@vellumai/credential-executor 0.10.12-dev.202607250047.75b9ec6 → 0.10.12-staging.1

package/node_modules/@vellumai/service-contracts/package.json

@@ -17,7 +17,6 @@
     "./rpc": "./src/rpc.ts",
     "./attachment-naming": "./src/attachment-naming.ts",
     "./redacted-credential": "./src/redacted-credential.ts",
-    "./secret-detection": "./src/secret-detection.ts",
     "./error": "./src/error.ts"
   },
   "scripts": {

package/node_modules/@vellumai/service-contracts/src/remote-web-pairing.ts

@@ -109,77 +109,12 @@ export type RemoteWebPairingTokenResponse =
 // only) so both Node and browser callers share one implementation.
 
 /** Why a public base URL can't be advertised in a pairing challenge. */
-export type PublicBaseUrlRejection =
-  | "unparseable"
-  | "loopback"
-  | "non-https"
-  | "service-website";
+export type PublicBaseUrlRejection = "unparseable" | "loopback" | "non-https";
 
 export type PublicBaseUrlResult =
   | { ok: true; url: string }
   | { ok: false; reason: PublicBaseUrlRejection };
 
-/**
- * Hosts that are a tunnel/ingress vendor's own website, not a user's assistant
- * endpoint. These are the tunnel vendors our docs mention, and their sites are
- * exactly where a lost user grabs a URL from — e.g. a Tailscale admin invite
- * link (`login.tailscale.com/admin/invite/…`), which is https and non-loopback
- * and so clears every other check. Pairing refuses them with a targeted message
- * rather than minting a challenge the scanning device can never reach.
- */
-export const TUNNEL_PROVIDER_WEBSITE_HOSTS = [
-  "login.tailscale.com",
-  "tailscale.com",
-  "www.tailscale.com",
-  "ngrok.com",
-  "dashboard.ngrok.com",
-  "dash.cloudflare.com",
-  "cloudflare.com",
-  "www.cloudflare.com",
-] as const;
-
-/**
- * A URL whose exact host is a tunnel/ingress vendor's own website (see
- * {@link TUNNEL_PROVIDER_WEBSITE_HOSTS}). Exact-host only: a user's real
- * Tailscale endpoint (`*.ts.net`) or Cloudflare-fronted domain is never a
- * listed host, so a legitimate address is never mistaken for a vendor site.
- */
-export function isTunnelProviderWebsiteUrl(url: string): boolean {
-  let hostname: string;
-  try {
-    // WHATWG URL lowercases the hostname during parsing.
-    hostname = new URL(url).hostname;
-  } catch {
-    return false;
-  }
-  return (TUNNEL_PROVIDER_WEBSITE_HOSTS as readonly string[]).includes(
-    hostname,
-  );
-}
-
-/**
- * The display name of the tunnel/ingress vendor a service-website URL points
- * at (`"Tailscale"` / `"ngrok"` / `"Cloudflare"`), or null when the host is not
- * a known vendor site. Drives the "This is <Name>'s website" pairing guidance.
- */
-export function tunnelProviderWebsiteName(url: string): string | null {
-  let hostname: string;
-  try {
-    hostname = new URL(url).hostname;
-  } catch {
-    return null;
-  }
-  if (
-    !(TUNNEL_PROVIDER_WEBSITE_HOSTS as readonly string[]).includes(hostname)
-  ) {
-    return null;
-  }
-  if (hostname.includes("tailscale")) return "Tailscale";
-  if (hostname.includes("ngrok")) return "ngrok";
-  if (hostname.includes("cloudflare")) return "Cloudflare";
-  return null;
-}
-
 /**
  * A loopback URL — `localhost`, `[::1]`, or `127.x.x.x`. A pairing link that
  * encodes a loopback address is unreachable from the scanning device.
@@ -232,9 +167,6 @@ export function resolvePublicBaseUrl(raw: string): PublicBaseUrlResult {
   if (isLoopbackPublicUrl(normalized)) {
     return { ok: false, reason: "loopback" };
   }
-  if (isTunnelProviderWebsiteUrl(normalized)) {
-    return { ok: false, reason: "service-website" };
-  }
   if (new URL(normalized).protocol !== "https:") {
     return { ok: false, reason: "non-https" };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/credential-executor",
-  "version": "0.10.12-dev.202607250047.75b9ec6",
+  "version": "0.10.12-staging.1",
   "license": "MIT",
   "type": "module",
   "exports": {

package/node_modules/@vellumai/service-contracts/src/__tests__/secret-detection.test.ts

@@ -1,449 +0,0 @@
-import { describe, expect, test } from "bun:test";
-
-// Self-referencing package import — proves the `./secret-detection` subpath
-// export resolves for consumers.
-import * as subpathExport from "@vellumai/service-contracts/secret-detection";
-
-import {
-  detectSecretsInText,
-  isCompletePrivateKeyBlock,
-  PEM_REDACTION_MAX_BODY_LENGTH,
-  PREFIX_PATTERNS,
-  PRIVATE_KEY_REDACTION_REGEX,
-  REDACTION_PREFIX_PATTERNS,
-  TOKEN_SHAPE,
-  TOKEN_SHAPE_LABEL,
-  TOKEN_SHAPE_MAX_LENGTH,
-} from "../secret-detection.js";
-
-// All fixtures below are synthetic lookalike tokens — never real key material.
