectorized) --
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS index_events (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      agent_id TEXT NOT NULL,
-      event_type TEXT NOT NULL,
-      target_table TEXT,
-      target_id INTEGER,
-      details TEXT,
-      created_at TEXT NOT NULL
-    )
-  `);
-    db.exec('CREATE INDEX IF NOT EXISTS idx_index_events ON index_events(agent_id, created_at DESC)');
-}
-/**
- * Run migrations on an agent message database.
- */
-export function migrate(db) {
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS schema_version (
-      version INTEGER PRIMARY KEY,
-      applied_at TEXT NOT NULL
-    )
-  `);
-    const row = db
-        .prepare('SELECT MAX(version) AS version FROM schema_version')
-        .get();
-    const currentVersion = typeof row?.version === 'number' ? row.version : 0;
-    if (currentVersion > LATEST_SCHEMA_VERSION) {
-        console.warn(`[hypermem] Database schema version (${currentVersion}) is newer than this engine (${LATEST_SCHEMA_VERSION}).`);
-        return;
-    }
-    // For fresh DBs (version 0), jump straight to v4 (messages-only).
-    // For existing DBs (v1–v3), we skip the old schema — those tables will be
-    // left in place but unused. Data migration to library is a separate step.
-    if (currentVersion < 4) {
-        if (currentVersion === 0) {
-            // Fresh DB — create messages-only schema directly
-            applyV4MessagesOnly(db);
-        }
-        else {
-            // Existing DB with old schema (v1–v3).
-            // The old tables (facts, knowledge, episodes, topics, agents) remain
-            // but are no longer written to. New tables get created alongside.
-            applyV4MessagesOnly(db);
-            // Note: old tables like 'facts', 'knowledge', etc. are left in place
-            // for data migration. A separate migration tool will move them to library.db.
-        }
-        db.prepare('INSERT INTO schema_version (version, applied_at) VALUES (?, ?)')
-            .run(4, nowIso());
-    }
-    // v4 → v5: add cursor columns to conversations table for dual-write durability
-    if (currentVersion < 5) {
-        // ALTER TABLE ADD COLUMN is safe on existing rows — all default to NULL
-        const cols = db.prepare('PRAGMA table_info(conversations)').all()
-            .map(r => r.name);
-        if (!cols.includes('cursor_last_sent_id')) {
-            db.exec('ALTER TABLE conversations ADD COLUMN cursor_last_sent_id INTEGER');
-        }
-        if (!cols.includes('cursor_last_sent_index')) {
-            db.exec('ALTER TABLE conversations ADD COLUMN cursor_last_sent_index INTEGER');
-        }
-        if (!cols.includes('cursor_last_sent_at')) {
-            db.exec('ALTER TABLE conversations ADD COLUMN cursor_last_sent_at TEXT');
-        }
-        if (!cols.includes('cursor_window_size')) {
-            db.exec('ALTER TABLE conversations ADD COLUMN cursor_window_size INTEGER');
-        }
-        if (!cols.includes('cursor_token_count')) {
-            db.exec('ALTER TABLE conversations ADD COLUMN cursor_token_count INTEGER');
-        }
-        db.prepare('INSERT OR IGNORE INTO schema_version (version, applied_at) VALUES (?, ?)')
-            .run(5, nowIso());
-    }
-    // v5 → v6: add topic_id to messages, add per-session topics table
-    if (currentVersion < 6) {
-        // Add topic_id column to messages (nullable TEXT)
-        const msgCols = db.prepare('PRAGMA table_info(messages)').all()
-            .map(r => r.name);
-        if (!msgCols.includes('topic_id')) {
-            db.exec('ALTER TABLE messages ADD COLUMN topic_id TEXT');
-        }
-        // Add index on messages.topic_id
-        db.exec('CREATE INDEX IF NOT EXISTS idx_messages_topic_id ON messages(topic_id)');
-        // Add per-session topics table (in messages.db for session-scoped topic tracking)
-        db.exec(`
-      CREATE TABLE IF NOT EXISTS topics (
-        id TEXT PRIMARY KEY,
-        session_key TEXT NOT NULL,
-        name TEXT NOT NULL,
-        created_at INTEGER NOT NULL,
-        last_active_at INTEGER NOT NULL,
-        message_count INTEGER DEFAULT 0,
-        metadata TEXT
-      )
-    `);
-        db.exec('CREATE INDEX IF NOT EXISTS idx_topics_session_key ON topics(session_key)');
-        db.prepare('INSERT OR IGNORE INTO schema_version (version, applied_at) VALUES (?, ?)')
