@skrr-ai/cli 0.1.103 → 0.1.104

package/dist/commands/commitments/create.js

@@ -164,6 +164,8 @@ class CommitmentsCreate extends base_command_1.BaseCommand {
         '<%= config.bin %> commitments create --agent <agent-id> --title "AWS cost watch" --outcome "Cost regressions are investigated" --agent-directive-file ./aws-cost-policy.md',
         '<%= config.bin %> commitments create --from-json commitment.json --json',
         `# Replace <agent-id> with your Agent ID; this creates a draft, not a running loop.
+# In "policy", 0 is a ZERO budget (nothing may run or be spent), not "no limit".
+# To remove a limit set it to null (e.g. "maxCostUsdPerDay": null) or leave the key out.
 cat > commitment.json <<'JSON'
 {
   "agentId": "<agent-id>",

package/dist/commands/daemon/logs.d.ts

@@ -61,13 +61,25 @@ export declare function resolveDaemonLogsProfile(flags: Pick<DaemonLogsFlags, 'p
     home?: string;
     env?: NodeJS.ProcessEnv;
 }): string;
+/** Output destinations the installed launchd definition for a profile declares. */
+export interface InstalledServiceLogDestinations {
+    /** The `--log-file` in ProgramArguments, when present. */
+    logFile: string | null;
+    stdoutPath: string | null;
+    stderrPath: string | null;
+}
 /**
- * Log files the installed launchd definition for this profile sends output to
- * (OSK-15993). The desktop supervisor starts the daemon with
+ * Read the installed launchd definition's log destinations (OSK-15993). The
+ * desktop supervisor starts the daemon with
  * `--log-file ~/Library/Logs/Skrr/daemon.app.log` and redirects stderr to
  * `daemon.stderr.log`, so the profile's `logs/` directory can hold a file
  * nobody has written for a week. Read-only: the plist is parsed, never loaded.
  */
+export declare function installedServiceLogDestinations(profile: string, options?: {
+    home?: string;
+    platform?: NodeJS.Platform;
+}): InstalledServiceLogDestinations | null;
+/** The installed service's log files for the main log, or for `--stderr`. */
 export declare function installedServiceLogCandidates(profile: string, stderr: boolean, options?: {
     home?: string;
     platform?: NodeJS.Platform;
@@ -82,6 +94,8 @@ export declare function chooseLegacyFallbackLog(args: {
     profilePath: string;
     serviceCandidates: readonly string[];
     mtimeOf: (filePath: string) => number | null;
+    /** Why the runtime's own answer is not used; ends the note. */
+    reason?: string;
 }): {
     path: string;
     note: string | null;
@@ -93,6 +107,59 @@ export declare function chooseLegacyFallbackLog(args: {
  * rather than printed about a file that may not be the one shown.
  */
 export declare function resolveForwardedLogPath(flags: Pick<DaemonLogsFlags, 'stderr' | 'profile'>, capture?: typeof execRuntimeBinaryCapture): Promise<string | null>;
+/**
+ * The first runtime whose own `logs` reads the LIVE daemon's `--log-file`
+ * (OSK-15993, `daemon/src/daemon-log-target.ts`). 0.8.112 through 0.8.118 have
+ * a `logs` subcommand, so the subcommand probe says "supported", but it reads
+ * the profile's `logs/daemon.log` unconditionally — with a desktop-managed
+ * daemon, a file nobody has written for a week. Forwarding to one of those is
+ * forwarding to the bug, so the CLI forwards only at or above this version.
+ */
+export declare const LIVE_LOG_RESOLUTION_RUNTIME_VERSION = "0.8.119";
+/** `x.y.z` from a version string, or null. A prerelease suffix is ignored. */
+export declare function parseRuntimeVersion(text: string): [number, number, number] | null;
+/** Whether `version` is at least `floor`; null when either is not a version. */
+export declare function runtimeVersionAtLeast(version: string, floor: string): boolean | null;
+/** The installed runtime's `--version`, or null when it cannot say in time. */
+export declare function probeRuntimeVersion(capture?: typeof execRuntimeBinaryCapture): Promise<string | null>;
+/**
+ * The live daemon's log as the runtime's `status --json` reports it
+ * (`service.logs`). Status has named the live `--log-file` since before `logs`
+ * did, so on 0.8.117 status is right while logs is wrong. Null when status
+ * cannot answer, or answers with anything but an absolute path.
