@wenathlan/devthink 2.0.14 → 2.0.19

package/hardening.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardening.d.ts","sourceRoot":"","sources":["../hardening.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9E,mTAAmT;AACnT,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,CAyBA;AAED,wUAAwU;AACxU,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACjH,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,CAsBA;AAED,mOAAmO;AACnO,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ,CAOA;AAED,6RAA6R;AAC7R,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IACnG,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,MAAM,EAAE,MAAM,CAAC;CAChB,CAgBA;AAED,0NAA0N;AAC1N,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IACtE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAcA;AAED,qMAAqM;AACrM,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAkB7F;AAED,mSAAmS;AACnS,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAmB1D;AAED,oSAAoS;AACpS,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAexG"}

package/hardening.js

@@ -0,0 +1,188 @@
+/*! devthink 2.0.19 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+
+// security.ts
+var maskmarker = "[redacted]";
+function fieldshapekind(name) {
+  const lowered = name.toLowerCase();
+  if (lowered.includes("password") || lowered.includes("passwd") || lowered.includes("pwd") || lowered.includes("passphrase"))
+    return "password";
+  if (lowered.includes("token") || lowered.includes("apikey") || lowered.includes("api_key") || lowered.includes("auth") || lowered.includes("bearer"))
+    return "token";
+  if (lowered.includes("card") || lowered.includes("cvc") || lowered.includes("cvv") || lowered.includes("expiry") || lowered.includes("pan"))
+    return "card";
+  if (lowered.includes("secret")) return "secret";
+  return void 0;
+}
+function maskingfield(name, shapes) {
+  if (fieldshapekind(name) !== void 0) return true;
+  const lowered = name.toLowerCase();
+  return shapes.some((shape) => shape !== "" && lowered.includes(shape));
+}
+function maskvalue(value) {
+  return value === "" ? "" : maskmarker;
+}
+function maskfield(input) {
+  return maskingfield(input.name, input.shapes) ? maskvalue(input.value) : input.value;
+}
+function maskrecord(record, shapes) {
+  const masked = {};
+  for (const [key, value] of Object.entries(record)) {
+    if (typeof value === "string") {
+      const sibling = record.name;
+      masked[key] = key === "value" && typeof sibling === "string" ? maskfield({ name: sibling, value, shapes }) : maskfield({ name: key, value, shapes });
+    } else if (Array.isArray(value))
+      masked[key] = value.map(
+        (item) => Boolean(item) && typeof item === "object" && !Array.isArray(item) ? maskrecord(item, shapes) : item
+      );
+    else if (Boolean(value) && typeof value === "object")
+      masked[key] = maskrecord(value, shapes);
+    else masked[key] = value;
+  }
+  return masked;
+}
+function maskexport(record, shapes) {
+  return maskrecord(record, shapes);
+}
+
+// hardening.ts
+function masklogtext(input) {
+  const maskedkeys = [];
+  let text = input.text;
+  const patterns = [
+    [/(\w+)\s*:\s*"((?:[^"\\]|\\.)*)"/g, (match) => `${match[1]}: "${maskvalue(match[2] ?? "")}"`],
+    [/(\w+)\s*=\s*([^\s&;]+)/g, (match) => `${match[1]}=${maskvalue(match[2] ?? "")}`],
+    [/(\w+)\s*:\s*([^\s,;]+)/g, (match) => `${match[1]}: ${maskvalue(match[2] ?? "")}`]
+  ];
+  for (const [pattern, rewrite] of patterns) {
+    text = text.replace(pattern, (full, key, ...rest) => {
+      if (!maskingfield(String(key), input.shapes)) return full;
+      maskedkeys.push(String(key));
+      return rewrite([full, String(key), String(rest[0] ?? "")]);
+    });
+  }
+  const unique = [...new Set(maskedkeys)];
+  return {
+    text,
+    maskedkeys: unique,
+    reason: unique.length === 0 ? "The log text carries no secret shaped key value pair; the masking pass changed nothing." : `The masking pass covered the log field${unique.length === 1 ? "" : "s"} ${unique.join(", ")} the text carried since the audit; the typed values answer the redaction marker.`
+  };
+}
+function localscangate(input) {
+  const signatures = input.hook?.localsignatures ?? [];
+  if (signatures.length === 0)
+    return {
+      verdict: "pending",
+      reason: "The scanning hook carries no local signature list; the verdict stays with the configured scanner endpoint and the file holds."
+    };
+  if (input.digest === void 0 || input.digest.trim() === "")
+    return {
+      verdict: "pending",
+      reason: `The local signature check of ${input.hook?.scanner ?? "the scanning hook"} needs the file digest; a digest nobody computed flags nothing.`
+    };
+  if (signatures.includes(input.digest))
+    return {
+      verdict: "flagged",
+      reason: `The local signature list of ${input.hook?.scanner} matched the file digest; the quarantine deletes the file and no remote endpoint ever fires.`
+    };
+  return {
+    verdict: "pending",
+    reason: `The local signature list of ${input.hook?.scanner} matched no signature; the verdict falls back to the configured scanner endpoint and the file holds.`
+  };
+}
+function hatchbannerof(input) {
+  return {
+    title: `Escape hatch: ${input.halted} in flight call${input.halted === 1 ? "" : "s"} halted`,
+    explanation: `The escape hatch key stopped every native call in one press at ${new Date(input.at).toISOString()}; the transport detached until you reattach and the halt stays recorded in the audit trail.`,
+    halted: input.halted,
+    at: input.at
+  };
+}
+function newdomainpausecard(input) {
+  if (input.knownorigins.includes(input.origin))
+    return {
+      pause: false,
+      card: { title: "", explanation: "", origin: input.origin },
+      reason: `The domain ${input.origin} sits inside the recorded origins; the review mode runs the ${input.kind} step without the new domain pause.`
+    };
+  return {
+    pause: true,
+    card: {
+      title: `New domain: ${input.origin}`,
+      explanation: `The ${input.kind} step targets a domain the profile workspace never recorded. The run pauses here so you can review the new trust boundary: the safedefaults profile applied reads only, every sensitive class stays denied, and the next explicit grant opens the domain the same way the first one did.`,
+      origin: input.origin
+    },
+    reason: `The review mode paused the ${input.kind} step on the new domain ${input.origin} with the explanatory card; the run resumes after the domain review.`
+  };
+}
+function runtracekeys(input) {
+  if (input.runid.trim() === "")
+    throw new Error("The run trace purge names its run; a nameless run trace purges nothing.");
+  const runid = input.runid.trim();
+  const keys = input.keys.filter((key) => key === runid || key.endsWith(runid));
+  const kept = input.keys.filter((key) => !keys.includes(key));
+  return {
+    keys,
+    kept,
+    reason: keys.length === 0 ? `No stored key carries the trace of the run ${runid}; the run trace purge deletes nothing.` : `The run trace purge deletes ${keys.length} stored key${keys.length === 1 ? "" : "s"} carrying the trace of the run ${runid} \u2014 ${keys.join(", ")} \u2014 while ${kept.length} key${kept.length === 1 ? "" : "s"} of other runs survive.`
+  };
+}
+function syncrotationgate(input) {
+  if ((input.current ?? "").trim() === "" || (input.next ?? "").trim() === "")
+    return {
+      allowed: false,
+      reason: "The key rotation names both the current passphrase and the next one; a rotation without either passphrase never rekeys because no key ever defaults in code."
+    };
+  if (input.current === input.next)
+    return {
+      allowed: false,
+      reason: "The key rotation needs a next passphrase that differs from the current one; rotating onto the same key rekeys nothing."
+    };
+  return {
+    allowed: true,
+    reason: "The key rotation entry point opens with both passphrases present; the derived key rekeys the sync payloads while the passphrases never persist."
+  };
+}
+function stdioclientsignaturegate(input) {
+  if (input.signature === void 0 || input.platformverifier === void 0)
+    return {
+      verified: false,
+      allowed: true,
+      reason: "The platform carries no signature verifier the bridge can call; the local stdio bridge stays unverified while the record marks it."
+    };
+  if (!input.platformverifier(input.host, input.signature))
+    return {
+      verified: false,
+      allowed: false,
+      reason: `The client signature of the ${input.host} bridge failed the platform verification; the local stdio bridge refuses the client and no frame relays.`
+    };
+  return {
+    verified: true,
+    allowed: true,
+    reason: `The platform verifier confirmed the client signature of the ${input.host} bridge; the local stdio bridge relays its frames under the verified client.`
+  };
+}
+function transparencyexportmask(input) {
+  const payload = maskexport(input.report, input.shapes);
+  const maskedfields = Object.keys(input.report).filter((key) => maskingfield(key, input.shapes));
+  if (input.regions.length > 0 && Array.isArray(payload.captures))
+    payload.captures = payload.captures.map(
+      (entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry) ? { ...entry, redacted: true, redactedregions: input.regions.length } : entry
+    );
+  return {
+    payload,
+    maskedfields,
+    redactedregions: input.regions.length,
+    reason: `The transparency export left with the masking pass over ${maskedfields.length} shaped field${maskedfields.length === 1 ? "" : "s"} and ${input.regions.length} redact region${input.regions.length === 1 ? "" : "s"} covering its capture derived entries; the raw values stay behind the redaction marker.`
+  };
+}
+export {
+  hatchbannerof,
+  localscangate,
+  masklogtext,
+  newdomainpausecard,
+  runtracekeys,
+  stdioclientsignaturegate,
+  syncrotationgate,
+  transparencyexportmask
+};
+//# sourceMappingURL=hardening.js.map