-            .run(6, nowIso());
-    }
-    // v6 → v7: Turn DAG Phase 2 — add parent_id and depth to messages
-    if (currentVersion < 7) {
-        const msgCols = db.prepare('PRAGMA table_info(messages)').all()
-            .map(r => r.name);
-        if (!msgCols.includes('parent_id')) {
-            db.exec('ALTER TABLE messages ADD COLUMN parent_id INTEGER REFERENCES messages(id)');
-        }
-        if (!msgCols.includes('depth')) {
-            db.exec('ALTER TABLE messages ADD COLUMN depth INTEGER NOT NULL DEFAULT 0');
-        }
-        db.exec('CREATE INDEX IF NOT EXISTS idx_messages_parent_id ON messages(parent_id)');
-        db.prepare('INSERT OR IGNORE INTO schema_version (version, applied_at) VALUES (?, ?)')
-            .run(7, nowIso());
-    }
-    // v7 → v8: Turn DAG Phase 3 — add context_id index for DAG-native reads
-    // Also ensures context_id column exists (idempotent with ensureContextSchema)
-    if (currentVersion < 8) {
-        const msgCols8 = db.prepare('PRAGMA table_info(messages)').all()
-            .map(r => r.name);
-        if (!msgCols8.includes('context_id')) {
-            db.exec('ALTER TABLE messages ADD COLUMN context_id INTEGER');
-        }
-        db.exec('CREATE INDEX IF NOT EXISTS idx_messages_context_id ON messages(context_id)');
-        db.prepare('INSERT OR IGNORE INTO schema_version (version, applied_at) VALUES (?, ?)')
-            .run(8, nowIso());
-    }
-    // v8 → v9: Tool Artifact Store — durable storage for full tool result payloads.
-    // Transcript stubs carry an artifactId pointer; raw payload lives here so
-    // wave-guard degradation is never lossy. See specs/TOOL_ARTIFACT_STORE.md.
-    if (currentVersion < 9) {
-        db.exec(`
-      CREATE TABLE IF NOT EXISTS tool_artifacts (
-        id                 TEXT PRIMARY KEY,
-        content_hash       TEXT NOT NULL,
-        agent_id           TEXT NOT NULL,
-        session_key        TEXT NOT NULL,
-        conversation_id    INTEGER REFERENCES conversations(id),
-        message_id         INTEGER REFERENCES messages(id),
-        turn_id            TEXT,
-        tool_call_id       TEXT,
-        tool_name          TEXT NOT NULL,
-        is_error           INTEGER NOT NULL DEFAULT 0,
-        content_type       TEXT NOT NULL DEFAULT 'text/plain',
-        size_bytes         INTEGER NOT NULL,
-        token_estimate     INTEGER NOT NULL,
-        payload            TEXT NOT NULL,
-        summary            TEXT,
-        created_at         TEXT NOT NULL,
-        last_used_at       TEXT NOT NULL,
-        ref_count          INTEGER NOT NULL DEFAULT 1
-      )
-    `);
-        db.exec('CREATE INDEX IF NOT EXISTS idx_tool_artifacts_hash ON tool_artifacts(content_hash)');
-        db.exec('CREATE INDEX IF NOT EXISTS idx_tool_artifacts_session ON tool_artifacts(agent_id, session_key, created_at DESC)');
-        db.exec('CREATE INDEX IF NOT EXISTS idx_tool_artifacts_turn ON tool_artifacts(turn_id)');
-        db.exec('CREATE INDEX IF NOT EXISTS idx_tool_artifacts_tool_call ON tool_artifacts(tool_call_id)');
-        db.prepare('INSERT OR IGNORE INTO schema_version (version, applied_at) VALUES (?, ?)')
-            .run(9, nowIso());
-    }
-    // v9 → v10: Retention sweep — add is_sensitive flag to tool_artifacts.
-    // Enables differential TTL: sensitive artifacts expire sooner than standard ones.
-    // See: ToolArtifactStore.sweep() and ToolArtifactRetentionPolicy.
-    if (currentVersion < 10) {
-        const taCols = db.prepare('PRAGMA table_info(tool_artifacts)').all()
-            .map(r => r.name);
-        if (!taCols.includes('is_sensitive')) {
-            db.exec('ALTER TABLE tool_artifacts ADD COLUMN is_sensitive INTEGER NOT NULL DEFAULT 0');
-        }
-        db.prepare('INSERT OR IGNORE INTO schema_version (version, applied_at) VALUES (?, ?)')
