@vibe-commit/capture 0.8.0 → 0.9.0

package/dist/redact.d.ts

@@ -64,6 +64,14 @@ import type { RedactionProfile } from "./agents/types.js";
  * verdict inherits down the subtree* — and each agent supplies which keys play
  * which part. A second agent is a second row in the table below, not a branch.
  */
+/** `values`: every content string withheld. `strict`: the same, and a record holding a data-shaped KEY (a skill name, a path) is withheld as a whole line (C26's form). */
+export type AlwaysWithheld = "values" | "strict";
+export type AggregateVerdict = {
+    readonly kind: "withhold";
+} | {
+    readonly kind: "keepKeys";
+    readonly paths: ReadonlySet<string>;
+};
 export interface RedactionRules {
     /** Keys whose STRING value is a filesystem path. The SELECTOR, never redacted. */
     readonly pathKeys: ReadonlySet<string>;
@@ -79,6 +87,33 @@ export interface RedactionRules {
     readonly nestedJsonKeys: ReadonlySet<string>;
     /** Keys holding `[{ lines: [...] }]` hunk arrays whose lines are content. */
     readonly patchKeys: ReadonlySet<string>;
+    /**
+     * C37: extra path and content keys that apply ONLY inside a record's `attachment` subtree. An attachment names its file as `path` or
+     * `filename` (not `filePath`) and carries it as `content`, `rawContent` or `snippet`: `nested_memory {path, content: {path, content,
+     * rawContent}}`, `edited_text_file {filename, snippet}`, `instructions {files: [{path, content}]}`. `path` cannot be a path key
+     * everywhere (a tool input's `path` names a SEARCH root, not the subject of its siblings), so the scope is the subtree.
+     */
+    readonly attachment?: {
+        readonly pathKeys: ReadonlySet<string>;
+        readonly contentKeys: ReadonlySet<string>;
+    };
+    /**
+     * C39 (iv): a record this dialect's own schema says is a SUMMARY OF THE WHOLE CONVERSATION (Claude's `isCompactSummary` user record: a
+     * model-written digest of everything before it, file text included). Its content is withheld in EVERY copy, single-repo copies and the
+     * golden's shape included, with the same length-preserving marks as an isolated record. Decided by the record, never by a path.
+     */
+    readonly alwaysWithheld?: (record: Record<string, unknown>) => AlwaysWithheld | null;
+    /**
+     * C27 (R17 for records with no folder of their own): what a MULTI-REPOSITORY copy of a session does with a record whose origin cannot be
+     * told from the record. `null`: kept as written (the path rule still applies). `withhold`: every content string is withheld, as in an isolated
+     * record. `keepKeys`: strings under the listed key paths stay, every other string is withheld (a KEEP type is bound to its measured keys).
+     */
+    readonly aggregate?: (record: Record<string, unknown>) => AggregateVerdict | null;
+    /**
+     * C40 (2): keys whose WHOLE subtree is instruction text this dialect injects (Codex's `developer_instructions`, `base_instructions`):
+     * every string under such a key is withheld wherever the key appears, in every copy, whatever path sits beside it.
+     */
+    readonly withheldKeys?: (key: string) => boolean;
 }
 /**
  * The rules a profile LABEL names.
@@ -136,6 +171,44 @@ export interface RedactionCounts {
 export interface RedactedLine extends RedactionCounts {
     readonly line: string;
 }
+/**
+ * ⛔ **THE TWO ADDITIONS ANY-FOLDER CAPTURE MAKES TO THIS CHOKEPOINT** (R6 · R17). Both are decided by the CALLER, which knows
+ * the target; this module only applies them, length-preservingly, with the same markers as every other redaction.
+ *
+ *  - `hole` (R6, a FOLDER target's EXCLUSION ROOTS): a path inside `projectRoots` is still OUT OF TREE when `hole` says so. A
+ *    folder like `~/Documents/VibeCommit` contains repos; the folder stream keeps what is inside the folder and outside every git
+ *    work tree, and withholds anything inside a nested work tree (a backstop for a repo the evidence missed). "Inside A but not
+ *    inside B" is not expressible as a root set, which is why this is a predicate.
+ *  - `foreignRecord` (R17, RECORD ISOLATION): a record whose `cwd` resolves inside a work tree OTHER than the target's is a
+ *    command, its output, or prose from another repo's session. Every content-bearing string in it is withheld; the structural
+ *    keys (`STRUCTURAL_KEYS`) stay, so the stream still parses and a turn is still a turn. Records run from the launch folder
+ *    are untouched: that residual (prompts and prose from the parent folder) is stated in the README and the claims register.
+ */
+export interface RedactionScope {
+    readonly hole?: (candidate: string) => boolean;
+    readonly foreignRecord?: (record: Record<string, unknown>) => boolean;
+    /**
+     * C48 (11), Codex: the FILES a record's call names (an `apply_patch`'s headers in any form, `view_image`'s path; the same for the call's output), and for a
+     * call itself the places only its input is judged by. Each is judged like a Claude path: a file outside this copy's roots, or inside a hole, withholds the
+     * whole record (length-preserving), in every copy.
+     */
+    readonly namedFiles?: (record: Record<string, unknown>) => readonly string[];
+    /**
+     * C27: this copy belongs to a session that named a work tree other than the target's (or whose status is unknown, which counts the same).
+     * Records the dialect cannot attribute (`RedactionRules.aggregate`) are withheld from it.
+     */
+    readonly multi?: boolean;
+    /**
+     * C40 (1): the open-calls checkpoint of THIS stream, read at the record `at` was last given. `paths`: the call named these files (judged per copy
+     * with the copy's roots and holes); `none`: the call named no file (a stated residual: its result is kept); `unknown`: the call is not known
+     * (an overflow, a position the checkpoint no longer covers): its result is withheld, failing closed.
+     */
+    readonly calls?: (id: string) => readonly string[] | "none" | "unknown";
+    /** Called by `redactSpan` with the absolute offset of each segment it is about to redact, so `calls` can judge by position. */
+    readonly at?: (absoluteOffset: number) => void;
+    /** C42: told each parsed record of a span before it is judged (past the scan cursor, the hook learns calls and a second work tree from it). */
+    readonly observe?: (record: Record<string, unknown>) => void;
+}
 /**
  * Redact one NDJSON line. **Pure, total, and length-preserving.**
  *
@@ -144,7 +217,7 @@ export interface RedactedLine extends RedactionCounts {
  * (DESIGN.md §13.7), and a redactor that dropped a line it could not parse would
  * be silent data loss on a path where D56 §D8 makes loss permanent.
  */
-export declare function redactLine(line: string, projectRoots: readonly string[], rules: RedactionRules, resolver?: Containment): RedactedLine;
+export declare function redactLine(line: string, projectRoots: readonly string[], rules: RedactionRules, resolver?: Containment, scope?: RedactionScope): RedactedLine;
 /**
  * Redact every complete line in a raw transcript span.
  *
@@ -154,7 +227,9 @@ export declare function redactLine(line: string, projectRoots: readonly string[]
  * which is what keeps a span that bisects a multi-byte character from changing
  * length when it is re-encoded.
  */
-export declare function redactSpan(span: Buffer, projectRoots: readonly string[], rules: RedactionRules): {
+export declare function redactSpan(span: Buffer, projectRoots: readonly string[], rules: RedactionRules, scope?: RedactionScope, 
+/** The absolute offset of `span[0]` in its file (`scope.at` is told each segment's). */
+spanStart?: number): {
     bytes: Buffer;
 } & RedactionCounts;
 /**