@xortex/xcode 3.0.0

package/services/teamMemorySync/secretScanner.ts

@@ -0,0 +1,324 @@
+/**
+ * Client-side secret scanner for team memory (PSR M22174).
+ *
+ * Scans content for credentials before upload so secrets never leave the
+ * user's machine. Uses a curated subset of high-confidence rules from
+ * gitleaks (https://github.com/gitleaks/gitleaks, MIT license) — only
+ * rules with distinctive prefixes that have near-zero false-positive
+ * rates are included. Generic keyword-context rules are omitted.
+ *
+ * Rule IDs and regexes sourced directly from the public gitleaks config:
+ * https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml
+ *
+ * JS regex notes:
+ *   - gitleaks uses Go regex; inline (?i) and mode groups (?-i:...) are
+ *     not portable to JS. Affected rules are rewritten with explicit
+ *     character classes ([a-zA-Z0-9] instead of (?i)[a-z0-9]).
+ *   - Trailing boundary alternations like (?:[\x60'"\s;]|\\[nr]|$) from
+ *     Go regex are kept (JS $ matches end-of-string in default mode).
+ */
+
+import { capitalize } from '../../utils/stringUtils.js'
+
+type SecretRule = {
+  /** Gitleaks rule ID (kebab-case), used in labels and analytics */
+  id: string
+  /** Regex source, lazily compiled on first scan */
+  source: string
+  /** Optional JS regex flags (most rules are case-sensitive by default) */
+  flags?: string
+}
+
+export type SecretMatch = {
+  /** Gitleaks rule ID that matched (e.g., "github-pat", "aws-access-token") */
+  ruleId: string
+  /** Human-readable label derived from the rule ID */
+  label: string
+}
+
+// ─── Curated rules ──────────────────────────────────────────────
+// High-confidence patterns from gitleaks with distinctive prefixes.
+// Ordered roughly by likelihood of appearing in dev-team content.
+
+// Anthropic API key prefix, assembled at runtime so the literal byte
+// sequence isn't present in the external bundle (excluded-strings check).
+// join() is not constant-folded by the minifier.
+const ANT_KEY_PFX = ['sk', 'ant', 'api'].join('-')
+
+const SECRET_RULES: SecretRule[] = [
+  // — Cloud providers —
+  {
+    id: 'aws-access-token',
+    source: '\\b((?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16})\\b',
+  },
+  {
+    id: 'gcp-api-key',
+    source: '\\b(AIza[\\w-]{35})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'azure-ad-client-secret',
+    source:
+      '(?:^|[\\\\\'"\\x60\\s>=:(,)])([a-zA-Z0-9_~.]{3}\\dQ~[a-zA-Z0-9_~.-]{31,34})(?:$|[\\\\\'"\\x60\\s<),])',
+  },
+  {
+    id: 'digitalocean-pat',
+    source: '\\b(dop_v1_[a-f0-9]{64})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'digitalocean-access-token',
+    source: '\\b(doo_v1_[a-f0-9]{64})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+
+  // — AI APIs —
+  {
+    id: 'anthropic-api-key',
+    source: `\\b(${ANT_KEY_PFX}03-[a-zA-Z0-9_\\-]{93}AA)(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+  },
+  {
+    id: 'anthropic-admin-api-key',
+    source:
+      '\\b(sk-ant-admin01-[a-zA-Z0-9_\\-]{93}AA)(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'openai-api-key',
+    source:
+      '\\b(sk-(?:proj|svcacct|admin)-(?:[A-Za-z0-9_-]{74}|[A-Za-z0-9_-]{58})T3BlbkFJ(?:[A-Za-z0-9_-]{74}|[A-Za-z0-9_-]{58})\\b|sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'huggingface-access-token',
+    // gitleaks: hf_(?i:[a-z]{34}) → JS: hf_[a-zA-Z]{34}
+    source: '\\b(hf_[a-zA-Z]{34})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+
+  // — Version control —
+  {
+    id: 'github-pat',
+    source: 'ghp_[0-9a-zA-Z]{36}',
+  },
+  {
+    id: 'github-fine-grained-pat',
+    source: 'github_pat_\\w{82}',
+  },
+  {
+    id: 'github-app-token',
+    source: '(?:ghu|ghs)_[0-9a-zA-Z]{36}',
+  },
+  {
+    id: 'github-oauth',
+    source: 'gho_[0-9a-zA-Z]{36}',
+  },
+  {
+    id: 'github-refresh-token',
+    source: 'ghr_[0-9a-zA-Z]{36}',
+  },
+  {
+    id: 'gitlab-pat',
+    source: 'glpat-[\\w-]{20}',
+  },
+  {
+    id: 'gitlab-deploy-token',
+    source: 'gldt-[0-9a-zA-Z_\\-]{20}',
+  },
+
+  // — Communication —
+  {
+    id: 'slack-bot-token',