-            .run(10, nowIso());
-    }
-    // v10 → v11: composition snapshot sidecar for warm-restore capture.
-    if (currentVersion < 11) {
-        db.exec(`
-      CREATE TABLE IF NOT EXISTS composition_snapshots (
-        id INTEGER PRIMARY KEY,
-        context_id INTEGER NOT NULL REFERENCES contexts(id) ON DELETE CASCADE,
-        head_message_id INTEGER REFERENCES messages(id),
-        schema_version INTEGER NOT NULL DEFAULT 1,
-        captured_at TEXT NOT NULL,
-        model TEXT NOT NULL,
-        context_window INTEGER NOT NULL,
-        total_tokens INTEGER NOT NULL,
-        fill_pct REAL NOT NULL,
-        snapshot_kind TEXT NOT NULL DEFAULT 'full',
-        repair_depth INTEGER NOT NULL DEFAULT 0,
-        slots_json TEXT NOT NULL,
-        slots_integrity_hash TEXT NOT NULL,
-        created_at TEXT NOT NULL
-      )
-    `);
-        db.exec(`
-      CREATE INDEX IF NOT EXISTS idx_composition_snapshots_context_recent
-        ON composition_snapshots(context_id, captured_at DESC)
-    `);
-        db.prepare('INSERT OR IGNORE INTO schema_version (version, applied_at) VALUES (?, ?)')
-            .run(11, nowIso());
-    }
-}
-export { LATEST_SCHEMA_VERSION as SCHEMA_VERSION };
-//# sourceMappingURL=schema.js.map

package/dist/secret-scanner.d.ts

@@ -1,51 +0,0 @@
-/**
- * hypermem Secret Scanner
- *
- * Lightweight regex-based gate to prevent secrets from leaking into
- * shared memory (visibility >= 'org'). Runs before any write that
- * promotes content to org/council/fleet visibility.
- *
- * Design principles:
- *   - Fast: regex-only, no LLM dependency
- *   - Conservative: false positives are okay; false negatives are not
- *   - Auditable: each hit includes the rule name and matched region (redacted)
- *   - Not a full DLP system: blocks the obvious leaks; does not guarantee clean content
- *
- * Patterns sourced from:
- *   - gitleaks ruleset (https://github.com/gitleaks/gitleaks)
- *   - trufflehog common patterns
- *   - Manual additions for OpenClaw-specific secrets
- */
-export interface ScanResult {
-    clean: boolean;
-    hits: ScanHit[];
-}
-export interface ScanHit {
-    rule: string;
-    description: string;
-    /** Redacted match — only first/last 3 chars of the matched value */
-    redactedMatch: string;
-    /** Character offset of the match start */
-    offset: number;
-}
-/**
- * Scan content for secrets before promoting to shared visibility.
- *
- * Returns { clean: true } when no secrets found.
- * Returns { clean: false, hits } when secrets are detected.
- *
- * Callers must NOT write content with visibility >= 'org' when clean is false.
- */
-export declare function scanForSecrets(content: string): ScanResult;
-/**
- * Returns true when content is safe to promote to shared visibility (>= 'org').
- * Convenience wrapper around scanForSecrets.
- */
-export declare function isSafeForSharedVisibility(content: string): boolean;
-/**
- * Check whether a visibility level requires secret scanning.
- * Scanning is required for 'org', 'council', and 'fleet'.
- * 'private' content stays with the owner — no cross-agent risk.
- */
-export declare function requiresScan(visibility: string): boolean;
-//# sourceMappingURL=secret-scanner.d.ts.map

package/dist/secret-scanner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-scanner.d.ts","sourceRoot":"","sources":["../src/secret-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAmMD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CA+B1D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/dist/secret-scanner.js

@@ -1,248 +0,0 @@
-/**
- * hypermem Secret Scanner
- *
- * Lightweight regex-based gate to prevent secrets from leaking into
- * shared memory (visibility >= 'org'). Runs before any write that
- * promotes content to org/council/fleet visibility.
