arkaos 2.43.0 → 2.44.0

package/VERSION

@@ -1 +1 @@
-2.43.0
+2.44.0

package/core/governance/leak_scanner.py

@@ -0,0 +1,155 @@
+"""Client-name leak scanner (PR22 v2.44.0).
+
+Reads the user-local ``~/.arkaos/redaction-clients.json`` and scans
+source files / arbitrary text for word-boundary matches. Wired into
+the release preflight gate as a blocking check.
+
+Closes a real process gap: PR20 v2.42.0 shipped 9 client names in a
+production constant; the Quality Gate did not flag it; operator
+caught it manually pre-commit. Automation > checklist.
+
+Empty / missing config is a no-op by design — there are no false
+positives in CI clones that lack the operator's local list.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Iterable
+
+_DEFAULT_CONFIG_PATH = Path.home() / ".arkaos" / "redaction-clients.json"
+_MAX_FILE_BYTES = 10 * 1024 * 1024  # 10 MB per-file cap
+_SCAN_EXTENSIONS: frozenset[str] = frozenset({
+    ".py", ".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs",
+    ".json", ".yaml", ".yml", ".toml", ".md", ".sh", ".txt",
+})
+_EXCLUDE_DIRS: frozenset[str] = frozenset({
+    "node_modules", "__pycache__", ".venv", ".git", "dist", "build",
+})
+_LINE_EXCERPT_LIMIT = 200
+
+
+@dataclass(frozen=True)
+class LeakHit:
+    """One client-name occurrence in a scanned file."""
+    path: Path
+    line_number: int
+    line_excerpt: str
+    matched_token: str
+
+
+@dataclass(frozen=True)
+class ScanReport:
+    """Result of a scan."""
+    config_path: Path
+    pattern_count: int
+    files_scanned: int
+    hits: list[LeakHit]
+
+    @property
+    def clean(self) -> bool:
+        return not self.hits
+
+
+def scan_paths(
+    paths: Iterable[Path],
+    *,
+    config_path: Path | None = None,
+) -> ScanReport:
+    """Recursively scan the given paths for client-name leaks."""
+    cfg = config_path or _DEFAULT_CONFIG_PATH
+    patterns = _load_patterns(cfg)
+    if not patterns:
+        return ScanReport(config_path=cfg, pattern_count=0, files_scanned=0, hits=[])
+    regex = _build_regex(patterns)
+    hits: list[LeakHit] = []
+    files_scanned = 0
+    for path in paths:
+        for file_path in _iter_scannable_files(Path(path)):
+            files_scanned += 1
+            hits.extend(_scan_file(file_path, regex))
+    return ScanReport(
+        config_path=cfg,
+        pattern_count=len(patterns),
+        files_scanned=files_scanned,
+        hits=hits,
+    )
+
+
+def scan_text(
+    text: str,
+    *,
+    config_path: Path | None = None,
+) -> list[str]:
+    """Return the list of matched tokens (lowercased) found in *text*."""
+    cfg = config_path or _DEFAULT_CONFIG_PATH
+    patterns = _load_patterns(cfg)
+    if not patterns:
+        return []
+    regex = _build_regex(patterns)
+    return [m.group(1).lower() for m in regex.finditer(text)]
+
+
+def _load_patterns(config_path: Path) -> tuple[str, ...]:
+    try:
+        data = json.loads(config_path.read_text(encoding="utf-8"))
+        raw = data.get("clients", [])
+        return tuple(
+            str(c).strip().lower() for c in raw
+            if c and isinstance(c, str)
+        )
+    except (OSError, json.JSONDecodeError, AttributeError):
+        return ()
+
+
+def _build_regex(patterns: tuple[str, ...]) -> re.Pattern[str]:
+    escaped = [re.escape(p) for p in patterns]
+    return re.compile(
+        r"(?<![a-z0-9])(" + "|".join(escaped) + r")(?![a-z0-9])",
+        re.IGNORECASE,
+    )
+
+
+def _iter_scannable_files(root: Path):
+    if root.is_file():
+        if _is_scannable(root):
+            yield root
+        return
+    if not root.is_dir():
+        return
+    for entry in sorted(root.rglob("*")):
+        if any(part in _EXCLUDE_DIRS for part in entry.parts):
+            continue
+        if entry.is_file() and _is_scannable(entry):
+            yield entry
+
+
+def _is_scannable(path: Path) -> bool:
+    if path.suffix.lower() not in _SCAN_EXTENSIONS:
+        return False
+    try:
+        if path.stat().st_size > _MAX_FILE_BYTES:
+            return False
+    except OSError:
+        return False
+    return True
+
+
+def _scan_file(path: Path, regex: re.Pattern[str]) -> list[LeakHit]:
+    try:
+        text = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return []
+    hits: list[LeakHit] = []
+    for line_no, line in enumerate(text.splitlines(), start=1):
+        for match in regex.finditer(line):
+            hits.append(LeakHit(
+                path=path,
+                line_number=line_no,
+                line_excerpt=line[:_LINE_EXCERPT_LIMIT],
+                matched_token=match.group(1).lower(),
+            ))
+    return hits