+ */
+export declare function probeStatusLogPath(flags: Pick<DaemonLogsFlags, 'profile'>, capture?: typeof execRuntimeBinaryCapture): Promise<string | null>;
+/** What `skrr daemon logs` does: forward to the runtime, or read a file itself. */
+export type DaemonLogsPlan = {
+    kind: 'forward';
+}
+/** `note` goes to stderr before any log content; never printed for `--path`. */
+ | {
+    kind: 'read';
+    path: string;
+    note: string | null;
+    missingHint: string;
+};
+export interface DaemonLogsPlanDeps {
+    supportsLogs(): Promise<boolean | null>;
+    runtimeVersion(): Promise<string | null>;
+    statusLogPath(): Promise<string | null>;
+    /** The profile log for this invocation (`daemon.err.log` under `--stderr`). */
+    profilePath: string;
+    service: InstalledServiceLogDestinations | null;
+    mtimeOf(filePath: string): number | null;
+}
+/**
+ * Decide which runtime, if any, `skrr daemon logs` may trust (OSK-15993).
+ *
+ * - No `logs` subcommand: the legacy fallback, as before.
+ * - A runtime at or above {@link LIVE_LOG_RESOLUTION_RUNTIME_VERSION}: forward.
+ * - An older runtime, or one whose version cannot be read: ask its `status`
+ *   which file the live daemon writes and read that file here. When status
+ *   cannot answer, an older runtime gets the legacy fallback (the newest of the
+ *   profile log and the installed service's logs); an unknown one is forwarded.
+ */
+export declare function planDaemonLogs(flags: Pick<DaemonLogsFlags, 'stderr'>, deps: DaemonLogsPlanDeps): Promise<DaemonLogsPlan>;
 /** Read a bounded trailing window, so an unrotated legacy err log is safe. */
 export declare function readDaemonLogTail(filePath: string, maxLines: number): string[];
 /**

package/dist/commands/daemon/logs.js

@@ -3,12 +3,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.LIVE_LOG_RESOLUTION_RUNTIME_VERSION = void 0;
 exports.describeLogAge = describeLogAge;
 exports.resolveLegacyDaemonLogPath = resolveLegacyDaemonLogPath;
 exports.resolveDaemonLogsProfile = resolveDaemonLogsProfile;
+exports.installedServiceLogDestinations = installedServiceLogDestinations;
 exports.installedServiceLogCandidates = installedServiceLogCandidates;
 exports.chooseLegacyFallbackLog = chooseLegacyFallbackLog;
 exports.resolveForwardedLogPath = resolveForwardedLogPath;
+exports.parseRuntimeVersion = parseRuntimeVersion;
+exports.runtimeVersionAtLeast = runtimeVersionAtLeast;
+exports.probeRuntimeVersion = probeRuntimeVersion;
+exports.probeStatusLogPath = probeStatusLogPath;
+exports.planDaemonLogs = planDaemonLogs;
 exports.readDaemonLogTail = readDaemonLogTail;
 exports.buildDaemonLogsArgs = buildDaemonLogsArgs;
 const core_1 = require("@oclif/core");
@@ -93,22 +100,22 @@ function resolveDaemonLogsProfile(flags, options = {}) {
     return profile ?? 'default';
 }
 /**
- * Log files the installed launchd definition for this profile sends output to
- * (OSK-15993). The desktop supervisor starts the daemon with
+ * Read the installed launchd definition's log destinations (OSK-15993). The
+ * desktop supervisor starts the daemon with
  * `--log-file ~/Library/Logs/Skrr/daemon.app.log` and redirects stderr to
  * `daemon.stderr.log`, so the profile's `logs/` directory can hold a file
  * nobody has written for a week. Read-only: the plist is parsed, never loaded.
