@starci/hfs 4.0.7 → 4.0.8

package/runtime/engine/migrations/runtime/0003-usage-unavailable.sql

@@ -1,13 +0,0 @@
--- 0003-usage-unavailable (starci/runtime@1, user_version 1 -> 3). Applied by engine/ledger-db.mjs migrateLedger on the first
--- writer open of an older ledger, after a VACUUM INTO backup and an integrity_check, with foreign_key_check + quick_check
--- before COMMIT; a fresh ledger runs 0001 then this file.
---
--- op_attempts.usage_source admits 'unavailable' (the attempt's agent has no usage adapter, or no session file was ever found),
--- and usage_reason says why. SQLite cannot ALTER a CHECK, so the table SQL in sqlite_master is rewritten under
--- writable_schema (the documented path for a change that leaves the on-disk row format alone: the constraint only widens),
--- then schema_version is bumped by the migrator. Every existing row already satisfies the wider constraint.
-ALTER TABLE op_attempts ADD COLUMN usage_reason TEXT;
-PRAGMA writable_schema=ON;
-UPDATE sqlite_master
-   SET sql=replace(sql,'usage_source IN (''cli-transcript'',''provider-report'')','usage_source IN (''cli-transcript'',''provider-report'',''unavailable'')')
- WHERE type='table' AND name='op_attempts' AND instr(sql,'''unavailable''')=0;

package/runtime/engine/migrations/runtime/0004-attempt-why.sql

@@ -1,43 +0,0 @@
--- 0004-attempt-why (starci/runtime@1, user_version 3 -> 4). Applied by engine/ledger-db.mjs migrateLedger on the first
--- writer open of an older ledger (after a VACUUM INTO backup and an integrity_check, with foreign_key_check + quick_check
--- before COMMIT); a fresh ledger runs 0001 then the forward files.
---
--- op_attempts.why_json: the owner-facing reason an attempt failed, was blocked, refused or is waiting (starci/why@1,
--- scripts/kernel/why.mjs, docs/why.md), written with the settle. The two attempt views are recreated:
---   v_attempt_state.native  'awaiting-owner' (job awaiting_owner, or verdict blocked + report_outcome ask) and
---                           'rejected' (end_state requeued whose settle_json.reason is dispatch-rejected) are their own states;
---   v_op_history            carries why_json, and its `ui` reads 'awaiting-owner' and 'rejected' for those two natives
---                           (every other native still maps through ui_state_map; job_status stays a column).
-ALTER TABLE op_attempts ADD COLUMN why_json TEXT CHECK(why_json IS NULL OR json_valid(why_json));
-DROP VIEW IF EXISTS v_op_history;
-DROP VIEW IF EXISTS v_attempt_state;
-CREATE VIEW v_attempt_state AS
-SELECT a.attempt_id,
-       CASE WHEN a.end_state='worker-dead' THEN 'worker-dead' WHEN a.end_state='effect-unknown' THEN 'effect-unknown'
-            WHEN a.end_state='requeued' AND json_extract(a.settle_json,'$.reason')='dispatch-rejected' THEN 'rejected'
-            WHEN a.end_state='requeued' THEN 'requeued'
-            WHEN (a.verdict='blocked' AND a.report_outcome='ask')
-              OR (a.verdict IS NOT NULL AND (SELECT j.status FROM jobs j WHERE j.job_id=a.job_id)='awaiting_owner') THEN 'awaiting-owner'
-            WHEN a.verdict IS NOT NULL THEN a.verdict
-            WHEN a.dispatched_at IS NULL THEN 'routed' ELSE 'in-flight' END AS native
-FROM op_attempts a;
-CREATE VIEW v_op_history AS
-SELECT a.attempt_id, a.workflow_id, a.unit_id, a.job_id, a.op_id, a.try_no, a.dispatch_seq, a.dispatch_id, a.span_id,
-       a.agent, a.provider, a.model, a.model_profile, a.pool, a.effort, a.cli_version, a.runtime_rev,
-       a.terminal_handle, a.worktree_path, a.branch, a.base_sha, a.head_sha, a.integrated_sha,
-       a.routed_at, a.dispatched_at, a.reported_at, a.settled_at, a.released_at, a.worktree_removed_at,
-       COALESCE(a.wall_ms, a.settled_at - a.dispatched_at) AS cycle_ms,
-       a.report_outcome, a.verdict, a.settled_by, a.failure_class, a.end_state, a.why_json,
-       a.tokens_in, a.tokens_out, a.cost_usd, a.usage_source,
-       a.prompt_sha, a.transcript_sha, a.session_sha,
-       s.native AS attempt_state,
-       CASE WHEN s.native IN ('awaiting-owner','rejected') THEN s.native ELSE COALESCE(m.ui,'unknown') END AS ui,
-       j.status AS job_status, r.report_id, r.summary AS report_summary,
