@uniqbit/mate-core 0.18.4 → 1.0.0-canary.0

package/src/tools/setup/capabilities/tokensave.ts

@@ -4,6 +4,8 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 
+import { resolveSecretPolicy } from "../../../runtime/policy";
+import { DEFAULT_SECRET_DENY_PATTERNS, type SecretPolicy } from "../../../runtime/secret-patterns";
 import { resolveGitInfoExcludePath } from "../git-utils";
 import type { InstallRequirement } from "../install-contract";
 import type { CapabilityPlugin, RuntimeContributionsByRuntime } from "../plugin";
@@ -368,14 +370,40 @@ export async function isTokensaveIndexed(repoPath: string): Promise<boolean> {
   return fileExists(path.join(repoPath, TOKENSAVE_STORE_DIR, TOKENSAVE_STORE_DATABASE_FILE));
 }
 
+function secretExclude(pattern: string): string {
+  return `**/${pattern.replace(/^\/+/, "")}`;
+}
+
+/**
+ * Mate owns the excludes derived from the defaults and from the companion's
+ * current extra patterns. An extra removed from config is no longer
+ * recognizable, so its exclude stays: over-excluding from an index is harmless.
+ */
+function reconcileSecretExcludes(existing: unknown, secrets: SecretPolicy): string[] {
+  const owned = new Set([...DEFAULT_SECRET_DENY_PATTERNS, ...secrets.deny].map(secretExclude));
+  const kept = (Array.isArray(existing) ? existing : []).filter(
+    (entry): entry is string => typeof entry === "string" && !owned.has(entry),
+  );
+  const managed = secrets.guardrails ? [...new Set(secrets.deny.map(secretExclude))] : [];
+  return [...kept, ...managed];
+}
+
 /**
  * Reconciles Mate's single-graph branching posture into the working repo's
  * git-excluded `.tokensave/config.json` and deactivates existing branch
  * metadata. Best-effort by design: the file is created by `tokensave init`,
  * so an absent, unreadable, or unparseable config is left untouched rather
  * than treated as an error. Existing branch databases are never removed.
+ *
+ * With a secret policy, also reconciles the secret-file excludes: Mate's
+ * `**\/<pattern>` entries are appended while guardrails are on and removed
+ * when they are off, by exact value, so user-authored excludes keep their
+ * place. Without one, `exclude` is left as it is.
  */
-export async function ensureTokensaveBranchingPosture(repoPath: string): Promise<void> {
+export async function ensureTokensaveBranchingPosture(
+  repoPath: string,
+  secrets?: SecretPolicy,
+): Promise<void> {
   const configPath = path.join(repoPath, TOKENSAVE_STORE_DIR, TOKENSAVE_STORE_CONFIG_FILE);
 
   let raw: string;
@@ -395,8 +423,13 @@ export async function ensureTokensaveBranchingPosture(repoPath: string): Promise
     return;
   }
 
+  const config = parsed as Record<string, unknown>;
   const next = JSON.stringify(
-    { ...(parsed as Record<string, unknown>), ...TOKENSAVE_OWNED_POSTURE },
+    {
+      ...config,
+      ...TOKENSAVE_OWNED_POSTURE,
+      ...(secrets ? { exclude: reconcileSecretExcludes(config.exclude, secrets) } : {}),
+    },
     null,
     2,
   );
@@ -539,7 +572,7 @@ export function createTokensavePlugin(): CapabilityPlugin {
       ) {
         return;
       }
-      await ensureTokensaveBranchingPosture(targetPath);
+      await ensureTokensaveBranchingPosture(targetPath, resolveSecretPolicy(ctx.companionPath));
       if (ctx.mode === "setup") {
         installTokensaveAgentIntegrations(ctx.activeProviders, targetPath);
       }

package/src/tools/setup/context-services.ts

@@ -3,6 +3,8 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 
+import { managedBlockMarkers, managedBlockStartPattern } from "../../runtime/managed-block";
+import { removeEmptiedFile, writeAtomicThroughLink } from "../../runtime/write-atomic";
 import type {
   InstructionsService,
   McpServerDescriptor,
@@ -63,13 +65,6 @@ async function saveManifest(
 // Managed instruction blocks
 // ---------------------------------------------------------------------------
 
