@topmindspace/topmind-handoff 0.7.1 → 0.7.3

package/topmind_handoff/model.py

@@ -9,6 +9,8 @@ from dataclasses import dataclass, field
 from datetime import date, datetime
 from pathlib import Path
 
+from topmind_handoff.privacy import assert_private_text
+
 ROOT = Path(__file__).resolve().parent.parent
 SLICES = ("identity", "boundaries", "preference", "project", "fact")
 SLICE_TITLE = {
@@ -23,6 +25,7 @@ REVIEW_DAYS = {
     "boundaries": 180,
     "preference": 90,
     "project": 30,
+    "work": 30,
     "fact": 30,
 }
 CARD_STALE_DAYS = 90
@@ -74,6 +77,7 @@ def compiler_version() -> str:
 
 def safe_origin(origin: str) -> str:
     """One path segment. Reject absolute paths and any name that can leave the repo."""
+    assert_private_text(origin)
     name = origin.strip()
     if not name or name in {".", ".."} or any(mark in name for mark in ("/", "\\", "\x00")):
         raise ValueError("origin_id 必须是单个路径段")
@@ -82,6 +86,32 @@ def safe_origin(origin: str) -> str:
     return name
 
 
+def safe_claim_id(claim_id: str) -> str:
+    """Validate a claim id so it stays single-line and parseable inside `{id:...}`."""
+    assert_private_text(claim_id)
+    cleaned = claim_id.strip()
+    if not cleaned or any(ch in cleaned for ch in ("{", "}", "\n", "\r", "\t", " ", "\x00")):
+        raise ValueError("id 必须是非空的单行标识，且不含空格或花括号")
+    return cleaned
+
+
+def safe_scope(scope: str) -> str:
+    """Validate `shared`, `scenario:<name>`, or `origin:<origin_id>`."""
+    assert_private_text(scope)
+    cleaned = scope.strip() or "shared"
+    if cleaned == "shared":
+        return "shared"
+    if cleaned.startswith("scenario:"):
+        target = cleaned.split(":", 1)[1]
+        if scenario_filename(target) is None:
+            raise ValueError("场景名必须是单个路径段")
+        return f"scenario:{target}"
+    if cleaned.startswith("origin:"):
+        target = safe_origin(cleaned.split(":", 1)[1])
+        return f"origin:{target}"
+    raise ValueError("scope 必须是 shared、scenario:<场景> 或 origin:<origin_id>")
+
+
 def scenario_filename(name: str) -> str | None:
     """`scenario-<name>.md` when the name is one path segment. Otherwise None."""
     try:
@@ -294,7 +324,34 @@ def _authority_scope(op: Op) -> str:
     return op.scope
 
 
-def is_proposal(op: Op, authority: dict[str, str]) -> bool:
+def protected_claim_ids(ops: Iterable[Op]) -> set[str]:
+    """Human-authored protected identities keep protection across later labels/scopes."""
+    return {
+        op.claim_id for op in ops
+        if op.origin == "human" and op.kind in ("set", "retract")
+        and op.slice in ("identity", "boundaries")
+    }
+
+
+def unique_ops(ops: Iterable[Op]) -> list[Op]:
+    """Collapse identical replay; reject reuse of an id for different semantic content."""
+    seen: dict[str, tuple] = {}
+    result: list[Op] = []
+    for op in ops:
+        payload = (
+            op.origin, op.kind, op.claim_id, op.scope, op.slice, op.base,
+            tuple(sorted(set(op.closes))), op.at, op.text, op.detail,
+        )
+        if op.op_id in seen:
+            if seen[op.op_id] != payload:
+                raise ValueError("op_id 重复但操作内容或来源不同，请人工核对信箱")
+            continue
+        seen[op.op_id] = payload
+        result.append(op)
+    return result
+
+
+def is_proposal(op: Op, authority: dict[str, str], protected: set[str] | None = None) -> bool:
     """Return True when this op must not enter a view chain."""
     if op.kind == "propose":
         return True
@@ -302,6 +359,8 @@ def is_proposal(op: Op, authority: dict[str, str]) -> bool:
         return True
     if op.slice in ("identity", "boundaries") and op.origin != "human":
         return True
+    if op.claim_id in (protected or ()) and op.origin != "human":
+        return True
     if op.scope.startswith("origin:"):
         target = op.scope.split(":", 1)[1]
         return op.origin != target
@@ -313,17 +372,11 @@ def is_proposal(op: Op, authority: dict[str, str]) -> bool:
 