-       (SELECT count(*) FROM check_runs c WHERE c.attempt_id=a.attempt_id)                                 AS checks,
-       (SELECT count(*) FROM check_runs c WHERE c.attempt_id=a.attempt_id AND c.status IN ('fail','error')) AS checks_red,
-       (SELECT count(*) FROM job_artifacts x WHERE x.attempt_id=a.attempt_id)                              AS artifacts
-FROM op_attempts a
-JOIN v_attempt_state s ON s.attempt_id=a.attempt_id
-LEFT JOIN ui_state_map m ON m.entity='attempt' AND m.native=s.native
-LEFT JOIN jobs j    ON j.job_id=a.job_id
-LEFT JOIN reports r ON r.attempt_id=a.attempt_id;

package/runtime/engine/migrations/runtime/0005-ended-workflow-views.sql

@@ -1,93 +0,0 @@
--- 0005-ended-workflow-views (starci/runtime@1, user_version 4 -> 5). Applied by engine/ledger-db.mjs migrateLedger on the first
--- writer open of an older ledger (after a VACUUM INTO backup and an integrity_check, with foreign_key_check + quick_check
--- before COMMIT); a fresh ledger runs 0001 then the forward files.
---
--- The runtime views stop surfacing the live leftovers of an ENDED workflow (phase archived|finished): archive/finish close
--- the workflow's live Decision Items inside their own transaction before the phase flips, and events_refuse_archived refuses
--- every later write, so a leftover live DI (2026-09-30 nivo-backend di-876124d7) can never be resolved and only ever reads
--- 'bad' in the UI — a permanent attention item and blocker on work that no longer runs. Every leg carries the ENDED
--- predicate of scripts/reconciler/decisions.mjs listDecisions: LEFT JOIN workflows w; the row survives when its workflow is
--- missing or not ended (w.phase IS NULL OR w.phase NOT IN ('archived','finished')).
---   v_decision_rows  keeps an ended workflow's resolved rows (decision history) and drops only its live-status leftovers;
---   v_blocking       applies the join per UNION leg — an ended workflow owes no unit, decision, condition, incident,
---                    worker-question, settle-tail, product-land or settle-overdue row;
---   v_open_work      the same per leg (decision + job).
-DROP VIEW IF EXISTS v_decision_rows;
-DROP VIEW IF EXISTS v_blocking;
-DROP VIEW IF EXISTS v_open_work;
-CREATE VIEW v_decision_rows AS
-SELECT d.*,
-       (d.due_at IS NOT NULL AND d.status IN ('open','claimed','escalated') AND d.due_at < CAST(unixepoch('subsec')*1000 AS INTEGER)) AS overdue,
-       CASE WHEN d.status IN ('open','claimed','escalated')
-                 AND ((d.due_at IS NOT NULL AND d.due_at < CAST(unixepoch('subsec')*1000 AS INTEGER)) OR d.escalations>=2) THEN 'bad'
-            WHEN d.status='open' AND d.due_at IS NOT NULL
-                 AND (d.due_at - CAST(unixepoch('subsec')*1000 AS INTEGER)) < 0.2*(d.due_at - d.opened_at) THEN 'warn'
-            ELSE COALESCE(m.ui,'unknown') END AS ui
-FROM decision_items d LEFT JOIN ui_state_map m ON m.entity='decision' AND m.native=d.status
-                      LEFT JOIN workflows w ON w.workflow_id=d.workflow_id
-WHERE d.status NOT IN ('open','claimed','escalated') OR w.phase IS NULL OR w.phase NOT IN ('archived','finished');
-
-CREATE VIEW v_blocking AS
-SELECT e.workflow_id, 'unit' AS entity_type, e.to_unit AS entity_id, 'unit' AS blocker_type, e.from_unit AS blocker_id,
-       'UpstreamNotDone' AS reason_code, p.state AS detail, p.updated_at AS since, 'kernel' AS who
-  FROM unit_edges e JOIN work_units t ON t.workflow_id=e.workflow_id AND t.unit_id=e.to_unit
-                    JOIN work_units p ON p.workflow_id=e.workflow_id AND p.unit_id=e.from_unit
-                    LEFT JOIN workflows w ON w.workflow_id=e.workflow_id
- WHERE t.state IN ('planned','queued') AND p.state NOT IN ('done','dropped')
-   AND (w.phase IS NULL OR w.phase NOT IN ('archived','finished'))
-UNION ALL
-SELECT d.workflow_id, COALESCE(d.entity_type,'workflow'), COALESCE(d.entity_id,d.workflow_id), 'decision', d.di_id,
-       'DecisionOpen:'||d.kind, d.summary, d.opened_at, d.decider
-  FROM decision_items d LEFT JOIN workflows w ON w.workflow_id=d.workflow_id
- WHERE d.status IN ('open','claimed','escalated')
-   AND (w.phase IS NULL OR w.phase NOT IN ('archived','finished'))
-UNION ALL