-
-function matchingLabels(text: string): string[] {
-  return PREFIX_PATTERNS.filter((p) => p.regex.test(text)).map((p) => p.label);
-}
-
-const ALNUM = "abcdefghijklmnopqrstuvwxyz0123456789";
-
-/** Lowercase-alphanumeric filler of the given length (no separators, so it
- * can never form another pattern's prefix like `npm_` or `key-`). */
-function filler(length: number): string {
-  return ALNUM.repeat(Math.ceil(length / ALNUM.length)).slice(0, length);
-}
-
-/** One synthetic fixture per provider family, keyed by pattern label. */
-const FIXTURES: Record<string, string> = {
-  "AWS Access Key": "AKIAABCDEFGHIJKLMNOP",
-  "GitHub Token": `ghp_${filler(36)}`,
-  "GitHub Fine-Grained PAT": `github_pat_${filler(22)}`,
-  "GitLab Token": `glpat-${filler(20)}`,
-  "Stripe Secret Key": `sk_live_${filler(24)}`,
-  "Stripe Restricted Key": `rk_live_${filler(24)}`,
-  "Slack Bot Token": `xoxb-1234567890-1234567890-${filler(24)}`,
-  "Slack User Token": `xoxp-1234567890-1234567890-1234567890-${"0123456789abcdef".repeat(2)}`,
-  "Slack App Token": "xapp-1-abc123-4567-defghij890",
-  "Telegram Bot Token": `123456789:${filler(35)}`,
-  "Anthropic API Key": `sk-ant-${filler(80)}`,
-  "OpenAI API Key": `sk-${filler(20)}T3BlbkFJ${filler(20)}`,
-  "OpenAI Project Key": `sk-proj-${filler(40)}`,
-  "Google API Key": `AIza${filler(35)}`,
-  "Google OAuth Client Secret": `GOCSPX-${filler(28)}`,
-  "Twilio API Key": `SK${"0123456789abcdef".repeat(2)}`,
-  "SendGrid API Key": `SG.${filler(22)}.${filler(43)}`,
-  "Mailgun API Key": `key-${filler(32)}`,
-  "npm Token": `npm_${filler(36)}`,
-  "PyPI API Token": `pypi-${filler(50)}`,
-  "Private Key": "-----BEGIN OPENSSH PRIVATE KEY-----",
-  "Linear API Key": `lin_api_${filler(32)}`,
-  "Notion Integration Token": `ntn_${filler(40)}`,
-  "OpenRouter API Key": `sk-or-v1-${filler(40)}`,
-  "Vercel AI Gateway API Key": `vck_${filler(24)}`,
-  "Fireworks API Key": `fw_${filler(32)}`,
-  "Perplexity API Key": `pplx-${filler(40)}`,
-  "Tavily API Key": `tvly-${filler(20)}`,
-  "Firecrawl API Key": `fc-${filler(20)}`,
-};
-
-describe("subpath export", () => {
-  test("@vellumai/service-contracts/secret-detection resolves to this module", () => {
-    expect(subpathExport.PREFIX_PATTERNS).toBe(PREFIX_PATTERNS);
-    expect(subpathExport.detectSecretsInText).toBe(detectSecretsInText);
-  });
-});
-
-describe("PREFIX_PATTERNS", () => {
-  test("every pattern has a fixture", () => {
-    expect(Object.keys(FIXTURES).sort()).toEqual(
-      PREFIX_PATTERNS.map((p) => p.label).sort(),
-    );
-  });
-
-  test("pattern labels are unique", () => {
-    const labels = PREFIX_PATTERNS.map((p) => p.label);
-    expect(new Set(labels).size).toBe(labels.length);
-  });
-
-  // Label-uniqueness invariant: each fixture matches exactly one pattern, so
-  // a detected value always maps to an unambiguous label.
-  for (const [label, fixture] of Object.entries(FIXTURES)) {
-    test(`${label} fixture matches exactly that pattern`, () => {
-      expect(matchingLabels(fixture)).toEqual([label]);
-    });
-  }
-
-  test("does not match a short vck_ string", () => {
-    expect(matchingLabels("vck_abc")).toEqual([]);
-  });
-});
-
-describe("detectSecretsInText — prefix patterns", () => {
-  for (const [label, fixture] of Object.entries(FIXTURES)) {
-    test(`detects a ${label} with the right label and span`, () => {
-      const text = `my key is ${fixture} thanks`;
-      const start = text.indexOf(fixture);
-      expect(detectSecretsInText(text)).toEqual([
-        {
-          label,
-          value: fixture,
-          start,
-          end: start + fixture.length,
-          wholeMessage: false,
-        },
-      ]);
-    });
-  }
-
-  test("does not mutate the shared pattern objects' lastIndex", () => {
-    detectSecretsInText(`ghp_${filler(36)}`);
-    for (const p of PREFIX_PATTERNS) {
-      expect(p.regex.lastIndex).toBe(0);
-    }
-  });
-});
-
-describe("detectSecretsInText — placeholder suppression", () => {
-  test("known placeholder text returns no matches", () => {
-    expect(detectSecretsInText("your-api-key-here")).toEqual([]);
-    expect(detectSecretsInText("sk-xxxxxxxxxxxxxxxxxxxxxxxx")).toEqual([]);
-  });
-
-  test("placeholder-prefixed token-shaped message is suppressed", () => {
-    expect(detectSecretsInText(`fake_key_${filler(20)}`)).toEqual([]);
-    expect(detectSecretsInText(`test_api_${filler(16)}`)).toEqual([]);
-    expect(detectSecretsInText(`dummy-token-${filler(16)}`)).toEqual([]);
-  });
-
-  test("token-shaped message with a placeholder tail is suppressed", () => {
-    // TOKEN_SHAPE matches with tail "replace_with_your_key", which is a
-    // known placeholder.
-    expect(detectSecretsInText("acme_key_replace_with_your_key")).toEqual([]);
-  });
-
-  test("placeholder pre-context suppresses a prefix match (fake_ghp_...)", () => {
-    // The GitHub regex matches starting at `ghp_`, so the `fake_` marker
-    // sits in the pre-context window rather than the matched value.
