@wrongstack/core 0.9.7 → 0.9.19

package/dist/storage/index.js

@@ -170,9 +170,11 @@ function isEmptyMessage(msg) {
 var DefaultSessionStore = class {
   dir;
   events;
+  secretScrubber;
   constructor(opts) {
     this.dir = opts.dir;
     this.events = opts.events;
+    this.secretScrubber = opts.secretScrubber;
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
@@ -197,7 +199,11 @@ var DefaultSessionStore = class {
       );
     }
     try {
-      return new FileSessionWriter(id, handle, startedAt, meta, this.events, { dir: shardDir, filePath: file });
+      return new FileSessionWriter(id, handle, startedAt, meta, this.events, {
+        dir: shardDir,
+        filePath: file,
+        secretScrubber: this.secretScrubber
+      });
     } catch (err) {
       await handle.close().catch(() => {
       });
@@ -227,7 +233,7 @@ var DefaultSessionStore = class {
           provider: data.metadata.provider
         },
         this.events,
-        { resumed: true, dir: this.dir, filePath: file }
+        { resumed: true, dir: this.dir, filePath: file, secretScrubber: this.secretScrubber }
       );
       return { writer, data };
     } catch (err) {
@@ -433,6 +439,7 @@ var FileSessionWriter = class {
     this.resumed = opts.resumed ?? false;
     this.manifestFile = opts.dir ? path7.join(opts.dir, `${id}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
+    this.secretScrubber = opts.secretScrubber;
     this.summary = {
       id,
       title: "(empty session)",
@@ -461,6 +468,29 @@ var FileSessionWriter = class {
   resumed;
   appendFailCount = 0;
   lastAppendWarnAt = 0;
+  secretScrubber;
+  /**
+   * Scrub secrets out of conversation-turn events before they are observed
+   * for the summary, written to the JSONL log, or surfaced on resume. Only
+   * `user_input` / `llm_response` carry free-form user/model text; other event
+   * types either have no secret-bearing content or are already scrubbed
+   * upstream (tool results). Returns the event unchanged when no scrubber is
+   * configured.
+   */
+  scrubEvent(event) {
+    const s = this.secretScrubber;
+    if (!s) return event;
+    if (event.type === "user_input") {
+      return {
+        ...event,
+        content: typeof event.content === "string" ? s.scrub(event.content) : s.scrubObject(event.content)
+      };
+    }
+    if (event.type === "llm_response") {
+      return { ...event, content: s.scrubObject(event.content) };
+    }
+    return event;
+  }
   promptIndex = 0;
   pendingFileSnapshots = [];
   /** Tracks open tool_use IDs during the current run to serialize on close for resume. */
@@ -493,9 +523,10 @@ var FileSessionWriter = class {
       this.initDone = true;
       await this.writeSessionStartLazy();
     }
-    this.observeForSummary(event);
+    const scrubbed = this.scrubEvent(event);
+    this.observeForSummary(scrubbed);
     try {
-      await this.handle.appendFile(`${JSON.stringify(event)}
+      await this.handle.appendFile(`${JSON.stringify(scrubbed)}
 `, "utf8");
     } catch (err) {
       this.appendFailCount++;
@@ -1349,6 +1380,40 @@ var DefaultConfigLoader = class {
     }
     return Object.freeze(cfg);
   }
+  /**
+   * Persist a sync config to ~/.wrongstack/sync.json, with the token encrypted
+   * by the vault (if provided). The file is isolated from the main config
+   * hierarchy to prevent accidental commits.
+   */
+  async persistSyncConfig(cfg) {
+    let toWrite = { ...cfg };
+    if (this.vault && toWrite.githubToken && !toWrite.githubToken.startsWith("enc:")) {
+      toWrite = { ...toWrite, githubToken: this.vault.encrypt(toWrite.githubToken) };
+    }
+    await atomicWrite(this.paths.syncConfig, JSON.stringify(toWrite, null, 2), { mode: 384 });
+  }
+  /**
+   * Read ~/.wrongstack/sync.json (encrypted GitHub token storage) and decrypt
+   * the token if a vault is available. Returns null if the file doesn't exist.
+   * This is separate from main config loading because sync.json is intentionally
+   * isolated — it should never be part of project-local or env-driven config.
+   */
+  async loadSyncConfig() {
+    try {
+      const raw = await fsp.readFile(this.paths.syncConfig, "utf8");
+      const parsed = safeParse(raw);
+      if (!parsed.ok || !parsed.value) return null;
+      if (this.vault) {
+        const decrypted = decryptConfigSecrets({ sync: parsed.value }, this.vault);
+        return decrypted.sync ?? null;
+      }
+      return parsed.value;
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      console.warn("[config] Failed to load sync config:", err);
+      return null;
+    }
+  }
   async readJson(file) {
     let raw;
     try {
@@ -2904,7 +2969,25 @@ var CloudSync = class {
       baseTreeSha,
       `Sync ${cfg.categories.join(", ")} \u2014 ${(/* @__PURE__ */ new Date()).toISOString()}`
     );
-    await this.updateRef(token, owner, repoName, branch, commitSha);
+    try {
+      await this.updateRef(token, owner, repoName, branch, commitSha);
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("422")) {
+        const remote = await this.getRef(token, owner, repoName, branch);
+        const currentSha = remote.object.sha;
+        const rebasedCommitSha = await this.createCommit(
+          token,
+          owner,
+          repoName,
+          newTreeSha,
+          currentSha,
+          `Sync ${cfg.categories.join(", ")} \u2014 ${(/* @__PURE__ */ new Date()).toISOString()}`
+        );
+        await this.updateRef(token, owner, repoName, branch, rebasedCommitSha);
+      } else {
+        throw err;
+      }
+    }
     const syncState = {
       version: 1,
       sha: commitSha,