-SELECT c.workflow_id, c.entity_type, c.entity_id, 'condition', c.type, c.reason, c.message, c.last_transition_at, COALESCE(c.owner,'controller')
-  FROM conditions c LEFT JOIN workflows w ON w.workflow_id=c.workflow_id
- WHERE c.status<>'True'
-   AND (w.phase IS NULL OR w.phase NOT IN ('archived','finished'))
-UNION ALL
-SELECT i.workflow_id, 'job', COALESCE(i.job_id,i.workflow_id), 'incident', i.incident_id, 'IncidentOpen:'||i.kind,
-       COALESCE(i.detail,i.last_progress), i.created_at, i.owner
-  FROM incidents i LEFT JOIN workflows w ON w.workflow_id=i.workflow_id
- WHERE i.status='open'
-   AND (w.phase IS NULL OR w.phase NOT IN ('archived','finished'))
-UNION ALL
-SELECT x.workflow_id, 'attempt', CAST(x.attempt_id AS TEXT), 'question', CAST(x.inbox_id AS TEXT), 'WorkerQuestionPending',
-       json_extract(x.payload_json,'$.question'), x.created_at, 'kernel'
-  FROM inbox x LEFT JOIN workflows w ON w.workflow_id=x.workflow_id
- WHERE x.kind='worker-question' AND x.status IN ('pending','claimed')
-   AND (w.phase IS NULL OR w.phase NOT IN ('archived','finished'))
-UNION ALL
-SELECT s.workflow_id, 'attempt', CAST(s.attempt_id AS TEXT), 'settle-tail', CAST(s.attempt_id AS TEXT), 'SettleTailFailed', s.last_error,
-       COALESCE(s.started_at,s.queued_at), 'controller'
-  FROM settle_tails s LEFT JOIN workflows w ON w.workflow_id=s.workflow_id
- WHERE s.state='failed'
-   AND (w.phase IS NULL OR w.phase NOT IN ('archived','finished'))
-UNION ALL
-SELECT l.workflow_id, 'workflow', l.workflow_id, 'product-land', CAST(l.land_id AS TEXT), 'ProductLand:'||l.result, l.reason,
-       l.started_at, 'kernel'
-  FROM product_lands l LEFT JOIN workflows w ON w.workflow_id=l.workflow_id
- WHERE l.result IN ('failed','conflict','red')
-   AND NOT EXISTS(SELECT 1 FROM product_lands k WHERE k.workflow_id=l.workflow_id AND k.land_id>l.land_id AND k.result='landed')
-   AND (w.phase IS NULL OR w.phase NOT IN ('archived','finished'))
-UNION ALL
--- H1: a filed report nobody settled within its SLA (the same rows as v_settle_overdue) blocks its job.
-SELECT a.workflow_id, 'attempt', CAST(a.attempt_id AS TEXT), 'settle', CAST(a.attempt_id AS TEXT),
-       'SettleOverdue:'||COALESCE(a.report_outcome,'?'), a.job_id, a.reported_at,
-       CASE WHEN a.report_outcome='done' THEN 'settler' ELSE 'kernel' END
-  FROM op_attempts a LEFT JOIN workflows w ON w.workflow_id=a.workflow_id
- WHERE a.reported_at IS NOT NULL AND a.settled_at IS NULL AND a.end_state IS NULL
-   AND (CAST(unixepoch('subsec')*1000 AS INTEGER) - a.reported_at) > CASE WHEN a.report_outcome='done' THEN 180000 ELSE 900000 END
-   AND (w.phase IS NULL OR w.phase NOT IN ('archived','finished'));
-
-CREATE VIEW v_open_work AS
-SELECT 'decision' AS kind, d.workflow_id, d.di_id AS ref, d.summary AS what, d.opened_at AS since, d.due_at
-  FROM decision_items d LEFT JOIN workflows w ON w.workflow_id=d.workflow_id
- WHERE d.status IN ('open','claimed','escalated')
-   AND (w.phase IS NULL OR w.phase NOT IN ('archived','finished'))
-UNION ALL
-SELECT 'job-'||j.status, j.workflow_id, j.job_id, j.op_id, j.updated_at, j.deadline
-  FROM jobs j LEFT JOIN workflows w ON w.workflow_id=j.workflow_id
- WHERE j.status IN ('leased','running','answering','effect_unknown')
-   AND (w.phase IS NULL OR w.phase NOT IN ('archived','finished'));

package/runtime/scripts/lib/artifact-hold.mjs

@@ -1,89 +0,0 @@
-// artifact-hold.mjs — the retention exemption for job proofs. A path an indexed job artifact lives at
-// (job_artifacts, engine/migrations/runtime/0001-init.sql), a tree holding one, and the evidence directory around one (never a shared root:
-// the repository, .starciwork, .starciwork/evidence or .starciwork/kernel-evidence itself) are never
-// removed by housekeeping, whatever the workflow's phase (running, finished, archived); nor is the repository's
-// ledger .starciwork/runtime.sqlite (it holds the typed logs since 2026-09-27, scripts/kernel/typed-logs.mjs), nor the
-// retired logs file .starciwork/logs.sqlite or its logs.sqlite.migrated-<date> copy, nor a tree holding one. Every
-// runtime delete of a tree (safe-remove.mjs safeRemoveTree) and every housekeeping unlink asks artifactHoldOf first.