-function blockMarkers(frameworkName: string, blockKey: string): { start: string; end: string } {
-  return {
-    start: `<!-- ${frameworkName}:managed:${blockKey} start -->`,
-    end: `<!-- ${frameworkName}:managed:${blockKey} end -->`,
-  };
-}
-
 export function instructionBlockKey(pluginId: string, content: string): string {
   const hash = crypto.createHash("sha256").update(content).digest("hex").slice(0, 12);
   return `${pluginId}:${hash}`;
@@ -82,7 +77,7 @@ export async function upsertManagedBlock(
   blockKey: string,
   content: string,
 ): Promise<void> {
-  const { start, end } = blockMarkers(frameworkName, blockKey);
+  const { start, end } = managedBlockMarkers(frameworkName, blockKey);
   let existing = "";
   try {
     existing = await fs.readFile(filePath, "utf8");
@@ -93,7 +88,8 @@ export async function upsertManagedBlock(
   if (existing.includes(start)) return;
   const separator = existing.length === 0 || existing.endsWith("\n\n") ? "" : "\n";
   await fs.mkdir(path.dirname(filePath), { recursive: true });
-  await fs.writeFile(filePath, existing + (existing ? separator : "") + block, "utf8");
+  /** A session-start hook may read the file while another session's prepare rewrites it. */
+  await writeAtomicThroughLink(filePath, existing + (existing ? separator : "") + block);
 }
 
 /**
@@ -113,11 +109,7 @@ export async function removeManagedBlocksForPlugin(
   } catch {
     return;
   }
-  const escape = (value: string) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const keyPattern = new RegExp(
-    `<!-- ${escape(frameworkName)}:managed:(${escape(pluginId)}:[0-9a-f]+) start -->`,
-    "g",
-  );
+  const keyPattern = managedBlockStartPattern(frameworkName, pluginId);
   const keys = [...existing.matchAll(keyPattern)].map((match) => match[1]);
   for (const key of keys) {
     if (keepKeys.has(key)) continue;
@@ -131,7 +123,7 @@ async function removeManagedBlock(
   frameworkName: string,
   blockKey: string,
 ): Promise<void> {
-  const { start, end } = blockMarkers(frameworkName, blockKey);
+  const { start, end } = managedBlockMarkers(frameworkName, blockKey);
   let existing: string;
   try {
     existing = await fs.readFile(filePath, "utf8");
@@ -146,10 +138,10 @@ async function removeManagedBlock(
   const after = existing.slice(endIdx + end.length).replace(/^\n+/, "\n");
   const next = (before + after).replace(/^\n+/, "");
   if (!next.trim()) {
-    await fs.unlink(filePath).catch(() => {});
+    await removeEmptiedFile(filePath).catch(() => {});
     return;
   }
-  await fs.writeFile(filePath, next, "utf8");
+  await writeAtomicThroughLink(filePath, next);
 }
 
 // ---------------------------------------------------------------------------

package/src/tools/setup/dynamic-plugins/audiences.ts

@@ -8,10 +8,13 @@ import { ConfigError, type PluginDeclaration } from "../../../lib/orchestrator/t
 
 export const AUDIENCE_ENV = "MATE_AUDIENCE";
 
-/** The reserved audience holding the base set: always applied, never selected or listed. */
+/**
+ * Mate 0.18.4 saved the base set under `audiences.base`. That shape is read
+ * back for compatibility, never written: the next save uses the root shape.
+ */
 export const BASE_AUDIENCE = "base";
 
-/** The base set's audience-scoped keys; companion-wide keys stay at the root. */
+/** The keys 0.18.4 moved under `audiences.base`; companion-wide keys stayed at the root. */
 export const BASE_AUDIENCE_KEYS = ["capabilities", "plugins", "studio"] as const;
 
 export type AudienceResolution =
@@ -23,13 +26,6 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 function pluginList(value: unknown): unknown[] {
-  if (
-    isRecord(value) &&
-    isRecord(value.audiences) &&
-    Object.hasOwn(value.audiences, BASE_AUDIENCE)
-  ) {
-    return pluginList(normalizeBaseAudience(value));
-  }
   return isRecord(value) && Array.isArray(value.plugins) ? value.plugins : [];
 }
 
@@ -91,7 +87,6 @@ export function declaredAudiences(raw: unknown): string[] {
     : [];
 }
 