-    expect(detectSecretsInText(`fake_${"ghp_" + filler(36)}`)).toEqual([]);
-    expect(
-      detectSecretsInText(`docs use example_ghp_${filler(36)} as a stand-in`),
-    ).toEqual([]);
-  });
-
-  test("repeated-character variable portion suppresses a prefix match", () => {
-    // AKIA followed by 16 repeated placeholder characters.
-    expect(detectSecretsInText("AKIAXXXXXXXXXXXXXXXX")).toEqual([]);
-    expect(detectSecretsInText(`set AWS_KEY=AKIA${"X".repeat(16)}`)).toEqual(
-      [],
-    );
-  });
-
-  test("the same tokens without placeholder context still match", () => {
-    const github = `ghp_${filler(36)}`;
-    expect(detectSecretsInText(github).map((m) => m.label)).toEqual([
-      "GitHub Token",
-    ]);
-    expect(
-      detectSecretsInText("AKIAABCDEFGHIJKLMNOP").map((m) => m.label),
-    ).toEqual(["AWS Access Key"]);
-  });
-
-  test("token-shaped message with a repeated-character tail is suppressed", () => {
-    expect(detectSecretsInText(`my_key_${"x".repeat(16)}`)).toEqual([]);
-  });
-});
-
-describe("detectSecretsInText — whole-message token shape", () => {
-  test("a whole-message token-shaped value is detected", () => {
-    const token = `virlo_tkn_${filler(20)}`;
-    expect(TOKEN_SHAPE.test(token)).toBe(true);
-    expect(detectSecretsInText(token)).toEqual([
-      {
-        label: TOKEN_SHAPE_LABEL,
-        value: token,
-        start: 0,
-        end: token.length,
-        wholeMessage: true,
-      },
-    ]);
-  });
-
-  test("surrounding whitespace is trimmed and the span covers the token", () => {
-    const token = `acme_secret_${filler(18)}`;
-    expect(detectSecretsInText(`  ${token} \n`)).toEqual([
-      {
-        label: TOKEN_SHAPE_LABEL,
-        value: token,
-        start: 2,
-        end: 2 + token.length,
-        wholeMessage: true,
-      },
-    ]);
-  });
-
-  test("a normal sentence returns no matches", () => {
-    expect(
-      detectSecretsInText("can you review my pull request today?"),
-    ).toEqual([]);
-    expect(detectSecretsInText("")).toEqual([]);
-  });
-
-  test("token shape is not applied when a prefix pattern already matched", () => {
-    const key = `glpat-${filler(20)}`;
-    const results = detectSecretsInText(key);
-    expect(results).toHaveLength(1);
-    expect(results[0]!.label).toBe("GitLab Token");
-  });
-
-  test("a token-shaped value over the max length is not matched", () => {
-    // Same shape as a valid token but a tail longer than the shared max — the
-    // daemon ingress caps the whole-message heuristic here, so the client must
-    // too or a >512-char paste would warn client-side yet pass server-side.
-    const tail = filler(TOKEN_SHAPE_MAX_LENGTH + 1);
-    const token = `virlo_tkn_${tail}`;
-    expect(token.length).toBeGreaterThan(TOKEN_SHAPE_MAX_LENGTH);
-    expect(TOKEN_SHAPE.test(token)).toBe(true);
-    expect(detectSecretsInText(token)).toEqual([]);
-  });
-
-  test("a token-shaped value exactly at the max length is still matched", () => {
-    const prefix = "virlo_tkn_";
-    const token = `${prefix}${filler(TOKEN_SHAPE_MAX_LENGTH - prefix.length)}`;
-    expect(token.length).toBe(TOKEN_SHAPE_MAX_LENGTH);
-    const results = detectSecretsInText(token);
-    expect(results).toHaveLength(1);
-    expect(results[0]!.label).toBe(TOKEN_SHAPE_LABEL);
-  });
-});
-
-describe("REDACTION_PREFIX_PATTERNS — bounded whole-block private key", () => {
-  const FAKE_PEM_BODY =
-    "MIIFAKEfakefakefakefakefakefakefakefakefake\n" +
-    "FAKEfakefakefakefakefakefakefakefakefake==";
-  const FULL_PEM_BLOCK = `-----BEGIN RSA PRIVATE KEY-----\n${FAKE_PEM_BODY}\n-----END RSA PRIVATE KEY-----`;
-
-  function redactionPrivateKeyRegex(): RegExp {
-    const entry = REDACTION_PREFIX_PATTERNS.find(
-      (p) => p.label === "Private Key",
-    );
-    expect(entry).toBeDefined();
-    return new RegExp(entry!.regex.source, "g");
-  }
-
-  test("the redaction private-key entry is the bounded whole-block matcher", () => {
-    const entry = REDACTION_PREFIX_PATTERNS.find(
-      (p) => p.label === "Private Key",
-    );
-    expect(entry!.regex.source).toBe(PRIVATE_KEY_REDACTION_REGEX.source);
-  });
-
-  test("the redaction variant matches the WHOLE block, not just the header", () => {
-    const regex = redactionPrivateKeyRegex();
-    const match = regex.exec(FULL_PEM_BLOCK);
-    expect(match).not.toBeNull();
-    // The full header→body→footer span, so an in-place replace removes the
-    // key body and footer, not only the BEGIN line.
-    expect(match![0]).toBe(FULL_PEM_BLOCK);
-  });
-
-  test("an in-place replace with the redaction regex leaves no body or footer", () => {
-    const regex = redactionPrivateKeyRegex();
-    const text = `before\n${FULL_PEM_BLOCK}\nafter`;
-    const redacted = text.replace(regex, "[REDACTED]");
-    expect(redacted).toBe("before\n[REDACTED]\nafter");
-    // The base64 body and the END footer are gone.