-// Proofs, artifacts and logs are deleted ONLY by the owner-approved workflow purge (scripts/work/purge-workflow.mjs:
-// archive to a verified ZIP, then delete the finished workflow as a unit), never here.
-//
-// The ledgers are the ones the machine registry enrols (machine.sqlite `ledgers`); a ledger's repository is
-// the directory above its .starciwork. Only a target that overlaps a registered repository opens that
-// ledger, read-only, so a temp or lane sweep never touches sqlite past the registry read.
-import fs from 'node:fs';
-import path from 'node:path';
-import { createRequire } from 'node:module';
-import { hasLedgerColumn, hasLedgerTable, openLedgerReader } from '../../engine/ledger-db.mjs';
-import { machineFileFor, readMachine } from '../../engine/machine-db.mjs';
-import { pathKey, sameOrUnder } from './path-key.mjs';
-
-const require = createRequire(import.meta.url);
-const REGISTRY_TTL_MS = 30000;
-const norm = pathKey;
-let cache = { file: null, at: 0, repos: [] };
-
-const openReadOnly = (file) => openLedgerReader(file);
-
-/** The repositories whose ledgers the registry enrols: [{repo, ledger}], cached briefly per registry file; null when the registry cannot be read. */
-export function registeredRepos({ env = process.env, now = Date.now() } = {}) {
-  const file = machineFileFor(env);
-  if (cache.file === file && now - cache.at < REGISTRY_TTL_MS) return cache.repos;
-  const repos = fs.existsSync(file) ? readMachine((m) => m.listLedgers().map((l) => ({ ledger: l.file, repo: l.repoRoot })), null, { file, env }) : [];
-  cache = { file, at: now, repos };
-  return repos;
-}
-
-/**
- * Null when removing `target` touches no indexed artifact; else {ledger, repo, paths:[...up to 5], count}.
- * Held: an indexed file at or sameOrUnder `target`, or `target` inside the directory of an indexed file.
- * A ledger that cannot be read holds its whole repository, and an unreadable registry holds every path in or
- * holding a .starciwork directory - where every indexed artifact lives (fail closed).
- */
-export function artifactHoldOf(target, { env = process.env, repos = registeredRepos({ env }) } = {}) {
-  const t = norm(target);
-  if (repos === null) {
-    const work = t.split('/').includes('.starciwork') || fs.existsSync(path.join(target, '.starciwork'));
-    return work ? { ledger: machineFileFor(env), repo: null, paths: [], count: null, error: 'the machine registry cannot be read' } : null;
-  }
-  for (const { ledger, repo } of repos) {
-    const r = norm(repo);
-    if (!sameOrUnder(t, r) && !sameOrUnder(r, t)) continue;
-    // The repository's typed logs (scripts/kernel/typed-logs.mjs: the ledger's logs table, and the retired logs.sqlite
-    // with its migrated copy) are append-only history: never swept.
-    const work = path.join(repo, '.starciwork');
-    const logFiles = [path.basename(ledger), 'logs.sqlite', ...(fs.existsSync(work) && sameOrUnder(norm(work), t) ? fs.readdirSync(work).filter((n) => /^logs\.sqlite\.migrated-/.test(n)) : [])]
-      .filter((name, i, all) => all.indexOf(name) === i).map((name) => path.join(work, name)).filter((file) => sameOrUnder(norm(file), t) && fs.existsSync(file));
-    if (logFiles.length) return { ledger, repo, paths: logFiles.map((file) => `.starciwork/${path.basename(file)}`), count: logFiles.length };
-    if (!fs.existsSync(ledger)) continue;
-    let paths;
-    try {
-      const db = openReadOnly(ledger);
-      // alpha.3: job_artifacts index blobs by sha256 and hold no repository path (no `path` column), so an alpha.3
-      // ledger holds no tree; only a ledger that still indexes paths does.