package/headless.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless.d.ts","sourceRoot":"","sources":["../headless.ts"],"names":[],"mappings":"AACA,sUAAsU;AACtU,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAM3C,OAAO,KAAK,EACV,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,YAAY,EAEZ,YAAY,EACZ,QAAQ,EACT,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,OAAO,EAAY,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,4TAA4T;AAC5T,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,GAAG,sBAAsB,CAsExG;AAED,yNAAyN;AACzN,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,QAAQ,EAAE,YAAY,GAAG,SAAS,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,sBAAsB,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,YAAY,CAWf;AAED;;;;GAIG;AAEH,4JAA4J;AAC5J,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,eAAe,CAiBlB;AAED,gNAAgN;AAChN,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAe1F;AAED,yGAAyG;AACzG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAE9E;AAED,6LAA6L;AAC7L,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAC7G,UAAU,EAAE,YAAY,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;CACrB,CAUA;AAED,4KAA4K;AAC5K,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAE5G;AAED,mMAAmM;AACnM,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAExE;AAED,uLAAuL;AACvL,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,aAAa,CAEpE;AAED,wJAAwJ;AACxJ,wBAAgB,YAAY,CAC1B,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,GACf;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAA;CAAE,CAqB3G;AAED,iMAAiM;AACjM,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;CAAE,GAAG;IAC3G,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAMA;AAED,+IAA+I;AAC/I,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;CACpB,CAQA;AAED,8JAA8J;AAC9J,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG;IAC1E,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IACjC,MAAM,IAAI,aAAa,EAAE,CAAC;CAC3B,CAWA;AAED,8IAA8I;AAC9I,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,OAAO,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAGnG;AAED,mYAAmY;AACnY,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;IAC7D,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;CACb,GAAG;IACF,MAAM,IAAI,gBAAgB,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAAC;IAC9D,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C,CA2DA"}