-    expect(redacted).not.toContain("MIIFAKE");
-    expect(redacted).not.toContain("-----END");
-    expect(redacted).not.toContain("-----BEGIN");
-  });
-
-  test("a footerless key still redacts header-only (truncated-key fallback)", () => {
-    const regex = redactionPrivateKeyRegex();
-    const text = `-----BEGIN RSA PRIVATE KEY-----\n${FAKE_PEM_BODY}`;
-    const match = regex.exec(text);
-    expect(match).not.toBeNull();
-    // No END within the bound → optional footer group fails → header-only
-    // match, preserving the detection-fires guarantee.
-    expect(match![0]).toBe("-----BEGIN RSA PRIVATE KEY-----");
-  });
-
-  test("a body longer than the bound falls back to header-only, not a hang", () => {
-    const regex = redactionPrivateKeyRegex();
-    // Footer sits just past the body bound, so the whole-block branch can't
-    // reach it and the match degrades to the header (fail-open on redaction:
-    // an unbounded key is not a realistic PEM).
-    const overlongBody = "a".repeat(PEM_REDACTION_MAX_BODY_LENGTH + 100);
-    const text = `-----BEGIN RSA PRIVATE KEY-----\n${overlongBody}\n-----END RSA PRIVATE KEY-----`;
-    const match = regex.exec(text);
-    expect(match).not.toBeNull();
-    expect(match![0]).toBe("-----BEGIN RSA PRIVATE KEY-----");
-  });
-
-  test("many footerless BEGIN headers redact fast (bounded, no O(n²) hang)", () => {
-    const regex = redactionPrivateKeyRegex();
-    // A pathological paste: thousands of footerless headers, each followed by
-    // filler that an unbounded matcher would rescan hunting for a footer. The
-    // body bound caps each rescan, so the whole sweep stays linear.
-    const chunk = `-----BEGIN RSA PRIVATE KEY-----\n${filler(200)}\n`;
-    const text = chunk.repeat(5000);
-    const startedAt = Date.now();
-    const redacted = text.replace(regex, "[REDACTED]");
-    const elapsedMs = Date.now() - startedAt;
-    expect(redacted).toContain("[REDACTED]");
-    expect(redacted).not.toContain("-----BEGIN");
-    expect(elapsedMs).toBeLessThan(2000);
-  });
-
-  test("every non-private-key pattern is shared verbatim with PREFIX_PATTERNS", () => {
-    for (let i = 0; i < PREFIX_PATTERNS.length; i++) {
-      if (PREFIX_PATTERNS[i]!.label === "Private Key") {
-        continue;
-      }
-      expect(REDACTION_PREFIX_PATTERNS[i]).toBe(PREFIX_PATTERNS[i]);
-    }
-  });
-
-  test("detectSecretsInText still captures the whole block (P1 stays fixed)", () => {
-    const results = detectSecretsInText(FULL_PEM_BLOCK);
-    expect(results).toHaveLength(1);
-    expect(results[0]!.label).toBe("Private Key");
-    expect(results[0]!.value).toBe(FULL_PEM_BLOCK);
-  });
-});
-
-describe("detectSecretsInText — PEM private-key blocks", () => {
-  // Clearly fake PEM material — never a real key.
-  const FAKE_PEM_BODY =
-    "MIIFAKEfakefakefakefakefakefakefakefakefake\n" +
-    "FAKEfakefakefakefakefakefakefakefakefake==";
-  const FULL_PEM_BLOCK = `-----BEGIN RSA PRIVATE KEY-----\n${FAKE_PEM_BODY}\n-----END RSA PRIVATE KEY-----`;
-
-  test("a complete PEM block is one match spanning header through footer", () => {
-    const text = `here is my key\n${FULL_PEM_BLOCK}\nplease use it`;
-    const start = text.indexOf(FULL_PEM_BLOCK);
-    expect(detectSecretsInText(text)).toEqual([
-      {
-        label: "Private Key",
-        value: FULL_PEM_BLOCK,
-        start,
-        end: start + FULL_PEM_BLOCK.length,
-        wholeMessage: false,
-      },
-    ]);
-  });
-
-  test("a PGP private-key block with the BLOCK suffix is captured whole", () => {
-    const block = `-----BEGIN PGP PRIVATE KEY BLOCK-----\n${FAKE_PEM_BODY}\n-----END PGP PRIVATE KEY BLOCK-----`;
-    const results = detectSecretsInText(block);
-    expect(results).toHaveLength(1);
-    expect(results[0]!.value).toBe(block);
-  });
-
-  test("a header with a body but no END footer still fires — header-only span", () => {
-    // Truncated / partially pasted key: detection must not regress, the
-    // daemon ingress relies on the header alone to block.
-    const text = `-----BEGIN RSA PRIVATE KEY-----\n${FAKE_PEM_BODY}`;
-    const results = detectSecretsInText(text);
-    expect(results).toEqual([
-      {
-        label: "Private Key",
-        value: "-----BEGIN RSA PRIVATE KEY-----",
-        start: 0,
-        end: "-----BEGIN RSA PRIVATE KEY-----".length,
-        wholeMessage: false,
-      },
-    ]);
-    expect(isCompletePrivateKeyBlock(results[0]!.value)).toBe(false);
-  });
-
-  test("adjacent complete blocks match separately, not as one giant span", () => {
-    const text = `${FULL_PEM_BLOCK}\n\n${FULL_PEM_BLOCK}`;
-    const results = detectSecretsInText(text);
-    expect(results).toHaveLength(2);
-    expect(results[0]!.value).toBe(FULL_PEM_BLOCK);
-    expect(results[1]!.value).toBe(FULL_PEM_BLOCK);
-    expect(results[1]!.start).toBeGreaterThanOrEqual(results[0]!.end);
-  });
-
-  test("a footerless header never swallows a later complete block", () => {
-    // The body is tempered — it cannot cross another BEGIN header — so the
-    // truncated first key matches header-only and the second key matches
-    // as its own complete block.