-      try { paths = hasLedgerTable(db, 'job_artifacts') && hasLedgerColumn(db, 'job_artifacts', 'path') ? db.prepare('SELECT DISTINCT path FROM job_artifacts').all().map((row) => row.path) : []; }
-      finally { db.close(); }
-    } catch (error) {
-      return { ledger, repo, paths: [], count: null, error: String(error?.message ?? error) };
-    }
-    // "Around" holds an evidence directory, never a shared root: an artifact filed at the repository root or directly
-    // in .starciwork (e.g. a scope op indexing .starciwork/index.yaml) held every tree sameOrUnder it, so no purge could
-    // remove an archived workflow's kernel-evidence directory.
-    const shared = new Set([r, norm(work), norm(path.join(work, 'evidence')), norm(path.join(work, 'kernel-evidence'))]);
-    const held = paths.filter((rel) => {
-      const abs = norm(path.join(repo, rel));
-      const dir = norm(path.dirname(abs));
-      return sameOrUnder(abs, t) || (!shared.has(dir) && sameOrUnder(t, dir));
-    });
-    if (held.length) return { ledger, repo, paths: held.slice(0, 5), count: held.length };
-  }
-  return null;
-}
-
-/** artifactHoldOf as one refusal line, or null. */
-export const artifactHoldReason = (target, options) => {
-  const hold = artifactHoldOf(target, options);
-  if (!hold) return null;
-  return hold.error ? `the ledger ${hold.ledger} holding indexed job artifacts cannot be read (${hold.error})`
-    : `${hold.count} indexed job artifact(s) of ${hold.ledger} (${hold.paths.join(', ')})`;
-};

package/runtime/scripts/lib/artifact-store.mjs

@@ -1,103 +0,0 @@
-// Content-addressed operational evidence. Blob bytes are immutable and never removed here.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import crypto from 'node:crypto';
-
-export const ARTIFACT_ROOT_ENV = 'STARCI_ARTIFACT_ROOT';
-export const artifactRoot = (env = process.env) => path.resolve(env[ARTIFACT_ROOT_ENV] || path.join(os.homedir(), '.starci', 'artifacts'));
-const SHA = /^[a-f0-9]{64}$/;
-const assertSha = sha => {
-  if (typeof sha !== 'string' || !SHA.test(sha)) throw new TypeError('blob sha must be a lowercase sha256 hex digest');
-  return sha;
-};
-const location = sha => path.join(artifactRoot(), assertSha(sha).slice(0, 2), sha);
-const metadataPath = sha => `${location(sha)}.json`;
-const digest = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
-
-// Reject roots inside a checkout, including worktrees whose .git is a file.
-function ensureExternalRoot(root) {
-  let cursor = root;
-  while (true) {
-    if (fs.existsSync(path.join(cursor, '.git'))) throw new Error(`artifact root is inside a git checkout: ${root}`);
-    const parent = path.dirname(cursor);
-    if (parent === cursor) return;
-    cursor = parent;
-  }
-}
-
-function sourceBytes(bufferOrPath) {
-  if (Buffer.isBuffer(bufferOrPath)) return bufferOrPath;
-  if (bufferOrPath instanceof Uint8Array) return Buffer.from(bufferOrPath);
-  if (typeof bufferOrPath === 'string') return fs.readFileSync(bufferOrPath);
-  throw new TypeError('putBlob expects a Buffer, Uint8Array, or file path');
-}
-
-function publishOnce(destination, bytes) {
-  const dir = path.dirname(destination);
-  fs.mkdirSync(dir, { recursive: true });
-  const temp = path.join(dir, `.${path.basename(destination)}.${process.pid}.${crypto.randomUUID()}.tmp`);
-  try {
-    fs.writeFileSync(temp, bytes, { flag: 'wx' });
-    try { fs.linkSync(temp, destination); }
-    catch (error) { if (error.code !== 'EEXIST') throw error; }
-  } finally { try { fs.unlinkSync(temp); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
-}
-
-/** Store original bytes under their sha256. A concurrent or repeated put never replaces published bytes. */
-export function putBlob(bufferOrPath, { mediaType = 'application/octet-stream' } = {}) {
-  if (typeof mediaType !== 'string' || !mediaType.trim()) throw new TypeError('mediaType must be a nonempty string');
-  const root = artifactRoot();
-  ensureExternalRoot(root);
-  const bytes = sourceBytes(bufferOrPath);
-  const sha = digest(bytes);
-  const destination = location(sha);
-  const metadata = { size: bytes.length, mediaType, createdAt: new Date().toISOString() };
-  // Metadata is published first so a visible blob always has a sidecar. A crash can leave an orphan sidecar;
-  // the next put completes it. The first published media type and creation time win.
