@sjawhar/pi-legion 9.1.1 → 9.2.0

package/dist/legion.js

@@ -13704,6 +13704,7 @@ function activeDispatchConfig(env, options = {}) {
 }
 
 // ../contracts/src/dispatch-api.ts
+var MAX_ISSUE_BLOCKERS = 20;
 var ISSUE_TITLE_MAX = 1000;
 var MAX_ISSUE_PAGE_LIMIT = 250;
 var DEFAULT_ISSUE_PAGE_LIMIT = 50;
@@ -14032,6 +14033,7 @@ var dispatchToolSpecs = [
       project: z2.string().describe("Project key for the new issue."),
       title: z2.string({ max: ISSUE_TITLE_MAX }).describe("Concise issue title, at most 1,000 characters."),
       parent: z2.string().describe("Optional parent issue.").optional(),
+      blocked_by: z2.array(z2.string({ min: 1 }), { max: MAX_ISSUE_BLOCKERS }).describe("Issue keys in the same project this issue waits on. Dispatch refuses a dependency cycle.").optional(),
       external: z2.string().describe("Optional external issue reference.").optional(),
       force: z2.boolean().describe("Create even though POSSIBLE_DUPLICATE listed similar issues; pass it only after reading them.").optional(),
       spec: z2.string().describe(`Optional initial primary-document markdown. ${SPEC_WRITING_POINTER}`).optional(),
@@ -14048,7 +14050,7 @@ var dispatchToolSpecs = [
       status: "done",
       reason: "Shipped in owner/repo#7; verified on the production dashboard."
     },
-    description: "Update an existing issue: move its lifecycle status, retitle it, replace its labels, set " + "its priority, link a URL (the pull request that delivers it, a run, a document), set its " + "route, set or clear its parent, or attach it to architecture components. Status is one of " + `${ISSUE_STATUSES.join(", ")}; outside Legion, move it yourself as the work advances; inside ` + "Legion the daemon moves it. external_links are " + "merged into the issue's existing links by URL, so linking the pull request you just opened " + "keeps every earlier link. components replaces the issue's own attachment. Closing an issue " + "(status done) requires reason, the note that says why: it is posted on the issue as a " + "message, then the issue closes, because a closed issue refuses messages, comments, and " + "artifacts; reason goes only with status done. A closed issue takes only rank, components, " + "and a reopening status (any status but done); everything else, priority included, waits " + "for the reopen. " + "priority is yours to set and a human overrides it; rank, the board's own order, is not " + "settable here. At least one " + `field besides issue is required. ${ISSUE_REFERENCE}`,
+    description: "Update an existing issue: move its lifecycle status, retitle it, replace its labels, set " + "its priority, link a URL (the pull request that delivers it, a run, a document), set its " + "route, set or clear its parent, replace the issues it is blocked by, or attach it to " + "architecture components. Status is one of " + `${ISSUE_STATUSES.join(", ")}; outside Legion, move it yourself as the work advances; inside ` + "Legion the daemon moves it. external_links are " + "merged into the issue's existing links by URL, so linking the pull request you just opened " + "keeps every earlier link. components replaces the issue's own attachment. Closing an issue " + "(status done) requires reason, the note that says why: it is posted on the issue as a " + "message, then the issue closes, because a closed issue refuses messages, comments, and " + "artifacts; reason goes only with status done. A closed issue takes only rank, components, " + "and a reopening status (any status but done); everything else, priority included, waits " + "for the reopen. " + "priority is yours to set and a human overrides it; rank, the board's own order, is not " + "settable here. At least one " + `field besides issue is required. ${ISSUE_REFERENCE}`,
     arguments: (z2) => ({
       issue: z2.string().describe(ISSUE_REFERENCE),
       status: z2.enum(ISSUE_STATUSES).describe("New lifecycle status.").optional(),
@@ -14059,15 +14061,16 @@ var dispatchToolSpecs = [
       external_links: z2.array(z2.string({ min: 1 })).describe("URLs to link; merged into the issue's existing external links by URL.").optional(),
       route: z2.string().describe("Route the issue to role:<name> or session:<id>; an empty string clears it.").optional(),
       parent: z2.string().describe("Parent issue key in the same project; an empty string clears the parent.").optional(),
+      blocked_by: z2.array(z2.string({ min: 1 }), { max: MAX_ISSUE_BLOCKERS }).describe("Replacement list of issue keys in the same project this issue waits on; [] clears it. Dispatch refuses a dependency cycle.").optional(),
       components: componentsArgument(z2).optional()
     }),
     validation: {
       check: (value) => {
         const input = value;
         const reasonFits = input.status === "done" ? typeof input.reason === "string" && input.reason.trim() !== "" : input.reason === undefined;
-        return reasonFits && (typeof input.status === "string" || typeof input.title === "string" || Array.isArray(input.labels) || typeof input.priority === "number" || input.priority === null || Array.isArray(input.external_links) || typeof input.route === "string" || typeof input.parent === "string" || typeof input.components === "object" && input.components !== null);
+        return reasonFits && (typeof input.status === "string" || typeof input.title === "string" || Array.isArray(input.labels) || typeof input.priority === "number" || input.priority === null || Array.isArray(input.external_links) || typeof input.route === "string" || typeof input.parent === "string" || Array.isArray(input.blocked_by) || typeof input.components === "object" && input.components !== null);
       },
-      message: "Issue update requires at least one field besides issue: status, title, labels, priority, external_links, route, parent, or components. " + "status done requires reason, a non-empty note saying why the issue is closing, posted on the issue before it closes because a closed issue refuses messages, comments, and artifacts; reason goes only with status done."