package/core/release/preflight.py

@@ -61,10 +61,69 @@ def run_preflight(
         check_gh_auth(),
         check_git_remote(),
         check_git_clean(),
+        check_no_client_name_leaks(repo_root=root),
     ]
     return _aggregate(results)
 
 
+def check_no_client_name_leaks(
+    *, repo_root: Path | None = None,
+) -> CheckResult:
+    """Scan tracked source files for client identifiers (PR22 v2.44.0).
+
+    No-op when the operator's ~/.arkaos/redaction-clients.json is absent
+    or empty — no false positives in CI clones lacking the local config.
+    """
+    from core.governance.leak_scanner import scan_paths
+
+    root = repo_root or _DEFAULT_REPO_ROOT
+    paths = _collect_tracked_paths(root)
+    if paths is None:
+        return CheckResult(
+            name="no-client-name-leaks", passed=True,
+            reason="git ls-files unavailable — skipped",
+        )
+    report = scan_paths(paths)
+    return _format_leak_check_result(report)
+
+
+def _collect_tracked_paths(root: Path) -> list[Path] | None:
+    tracked = _run(["git", "-C", str(root), "ls-files", "--cached"])
+    if tracked is None or tracked.returncode != 0:
+        return None
+    return [root / line for line in tracked.stdout.splitlines() if line.strip()]
+
+
+def _format_leak_check_result(report) -> CheckResult:
+    if report.pattern_count == 0:
+        return CheckResult(
+            name="no-client-name-leaks", passed=True,
+            reason="no redaction config — scan skipped (no-op)",
+        )
+    if report.clean:
+        return CheckResult(
+            name="no-client-name-leaks", passed=True,
+            reason=f"{report.files_scanned} file(s) scanned, no leaks",
+        )
+    first = report.hits[0]
+    # PR22 v2.44.0 introduces this check at WARNING severity to ship the
+    # scanner without blocking on pre-existing leaks in test fixtures
+    # (test_dreaming.py and siblings) + historical CHANGELOG/ADR
+    # references. PR23 cleans those up and flips severity to "blocking".
+    return CheckResult(
+        name="no-client-name-leaks", passed=False, severity="warning",
+        reason=(
+            f"{len(report.hits)} leak(s) — first: "
+            f"{first.path.name}:{first.line_number} matched `{first.matched_token}`"
+        ),
+        remediation=(
+            "move the literal to ~/.arkaos/ or sanitize before commit; "
+            "PR22 scope intentionally warning-only — PR23 will scrub "
+            "historical leaks and flip this check to blocking"
+        ),
+    )
+
+
 def _load_repo_versions(
     root: Path,
 ) -> tuple[str | None, str | None, str | None] | None:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkaos",
-  "version": "2.43.0",
+  "version": "2.44.0",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "2.43.0"
+version = "2.44.0"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}