-  publishOnce(metadataPath(sha), Buffer.from(JSON.stringify(metadata)));
-  publishOnce(destination, bytes);
-  const stored = fs.statSync(destination);
-  if (stored.size !== bytes.length) throw new Error(`blob size mismatch: ${sha}`);
-  const info = statBlob(sha);
-  return { sha, size: info.size, mediaType: info.mediaType };
-}
-
-export function blobPath(sha) {
-  const file = location(sha);
-  return fs.existsSync(file) && fs.statSync(file).isFile() ? file : null;
-}
-
-export const hasBlob = sha => blobPath(sha) !== null;
-
-export function getBlob(sha) {
-  const file = blobPath(sha);
-  if (!file) throw Object.assign(new Error(`blob not found: ${sha}`), { code: 'ENOENT' });
-  const bytes = fs.readFileSync(file);
-  if (digest(bytes) !== sha) throw new Error(`blob hash mismatch: ${sha}`);
-  return bytes;
-}
-
-export function statBlob(sha) {
-  const file = blobPath(sha);
-  if (!file) return null;
-  const { size } = fs.statSync(file);
-  const metadata = JSON.parse(fs.readFileSync(metadataPath(sha), 'utf8'));
-  if (metadata.size !== size) throw new Error(`blob sidecar size mismatch: ${sha}`);
-  return { sha, size, mediaType: metadata.mediaType, createdAt: metadata.createdAt };
-}
-
-function canonical(value) {
-  if (value && typeof value === 'object') {
-    if (typeof value.toJSON === 'function') return canonical(value.toJSON());
-    if (Array.isArray(value)) return value.map(item => item === undefined ? null : canonical(item));
-    return Object.fromEntries(Object.keys(value).sort().filter(key => value[key] !== undefined).map(key => [key, canonical(value[key])]));
-  }
-  return value;
-}
-
-export function putJson(obj) {
-  const encoded = JSON.stringify(canonical(obj));
-  if (encoded === undefined) throw new TypeError('putJson expects a JSON value');
-  return putBlob(Buffer.from(encoded), { mediaType: 'application/json' }).sha;
-}

package/runtime/scripts/lib/redact.mjs

@@ -1,148 +0,0 @@
-// redact.mjs — the ONE redaction module (alpha.3, ARCHITECTURE-DB §4.2). Every blob put of text bytes
-// (report attachments, check stdout/stderr/output, terminal transcripts, CLI sessions) and every log write
-// passes through here first; the harness UI server reuses it. A blob whose bytes went through redactText is
-// stamped blobs.redaction = REDACTION_VERSION; bytes that cannot be filtered (images, video, archives) are
-// stamped 'binary'.
-//
-// It blanks: provider tokens and JWTs (secret-patterns.mjs, the push scan's list), auth headers, URL query
-// secrets, URL credentials (scheme://user:pass@host), PEM private-key blocks (the whole block), KEY=value /
-// KEY: value pairs whose key names a secret (FOO_API_KEY=..., password: ...), and the declared secrets of a
-// product repo's .starcistacks (their env-style names as keys, and their values wherever they appear).
-// Keys and surrounding words stay, so a redacted transcript still reads.
-import fs from 'node:fs';
-import path from 'node:path';
-import { FORBIDDEN_FILES, SECRET_PATTERNS } from './secret-patterns.mjs';
-import { parseYaml } from '../../engine/yaml.mjs';
-
-export const REDACTION_VERSION = 'v1';
-export const MARK = '[redacted]';
-
-const withGlobal = (re) => new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`);
-const PATTERNS = SECRET_PATTERNS.filter((rule) => rule.name !== 'private-key-block').map((rule) => ({ ...rule, g: withGlobal(rule.re) }));
-// Words that make an env-style key a secret, matched per `_`-separated segment of the name (FOO_API_KEY,
-// KEYCLOAK_ADMIN_PASSWORD, GH_TOKEN, MINIO_SECRET_KEY, DATABASE_URL is not; TESTS_PASSED is not).
