@wrongstack/core 0.305.1 → 0.306.2

package/dist/infrastructure/index.js

@@ -2387,45 +2387,12 @@ function isSecretField(name) {
 }
 
 // src/security/file-permissions.ts
-import { chmod } from "node:fs/promises";
-var SECRET_FILE_MODE = 384;
-async function restrictFilePermissions(filePath, opts) {
-  const label = opts?.label ?? "file-permissions";
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  if (process.platform === "win32") {
-    try {
-      const { execFile } = await import("node:child_process");
-      const { promisify } = await import("node:util");
-      const execFileAsync = promisify(execFile);
-      const user = windowsAccountName();
-      if (!user) {
-        warn(
-          `[${label}] Could not determine the current Windows user for ${filePath}; skipping icacls hardening.`
-        );
-        return;
-      }
-      await execFileAsync("icacls", [filePath, "/inheritance:r", "/grant:r", `${user}:(F)`], {
-        windowsHide: true
-      });
-    } catch {
-      warn(
-        `[${label}] Could not restrict permissions on ${filePath} \u2014 it may be readable by other users on this system.`
-      );
-    }
-  } else {
-    try {
-      await chmod(filePath, SECRET_FILE_MODE);
-    } catch {
-    }
-  }
-}
-function windowsAccountName() {
-  const username = process.env.USERNAME || process.env.USER;
-  if (!username || username.includes("\0")) return void 0;
-  const domain = process.env.USERDOMAIN;
-  if (domain && !domain.includes("\0")) return `${domain}\\${username}`;
-  return username;
-}
+import {
+  restrictDirPermissions,
+  restrictFilePermissions,
+  SECRET_DIR_MODE,
+  SECRET_FILE_MODE
+} from "@wrongstack/persistence";
 
 // src/utils/deep-merge.ts
 var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([

package/dist/observability/index.js

@@ -379,7 +379,10 @@ var SENSITIVE_FLAG_PATTERNS = [
   // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
   // The separator group is optional so the attached form (the common one) matches.
   // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
-  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+  // The value must be token-like (>= 8 chars) so ordinary combined flags such
+  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
+  // redacted, not just the first. Synced with packages/tools _redact-command.ts.
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
   // -p|-password|-a (redis auth) short flags: attached + separated + =value.
   // Same token-start anchor; over-redaction is an accepted tradeoff for a
   // redaction function (false positive = cosmetic noise; false negative = leak).
@@ -387,8 +390,9 @@ var SENSITIVE_FLAG_PATTERNS = [
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
   /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-  // when preceded by a flag name (e.g. --github-token=EyJ...).
-  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
+  // every such flag in the command line is redacted, not just the first.
+  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
 ];
 function redactCommand(cmd) {
   let result = cmd;

package/dist/plugin/index.d.ts

@@ -3,12 +3,13 @@ export { diffPluginConfig, type PluginConfigChange, type PluginConfigSource, typ
 export { KERNEL_API_VERSION, loadPlugins, type LoadPluginsOptions, type PluginHostHandle, type PluginLoadFailure, unloadPlugins, } from './loader.js';
 export type { PluginAPI } from '../types/plugin.js';
 export { buildReviewerModelPool, createAutoReviewPlugin, parseReviewSeverity, type ReviewerModelAssignment, selectRoundRobinReviewerAssignment, } from '../plugins/auto-review-plugin.js';
-export { type CascadeAgentKind, CHIMERA_REVIEW_PROMPT, createChimeraPlugin, type ChimeraCascadeNeededPayload, type ChimeraReviewCompletePayload, type ChimeraReviewNeededPayload, type ReviewContextBundle, } from '../plugins/chimera-plugin.js';
+export { type CascadeAgentKind, type CascadeEvidenceCheckResult, type CascadeEvidenceStatus, CHIMERA_REVIEW_PROMPT, createChimeraPlugin, type ChimeraCascadeNeededPayload, type ChimeraReviewCompletePayload, type ChimeraReviewNeededPayload, type ReviewContextBundle, } from '../plugins/chimera-plugin.js';
 export { createPromptsPlugin } from '../plugins/prompts-plugin.js';
 export { emitReviewIfChanged, recordCompletedReview, recordStartedReview, } from '../plugins/review-claim-registry.js';
-export { type FindingsIntegrationResult, integrateFindings, } from '../plugins/review-finding-integration.js';
+export { type FindingsIntegrationResult, classifyChimeraReviewSource, integrateFindings, } from '../plugins/review-finding-integration.js';
 export { type ParsedReviewReport, parseChimeraReviewReport, } from '../plugins/review-finding-parser.js';
-export { persistReviewReport, type ReportIntegrationResult, } from '../plugins/review-report-integration.js';
+export { verifyFindingsAgainstDisk, type VerifyFindingsOptions, } from '../plugins/review-finding-verification.js';
+export { persistReviewReport, type ReportIntegrationResult, updateReviewReportEvidence, } from '../plugins/review-report-integration.js';
 export { maybeCompactReviewStores, type ReviewStoreMaintenanceResult, } from '../plugins/review-store-maintenance.js';
 export { createSkillsPlugin } from '../plugins/skills-plugin.js';
 export { createSyncPlugin } from '../plugins/sync-plugin.js';