+      message: "Issue update requires at least one field besides issue: status, title, labels, priority, external_links, route, parent, blocked_by, or components. " + "status done requires reason, a non-empty note saying why the issue is closing, posted on the issue before it closes because a closed issue refuses messages, comments, and artifacts; reason goes only with status done."
     },
     strict: true
   },
@@ -15477,6 +15480,15 @@ var CHECKS = {
 };
 var MAX_DETAIL_BYTES = 1024;
 var HELD = "\uFFFF";
+var C1_INTRODUCER = "\uFFFE";
+var OPENER = "\uFDD0";
+var HELD_READINGS = [
+  [/(?:\uffff\[|\ufffe)[0-?]*[!-)+,/-]*/g, OPENER],
+  [/\ufdd0[@-~]?/g, HELD],
+  [/\uffff/g, " "]
+];
+var HELD_SEQUENCE = String.raw`\ufffe|\ufdd0|\uffff(?:\[[0-?]*[@-~])?`;
+var JWT_FIRST_HELD_SEQUENCE = String.raw`\ufffe|\uffff(?:\[[0-?]*[@-~])?`;
 function isSpace(code) {
   return code >= 9 && code <= 13 || code === 32 || code === 133 || code === 160 || code === 5760 || code >= 8192 && code <= 8202 || code === 8232 || code === 8233 || code === 8239 || code === 8287 || code === 12288;
 }
@@ -15495,33 +15507,83 @@ function truncateUtf8(text, max) {
 var CREDENTIAL_RULES = [
   [/(?<![a-z0-9+.-])([0-9+.-]*[a-z][a-z0-9+.-]*:\/\/)[^ /?#]+@/gi, "$1***@"],
   [
-    /([?&](?:token|key|secret|password|access_token|refresh_token|id_token|api_key|apikey|client_secret|sig|x-amz-security-token|x-amz-signature)=)[^ &#"'<>]+/gi,
+    /([?&](?:token|key|secret|password|access_token|accesstoken|refresh_token|id_token|auth_token|private_token|api_key|apikey|client_secret|sig|signature|x-amz-security-token|x-amz-signature|x-goog-signature)=)[^ &#"'<>]+/gi,
+    "$1***"
+  ],
+  [
+    /\b(password[ \ufffe\uffff]*=[ \ufffe\uffff]*)(?:(')(?:[^'\\]|\\.)*('?)|[^ &#"'<>]+)/gi,
+    "$1$2***$3"
+  ],
+  [
+    /(authorization\\?["']?[ \ufffe\uffff]*[:=][ \ufffe\uffff]*)(?:(\\["'](?:(?:bearer|basic|token|digest)[ \ufffe\uffff]+)?)[^"'\\]+|(["'](?:(?:bearer|basic|token|digest)[ \ufffe\uffff]+)?)(?:[^"'\\]|\\.)+|(\[?(?:(?:bearer|basic|token|digest)[ \ufffe\uffff]+)?)[^)\]}>]+)/gi,
+    "$1$2$3$4***"
+  ],
+  [
+    new RegExp(String.raw`((?:api-key|ocp-apim-subscription-key|x-subscription-token)\\?["']?[ \ufffe\uffff]*[:=][ \ufffe\uffff]*\\?["']?)(?:[A-Za-z0-9._~+/=*-]|${HELD_SEQUENCE})+`, "gi"),
+    "$1***"
+  ],
+  [
+    /(\\?["'](?:api_key|access_token)\\?["'][ \ufffe\uffff]*:[ \ufffe\uffff]*\\?["'])[^"'\\]+/gi,
+    "$1***"
+  ],
+  [
+    new RegExp(String.raw`\b(bearer[ \ufffe\uffff]+)(?:[A-Za-z0-9._~+/=*-]|${HELD_SEQUENCE})+`, "gi"),
     "$1***"
   ],
   [
-    /(authorization["']?[ \uffff]*[:=][ \uffff]*)(?:(["'])((?:bearer|basic|token|digest)[ \uffff]+)?[^"']+|(\[?)((?:bearer|basic|token|digest)[ \uffff]+)?[^)\]}>]+)/gi,
-    "$1$2$3$4$5***"
+    new RegExp(String.raw`\b(gh[pousr]_|github_pat_)(?:[A-Za-z0-9._-]|${HELD_SEQUENCE}){20,}`, "g"),
+    "$1***"
   ],
-  [/(x-api-key["']?[ \uffff]*[:=][ \uffff]*["']?)[A-Za-z0-9._~+/=*\uffff-]+/gi, "$1***"],
-  [/\b(bearer[ \uffff]+)[A-Za-z0-9._~+/=*\uffff-]+/gi, "$1***"],
-  [/\b(gh[pousr]_|github_pat_)[A-Za-z0-9._\uffff-]{20,}/g, "$1***"],
   [
-    /(?<![A-Za-z0-9_\uffff-])eyJ[A-Za-z0-9_\uffff-]{8,}\.[A-Za-z0-9_\uffff-]{8,}\.[A-Za-z0-9_\uffff-]*/g,