  */
-function installedServiceLogCandidates(profile, stderr, options = {}) {
+function installedServiceLogDestinations(profile, options = {}) {
     if ((options.platform ?? process.platform) !== 'darwin')
-        return [];
+        return null;
     const plist = node_path_1.default.join(options.home ?? (0, node_os_1.homedir)(), 'Library', 'LaunchAgents', `ai.skrr.daemon.${profile}.plist`);
     let xml;
     try {
         xml = (0, node_fs_1.readFileSync)(plist, 'utf8');
     }
     catch {
-        return [];
+        return null;
     }
     const unescape = (v) => v
         .replace(/&lt;/g, '<')
@@ -120,22 +127,28 @@ function installedServiceLogCandidates(profile, stderr, options = {}) {
         const m = new RegExp(`<key>\\s*${key}\\s*</key>\\s*<string>([\\s\\S]*?)</string>`).exec(xml);
         return m?.[1]?.trim() ? unescape(m[1].trim()) : null;
     };
-    if (stderr) {
-        const errPath = stringFor('StandardErrorPath');
-        return errPath ? [errPath] : [];
-    }
-    const out = [];
+    let logFile = null;
     const array = /<key>\s*ProgramArguments\s*<\/key>\s*<array>([\s\S]*?)<\/array>/.exec(xml);
     if (array?.[1]) {
         const args = [...array[1].matchAll(/<string>([\s\S]*?)<\/string>/g)].map((m) => unescape(m[1].trim()));
         const at = args.lastIndexOf('--log-file');
         if (at >= 0 && args[at + 1] && !args[at + 1].startsWith('-'))
-            out.push(args[at + 1]);
+            logFile = args[at + 1];
     }
-    const stdoutPath = stringFor('StandardOutPath');
-    if (stdoutPath)
-        out.push(stdoutPath);
-    return out;
+    return {
+        logFile,
+        stdoutPath: stringFor('StandardOutPath'),
+        stderrPath: stringFor('StandardErrorPath'),
+    };
+}
+/** The installed service's log files for the main log, or for `--stderr`. */
+function installedServiceLogCandidates(profile, stderr, options = {}) {
+    const dest = installedServiceLogDestinations(profile, options);
+    if (!dest)
+        return [];
+    if (stderr)
+        return dest.stderrPath ? [dest.stderrPath] : [];
+    return [dest.logFile, dest.stdoutPath].filter((p) => Boolean(p));
 }
 /**
  * Pick the file the legacy fallback reads. An old daemon cannot say which file
@@ -164,7 +177,7 @@ function chooseLegacyFallbackLog(args) {
             (profileMtime === null
                 ? `the profile log ${args.profilePath}, which does not exist.`
                 : `the profile log ${args.profilePath}, which has not been written since.`) +
-            ' This daemon predates `logs`, so it cannot name its live log itself.',
+            ` ${args.reason ?? 'This daemon predates `logs`, so it cannot name its live log itself.'}`,
     };
 }
 /**
@@ -191,6 +204,153 @@ async function resolveForwardedLogPath(flags, capture = exec_runtime_binary_1.ex
         return null;
     }
 }
+/**
+ * The first runtime whose own `logs` reads the LIVE daemon's `--log-file`
+ * (OSK-15993, `daemon/src/daemon-log-target.ts`). 0.8.112 through 0.8.118 have
+ * a `logs` subcommand, so the subcommand probe says "supported", but it reads
+ * the profile's `logs/daemon.log` unconditionally — with a desktop-managed
+ * daemon, a file nobody has written for a week. Forwarding to one of those is
+ * forwarding to the bug, so the CLI forwards only at or above this version.
+ */
+exports.LIVE_LOG_RESOLUTION_RUNTIME_VERSION = '0.8.119';
+/** `x.y.z` from a version string, or null. A prerelease suffix is ignored. */
+function parseRuntimeVersion(text) {
+    const m = /(\d+)\.(\d+)\.(\d+)/.exec(text);
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+/** Whether `version` is at least `floor`; null when either is not a version. */
+function runtimeVersionAtLeast(version, floor) {
+    const a = parseRuntimeVersion(version);
+    const b = parseRuntimeVersion(floor);
+    if (!a || !b)
+        return null;
+    for (let i = 0; i < 3; i += 1) {
+        if (a[i] !== b[i])
+            return a[i] > b[i];
+    }
+    return true;
+}
+/** The installed runtime's `--version`, or null when it cannot say in time. */
+async function probeRuntimeVersion(capture = exec_runtime_binary_1.execRuntimeBinaryCapture) {
+    try {
+        const out = await capture(['--version'], { timeoutMs: 5_000 });
+        if (out.code !== 0)
+            return null;
+        const parsed = parseRuntimeVersion(out.stdout);
+        return parsed ? parsed.join('.') : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The live daemon's log as the runtime's `status --json` reports it
+ * (`service.logs`). Status has named the live `--log-file` since before `logs`
+ * did, so on 0.8.117 status is right while logs is wrong. Null when status
+ * cannot answer, or answers with anything but an absolute path.
