@tekmidian/pai 1.0.5 → 1.0.7

package/dist/hooks/handoff-link.mjs

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+import { createRequire as __paiCreateRequire } from 'node:module';
+const require = __paiCreateRequire(import.meta.url);
+if (!process.env.PAI_QUIET_NOTICES) process.env.PAI_QUIET_NOTICES = '1';
+
+// src/session/handoff.ts
+import { appendFileSync, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2, writeFileSync } from "node:fs";
+import { basename, dirname as dirname2, join as join2 } from "node:path";
+
+// src/workers/ps-table.ts
+var PS_MAX_BUFFER = 64 * 1024 * 1024;
+
+// src/utils/redact.ts
+var REDACTED = "[REDACTED]";
+var REDACTED_RE = String.raw`\[REDACTED\]`;
+var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+var PROSE = "is|are|was|were|be|to|of|in|on|for|and|or|the|a|an|that|this|it|not|out|here|there|so|as|at|by|with|if|when|which";
+var VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
+var REDACT_RULES = [
+  {
+    // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
+    id: "authorization",
+    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+([^\s'"]+)/gi,
+    replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
+  },
+  {
+    // `Cookie: a=b; c=d` — keep the cookie names, redact every value
+    id: "cookie",
+    re: /((?:Set-)?Cookie\s*:\s*)([^\n]+)/gi,
+    replace: (_m, head, rest) => `${head}${rest.replace(/([^=;\s'"]+=)[^;'"]*/g, `$1${REDACTED}`)}`
+  },
+  {
+    // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
+    // the word must be a whole key segment, so `monkeys=` stays untouched.
+    // The separator may start with the key's closing quote (JSON); it is kept.
+    id: "key-value",
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(["']?\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(?!(?:${PROSE})\b)(${VAL})`, "gi"),
+    replace: (m, key, sep, val) => {
+      if (/[_-](?:count|length|len|size|limit|max|min|budget)$/i.test(key) && /^\d+$/.test(val)) return m;
+      const q = sep[0] === '"' || sep[0] === "'" ? val[0] : "";
+      return q && (q === '"' || q === "'") ? `${key}${sep}${q}${REDACTED}${q}` : `${key}${sep}${REDACTED}`;
+    }
+  },
+  {
+    // npmrc `//registry/:_authToken=xxx`
+    id: "npm-auth-token",
+    re: new RegExp(String.raw`(_authToken\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `curl -u user:pass` / `--user user:pass` — keep the user
+    id: "curl-user",
+    re: /(\bcurl\b[^\n]{0,500}?\s(?:-u|--user)[\s=]+['"]?[^\s:'"]+:)([^\s'"]+)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `mysql -phunter2` / `mysqldump -p'hunter2'` — attached password only
+    id: "mysql-p",
+    re: /(\bmysql(?:dump)?\b[^\n]{0,300}?\s-p)('[^']*'|"[^"]*"|[^\s'"-][^\s'"]*)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
+    id: "env-style",
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:export\s+)?[A-Z][A-Z0-9]*_(?:KEY|SECRET|TOKEN|PASS\w*|CRED\w*|AUTH\w*)\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // long CLI flags only: `--password X`, `--token X`, `--api-key X`, `--secret X`, `--passwd X`
+    id: "cli-flag",
+    re: new RegExp(String.raw`(--(?:password|token|api-key|secret|passwd)(?:\s*=\s*|\s+))(${VAL})`, "gi"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `scheme://user:pass@host` — redact the password, keep user and host
+    id: "url-credentials",
+    re: /((?<![a-z0-9+.-])[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:)([^\s/@]+)(@)/gi,
+    replace: (_m, head, _pass, at) => `${head}${REDACTED}${at}`
+  },
+  {
+    // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
+    // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
+    id: "token-prefix",
+    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}|[sr]k_(?:live|test)_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+    replace: REDACTED
+  },
+  {
+    // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
+    id: "long-run",
+    re: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,4096}={0,2}(?![\w/])/g,
+    // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
+    replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
+  }
+];
+var LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
+var LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+var LONG_RUN_MAX_LINE = 64 * 1024;
+var KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
+
+// src/hooks/ts/lib/loop-guard.ts
+var LOOP_MAX_REPEATS = 4;
+var LOOP_READ_STREAK = Number(process.env.PAI_LOOP_READ_STREAK) > 0 ? Number(process.env.PAI_LOOP_READ_STREAK) : 15;
+var SELF = "If your part is done, commit and write your R report. If you are stuck, report the blocker in R x= (or use pai worker help if available).";
+var LOOP_DENY_REASON = `loop guard: you ran this command ${LOOP_MAX_REPEATS} times with the same result and nothing changed. Stop repeating it. ${SELF}`;
+var WAIT_CAP_MS = 45 * 6e4;
+var FP_FULL_READ_BYTES = 256 * 1024;
+var FP_TOTAL_BYTES = 4 * 1024 * 1024;
+
+// src/config/pai-home.ts
+import { existsSync, mkdirSync, readFileSync, copyFileSync, renameSync, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+function legacyPaiHomeDir() {
+  return join(homedir(), ".claude", "pai");
+}
+function defaultPaiHomeDir() {
+  return join(homedir(), ".pai");
+}
+function paiHomeDir() {
+  if (process.env.PAI_HOME) return process.env.PAI_HOME;
+  const fresh = defaultPaiHomeDir();
+  const legacy = legacyPaiHomeDir();
+  if (!existsSync(join(fresh, "config.yaml")) && existsSync(join(legacy, "config.yaml"))) return legacy;
+  return fresh;
+}
+function paiHomePath(...segments) {
+  return join(paiHomeDir(), ...segments);
+}
+
+// src/session/handoff.ts
+function handoffsDir() {
+  return paiHomePath("handoffs");
+}
+function appendHandoffLink(from, to, now = /* @__PURE__ */ new Date()) {
+  try {
+    const dir = handoffsDir();
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+    appendFileSync(join2(dir, "links.jsonl"), `${JSON.stringify({ ts: now.toISOString(), from, to })}
+`);
+  } catch {
+  }
+}
+
+// src/hooks/ts/user-prompt/handoff-link.ts
+var MARKER = /\[pai-handoff from=([^\]\s]+)\]/;
+async function main() {
+  try {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    const prompt = typeof input.prompt === "string" ? input.prompt : "";
+    const m = MARKER.exec(prompt);
+    if (!m || !input.session_id) return;
+    appendHandoffLink(m[1], input.session_id);
+  } catch {
+  }
+}
+void main();
+//# sourceMappingURL=handoff-link.mjs.map

package/dist/hooks/load-project-context.mjs

@@ -8177,6 +8177,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8771,6 +8772,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8907,6 +8915,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,
@@ -9034,7 +9043,7 @@ function ownsPid(status) {
       env: { ...process.env, LC_ALL: "C" }
     }).trim();
     const psStart = Date.parse(out);
-    const started = spawnTimeOf(status) ?? Date.parse(status.started.replace(" ", "T"));
+    const started = status.procStart ?? spawnTimeOf(status) ?? Date.parse(status.started.replace(" ", "T"));
     if (Number.isNaN(psStart) || Number.isNaN(started)) return alive(status.pid);
     return Math.abs(psStart - started) <= 12e4;
   } catch {

package/dist/hooks/local-model-hint.mjs

@@ -8191,6 +8191,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8785,6 +8786,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8921,6 +8929,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,

package/dist/hooks/route-agents-to-worker.mjs

@@ -8194,6 +8194,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8788,6 +8789,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8924,6 +8932,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,