-    const text = `-----BEGIN EC PRIVATE KEY-----\ntruncated\n\n${FULL_PEM_BLOCK}`;
-    const results = detectSecretsInText(text);
-    expect(results.map((r) => r.value)).toEqual([
-      "-----BEGIN EC PRIVATE KEY-----",
-      FULL_PEM_BLOCK,
-    ]);
-  });
-
-  test("a token-lookalike run inside the block body loses to the block", () => {
-    // Base64 can legally contain an AKIA + 16-uppercase run; the Private
-    // Key pattern is first in PREFIX_PATTERNS so the whole-block span wins
-    // the overlap dedupe instead of being fragmented by the AWS pattern.
-    const block = `-----BEGIN RSA PRIVATE KEY-----\nAKIAABCDEFGHIJKLMNOP\n${FAKE_PEM_BODY}\n-----END RSA PRIVATE KEY-----`;
-    const results = detectSecretsInText(block);
-    expect(results).toHaveLength(1);
-    expect(results[0]!.label).toBe("Private Key");
-    expect(results[0]!.value).toBe(block);
-  });
-});
-
-describe("isCompletePrivateKeyBlock", () => {
-  test("true for a value ending at the END footer", () => {
-    expect(
-      isCompletePrivateKeyBlock(
-        "-----BEGIN OPENSSH PRIVATE KEY-----\nMIIFAKEfake==\n-----END OPENSSH PRIVATE KEY-----",
-      ),
-    ).toBe(true);
-  });
-
-  test("false for a header-only match and for non-PEM values", () => {
-    expect(
-      isCompletePrivateKeyBlock("-----BEGIN OPENSSH PRIVATE KEY-----"),
-    ).toBe(false);
-    expect(isCompletePrivateKeyBlock(`ghp_${filler(36)}`)).toBe(false);
-  });
-});
-
-describe("detectSecretsInText — multiple and overlapping matches", () => {
-  test("multiple secrets yield sorted, non-overlapping matches", () => {
-    const aws = "AKIAABCDEFGHIJKLMNOP";
-    const github = `ghp_${filler(36)}`;
-    // GitHub appears before AWS in the text but after it in pattern order.
-    const text = `first ${github} then ${aws} done`;
-    const results = detectSecretsInText(text);
-    expect(results.map((r) => r.label)).toEqual([
-      "GitHub Token",
-      "AWS Access Key",
-    ]);
-    for (let i = 1; i < results.length; i++) {
-      expect(results[i]!.start).toBeGreaterThanOrEqual(results[i - 1]!.end);
-    }
-  });
-
-  test("overlapping spans keep the first pattern in list order", () => {
-    // The GitHub token's tail embeds an `npm_…` run; GitHub Token precedes
-    // npm Token in PREFIX_PATTERNS, so only the GitHub match survives.
-    const value = `ghp_npm_${filler(36)}`;
-    const results = detectSecretsInText(value);
-    expect(results.map((r) => r.label)).toEqual(["GitHub Token"]);
-  });
-});

package/node_modules/@vellumai/service-contracts/src/secret-detection.ts

@@ -1,468 +0,0 @@
-/**
- * Shared prefix-based secret patterns — the single source of truth.
- *
- * Ingress blocking, tool output scanning, log redaction, and client-side
- * composer detection all consume this list.  When adding a new integration,
- * add its API key pattern here.
- *
- * This module is intentionally data-only: no imports, no entropy logic,
- * no config — safe for hot-path consumers like log serializers, and
- * browser-safe so web clients can bundle it directly.
- *
- * The exported `PATTERNS`/constants are shared verbatim by the daemon and the
- * web clients, so the two sides agree on what a secret *looks like*. The web
- * composer scanner is a conservative superset pre-filter of the daemon ingress
- * check, not an identical twin: the daemon additionally applies a per-user
- * secret allowlist and config gating (`secretDetection.enabled` /
- * `blockIngress`) on top of these shared patterns, so the client may warn on a
- * few values the server would accept (e.g. an allowlisted token). Only the
- * shared patterns and length bounds in this module are guaranteed identical
- * across client and server.
- */
-
-// ---------------------------------------------------------------------------
-// Types
-// ---------------------------------------------------------------------------
-
-export interface SecretPrefixPattern {
-  /** Human-readable label shown in block notices and redaction tags. */
-  label: string;
-  /**
-   * Regex that matches the token value.  Must NOT include the `g` flag or
-   * capture groups — consumers add those as needed.
-   */
-  regex: RegExp;
-}
-
-// ---------------------------------------------------------------------------
-// Prefix patterns
-// ---------------------------------------------------------------------------
-
-/**
- * High-confidence, prefix-based secret patterns.
- *
- * Each entry matches a known API key / token format by its distinctive
- * prefix.  Patterns that require surrounding context (entropy analysis,
- * keyword proximity, URL structure) do NOT belong here — they stay in
- * `secret-scanner.ts` as scanner-only patterns.
- *
- * **When adding a new third-party integration, add its API key pattern
- * here.**  If the service uses only opaque OAuth access tokens (no fixed
- * prefix), no pattern is needed.
- */
-/** Detection label for PEM private-key matches. */
-export const PRIVATE_KEY_LABEL = "Private Key";
-
-// PEM private-key header/footer type variants, shared by the Private Key
-// pattern and the complete-block check.
-const PEM_KEY_TYPE = String.raw`(?:RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY(?:\s+BLOCK)?`;
-const PEM_BEGIN = String.raw`-----BEGIN ${PEM_KEY_TYPE}-----`;
-const PEM_END = String.raw`-----END ${PEM_KEY_TYPE}-----`;
-
-const PEM_COMPLETE_BLOCK = new RegExp(`${PEM_END}$`);
-
-/**
- * Whole-block PEM body atom: one tempered body character. `(?!-----BEGIN)`
- * keeps the body from crossing into an adjacent block, so two keys never
- * merge into one span.