+ */
+async function probeStatusLogPath(flags, capture = exec_runtime_binary_1.execRuntimeBinaryCapture) {
+    try {
+        const out = await capture([...(flags.profile ? ['--profile', flags.profile] : []), 'status', '--json'], { timeoutMs: 15_000 });
+        // `status` exits non-zero when it reports problems; the JSON is still the answer.
+        const start = out.stdout.indexOf('{');
+        if (start < 0)
+            return null;
+        const parsed = JSON.parse(out.stdout.slice(start));
+        const logs = parsed?.service?.logs;
+        return typeof logs === 'string' && node_path_1.default.isAbsolute(logs) ? logs : null;
+    }
+    catch {
+        return null;
+    }
+}
+function sameLogFile(a, b) {
+    return Boolean(a && b && node_path_1.default.resolve(a) === node_path_1.default.resolve(b));
+}
+/**
+ * Decide which runtime, if any, `skrr daemon logs` may trust (OSK-15993).
+ *
+ * - No `logs` subcommand: the legacy fallback, as before.
+ * - A runtime at or above {@link LIVE_LOG_RESOLUTION_RUNTIME_VERSION}: forward.
+ * - An older runtime, or one whose version cannot be read: ask its `status`
+ *   which file the live daemon writes and read that file here. When status
+ *   cannot answer, an older runtime gets the legacy fallback (the newest of the
+ *   profile log and the installed service's logs); an unknown one is forwarded.
+ */
+async function planDaemonLogs(flags, deps) {
+    const legacy = (reason) => {
+        const chosen = chooseLegacyFallbackLog({
+            profilePath: deps.profilePath,
+            serviceCandidates: (flags.stderr
+                ? [deps.service?.stderrPath]
+                : [deps.service?.logFile, deps.service?.stdoutPath]).filter((p) => Boolean(p)),
+            mtimeOf: deps.mtimeOf,
+            reason,
+        });
+        return {
+            kind: 'read',
+            path: chosen.path,
+            note: chosen.note,
+            missingHint: 'The installed daemon predates `oversky logs`; start it or upgrade it, then retry.',
+        };
+    };
+    const supports = await deps.supportsLogs();
+    if (supports === false) {
+        return legacy('This daemon predates `logs`, so it cannot name its live log itself.');
+    }
+    // Help could not be read: nothing to go on, keep the old behaviour.
+    if (supports === null)
+        return { kind: 'forward' };
+    const version = await deps.runtimeVersion();
+    const current = version
+        ? runtimeVersionAtLeast(version, exports.LIVE_LOG_RESOLUTION_RUNTIME_VERSION)
+        : null;
+    if (current === true)
+        return { kind: 'forward' };
+    const live = await deps.statusLogPath();
+    const predates = version !== null
+        ? `The installed runtime (${version}) predates \`logs\` following the live daemon's ` +
+            `--log-file (${exports.LIVE_LOG_RESOLUTION_RUNTIME_VERSION}), so it would read ${deps.profilePath}.`
+        : `The installed runtime did not report its version, so its \`logs\` may read ` +
+            `${deps.profilePath} instead of the live log.`;
+    if (!live) {
+        if (current === null)
+            return { kind: 'forward' };
+        return legacy(`${predates} Its \`status\` did not name the live log either.`);
+    }
+    // The live daemon writes the profile log itself: the runtime's answer is right.