- *
- * Design principles:
- *   - Fast: regex-only, no LLM dependency
- *   - Conservative: false positives are okay; false negatives are not
- *   - Auditable: each hit includes the rule name and matched region (redacted)
- *   - Not a full DLP system: blocks the obvious leaks; does not guarantee clean content
- *
- * Patterns sourced from:
- *   - gitleaks ruleset (https://github.com/gitleaks/gitleaks)
- *   - trufflehog common patterns
- *   - Manual additions for OpenClaw-specific secrets
- */
-const RULES = [
-    // ── API Keys ──────────────────────────────────────────────
-    {
-        id: 'anthropic-api-key',
-        description: 'Anthropic API key',
-        pattern: /\bsk-ant-[a-zA-Z0-9\-_]{20,}\b/g,
-    },
-    {
-        id: 'openai-api-key',
-        description: 'OpenAI API key',
-        pattern: /\bsk-[a-zA-Z0-9\-_]{20,}\b/g,
-    },
-    {
-        id: 'openai-org-id',
-        description: 'OpenAI organization ID',
-        pattern: /\borg-[a-zA-Z0-9]{16,}\b/g,
-    },
-    {
-        id: 'github-pat-classic',
-        description: 'GitHub personal access token (classic)',
-        pattern: /\bghp_[a-zA-Z0-9]{36}\b/g,
-    },
-    {
-        id: 'github-pat-fine',
-        description: 'GitHub fine-grained personal access token',
-        pattern: /\bgithub_pat_[a-zA-Z0-9_]{82}\b/g,
-    },
-    {
-        id: 'github-oauth-token',
-        description: 'GitHub OAuth token',
-        pattern: /\bgho_[a-zA-Z0-9]{36}\b/g,
-    },
-    {
-        id: 'github-app-token',
-        description: 'GitHub App installation token',
-        pattern: /\bghs_[a-zA-Z0-9]{36}\b/g,
-    },
-    {
-        id: 'github-refresh-token',
-        description: 'GitHub refresh token',
-        pattern: /\bghr_[a-zA-Z0-9]{76}\b/g,
-    },
-    {
-        id: 'aws-access-key',
-        description: 'AWS access key ID',
-        pattern: /\b(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b/g,
-    },
-    {
-        id: 'aws-secret-key',
-        description: 'AWS secret access key (heuristic)',
-        pattern: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)["\s:=]+([A-Za-z0-9\/+]{40})\b/gi,
-    },
-    {
-        id: 'google-api-key',
-        description: 'Google API key',
-        pattern: /\bAIza[0-9A-Za-z_\-]{35}\b/g,
-    },
-    {
-        id: 'google-oauth',
-        description: 'Google OAuth client secret',
-        pattern: /\bGOCSPX-[0-9A-Za-z_\-]{28}\b/g,
-    },
-    {
-        id: 'slack-token',
-        description: 'Slack API token',
-        pattern: /\bxox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,32}\b/g,
-    },
-    {
-        id: 'slack-webhook',
-        description: 'Slack incoming webhook URL',
-        pattern: /https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]{9,11}\/[A-Z0-9]{9,11}\/[a-zA-Z0-9]{24}/g,
-    },
-    {
-        id: 'discord-token',
-        description: 'Discord bot token',
-        pattern: /\b[MNO][a-zA-Z0-9]{23}\.[a-zA-Z0-9_\-]{6}\.[a-zA-Z0-9_\-]{27}\b/g,
-    },
-    {
-        id: 'discord-webhook',
-        description: 'Discord webhook URL',
-        pattern: /https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]{17,19}\/[a-zA-Z0-9_\-]{68}/g,
-    },
-    {
-        id: 'stripe-key',
-        description: 'Stripe API key',
-        pattern: /\b(?:sk|pk|rk)_(?:live|test)_[a-zA-Z0-9]{24,99}\b/g,
-    },
-    {
-        id: 'sendgrid-key',
-        description: 'SendGrid API key',
-        pattern: /\bSG\.[a-zA-Z0-9\-_]{22,}\.[a-zA-Z0-9\-_]{43,}\b/g,
-    },
-    {
-        id: 'twilio-account-sid',
-        description: 'Twilio Account SID',
-        pattern: /\bAC[0-9a-fA-F]{32}\b/g,
-    },
-    {
-        id: 'twilio-auth-token',
-        description: 'Twilio Auth Token (heuristic)',
-        pattern: /(?:twilio[_\s\-]*(?:auth[_\s\-]*)?token)["\s:=]+([0-9a-f]{32})\b/gi,
-    },
-    // ── Private Keys / Certificates ───────────────────────────
-    {
-        id: 'pem-private-key',
-        description: 'PEM private key block',
-        pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g,
-    },
-    {
-        id: 'pem-certificate',
-        description: 'PEM certificate (may contain private data)',
-        pattern: /-----BEGIN CERTIFICATE-----/g,
-    },
-    // ── Passwords in common config patterns ───────────────────
-    {
-        id: 'password-assignment',