+    source: 'xoxb-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*',
+  },
+  {
+    id: 'slack-user-token',
+    source: 'xox[pe](?:-[0-9]{10,13}){3}-[a-zA-Z0-9-]{28,34}',
+  },
+  {
+    id: 'slack-app-token',
+    source: 'xapp-\\d-[A-Z0-9]+-\\d+-[a-z0-9]+',
+    flags: 'i',
+  },
+  {
+    id: 'twilio-api-key',
+    source: 'SK[0-9a-fA-F]{32}',
+  },
+  {
+    id: 'sendgrid-api-token',
+    // gitleaks: SG\.(?i)[a-z0-9=_\-\.]{66} → JS: case-insensitive via flag
+    source: '\\b(SG\\.[a-zA-Z0-9=_\\-.]{66})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+
+  // — Dev tooling —
+  {
+    id: 'npm-access-token',
+    source: '\\b(npm_[a-zA-Z0-9]{36})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'pypi-upload-token',
+    source: 'pypi-AgEIcHlwaS5vcmc[\\w-]{50,1000}',
+  },
+  {
+    id: 'databricks-api-token',
+    source: '\\b(dapi[a-f0-9]{32}(?:-\\d)?)(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'hashicorp-tf-api-token',
+    // gitleaks: (?i)[a-z0-9]{14}\.(?-i:atlasv1)\.[a-z0-9\-_=]{60,70}
+    // → JS: case-insensitive hex+alnum prefix, literal "atlasv1", case-insensitive suffix
+    source: '[a-zA-Z0-9]{14}\\.atlasv1\\.[a-zA-Z0-9\\-_=]{60,70}',
+  },
+  {
+    id: 'pulumi-api-token',
+    source: '\\b(pul-[a-f0-9]{40})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'postman-api-token',
+    // gitleaks: PMAK-(?i)[a-f0-9]{24}\-[a-f0-9]{34} → JS: use [a-fA-F0-9]
+    source:
+      '\\b(PMAK-[a-fA-F0-9]{24}-[a-fA-F0-9]{34})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+
+  // — Observability —
+  {
+    id: 'grafana-api-key',
+    source:
+      '\\b(eyJrIjoi[A-Za-z0-9+/]{70,400}={0,3})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'grafana-cloud-api-token',
+    source: '\\b(glc_[A-Za-z0-9+/]{32,400}={0,3})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'grafana-service-account-token',
+    source:
+      '\\b(glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'sentry-user-token',
+    source: '\\b(sntryu_[a-f0-9]{64})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'sentry-org-token',
+    source:
+      '\\bsntrys_eyJpYXQiO[a-zA-Z0-9+/]{10,200}(?:LCJyZWdpb25fdXJs|InJlZ2lvbl91cmwi|cmVnaW9uX3VybCI6)[a-zA-Z0-9+/]{10,200}={0,2}_[a-zA-Z0-9+/]{43}',
+  },
+
+  // — Payment / commerce —
+  {
+    id: 'stripe-access-token',
+    source:
+      '\\b((?:sk|rk)_(?:test|live|prod)_[a-zA-Z0-9]{10,99})(?:[\\x60\'"\\s;]|\\\\[nr]|$)',
+  },
+  {
+    id: 'shopify-access-token',
+    source: 'shpat_[a-fA-F0-9]{32}',
+  },
+  {
+    id: 'shopify-shared-secret',
+    source: 'shpss_[a-fA-F0-9]{32}',
+  },
+
+  // — Crypto —
+  {
+    id: 'private-key',
+    source:
+      '-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----[\\s\\S-]{64,}?-----END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----',
+    flags: 'i',
+  },
+]
+
+// Lazily compiled pattern cache — compile once on first scan.
+let compiledRules: Array<{ id: string; re: RegExp }> | null = null
+
+function getCompiledRules(): Array<{ id: string; re: RegExp }> {
+  if (compiledRules === null) {
+    compiledRules = SECRET_RULES.map(r => ({
+      id: r.id,
+      re: new RegExp(r.source, r.flags),
+    }))
+  }
+  return compiledRules
+}
+
+/**
+ * Convert a gitleaks rule ID (kebab-case) to a human-readable label.
+ * e.g., "github-pat" → "GitHub PAT", "aws-access-token" → "AWS Access Token"
+ */
+function ruleIdToLabel(ruleId: string): string {
+  // Words where the canonical capitalization differs from title case
+  const specialCase: Record<string, string> = {
+    aws: 'AWS',
+    gcp: 'GCP',
+    api: 'API',
+    pat: 'PAT',
+    ad: 'AD',
+    tf: 'TF',
+    oauth: 'OAuth',
+    npm: 'NPM',
+    pypi: 'PyPI',
+    jwt: 'JWT',
+    github: 'GitHub',
+    gitlab: 'GitLab',
+    openai: 'OpenAI',
+    digitalocean: 'DigitalOcean',
+    huggingface: 'HuggingFace',
+    hashicorp: 'HashiCorp',
+    sendgrid: 'SendGrid',
+  }
+  return ruleId
+    .split('-')
+    .map(part => specialCase[part] ?? capitalize(part))
+    .join(' ')
+}
+
+/**
+ * Scan a string for potential secrets.