- */
-const PEM_BLOCK_TAIL = String.raw`(?:(?!-----BEGIN)[\s\S])`;
-
-/**
- * Upper bound on the PEM body scan distance for the redaction matcher. An
- * RSA-8192 PEM is ~6.4 KB, so 16 KiB clears real keys with headroom while
- * capping the per-header rescan distance. The bound is what keeps the
- * redaction matcher O(n) on large serialized strings full of footerless
- * `-----BEGIN … PRIVATE KEY-----` headers: each header rescans at most this
- * far looking for a footer instead of to EOF, which is what the unbounded
- * whole-block matcher does (its O(n²) worst case).
- */
-export const PEM_REDACTION_MAX_BODY_LENGTH = 16384;
-
-/**
- * Whole-block private-key matcher for detect-AND-REDACT consumers (log
- * serializers, the tool-output scanner, staged-export rewrite).
- *
- * These consumers replace the matched span in place, so the match must cover
- * the ENTIRE key — header → body → footer — or the base64 body and `-----END-----`
- * footer survive redaction. This captures the whole block, but with a
- * length-BOUNDED body quantifier ({@link PEM_REDACTION_MAX_BODY_LENGTH}) so a
- * stream of footerless headers cannot drive the O(n²) worst case the unbounded
- * whole-block matcher incurs. The footer group is optional, so a truncated /
- * footerless key still matches header-only — preserving the detection-fires
- * guarantee ingress blocking relies on. Tempered + lazy + bounded ⇒ no
- * catastrophic backtracking.
- *
- * `detectSecretsInText` (chat) keeps the unbounded whole-block
- * {@link PREFIX_PATTERNS} entry, which the store/rewrite path relies on to
- * capture arbitrarily large keys in full.
- */
-export const PRIVATE_KEY_REDACTION_REGEX = new RegExp(
-  `${PEM_BEGIN}(?:${PEM_BLOCK_TAIL}{0,${PEM_REDACTION_MAX_BODY_LENGTH}}?${PEM_END})?`,
-);
-
-/**
- * True when a `Private Key` match is a complete PEM block — it ends at an
- * `-----END … PRIVATE KEY-----` footer (the pattern guarantees it starts at
- * the BEGIN header). A header-only match means the footer is absent from
- * the scanned text (truncated or partial paste), so the match does NOT
- * cover the key body: storing or replacing such a value would leave key
- * material behind.
- */
-export function isCompletePrivateKeyBlock(value: string): boolean {
-  return PEM_COMPLETE_BLOCK.test(value);
-}
-
-export const PREFIX_PATTERNS: SecretPrefixPattern[] = [
-  // -- Private keys --
-  // First in the list on purpose: `detectSecretsInText` resolves overlapping
-  // spans by list order, and a PEM body is base64 — it can embed runs that
-  // look like other tokens (e.g. `AKIA` + 16 chars). The whole-block match
-  // must win those overlaps or the block would be fragmented.
-  {
-    label: PRIVATE_KEY_LABEL,
-    // Matches the entire PEM block (header through footer) when the END
-    // footer is present, so consumers that store or replace the matched
-    // value handle the whole key. The block tail is optional: a header with
-    // no footer (truncated or streamed partial paste) still matches alone,
-    // which ingress blocking relies on. The body is tempered — it never
-    // crosses another BEGIN header — so adjacent blocks match separately.
-    regex: new RegExp(`${PEM_BEGIN}(?:${PEM_BLOCK_TAIL}*?${PEM_END})?`),
-  },
-
-  // -- AWS --
-  { label: "AWS Access Key", regex: /AKIA[0-9A-Z]{16}/ },
-
-  // -- GitHub --
-  { label: "GitHub Token", regex: /gh[pousr]_[A-Za-z0-9_]{36,}/ },
-  { label: "GitHub Fine-Grained PAT", regex: /github_pat_[A-Za-z0-9_]{22,}/ },
-
-  // -- GitLab --
-  { label: "GitLab Token", regex: /glpat-[A-Za-z0-9\-_]{20,}/ },
-
-  // -- Stripe --
-  { label: "Stripe Secret Key", regex: /sk_live_[A-Za-z0-9]{24,}/ },
-  { label: "Stripe Restricted Key", regex: /rk_live_[A-Za-z0-9]{24,}/ },
-
-  // -- Slack --
-  {
-    label: "Slack Bot Token",
-    regex: /xoxb-[0-9]{10,}-[0-9]{10,}-[A-Za-z0-9]{24,}/,
-  },
-  {
-    label: "Slack User Token",
-    regex: /xoxp-[0-9]{10,}-[0-9]{10,}-[0-9]{10,}-[a-f0-9]{32}/,
-  },
-  {
-    label: "Slack App Token",
-    regex: /xapp-[0-9]+-[A-Za-z0-9]+-[0-9]+-[A-Za-z0-9]+/,
-  },
-
-  // -- Telegram --
-  {
-    label: "Telegram Bot Token",
-    // Format: <bot_id>:<secret> where bot_id is 8–10 digits, secret is 35 chars
-    regex: /[0-9]{8,10}:[A-Za-z0-9_-]{35}/,
-  },
-
-  // -- Anthropic --
-  { label: "Anthropic API Key", regex: /sk-ant-[A-Za-z0-9\-_]{80,}/ },
-
-  // -- OpenAI --
-  {
-    label: "OpenAI API Key",
-    regex: /sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}/,
-  },
-  { label: "OpenAI Project Key", regex: /sk-proj-[A-Za-z0-9\-_]{40,}/ },
-
-  // -- Google --
-  { label: "Google API Key", regex: /AIza[A-Za-z0-9\-_]{35}/ },
-  {
-    label: "Google OAuth Client Secret",