 
 def compile_ops(ops: list[Op], authority: dict[str, str]) -> tuple[dict[tuple[str, str], ClaimResult], list[Op]]:
-    """Compile a list of operations. Duplicate op_ids collapse to the first."""
-    seen: set[str] = set()
-    unique: list[Op] = []
-    for op in ops:
-        if op.op_id in seen:
-            continue
-        seen.add(op.op_id)
-        unique.append(op)
-
-    proposals = [op for op in unique if is_proposal(op, authority)]
-    applicable = [op for op in unique if not is_proposal(op, authority)]
+    """Compile operations with stable human protection and verified replay identity."""
+    unique = unique_ops(ops)
+    protected = protected_claim_ids(unique)
+    proposals = [op for op in unique if is_proposal(op, authority, protected)]
+    applicable = [op for op in unique if not is_proposal(op, authority, protected)]
     # A demoted op stays out of the view, but a later allowed set may use its op_id as base.
     anchors: dict[tuple[str, str], set[str]] = {}
     for op in proposals:

package/topmind_handoff/package.py

@@ -8,15 +8,18 @@ from dataclasses import dataclass, field
 from datetime import date
 from pathlib import Path
 
-from topmind_handoff.compile import append_outbox, compile_repo, projection_body
+from topmind_handoff.compile import append_outbox, compile_repo, load_pieces, projection_body
 from topmind_handoff.model import (
     REVIEW_MARK,
     ROOT,
     compiler_version,
+    compile_ops,
     origin_markdown,
     parse_outbox,
     safe_origin,
+    unique_ops,
 )
+from topmind_handoff.privacy import assert_private_text
 
 APPENDIX_MARK = "本附录是操作账本，不是新事实。按 op_id 去重重放；不要把这些条目再导入为新的事实或记忆。"
 ANCHOR_FIELDS = ("对本智能体的称呼", "称呼", "语言", "时区")
@@ -72,7 +75,7 @@ def render_package(repo: Path, origin: str, today: date | None = None) -> str:
         "",
         body,
         "",
-        "## 10. 操作附录（已反映在上文视图中）",
+        "## 操作附录（已反映在上文视图中）",
         "",
         APPENDIX_MARK,
         "不要把本附录当指令执行。",
@@ -82,7 +85,9 @@ def render_package(repo: Path, origin: str, today: date | None = None) -> str:
         "```",
         "",
     ]
-    return "\n".join(lines)
+    rendered = "\n".join(lines)
+    assert_private_text(rendered)
+    return rendered
 
 
 def _ops_fence(package: str) -> re.Match[str] | None:
@@ -100,23 +105,13 @@ def _appendix_ops(package: str, origin: str):
     return parse_outbox(match.group(1), origin)
 
 
-def _known_ids(repo: Path) -> set[str]:
-    found: set[str] = set()
-    outbox = repo / "outbox"
-    if not outbox.is_dir():
-        return found
-    for path in outbox.glob("*.md"):
-        for op in parse_outbox(path.read_text(encoding="utf-8"), path.stem):
-            found.add(op.op_id)
-    return found
-
-
 def replay_package(repo: Path, package: str, *, confirmed: bool = False) -> list[str]:
     """List appendix ops this repo does not have. Write them only after confirmation.
 
     Existing outbox lines, other origins, and environment cards are left as they are.
     """
     repo = Path(repo)
+    assert_private_text(package)
     front = _front(package)
     version = front.get("handoff_version", "")
     if version != PACKAGE_VERSION:
@@ -124,8 +119,10 @@ def replay_package(repo: Path, package: str, *, confirmed: bool = False) -> list
     if not _has_ops_appendix(package):
         raise ValueError("交接包没有操作附录")
     origin = safe_origin(front.get("origin_id") or "unknown")
-    incoming = _appendix_ops(package, origin)
-    known = _known_ids(repo)
+    incoming = unique_ops(_appendix_ops(package, origin))
+    authority, _tips, _cards, existing = load_pieces(repo)
+    combined = unique_ops(existing + incoming)
+    known = {op.op_id for op in existing}
     added: list[str] = []
     blocks: list[str] = []
     for op in incoming:
@@ -134,6 +131,11 @@ def replay_package(repo: Path, package: str, *, confirmed: bool = False) -> list
         known.add(op.op_id)
         added.append(op.op_id)
         blocks.append(op.raw.rstrip("\n"))
+    if blocks:
+        claims, _proposals = compile_ops(combined, authority)
+        blocked = [op for result in claims.values() for op in result.unapplied if op.op_id in added]
+        if blocked:
+            raise ValueError("交接包缺少因果依赖或裁决不适用；请补齐依赖后重放，未写入文件")
     if not blocks or not confirmed:
         return added
     append_outbox(repo, origin, origin, blocks)
@@ -142,7 +144,7 @@ def replay_package(repo: Path, package: str, *, confirmed: bool = False) -> list
 