+    if (sameLogFile(live, node_path_1.default.join(node_path_1.default.dirname(deps.profilePath), 'daemon.log'))) {
+        return { kind: 'forward' };
+    }
+    const missingHint = 'The live daemon has not written it yet; `skrr daemon status` shows whether one is running.';
+    if (!flags.stderr) {
+        return {
+            kind: 'read',
+            path: live,
+            note: `Showing ${live}, the live daemon's log as \`skrrd status\` reports it. ${predates}`,
+            missingHint,
+        };
+    }
+    // --stderr: trust the installed definition's redirect only when it is the
+    // one that launched this daemon (its --log-file is the live one) — the same
+    // rule the runtime's own resolution applies.
+    if (deps.service?.stderrPath && sameLogFile(deps.service.logFile, live)) {
+        return {
+            kind: 'read',
+            path: deps.service.stderrPath,
+            note: `Showing ${deps.service.stderrPath}, the live daemon's stderr as its service definition ` +
+                `redirects it; its full log, WARN and ERROR included, is ${live}. ${predates}`,
+            missingHint,
+        };
+    }
+    return {
+        kind: 'read',
+        path: live,
+        note: `Showing ${live}, the live daemon's log as \`skrrd status\` reports it; it carries every ` +
+            `WARN and ERROR line. ${predates}`,
+        missingHint,
+    };
+}
 /** Read a bounded trailing window, so an unrotated legacy err log is safe. */
 function readDaemonLogTail(filePath, maxLines) {
     if (maxLines === 0)
@@ -301,29 +461,38 @@ class DaemonLogs extends core_1.Command {
             // `oversky 0.2.x` has profiles and writes the same files, but has no
             // `logs` subcommand. Probe top-level help first so forwarding does not
             // print an unrelated "unknown option" error before the useful output.
-            if ((await (0, exec_runtime_binary_1.runtimeBinarySupportsSubcommand)('logs')) === false) {
-                const chosen = chooseLegacyFallbackLog({
-                    profilePath: resolveLegacyDaemonLogPath(flags),
-                    serviceCandidates: installedServiceLogCandidates(resolveDaemonLogsProfile(flags), flags.stderr === true),
-                    mtimeOf: (filePath) => {
-                        try {
-                            return (0, node_fs_1.statSync)(filePath).mtimeMs;
-                        }
-                        catch {
-                            return null;
-                        }
-                    },
-                });
-                const logPath = chosen.path;
-                if (chosen.note)
-                    this.logToStderr(chosen.note);
+            //
+            // OSK-15993: a runtime that HAS `logs` is not necessarily one to trust
+            // with it — 0.8.112–0.8.118 read the profile log even when the live
+            // daemon writes elsewhere. `planDaemonLogs` forwards only to a runtime
+            // that resolves the live log itself.
+            const plan = await planDaemonLogs(flags, {
+                supportsLogs: () => (0, exec_runtime_binary_1.runtimeBinarySupportsSubcommand)('logs'),
+                runtimeVersion: () => probeRuntimeVersion(),
+                statusLogPath: () => probeStatusLogPath(flags),
+                profilePath: resolveLegacyDaemonLogPath(flags),
+                service: installedServiceLogDestinations(resolveDaemonLogsProfile(flags)),
+                mtimeOf: (filePath) => {
+                    try {
+                        return (0, node_fs_1.statSync)(filePath).mtimeMs;
+                    }
+                    catch {
+                        return null;
+                    }
+                },
+            });
+            if (plan.kind === 'read') {
+                const logPath = plan.path;
+                // `--path` prints the one path and nothing else, on either stream.
                 if (flags.path) {
                     this.log(logPath);
                     return;
                 }
+                if (plan.note)
+                    this.logToStderr(plan.note);
                 showAge(logPath);
                 if (!(0, node_fs_1.existsSync)(logPath)) {
-                    this.error(`No daemon log at ${logPath}. The installed daemon predates \`oversky logs\`; start it or upgrade it, then retry.`, { exit: 1 });
+                    this.error(`No daemon log at ${logPath}. ${plan.missingHint}`, { exit: 1 });
                 }
                 const lines = readDaemonLogTail(logPath, flags.lines ?? 200);
                 if (lines.length > 0)

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/telemetryRedaction.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Keeping a Hosted Machine preview capability out of telemetry (OSK-16174).