+ *
+ * Returns one match per rule that fired (deduplicated by rule ID). The
+ * actual matched text is intentionally NOT returned — we never log or
+ * display secret values.
+ */
+export function scanForSecrets(content: string): SecretMatch[] {
+  const matches: SecretMatch[] = []
+  const seen = new Set<string>()
+
+  for (const rule of getCompiledRules()) {
+    if (seen.has(rule.id)) {
+      continue
+    }
+    if (rule.re.test(content)) {
+      seen.add(rule.id)
+      matches.push({
+        ruleId: rule.id,
+        label: ruleIdToLabel(rule.id),
+      })
+    }
+  }
+
+  return matches
+}
+
+/**
+ * Get a human-readable label for a gitleaks rule ID.
+ * Falls back to kebab-to-Title conversion for unknown IDs.
+ */
+export function getSecretLabel(ruleId: string): string {
+  return ruleIdToLabel(ruleId)
+}
+
+/**
+ * Redact any matched secrets in-place with [REDACTED].
+ * Unlike scanForSecrets, this returns the content with spans replaced
+ * so the surrounding text can still be written to disk safely.
+ */
+let redactRules: RegExp[] | null = null
+
+export function redactSecrets(content: string): string {
+  redactRules ??= SECRET_RULES.map(
+    r => new RegExp(r.source, (r.flags ?? '').replace('g', '') + 'g'),
+  )
+  for (const re of redactRules) {
+    // Replace only the captured group, not the full match — patterns include
+    // boundary chars (space, quote, ;) outside the group that must survive.
+    content = content.replace(re, (match, g1) =>
+      typeof g1 === 'string' ? match.replace(g1, '[REDACTED]') : '[REDACTED]',
+    )
+  }
+  return content
+}

package/services/teamMemorySync/teamMemSecretGuard.ts

@@ -0,0 +1,44 @@
+import { feature } from 'bun:bundle'
+
+/**
+ * Check if a file write/edit to a team memory path contains secrets.
+ * Returns an error message if secrets are detected, or null if safe.
+ *
+ * This is called from FileWriteTool and FileEditTool validateInput to
+ * prevent the model from writing secrets into team memory files, which
+ * would be synced to all repository collaborators.
+ *
+ * Callers can import and call this unconditionally — the internal
+ * feature('TEAMMEM') guard keeps it inert when the build flag is off.
+ * secretScanner assembles sensitive prefixes at runtime (ANT_KEY_PFX).
+ */
+export function checkTeamMemSecrets(
+  filePath: string,
+  content: string,
+): string | null {
+  if (feature('TEAMMEM')) {
+    /* eslint-disable @typescript-eslint/no-require-imports */
+    const { isTeamMemPath } =
+      require('../../memdir/teamMemPaths.js') as typeof import('../../memdir/teamMemPaths.js')
+    const { scanForSecrets } =
+      require('./secretScanner.js') as typeof import('./secretScanner.js')
+    /* eslint-enable @typescript-eslint/no-require-imports */
+
+    if (!isTeamMemPath(filePath)) {
+      return null
+    }
+
+    const matches = scanForSecrets(content)
+    if (matches.length === 0) {
+      return null
+    }
+
+    const labels = matches.map(m => m.label).join(', ')
+    return (
+      `Content contains potential secrets (${labels}) and cannot be written to team memory. ` +
+      'Team memory is shared with all repository collaborators. ' +
+      'Remove the sensitive content and try again.'
+    )
+  }
+  return null
+}

package/services/teamMemorySync/types.ts

@@ -0,0 +1,156 @@
+/**
+ * Team Memory Sync Types
+ *
+ * Zod schemas and types for the repo-scoped team memory sync API.
+ * Based on the backend API contract from anthropic/anthropic#250711.
+ */
+
+import { z } from 'zod/v4'
+import { lazySchema } from '../../utils/lazySchema.js'
+
+/**
+ * Content portion of team memory data - flat key-value storage.
+ * Keys are file paths relative to the team memory directory (e.g. "MEMORY.md", "patterns.md").
+ * Values are UTF-8 string content (typically Markdown).
+ */
+export const TeamMemoryContentSchema = lazySchema(() =>
+  z.object({
+    entries: z.record(z.string(), z.string()),
+    // Per-key SHA-256 of entry content (`sha256:<hex>`). Added in
+    // anthropic/anthropic#283027. Optional for forward-compat with older
+    // server deployments; empty map when entries is empty.