-const SECRET_SEGMENTS = new Set(['PASSWORD', 'PASSWD', 'PWD', 'PASS', 'SECRET', 'SECRETS', 'TOKEN', 'APIKEY', 'KEY', 'CREDENTIAL', 'CREDENTIALS', 'COOKIE', 'OTP', 'DSN', 'PAT']);
-export const isSecretEnvName = (name) => String(name).replace(/^export\s+/, '').replace(/_FILE$/, '').split('_').some((seg) => SECRET_SEGMENTS.has(seg));
-const PEM_BLOCK = /-----BEGIN ((?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?)-----[\s\S]*?(?:-----END \1-----|$)/g;
-const RULES = [
-  { name: 'url-credentials', re: /\b([a-z][a-z0-9+.-]*:\/\/)([^\s:@/"'<>]+):([^\s@/"'<>]+)@/gi, to: (m, scheme, user) => `${scheme}${user}:${MARK}@` },
-  { name: 'auth-header', re: /\b(Bearer|Basic|Token)(\s+)[A-Za-z0-9._~+/=-]{8,}/gi, to: (m, a, b) => `${a}${b}${MARK}` },
-  { name: 'url-secret', re: /([?&#](?:access_token|refresh_token|id_token|token|key|api_key|apikey|secret|code|password|otp|sig|signature)=)([^&#\s"']+)/gi, to: (m, a) => `${a}${MARK}` },
-  { name: 'otp', re: /\b(otp|one[-_ ]?time[-_ ]?(?:code|password|pin)|verification[-_ ]?code|2fa[-_ ]?code|mã[ _-]?(?:otp|xác[ _-]?(?:thực|minh)))(\s*[:=]?\s*["']?)(\d{4,8})\b/giu, to: (m, a, b) => `${a}${b}${MARK}` },
-  // ENV_STYLE_KEY=value / ENV_STYLE_KEY: value (shell exports, dotenv, compose, CLI echo).
-  { name: 'env-secret', re: /\b((?:export\s+)?[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*)(\s*[:=]\s*["']?)((?!\[redacted)[^\s"'`]{3,})/g,
-    to: (m, a, b, c) => (isSecretEnvName(a) && !c.startsWith('/run/secrets/') && !c.startsWith('$') ? `${a}${b}${MARK}` : m) },
-  { name: 'keyed-secret', re: /\b(password|passwd|pwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|auth[_-]?token|session[_-]?token|private[_-]?key|otp|pin[_-]?code|cookie|set-cookie)(["']?\s*[:=]\s*["']?)((?!\[redacted)[^\s"',;&}]{3,})/gi, to: (m, a, b) => `${a}${b}${MARK}` },
-];
-
-/** Keys whose value is a secret whatever it looks like; the key stays, the value goes. */
-export const SECRET_KEY = /^(?:password|passwd|pwd|pass|secret|otp|pin|pincode|pin_code|credential|credentials|authorization|cookie|cookies|set-cookie|private[_-]?key|client[_-]?secret|api[_-]?key|apikey|[a-z_-]*token|[a-z_-]*secret)$/i;
-
-// ------------------------------------------------------------------------------ declared stack secrets
-// A product repo's .starcistacks/<stack>/stack.yaml `secrets:` block names each secret and the runtime file
-// that holds its value. Both are learned once per repo root per process; values never leave this module.
-const STACK_DIRS = ['.starcistacks'];
-const learnedRoots = new Set();
-const secretValues = new Set();
-const secretNames = new Set();
-const envName = (name) => String(name).replace(/[^A-Za-z0-9]+/g, '_').replace(/^_+|_+$/g, '').toUpperCase();
-const readSafe = (file) => { try { return fs.readFileSync(file, 'utf8'); } catch { return null; } };
-const listSafe = (dir) => { try { return fs.readdirSync(dir, { withFileTypes: true }); } catch { return []; } };
-
-/** A value this process must never write out (a secret it resolved itself). Values under 6 chars are ignored. */
-export function addSecretValue(value) {
-  const v = typeof value === 'string' ? value.trim() : '';
-  if (v.length >= 6 && !/^\[redacted/.test(v)) secretValues.add(v);
-}
-
-/** Learn the declared secrets of every .starcistacks stack under `repoRoot` (idempotent). */
-export function learnStackSecrets(repoRoot) {
-  if (typeof repoRoot !== 'string' || !repoRoot) return;
-  const root = path.resolve(repoRoot);
-  if (learnedRoots.has(root)) return;
-  learnedRoots.add(root);
-  for (const stackDir of STACK_DIRS) {
-    for (const entry of listSafe(path.join(root, stackDir))) {
-      if (!entry.isDirectory()) continue;
-      const dir = path.join(root, stackDir, entry.name);
-      const text = readSafe(path.join(dir, 'stack.yaml'));
-      let doc = null;
-      try { doc = text ? parseYaml(text) : null; } catch { doc = null; }
-      const secrets = doc && typeof doc.secrets === 'object' && doc.secrets ? doc.secrets : {};
-      for (const [name, spec] of Object.entries(secrets)) {
-        secretNames.add(envName(name));
-        if (spec && typeof spec.file === 'string') addSecretValue(readSafe(path.resolve(dir, spec.file)));
-      }
-      // Plaintext runtime copies of the secrets (git-ignored): their values are secrets too.