-/** `MATE_AUDIENCE=base` selects the base set alone, the same as no audience. */
 export function resolveAudience(raw: unknown, audience: string | null): AudienceResolution {
   if (audience === null || audience === BASE_AUDIENCE) return { ok: true, active: null };
   const declared = declaredAudiences(raw);
@@ -104,34 +99,7 @@ export function resolveAudience(raw: unknown, audience: string | null): Audience
  * its own `policy` and `config`. An unknown audience contributes nothing.
  */
 export function effectivePluginDeclarations(raw: unknown, audience: string | null): unknown[] {
-  return [...pluginList(raw), ...pluginList(audienceEntry(raw, audience))];
-}
-
-/** One effective declaration and its source: `null` for base, else the audience name. */
-export interface SourcedDeclaration {
-  entry: unknown;
-  audience: string | null;
-}
-
-/** `effectivePluginDeclarations`, each entry marked with the source that declared it. */
-export function effectivePluginDeclarationSources(
-  raw: unknown,
-  audience: string | null,
-): SourcedDeclaration[] {
-  return [
-    ...pluginList(raw).map((entry) => ({ entry, audience: null })),
-    ...pluginList(audienceEntry(raw, audience)).map((entry) => ({ entry, audience })),
-  ];
-}
-
-/** The declarations of one audience only, without base. */
-export function audiencePluginDeclarations(raw: unknown, audience: string): unknown[] {
-  return pluginList(audienceEntry(raw, audience));
-}
-
-/** The raw `audiences.<name>` entry, for fingerprinting what a layer depends on. */
-export function audienceDeclarationEntry(raw: unknown, audience: string): unknown {
-  return audienceEntry(raw, audience);
+  return [...pluginList(normalizeBaseAudience(raw)), ...pluginList(audienceEntry(raw, audience))];
 }
 
 /**
@@ -140,7 +108,7 @@ export function audienceDeclarationEntry(raw: unknown, audience: string): unknow
  * version. Runtime declarations must come from `effectivePluginDeclarations`.
  */
 export function allPluginDeclarations(raw: unknown): unknown[] {
-  const all = [...pluginList(raw)];
+  const all = [...pluginList(normalizeBaseAudience(raw))];
   for (const name of declaredAudiences(raw)) {
     all.push(...pluginList(audienceEntry(raw, name)));
   }

package/src/tools/setup/dynamic-plugins/declarations.ts

@@ -13,7 +13,7 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 /**
- * Raw read of the companion's base `plugins:` list, from either shape. Deliberately avoids
+ * Raw read of the companion's `plugins:` list. Deliberately avoids
  * `ConfigStore.load()` — hydration runs on every invocation and must never
  * create or migrate config files as a side effect.
  */

package/src/tools/setup/dynamic-plugins/hydrate.ts

@@ -9,7 +9,7 @@ import type { Plugin } from "../plugin";
 import type { PluginRegistry } from "../registry";
 import {
   describeUnknownAudience,
-  effectivePluginDeclarationSources,
+  effectivePluginDeclarations,
   readAudienceSelection,
   readFrameworkRaw,
   resolveAudience,
@@ -71,8 +71,7 @@ function activateDeclaredPlugin(plugin: Plugin): Plugin {
 /**
  * Registers the companion's effective plugins (base plus the active
  * `MATE_AUDIENCE`) into the active registry — compiled-in plugins first
- * (they are already registered), declared order after. Each registration is
- * marked with its source, so persisted passes can keep to base. Runs before cap-command detection on every invocation. No-op
+ * (they are already registered), declared order after. Runs before cap-command detection on every invocation. No-op
  * without a companion or `plugins:` entries; all diagnostics go to stderr;
  * never throws.
  */
@@ -90,12 +89,12 @@ export async function hydrateDynamicPlugins(deps: HydrateDynamicPluginsDeps = {}
     if (!audience.ok) {
       warn(`${describeUnknownAudience(audience)}; applying the base configuration only`);
     }
-    const entries = effectivePluginDeclarationSources(raw, audience.ok ? audience.active : null);
+    const entries = effectivePluginDeclarations(raw, audience.ok ? audience.active : null);
     if (entries.length === 0) return;
 
     const registry = deps.registry ?? getActiveDistribution().registry;
 