+    entryChecksums: z.record(z.string(), z.string()).optional(),
+  }),
+)
+
+/**
+ * Full response from GET /api/claude_code/team_memory
+ */
+export const TeamMemoryDataSchema = lazySchema(() =>
+  z.object({
+    organizationId: z.string(),
+    repo: z.string(),
+    version: z.number(),
+    lastModified: z.string(), // ISO 8601 timestamp
+    checksum: z.string(), // SHA256 with 'sha256:' prefix
+    content: TeamMemoryContentSchema(),
+  }),
+)
+
+/**
+ * Structured 413 error body from the server (anthropic/anthropic#293258).
+ * The server's RequestTooLargeException serializes error_code and the
+ * extra_details dict flattened into error.details. We only model the
+ * too-many-entries case; entry-too-large is handled via MAX_FILE_SIZE_BYTES
+ * pre-check on the client side and would need a separate schema.
+ */
+export const TeamMemoryTooManyEntriesSchema = lazySchema(() =>
+  z.object({
+    error: z.object({
+      details: z.object({
+        error_code: z.literal('team_memory_too_many_entries'),
+        max_entries: z.number().int().positive(),
+        received_entries: z.number().int().positive(),
+      }),
+    }),
+  }),
+)
+
+export type TeamMemoryData = z.infer<ReturnType<typeof TeamMemoryDataSchema>>
+
+/**
+ * A file skipped during push because it contains a detected secret.
+ * The path is relative to the team memory directory. Only the matched
+ * gitleaks rule ID is recorded — never the secret value itself.
+ */
+export type SkippedSecretFile = {
+  path: string
+  /** Gitleaks rule ID (e.g., "github-pat", "aws-access-token") */
+  ruleId: string
+  /** Human-readable label derived from rule ID */
+  label: string
+}
+
+/**
+ * Result from fetching team memory
+ */
+export type TeamMemorySyncFetchResult = {
+  success: boolean
+  data?: TeamMemoryData
+  isEmpty?: boolean // true if 404 (no data exists)
+  notModified?: boolean // true if 304 (ETag matched, no changes)
+  checksum?: string // ETag from response header
+  error?: string
+  skipRetry?: boolean
+  errorType?: 'auth' | 'timeout' | 'network' | 'parse' | 'unknown'
+  httpStatus?: number
+}
+
+/**
+ * Lightweight metadata-only probe result (GET ?view=hashes).
+ * Contains per-key checksums without entry bodies. Used to refresh
+ * serverChecksums cheaply during 412 conflict resolution.
+ */
+export type TeamMemoryHashesResult = {
+  success: boolean
+  version?: number
+  checksum?: string
+  entryChecksums?: Record<string, string>
+  error?: string
+  errorType?: 'auth' | 'timeout' | 'network' | 'parse' | 'unknown'
+  httpStatus?: number
+}
+
+/**
+ * Result from uploading team memory with conflict info
+ */
+export type TeamMemorySyncPushResult = {
+  success: boolean
+  filesUploaded: number
+  checksum?: string
+  conflict?: boolean // true if 412 Precondition Failed
+  error?: string
+  /** Files skipped because they contain detected secrets (PSR M22174). */
+  skippedSecrets?: SkippedSecretFile[]
+  errorType?:
+    | 'auth'
+    | 'timeout'
+    | 'network'
+    | 'conflict'
+    | 'unknown'
+    | 'no_oauth'
+    | 'no_repo'
+  httpStatus?: number
+}
+
+/**
+ * Result from uploading team memory
+ */
+export type TeamMemorySyncUploadResult = {
+  success: boolean
+  checksum?: string
+  lastModified?: string
+  conflict?: boolean // true if 412 Precondition Failed
+  error?: string
+  errorType?: 'auth' | 'timeout' | 'network' | 'unknown'
+  httpStatus?: number
+  /**
+   * Structured error_code from a parsed 413 body (anthropic/anthropic#293258).
+   * Currently only 'team_memory_too_many_entries' is modelled; if the server
+   * adds more (entry_too_large, total_bytes_exceeded) they'd extend this
+   * union.  Passed straight through to the tengu_team_mem_sync_push event
+   * as a Datadog-filterable facet.
+   */
+  serverErrorCode?: 'team_memory_too_many_entries'
+  /**
+   * Server-enforced max_entries, populated when serverErrorCode is
+   * team_memory_too_many_entries. Lets the caller cache the effective
+   * (possibly per-org) limit for subsequent pushes.
+   */
+  serverMaxEntries?: number
+  /**
+   * How many entries the rejected push would have produced after merge.
+   * Populated alongside serverMaxEntries.
+   */
+  serverReceivedEntries?: number
+}