-    regex: /GOCSPX-[A-Za-z0-9\-_]{28}/,
-  },
-
-  // -- Twilio --
-  { label: "Twilio API Key", regex: /SK[0-9a-f]{32}/ },
-
-  // -- SendGrid --
-  {
-    label: "SendGrid API Key",
-    regex: /SG\.[A-Za-z0-9\-_]{22}\.[A-Za-z0-9\-_]{43}/,
-  },
-
-  // -- Mailgun --
-  { label: "Mailgun API Key", regex: /key-[A-Za-z0-9]{32}/ },
-
-  // -- npm --
-  { label: "npm Token", regex: /npm_[A-Za-z0-9]{36}/ },
-
-  // -- PyPI --
-  { label: "PyPI API Token", regex: /pypi-[A-Za-z0-9\-_]{50,}/ },
-
-  // -- Linear --
-  { label: "Linear API Key", regex: /lin_api_[A-Za-z0-9]{32,}/ },
-
-  // -- Notion --
-  { label: "Notion Integration Token", regex: /ntn_[A-Za-z0-9]{40,}/ },
-
-  // -- OpenRouter --
-  { label: "OpenRouter API Key", regex: /sk-or-v1-[A-Za-z0-9\-_]{40,}/ },
-
-  // -- Vercel AI Gateway --
-  { label: "Vercel AI Gateway API Key", regex: /vck_[A-Za-z0-9\-_]{24,}/ },
-
-  // -- Fireworks --
-  { label: "Fireworks API Key", regex: /fw_[A-Za-z0-9]{32,}/ },
-
-  // -- Perplexity --
-  { label: "Perplexity API Key", regex: /pplx-[A-Za-z0-9]{40,}/ },
-
-  // -- Tavily --
-  { label: "Tavily API Key", regex: /tvly-[A-Za-z0-9]{20,}/ },
-
-  // -- Firecrawl --
-  { label: "Firecrawl API Key", regex: /fc-[A-Za-z0-9]{20,}/ },
-];
-
-/**
- * {@link PREFIX_PATTERNS} variant for detect-AND-redact consumers (log
- * serializers, the tool-output scanner, staged-export rewrite). Identical to
- * `PREFIX_PATTERNS` except the private-key entry uses the length-BOUNDED
- * whole-block matcher ({@link PRIVATE_KEY_REDACTION_REGEX}): those consumers
- * replace the matched span in place, so the match must cover the whole key
- * (header → body → footer) or the body leaks — but they route to the bounded
- * matcher to avoid the unbounded whole-block matcher's O(n²) worst case on
- * large serialized strings. `detectSecretsInText` (chat) uses `PREFIX_PATTERNS`
- * for unbounded full-block capture.
- */
-export const REDACTION_PREFIX_PATTERNS: SecretPrefixPattern[] =
-  PREFIX_PATTERNS.map((p) =>
-    p.label === PRIVATE_KEY_LABEL
-      ? { label: PRIVATE_KEY_LABEL, regex: PRIVATE_KEY_REDACTION_REGEX }
-      : p,
-  );
-
-// ---------------------------------------------------------------------------
-// Token-shape heuristic (whole-message only)
-// ---------------------------------------------------------------------------
-
-/**
- * A single token-shaped value: an alphanumeric head, a separator-delimited
- * secret keyword infix, and a >=16-char tail (e.g. `virlo_tkn_JF…`). The
- * capture group isolates the tail for placeholder checks. Applied only when
- * the entire trimmed message is one such token — the whole-message and
- * keyword-infix requirements keep false positives near zero without any
- * entropy scoring.
- */
-export const TOKEN_SHAPE =
-  /^[A-Za-z0-9][A-Za-z0-9_-]*[_-](?:tkn|token|key|secret|api|pat|sk|auth)[_-]([A-Za-z0-9_-]{16,})$/i;
-
-/**
- * Length bounds for the whole-message token-shape heuristic, shared by the
- * daemon ingress check and the web composer scanner so both accept and reject
- * the same whole-message tokens. Below the min a "token" is too short to be a
- * plausible secret; above the max it is almost certainly a paste of something
- * else (a base64 blob, a minified line) rather than a single credential.
- */
-export const TOKEN_SHAPE_MIN_LENGTH = 20;
-export const TOKEN_SHAPE_MAX_LENGTH = 512;
-
-/** Detection label for a whole-message token-shape match, shared by the daemon
- * ingress check and the web composer scanner so both report the same
- * user-facing type. */
-export const TOKEN_SHAPE_LABEL = "Token-shaped value";
-
-// ---------------------------------------------------------------------------
-// Placeholder suppression (ingress semantics: user-typed input, near-zero
-// false positives)
-// ---------------------------------------------------------------------------
-
-export const KNOWN_PLACEHOLDERS = new Set([
-  "your-api-key-here",
-  "your_api_key_here",
-  "insert-your-key-here",
-  "insert_your_key_here",
-  "replace-with-your-key",
-  "replace_with_your_key",
-  "xxx",
-  "xxxxxxxx",
-  "test",
-  "example",
-  "sample",
-  "demo",
-  "placeholder",
-  "changeme",
-  "CHANGEME",
-  "TODO",
-  "FIXME",
-  "your-token-here",
-  "your_token_here",
-  "my-api-key",
-  "my_api_key",
-]);
-
-export const PLACEHOLDER_PREFIXES = [
-  "sk-test-",
-  "sk_test_",
-  "fake_",
-  "fake-",
-  "dummy_",
-  "dummy-",
-  "test_",
-  "test-",
-  "example_",
-  "example-",
-  "sample_",
-  "sample-",
-  "mock_",
-  "mock-",
-];
-
-/**
- * Check if the text immediately before a matched value indicates a
- * placeholder context (e.g. "fake_", "test_"): true when the pre-context
- * window ends with any `PLACEHOLDER_PREFIXES` entry, case-insensitive.