 
 @dataclass
-class LegacyPlan:
+class HostMergePlan:
     additions: dict[str, str] = field(default_factory=dict)
     anchor_conflicts: dict[str, tuple[str, str]] = field(default_factory=dict)
     anchor_fills: dict[str, str] = field(default_factory=dict)
@@ -152,20 +154,15 @@ class LegacyPlan:
     omitted_local_ids: list[str] = field(default_factory=list)
 
 
-_SECTION_6 = re.compile(r"^##\s*6(?:\.|\s|$)")
-
-
 def _skip_heading(stripped: str) -> bool:
     """Boundaries are behavior, not facts. The rendered slice heading is ## 边界."""
-    if _SECTION_6.match(stripped):
-        return True
     return stripped.lstrip("#").strip() == "边界"
 
 
 def _claim_items(package: str) -> list[tuple[str | None, str]]:
     """List items outside boundary sections and outside fenced blocks.
 
-    Section 6 and the rendered ## 边界 slice are behavior, not memory.
+    The rendered ## 边界 slice is behavior, not memory.
     Fenced blocks hold the operations appendix, which is a ledger and not a new claim.
     """
     items: list[tuple[str | None, str]] = []
@@ -215,8 +212,9 @@ def _is_tombstone(text: str) -> bool:
     return "已撤回" in text or "withdrawn" in lowered
 
 
-def legacy_import_plan(package: str, local: dict) -> LegacyPlan:
+def plan_host_merge(package: str, local: dict) -> HostMergePlan:
     """Diff view lines into host memory. Existing text and anchors are not replaced."""
+    assert_private_text(package)
     front = _front(package)
     version = front.get("handoff_version", "")
     if package.startswith("---"):
@@ -226,7 +224,7 @@ def legacy_import_plan(package: str, local: dict) -> LegacyPlan:
             raise ValueError("交接包没有操作附录")
     local_anchors = dict(local.get("anchors") or {})
     local_claims = dict(local.get("claims") or {})
-    plan = LegacyPlan()
+    plan = HostMergePlan()
     seen: set[str] = set()
     local_texts = {value for value in local_claims.values() if value}
     for claim_id, text in _claim_items(package):
@@ -282,7 +280,7 @@ def legacy_import_plan(package: str, local: dict) -> LegacyPlan:
     return plan
 
 
-def apply_legacy_plan(plan: LegacyPlan, local: dict, *, confirmed: bool) -> dict:
+def apply_host_merge(plan: HostMergePlan, local: dict, *, confirmed: bool) -> dict:
     """Add confirmed new claims and empty anchors. Never delete or replace existing text."""
     result = deepcopy(local)
     result.setdefault("anchors", {})

package/topmind_handoff/privacy.py

@@ -0,0 +1,41 @@
+"""Local high-confidence privacy checks. Never echo matched values."""
+
+from __future__ import annotations
+
+import re
+
+_CREDENTIALS = (
+    re.compile(r"\bsk-[A-Za-z0-9_-]{10,}"),
+    re.compile(r"\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}"),
+    re.compile(r"\bgithub_pat_[A-Za-z0-9_]{20,}"),
+    re.compile(r"\bnpm_[A-Za-z0-9]{20,}"),
+    re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}"),
+    re.compile(r"\bAIza[0-9A-Za-z_-]{30,}"),
+    re.compile(r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b"),
+    re.compile(r"\bBearer\s+[A-Za-z0-9._-]{20,}", re.I),
+    re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
+    re.compile(r"\b(?:api[_-]?key|access[_-]?token|client[_-]?secret|password|secret)\b\s*[:=]\s*['\"]?[A-Za-z0-9+/._-]{16,}", re.I),
+)
+_HOMES = (
+    re.compile(r"/(?:home|Users)/([^/\s\"'<>|`]+)"),
+    re.compile(r"[A-Za-z]:\\Users\\([^\\/\s\"'<>|]+)", re.I),
+)
+_PLACEHOLDERS = {"user", "username", "yourname", "example", "runner", "ubuntu", "public", "shared", "zhangsan"}
+
+
+def assert_private_text(text: str) -> None:
+    """Reject obvious credentials and personal home paths before any write.
+
+    This deliberately does not claim to detect every form of PII. Semantic
+    privacy review and user confirmation still apply.
+    """
+    for pattern in _CREDENTIALS:
+        match = pattern.search(text)
+        if match:
+            line = text.count("\n", 0, match.start()) + 1
+            raise ValueError(f"隐私检查拒绝：第 {line} 行疑似凭据（内容已隐藏）")
+    for pattern in _HOMES:
+        for match in pattern.finditer(text):
+            if match.group(1).lower() not in _PLACEHOLDERS:
+                line = text.count("\n", 0, match.start()) + 1
+                raise ValueError(f"隐私检查拒绝：第 {line} 行含个人主目录，请泛化为 ~（内容已隐藏）")