+ *
+ * `/api/previews/<token>/...` serves a person's machine with NO login: the token in the path is a bearer
+ * capability (`pvw_<22 chars>.<expiry>.<22 chars>`, idle TTL ten minutes). Anyone who can read a trace, an error
+ * report or a log line that carries it can open the preview, so every sink that records a URL has to run its
+ * strings through here first. This file is the ONE place that knows what to look for; the sinks (OpenTelemetry
+ * exporters, Sentry hooks, request and CSRF logs, client-log ingest) only decide WHERE to call it.
+ *
+ * WHAT IT MATCHES. The prefix `pvw_` and then every character a token is made of, however far that goes, rather
+ * than the exact 22.digits.22 shape. A truncated token is still part of the secret, a log line cut at 200
+ * characters is the ordinary way one gets truncated, and a looser match costs nothing: the marker replaces
+ * only what looked like a token. The token alphabet is base64url plus the two dots, or any of those characters
+ * written as a percent-escape, once or several times (`encodeURIComponent` of a URL that was itself in a query
+ * string). `packages/data-provider/specs/hostedPreview.spec.ts` pins this against the contract's token shape
+ * and `api/server/services/HostedPreview/__tests__/telemetryRedaction.spec.js` against tokens the issuer really
+ * mints, so a change to either side fails there rather than in a trace nobody reads.
+ *
+ * WHAT IT DOES NOT. A prefix that is itself percent-encoded (`%70vw_`) is not recognised: nothing in this
+ * repository writes one, and a scan that decoded every string first would cost every sink on every record. The
+ * request log's own `/[credential]` rewrite (`requestLogger.js`) covers the other credential prefixes and
+ * stays as it is.
+ *
+ * COST. Linear in the input. The only nested repetition is `%(?:25)*XX`, and `XX` is never `25`, so the engine
+ * cannot read one run of `25`s two ways; the tests feed it a megabyte of the worst shapes.
+ *
+ * NEVER THROWS. These run inside telemetry hooks, and a hook that throws takes a request or an error report
+ * with it. Whatever cannot be scrubbed is reported to the caller as such (`false`), and the caller drops the
+ * record, because a record with the token still in it is exactly what this exists to prevent.
+ */
+/** What replaces a token. Fixed, so a trace can say a preview was involved but not which one. */
+export declare const PREVIEW_TOKEN_REDACTION: "pvw_[redacted]";
+/**
+ * Replace every preview token in a string with {@link PREVIEW_TOKEN_REDACTION}. The rest of the string is
+ * untouched, so a trace is still readable. Anything that is not a string comes back as it came.
+ */
+export declare function redactPreviewTokens(value: string): string;
+export declare function redactPreviewTokens<T>(value: T): T;
+export interface PreviewTokenWalkLimits {
+    /** Objects and arrays visited before the walk gives up. Default 50 000: a Sentry transaction of a thousand spans. */
+    maxNodes?: number;
+    /** Nesting followed before the walk gives up. Default 32. */
+    maxDepth?: number;
+}
+/**
+ * Redact every string inside an object graph, IN PLACE (an error report is rewritten far more cheaply than it is
+ * copied). Returns `true` when the whole graph was scrubbed and `false` when some of it could not be: past
+ * the bounds, frozen, behind a getter that throws. A `false` means the value may still hold a token and must not
+ * be sent. Binary payloads are skipped, not walked, and Error messages and stacks are scrubbed though they are
+ * not enumerable.
+ */
+export declare function redactPreviewTokensDeep(root: unknown, limits?: PreviewTokenWalkLimits): boolean;
+/**
+ * Sentry `init` options with a redacting `beforeSend`, `beforeSendTransaction` and `beforeBreadcrumb`. Those three
+ * are where an event's `request.url`, `request.query_string`, `transaction`, spans, breadcrumbs, `extra` and
+ * `contexts` pass last, so redacting the whole record there needs no list of fields and covers one added later.
+ * An existing hook runs FIRST and keeps its say (it can still drop the record, change it, or be asynchronous);
+ * what it returns is scrubbed after it, so nothing it adds escapes. The options object passed in is not modified.
+ * Every `Sentry.init` in this repository goes through this, and an architecture spec fails if one is added without.