+    new RegExp(String.raw`(?:(?=eyJ)(?<!\uffff\[[0-?]*(?:[@-~]?|\\u[0-9A-Fa-f]{4}))(?:(?<![A-Za-z0-9_\ufffe\uffff-])|(?<=%[0-9A-Fa-f]{2}|\\u[0-9A-Fa-f]{4}))eyJ(?:[A-Za-z0-9_-]|${JWT_FIRST_HELD_SEQUENCE}){8,}|(?<=\uffff)eyJ(?:[A-Za-z0-9_-]|\ufffe){8,}|(?=eyJ)(?<=\uffff\[[0-?]*(?:[@-~]|\\u[0-9A-Fa-f]{4})?)eyJ[A-Za-z0-9_-]*\ufffe(?:[A-Za-z0-9_-]|\ufffe)*)\.(?:[A-Za-z0-9_-]|${HELD_SEQUENCE}){8,}\.(?:[A-Za-z0-9_-]|${HELD_SEQUENCE})*`, "g"),
     "***"
   ],
-  [/\b(sk-|dsp_)[A-Za-z0-9_\uffff-]{20,}/g, "$1***"],
-  [/\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, "$1***"]
+  [
+    new RegExp(String.raw`\b(sk-|dsp_|ya29\.|xox[a-z]-|glpat-|npm_)(?:[A-Za-z0-9_-]|${HELD_SEQUENCE}){20,}`, "g"),
+    "$1***"
+  ],
+  [new RegExp(String.raw`\b(AIza)(?:[A-Za-z0-9_-]|${HELD_SEQUENCE}){35,}`, "g"), "$1***"],
+  [new RegExp(String.raw`\b(AKIA|ASIA)(?:(?:${HELD_SEQUENCE})*[A-Z0-9]){16}\b`, "g"), "$1***"]
 ];
+var MAX_REDACTION_PASSES = 8;
+function redactCredentials(text) {
+  let line = text;
+  for (let pass = 0;pass < MAX_REDACTION_PASSES; pass++) {
+    const next = CREDENTIAL_RULES.reduce((redacted, [pattern, replacement]) => redacted.replace(pattern, replacement), line);
+    if (next === line)
+      break;
+    line = next;
+  }
+  return line;
+}
+function withoutLastCodePoint(text) {
+  const last = text.charCodeAt(text.length - 1);
+  return text.slice(0, last >= 56320 && last <= 57343 && text.length > 1 ? -2 : -1);
+}
 function cleanDetail(text) {
   let marked = "";
   for (const char of text) {
     const code = char.codePointAt(0) ?? 0;
-    const control = code < 32 || code >= 127 && code < 160;
-    marked += isSpace(code) ? " " : control ? HELD : char;
+    const control = code < 32 || code >= 127 && code < 160 || code === 65534 || code === 64976 || code === 65533;
+    marked += isSpace(code) ? " " : code === 155 ? C1_INTRODUCER : control ? HELD : char;
+  }
+  let redacted = redactCredentials(marked);
+  if (marked.includes(HELD) || marked.includes(C1_INTRODUCER)) {
+    for (const [pattern, replacement] of HELD_READINGS) {
+      const read = redacted.replace(pattern, replacement);
+      if (read !== redacted)
+        redacted = redactCredentials(read);
+    }
+  }
+  const line = redacted.split(" ").filter((field) => field !== "").join(" ");
+  let cut = truncateUtf8(line, MAX_DETAIL_BYTES).replace(/ +$/, "");
+  if (cut.length < line.length) {
+    while (redactCredentials(cut) !== cut) {
+      const space = cut.lastIndexOf(" ");
+      cut = space > 0 ? cut.slice(0, space) : withoutLastCodePoint(cut);
+    }
   }
-  const redacted = CREDENTIAL_RULES.reduce((line2, [pattern, replacement]) => line2.replace(pattern, replacement), marked);
-  const line = redacted.replaceAll(HELD, " ").split(" ").filter((field) => field !== "").join(" ");
-  return truncateUtf8(line, MAX_DETAIL_BYTES);
+  return cut;
 }
 function budgetLabel(ms) {
   return ms % 1000 === 0 ? `${ms / 1000} s` : `${ms} ms`;
@@ -15641,7 +15703,7 @@ function onEnvoyRoleRegained(listener) {
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion",
-  version: "9.1.1",
+  version: "9.2.0",
   license: "Apache-2.0",
   type: "module",
   omp: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion",
-  "version": "9.1.1",
+  "version": "9.2.0",
   "license": "Apache-2.0",
   "type": "module",
   "omp": {