-      for (const file of listSafe(path.join(dir, 'runtime', 'files'))) if (file.isFile()) addSecretValue(readSafe(path.join(dir, 'runtime', 'files', file.name)));
-    }
-  }
-}
-
-const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-let namesRe = null, namesSize = -1;
-const declaredNameRule = () => {
-  if (namesSize !== secretNames.size) {
-    namesSize = secretNames.size;
-    namesRe = secretNames.size ? new RegExp(`\\b((?:${[...secretNames].map(escapeRe).join('|')})(?:_FILE)?)(\\s*[:=]\\s*["']?)((?!\\[redacted)[^\\s"'\`]{3,})`, 'g') : null;
-  }
-  return namesRe;
-};
-
-// --------------------------------------------------------------------------------------------- text
-/**
- * `text` with every secret value blanked. `repoRoots` (optional) are product repos whose .starcistacks
- * declarations are learned first.
- */
-export function redactText(text, { repoRoots = [] } = {}) {
-  if (typeof text !== 'string' || !text) return text;
-  for (const root of repoRoots) learnStackSecrets(root);
-  let out = text.replace(PEM_BLOCK, (m, kind) => `[redacted:pem ${kind}]`);
-  for (const value of secretValues) if (out.includes(value)) out = out.split(value).join('[redacted:stack-secret]');
-  for (const rule of PATTERNS) {
-    rule.g.lastIndex = 0;
-    out = out.replace(rule.g, (match, value) => {
-      if (rule.name === 'assigned-secret') return rule.placeholder?.test(value ?? '') ? match : match.replace(value, MARK);
-      return `[redacted:${rule.name}]`;
-    });
-  }
-  const declared = declaredNameRule();
-  if (declared) { declared.lastIndex = 0; out = out.replace(declared, (m, a, b) => `${a}${b}${MARK}`); }
-  for (const rule of RULES) { rule.re.lastIndex = 0; out = out.replace(rule.re, rule.to); }
-  return out;
-}
-
-/** A path that is a secret by being one (an env file, a key file, .secrets/): blanked, its rule named. */
-export function redactPath(p) {
-  if (typeof p !== 'string') return p;
-  const slashed = p.replace(/\\/g, '/');
-  const rule = FORBIDDEN_FILES.find((r) => r.test(slashed));
-  return rule ? `[redacted:${rule.name}]` : redactText(p);
-}
-
-/** A deep copy of `value` with secret-named keys blanked and every string redacted. */
-export function redactData(value, key = null, depth = 0) {
-  if (depth > 8) return '[depth]';
-  if (key && SECRET_KEY.test(key) && value != null && typeof value !== 'object' && typeof value !== 'boolean') return MARK;
-  if (typeof value === 'string') return /(?:path|ref|file)$/i.test(key ?? '') ? redactPath(value) : redactText(value);
-  if (Array.isArray(value)) return value.map((v) => redactData(v, null, depth + 1));
-  if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactData(v, k, depth + 1)]));
-  return value;
-}
-
-// -------------------------------------------------------------------------------------------- bytes
-/** True for media types whose bytes are text the filter can read. */
-export const isTextMedia = (mediaType) => /^text\/|[/+](?:json|xml|yaml|x-yaml|javascript|x-ndjson|x-diff|x-patch|csv|sql|x-sh)\b|^application\/(?:json|xml|yaml|javascript|x-ndjson|x-diff|x-patch|sql)$/i
-  .test(String(mediaType ?? ''));
-
-/**
- * Bytes ready for a blob put: text bytes redacted ({redaction:'v1'}), anything else untouched
- * ({redaction:'binary'}). The blob sha is then taken over the returned bytes.
- */
-export function redactBytes(bytes, mediaType, { repoRoots = [] } = {}) {
-  const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
-  if (!isTextMedia(mediaType)) return { bytes: buf, redaction: 'binary' };
-  const text = buf.toString('utf8');
-  const clean = redactText(text, { repoRoots });
-  return { bytes: clean === text ? buf : Buffer.from(clean, 'utf8'), redaction: REDACTION_VERSION };
-}