+ */
+export declare function withPreviewTokenRedaction<T extends object>(options: T): T;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/telemetryRedaction.js

@@ -0,0 +1,177 @@
+"use strict";
+/**
+ * Keeping a Hosted Machine preview capability out of telemetry (OSK-16174).
+ *
+ * `/api/previews/<token>/...` serves a person's machine with NO login: the token in the path is a bearer
+ * capability (`pvw_<22 chars>.<expiry>.<22 chars>`, idle TTL ten minutes). Anyone who can read a trace, an error
+ * report or a log line that carries it can open the preview, so every sink that records a URL has to run its
+ * strings through here first. This file is the ONE place that knows what to look for; the sinks (OpenTelemetry
+ * exporters, Sentry hooks, request and CSRF logs, client-log ingest) only decide WHERE to call it.
+ *
+ * WHAT IT MATCHES. The prefix `pvw_` and then every character a token is made of, however far that goes, rather
+ * than the exact 22.digits.22 shape. A truncated token is still part of the secret, a log line cut at 200
+ * characters is the ordinary way one gets truncated, and a looser match costs nothing: the marker replaces
+ * only what looked like a token. The token alphabet is base64url plus the two dots, or any of those characters
+ * written as a percent-escape, once or several times (`encodeURIComponent` of a URL that was itself in a query
+ * string). `packages/data-provider/specs/hostedPreview.spec.ts` pins this against the contract's token shape
+ * and `api/server/services/HostedPreview/__tests__/telemetryRedaction.spec.js` against tokens the issuer really
+ * mints, so a change to either side fails there rather than in a trace nobody reads.
+ *
+ * WHAT IT DOES NOT. A prefix that is itself percent-encoded (`%70vw_`) is not recognised: nothing in this
+ * repository writes one, and a scan that decoded every string first would cost every sink on every record. The
+ * request log's own `/[credential]` rewrite (`requestLogger.js`) covers the other credential prefixes and
+ * stays as it is.
+ *
+ * COST. Linear in the input. The only nested repetition is `%(?:25)*XX`, and `XX` is never `25`, so the engine
+ * cannot read one run of `25`s two ways; the tests feed it a megabyte of the worst shapes.
+ *
+ * NEVER THROWS. These run inside telemetry hooks, and a hook that throws takes a request or an error report
+ * with it. Whatever cannot be scrubbed is reported to the caller as such (`false`), and the caller drops the
+ * record, because a record with the token still in it is exactly what this exists to prevent.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PREVIEW_TOKEN_REDACTION = void 0;
+exports.redactPreviewTokens = redactPreviewTokens;
+exports.redactPreviewTokensDeep = redactPreviewTokensDeep;
+exports.withPreviewTokenRedaction = withPreviewTokenRedaction;
+/** What replaces a token. Fixed, so a trace can say a preview was involved but not which one. */
+exports.PREVIEW_TOKEN_REDACTION = 'pvw_[redacted]';
+/**
+ * One character of a token: base64url, a dot, or any of those written as a percent-escape. An escape that was
+ * escaped again is `%25` followed by the original two digits (`_` is `%5F`, then `%255F`, then `%25255F`), which is
+ * what the `(?:25)*` is for. `25` is not itself a digit pair of a token character, so a run of them can only be
+ * read one way.
+ */
+const TOKEN_CHAR = '(?:[A-Za-z0-9._-]|%(?:25)*(?:2[DdEe]|3[0-9]|4[1-9A-Fa-f]|5[0-9AaFf]|6[1-9A-Fa-f]|7[0-9Aa]))';
+/**
+ * `pvw` then an underscore, which may be written `%5F` (or `%255F`, ...); then at least ONE token character. Not
+ * zero: the marker is `pvw_[`, and `[` is not a token character, so a string that was already redacted matches
+ * nothing and redacting twice changes nothing.