- */
-export function isPlaceholderContext(preContext: string): boolean {
-  const lower = preContext.toLowerCase();
-  for (const prefix of PLACEHOLDER_PREFIXES) {
-    if (lower.endsWith(prefix)) {
-      return true;
-    }
-  }
-  return false;
-}
-
-/**
- * Check if a matched value is a placeholder/test value that should not be
- * reported: exact `KNOWN_PLACEHOLDERS` membership, a `PLACEHOLDER_PREFIXES`
- * prefix (both case-insensitive), or a variable portion that is one repeated
- * character (e.g. `AKIA` + `X` x 16).
- */
-export function isPlaceholderValue(value: string): boolean {
-  const lower = value.toLowerCase();
-  if (KNOWN_PLACEHOLDERS.has(lower)) {
-    return true;
-  }
-  for (const prefix of PLACEHOLDER_PREFIXES) {
-    if (lower.startsWith(prefix)) {
-      return true;
-    }
-  }
-
-  // Repeated characters in the variable portion (e.g. "AKIA" + "X" x 16)
-  // Strip known prefixes to isolate the variable part
-  const variablePart = value
-    .replace(
-      /^(?:AKIA|gh[pousr]_|github_pat_|glpat-|sk_live_|rk_live_|xoxb-|xoxp-|xapp-|sk-ant-|sk-proj-|sk-or-v1-|AIza|GOCSPX-|SK|SG\.|npm_|pypi-|key-|lin_api_|ntn_|fw_|pplx-|-----BEGIN [A-Z ]*PRIVATE KEY-----)/,
-      "",
-    )
-    .replace(/[^A-Za-z0-9]/g, "");
-  if (variablePart.length >= 8) {
-    const firstChar = variablePart[0];
-    if (variablePart.split("").every((c) => c === firstChar)) {
-      return true;
-    }
-  }
-
-  return false;
-}
-
-// ---------------------------------------------------------------------------
-// Draft scanner
-// ---------------------------------------------------------------------------
-
-export interface DetectedSecret {
-  /** Human-readable secret type label, e.g. "Anthropic API Key". */
-  label: string;
-  /** The matched secret text. */
-  value: string;
-  /** Start offset of the match in the scanned text (inclusive). */
-  start: number;
-  /** End offset of the match in the scanned text (exclusive). */
-  end: number;
-  /** True when the entire trimmed text is one token-shaped value. */
-  wholeMessage: boolean;
-}
-
-/**
- * Global clones of {@link PREFIX_PATTERNS}, compiled once so the draft
- * scanner never mutates the shared pattern objects' `lastIndex` and never
- * recompiles on the hot path (the composer scans on every draft change).
- */
-const GLOBAL_PREFIX_PATTERNS: SecretPrefixPattern[] = PREFIX_PATTERNS.map(
-  ({ label, regex }) => ({
-    label,
-    regex: new RegExp(
-      regex.source,
-      regex.flags.includes("g") ? regex.flags : regex.flags + "g",
-    ),
-  }),
-);
-
-/**
- * Scan a draft message for high-confidence secrets.
- *
- * Runs every `PREFIX_PATTERNS` entry over the text, suppressing placeholder
- * values and matches immediately preceded by a placeholder context (e.g.
- * `fake_` before a real-looking token) — the same suppression the daemon
- * applies at ingress, so client and server accept the same placeholders.
- * When no prefix pattern matches, the trimmed whole message is
- * tested against {@link TOKEN_SHAPE} — the same whole-message token-shape
- * heuristic the daemon blocks at ingress. Overlapping spans are deduped
- * (first pattern in list order wins); results are sorted by `start`.
- */
-export function detectSecretsInText(text: string): DetectedSecret[] {
-  const matches: DetectedSecret[] = [];
-
-  for (const { label, regex } of GLOBAL_PREFIX_PATTERNS) {
-    // Reset lastIndex — the compiled global regexes are shared across calls.
-    regex.lastIndex = 0;
-    let match: RegExpExecArray | null;
-
-    while ((match = regex.exec(text)) !== null) {
-      const value = match[0];
-
-      // Skip placeholders and test values (check both the match and
-      // a small window before it for placeholder prefixes like "fake_")
-      const contextStart = Math.max(0, match.index - 10);
-      const preContext = text.slice(contextStart, match.index);
-      if (isPlaceholderValue(value) || isPlaceholderContext(preContext)) {
-        continue;
-      }
-      const start = match.index;
-      const end = start + value.length;
-      // Overlap dedupe: the first pattern in list order wins.
-      if (matches.some((m) => start < m.end && end > m.start)) {
-        continue;
-      }
-      matches.push({ label, value, start, end, wholeMessage: false });
-    }
-  }
-
-  if (matches.length === 0) {
-    const trimmed = text.trim();
-    const shapeMatch =
-      trimmed.length >= TOKEN_SHAPE_MIN_LENGTH &&
-      trimmed.length <= TOKEN_SHAPE_MAX_LENGTH
-        ? TOKEN_SHAPE.exec(trimmed)
-        : null;
-    if (
-      shapeMatch !== null &&
-      !isPlaceholderValue(trimmed) &&
-      !isPlaceholderValue(shapeMatch[1]!)
-    ) {
-      const start = text.length - text.trimStart().length;
-      matches.push({
-        label: TOKEN_SHAPE_LABEL,
-        value: trimmed,
-        start,
-        end: start + trimmed.length,
-        wholeMessage: true,
-      });
-    }
-  }
-
-  return matches.sort((a, b) => a.start - b.start);
-}