-    for (const { entry, audience: source } of entries) {
+    for (const entry of entries) {
       const { declaration, error } = validateDeclaration(entry);
       if (!declaration) {
         if (error) warn(error);
@@ -123,8 +122,6 @@ export async function hydrateDynamicPlugins(deps: HydrateDynamicPluginsDeps = {}
       registry.register({
         plugin: activateDeclaredPlugin(result.plugin),
         policy: declaration.policy ?? "optional",
-        audience: source,
-        packageName: declaration.package,
       });
       hydratedPackages.add(declaration.package);
     }

package/src/tools/setup/dynamic-plugins/install.ts

@@ -26,45 +26,40 @@ export interface PluginInstallResult {
   error?: string;
 }
 
-/** Runs `npm install` for the shared plugin workspace, honoring the user's ambient registry/auth config. */
-function defaultNpmInstall(workspaceRoot: string): { ok: boolean; detail?: string } {
-  const result = spawnSync("npm", ["install", "--no-audit", "--no-fund", "--silent"], {
-    cwd: workspaceRoot,
-    encoding: "utf8",
-  });
+/**
+ * Runs `npm <command>` in the shared plugin workspace, honoring the user's ambient
+ * registry/auth config. `--loglevel=error` keeps npm's own error in stderr for the report.
+ */
+function runNpm(
+  workspaceRoot: string,
+  command: string,
+  args: string[] = [],
+): { ok: boolean; detail?: string } {
+  const result = spawnSync(
+    "npm",
+    [command, "--no-audit", "--no-fund", "--loglevel=error", ...args],
+    { cwd: workspaceRoot, encoding: "utf8" },
+  );
   if (result.error || result.status !== 0) {
     return {
       ok: false,
       detail:
         result.error?.message ??
-        result.stderr?.trim() ??
-        `npm install exited with ${result.status}`,
+        (result.stderr?.trim() || `npm ${command} exited with ${result.status}`),
     };
   }
   return { ok: true };
 }
 
+/** Runs `npm install` for the shared plugin workspace. */
+const defaultNpmInstall: NpmInstallRunner = (workspaceRoot) => runNpm(workspaceRoot, "install");
+
 /** Version literals treated as moving targets: re-resolved via `npm update` on every run. */
 const MOVING_VERSION_TAGS = new Set(["latest", "canary"]);
 
 /** Runs `npm update <pkg...>` to force re-resolution of moving-tag-declared plugins every run. */
-function defaultNpmUpdate(
-  workspaceRoot: string,
-  packages: string[],
-): { ok: boolean; detail?: string } {
-  const result = spawnSync("npm", ["update", "--no-audit", "--no-fund", "--silent", ...packages], {
-    cwd: workspaceRoot,
-    encoding: "utf8",
-  });
-  if (result.error || result.status !== 0) {
-    return {
-      ok: false,
-      detail:
-        result.error?.message ?? result.stderr?.trim() ?? `npm update exited with ${result.status}`,
-    };
-  }
-  return { ok: true };
-}
+const defaultNpmUpdate: NpmUpdateRunner = (workspaceRoot, packages) =>
+  runNpm(workspaceRoot, "update", packages);
 
 async function readInstalledVersion(packageRoot: string): Promise<string | null> {
   try {
@@ -155,14 +150,15 @@ export async function installDeclaredPlugins(
 
   await writeWorkspaceManifest(workspaceRoot, desired);
   const installOutcome = await runNpmInstall(workspaceRoot);
+  // Failure is decided from `ok`, so an empty detail can never read as success.
   const installFailure = installOutcome.ok
     ? undefined
-    : (installOutcome.detail ?? "npm install failed");
+    : installOutcome.detail || "npm install failed";
 
   let updateFailure: string | undefined;
   if (movingPackages.length > 0) {
     const updateOutcome = await runNpmUpdate(workspaceRoot, movingPackages);
-    updateFailure = updateOutcome.ok ? undefined : (updateOutcome.detail ?? "npm update failed");
+    updateFailure = updateOutcome.ok ? undefined : updateOutcome.detail || "npm update failed";
   }
 
   const resolvedVersions = await Promise.all(
@@ -174,7 +170,7 @@ export async function installDeclaredPlugins(
   return sorted.map((declaration, index) => {
     const isMoving = MOVING_VERSION_TAGS.has(declaration.version);
     const failure = installFailure ?? (isMoving ? updateFailure : undefined);
-    if (failure) {
+    if (failure !== undefined) {
       return { package: declaration.package, status: "failed", error: failure };
     }
     const resolvedVersion = resolvedVersions[index];