+ */
+const PREVIEW_TOKEN = new RegExp(`pvw(?:_|%(?:25)*5[Ff])${TOKEN_CHAR}+`, 'g');
+function redactPreviewTokens(value) {
+    if (typeof value !== 'string' || value.indexOf('pvw') === -1) {
+        return value;
+    }
+    return value.replace(PREVIEW_TOKEN, exports.PREVIEW_TOKEN_REDACTION);
+}
+const DEFAULT_MAX_NODES = 50_000;
+const DEFAULT_MAX_DEPTH = 32;
+/**
+ * Redact every string inside an object graph, IN PLACE (an error report is rewritten far more cheaply than it is
+ * copied). Returns `true` when the whole graph was scrubbed and `false` when some of it could not be: past
+ * the bounds, frozen, behind a getter that throws. A `false` means the value may still hold a token and must not
+ * be sent. Binary payloads are skipped, not walked, and Error messages and stacks are scrubbed though they are
+ * not enumerable.
+ */
+function redactPreviewTokensDeep(root, limits = {}) {
+    if (root === null || typeof root !== 'object') {
+        return true;
+    }
+    const maxNodes = limits.maxNodes ?? DEFAULT_MAX_NODES;
+    const maxDepth = limits.maxDepth ?? DEFAULT_MAX_DEPTH;
+    try {
+        const seen = new WeakSet();
+        const stack = [[root, 0]];
+        let visited = 0;
+        let complete = true;
+        const rewrite = (holder, key, current) => {
+            const next = redactPreviewTokens(current);
+            if (next === current) {
+                return;
+            }
+            try {
+                holder[key] = next;
+            }
+            catch {
+                // a frozen object throws in strict code
+            }
+            if (holder[key] !== next) {
+                // and silently keeps the old value in sloppy code
+                complete = false;
+            }
+        };
+        while (stack.length > 0) {
+            const [node, depth] = stack.pop();
+            if (seen.has(node) || ArrayBuffer.isView(node)) {
+                continue;
+            }
+            seen.add(node);
+            visited += 1;
+            if (visited > maxNodes) {
+                return false;
+            }
+            const holder = node;
+            if (node instanceof Error) {
+                for (const key of ['message', 'stack']) {
+                    if (typeof holder[key] === 'string') {
+                        rewrite(holder, key, holder[key]);
+                    }
+                }
+            }
+            for (const key of Object.keys(node)) {
+                let child;
+                try {
+                    child = holder[key];
+                }
+                catch {
+                    complete = false;
+                    continue;
+                }
+                if (typeof child === 'string') {
+                    rewrite(holder, key, child);
+                }
+                else if (child !== null && typeof child === 'object') {
+                    if (depth + 1 > maxDepth) {
+                        complete = false;
+                    }
+                    else {
+                        stack.push([child, depth + 1]);
+                    }
+                }
+            }
+        }
+        return complete;
+    }
+    catch {
+        return false;
+    }
+}
+function isThenable(value) {
+    return (value !== null &&
+        (typeof value === 'object' || typeof value === 'function') &&
+        typeof value.then === 'function');
+}
+/** The record with its tokens redacted, or `null` (dropped) when that could not be done. */
+function scrubRecord(record) {
+    if (record === null || record === undefined) {
+        return record;
+    }
+    if (typeof record !== 'object') {
+        return null;
+    }
+    return redactPreviewTokensDeep(record) ? record : null;
+}
+function guard(existing) {
+    return (value, hint) => {
+        const result = existing ? existing(value, hint) : value;
+        return isThenable(result) ? result.then(scrubRecord) : scrubRecord(result);
+    };
+}
+/**
+ * Sentry `init` options with a redacting `beforeSend`, `beforeSendTransaction` and `beforeBreadcrumb`. Those three
+ * are where an event's `request.url`, `request.query_string`, `transaction`, spans, breadcrumbs, `extra` and
+ * `contexts` pass last, so redacting the whole record there needs no list of fields and covers one added later.
+ * An existing hook runs FIRST and keeps its say (it can still drop the record, change it, or be asynchronous);
+ * what it returns is scrubbed after it, so nothing it adds escapes. The options object passed in is not modified.
+ * Every `Sentry.init` in this repository goes through this, and an architecture spec fails if one is added without.
+ */
+function withPreviewTokenRedaction(options) {
+    const hooks = options;
+    return {
+        ...options,
+        beforeSend: guard(hooks.beforeSend),
+        beforeSendTransaction: guard(hooks.beforeSendTransaction),
+        beforeBreadcrumb: guard(hooks.beforeBreadcrumb),
+    };
+}