-        description: 'Password in config-like assignment',
-        // Matches: password=<value>, "password": "<value>", PASSWORD=<value>
-        pattern: /(?:^|[,{;\n])\s*(?:password|passwd|secret|token|api_key|apikey|api-key|access_token|auth_token|client_secret)\s*[=:]\s*["']([^"'\n]{8,})["']/gim,
-        minEntropy: 2.5,
-    },
-    // ── Database connection strings ────────────────────────────
-    {
-        id: 'db-connection-string',
-        description: 'Database connection string with credentials',
-        pattern: /(?:postgres|postgresql|mysql|mongodb|redis):\/\/[^:]+:[^@]{6,}@/gi,
-    },
-    // ── Bearer tokens ─────────────────────────────────────────
-    {
-        id: 'bearer-token-header',
-        description: 'Bearer token in Authorization header value',
-        pattern: /Authorization[:\s]+Bearer\s+([a-zA-Z0-9\-_=.]{20,})/gi,
-    },
-    // ── JWT ───────────────────────────────────────────────────
-    {
-        id: 'jwt-token',
-        description: 'JSON Web Token',
-        pattern: /\beyJ[a-zA-Z0-9\-_]+\.eyJ[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\b/g,
-        minEntropy: 3.0,
-    },
-    // ── OpenClaw-specific ──────────────────────────────────────
-    {
-        id: 'openclaw-api-key',
-        description: 'OpenClaw API key',
-        pattern: /\boc_[a-zA-Z0-9\-_]{24,}\b/g,
-    },
-];
-// ─── Entropy Calculation ─────────────────────────────────────────
-/**
- * Calculate Shannon entropy of a string (bits per character, base 2).
- * Used to filter out low-entropy false positives like "password=example".
- */
-function shannonEntropy(s) {
-    if (s.length === 0)
-        return 0;
-    const freq = new Map();
-    for (const ch of s) {
-        freq.set(ch, (freq.get(ch) || 0) + 1);
-    }
-    let entropy = 0;
-    for (const count of freq.values()) {
-        const p = count / s.length;
-        entropy -= p * Math.log2(p);
-    }
-    return entropy;
-}
-// ─── Redaction ───────────────────────────────────────────────────
-/**
- * Redact a matched value: show first 3 and last 3 characters, mask the middle.
- */
-function redact(value) {
-    if (value.length <= 8)
-        return '[REDACTED]';
-    const prefix = value.slice(0, 3);
-    const suffix = value.slice(-3);
-    const masked = '*'.repeat(Math.min(value.length - 6, 20));
-    return `${prefix}${masked}${suffix}`;
-}
-// ─── Public API ──────────────────────────────────────────────────
-/**
- * Scan content for secrets before promoting to shared visibility.
- *
- * Returns { clean: true } when no secrets found.
- * Returns { clean: false, hits } when secrets are detected.
- *
- * Callers must NOT write content with visibility >= 'org' when clean is false.
- */
-export function scanForSecrets(content) {
-    const hits = [];
-    for (const rule of RULES) {
-        // Reset lastIndex for global regexes
-        rule.pattern.lastIndex = 0;
-        let match;
-        while ((match = rule.pattern.exec(content)) !== null) {
-            const matched = match[1] ?? match[0]; // prefer capture group 1 if present
-            // Entropy filter
-            if (rule.minEntropy && shannonEntropy(matched) < rule.minEntropy) {
-                continue;
-            }
-            hits.push({
-                rule: rule.id,
-                description: rule.description,
-                redactedMatch: redact(matched),
-                offset: match.index,
-            });
-            // Cap at 10 hits per content to avoid O(n²) explosion on adversarial input
-            if (hits.length >= 10)
-                break;
-        }
-        if (hits.length >= 10)
-            break;
-    }
-    return { clean: hits.length === 0, hits };
-}
-/**
- * Returns true when content is safe to promote to shared visibility (>= 'org').
- * Convenience wrapper around scanForSecrets.
- */
-export function isSafeForSharedVisibility(content) {
-    return scanForSecrets(content).clean;
-}
-/**
- * Check whether a visibility level requires secret scanning.
- * Scanning is required for 'org', 'council', and 'fleet'.
- * 'private' content stays with the owner — no cross-agent risk.
- */
-export function requiresScan(visibility) {
-    return visibility === 'org' || visibility === 'council' || visibility === 'fleet';
-}
-//# sourceMappingURL=secret-scanner.js.map