codiedev 0.10.0-beta.11 → 0.10.0-beta.13

package/dist/localScrubReport.js

@@ -0,0 +1,249 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keysIn = keysIn;
+exports.mergeKeys = mergeKeys;
+exports.describeText = describeText;
+exports.sessionKeyOf = sessionKeyOf;
+exports.redactExcluded = redactExcluded;
+exports.machineId = machineId;
+exports.buildReport = buildReport;
+exports.sendReport = sendReport;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const rules_1 = require("./scrub/rules");
+const captureExclusions_1 = require("./captureExclusions");
+const MAX_KEYS_PER_SESSION = 20;
+const TITLE_LEN = 80;
+function keysIn(text) {
+    const { redactions } = (0, rules_1.scrubSecrets)(text);
+    if (redactions.length === 0)
+        return [];
+    const hints = new Map();
+    for (const r of redactions) {
+        const [f] = (0, rules_1.secretFindings)(text, [r]);
+        if (!f)
+            continue;
+        const k = `${f.rule}\u0000${f.hint}`;
+        const hit = hints.get(k) ?? { rule: f.rule, hint: f.hint, count: 0 };
+        hit.count += 1;
+        hints.set(k, hit);
+    }
+    return [...hints.values()].slice(0, MAX_KEYS_PER_SESSION);
+}
+function mergeKeys(a, b) {
+    const out = new Map(a.map((k) => [`${k.rule}\u0000${k.hint}`, { ...k }]));
+    for (const k of b) {
+        const id = `${k.rule}\u0000${k.hint}`;
+        const cur = out.get(id);
+        if (cur)
+            cur.count += k.count;
+        else
+            out.set(id, { ...k });
+    }
+    return [...out.values()].slice(0, MAX_KEYS_PER_SESSION);
+}
+function tidy(s) {
+    const t = s.replace(/\s+/g, " ").trim();
+    if (!t)
+        return undefined;
+    return t.length > TITLE_LEN ? `${t.slice(0, TITLE_LEN - 1)}…` : t;
+}
+const NOT_A_PROMPT = /^(?:<|# AGENTS\.md|Caveat:|\[Request interrupted)/;
+function textOf(content) {
+    if (typeof content === "string")
+        return content;
+    if (Array.isArray(content)) {
+        for (const part of content) {
+            const p = part;
+            if (p && typeof p.text === "string" && (p.type === undefined || /text/.test(String(p.type))))
+                return p.text;
+        }
+    }
+    return undefined;
+}
+function firstPrompt(obj) {
+    const msg = obj.message;
+    const payload = obj.payload;
+    const data = obj.data;
+    const candidates = [];
+    if (msg?.role === "user")
+        candidates.push(msg.content);
+    if (obj.role === "user")
+        candidates.push(obj.message?.content ?? obj.content);
+    if (payload?.type === "message" && payload.role === "user")
+        candidates.push(payload.content);
+    if (obj.type === "user.message")
+        candidates.push(data?.content);
+    for (const c of candidates) {
+        const t = textOf(c);
+        if (t && !NOT_A_PROMPT.test(t.trimStart()))
+            return t;
+    }
+    return undefined;
+}
+function describeText(kind, cleaned) {
+    let title;
+    let named;
+    let cwd;
+    if (kind === "yaml") {
+        for (const line of cleaned.split(/\r?\n/)) {
+            const m = line.match(/^(summary|name|cwd):\s*(.*)$/);
+            if (!m)
+                continue;
+            const v = m[2].trim().replace(/^(["'])(.*)\1$/, "$2");
+            if (m[1] === "cwd")
+                cwd ??= v;
+            else
+                named ??= v;
+        }
+        return { title: named ? tidy(named) : undefined, cwd };
+    }
+    const docs = [];
+    if (kind === "jsonl") {
+        const lines = cleaned.split("\n");
+        for (let i = 0; i < lines.length && i < 2000; i++) {
+            if (!lines[i].trim())
+                continue;
+            try {
+                docs.push(JSON.parse(lines[i]));
+            }
+            catch { }
+        }
+    }
+    else if (kind === "json") {
+        try {
+            const d = JSON.parse(cleaned);
+            if (Array.isArray(d))
+                docs.push(...d);
+            else
+                docs.push(d);
+        }
+        catch { }
+    }
+    for (const d of docs) {
+        const o = d;
+        if (!o || typeof o !== "object")
+            continue;
+        if (!named && o.type === "summary" && typeof o.summary === "string")
+            named = o.summary;
+        if (!named && typeof o.thread_name === "string")
+            named = o.thread_name;
+        if (!cwd) {
+            const c = o.cwd ?? o.payload?.cwd;
+            if (typeof c === "string")
+                cwd = c;
+        }
+        if (!title) {
+            const info = o.info;
+            const t = info?.role === "user" ? textOf(o.parts) : firstPrompt(o);
+            if (t)
+                title = t;
+        }
+    }
+    return { title: tidy(named ?? title ?? ""), cwd };
+}
+function sessionKeyOf(harness, file) {
+    const base = path.basename(file);
+    if (base === "history.jsonl")
+        return "history";
+    if (harness === "copilot")
+        return path.basename(path.dirname(file));
+    const uuid = base.match(/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i);
+    if (uuid)
+        return uuid[1];
+    return base.replace(/\.(jsonl|json|ya?ml|txt)$/, "");
+}
+function redactExcluded(s, ignored) {
+    if (!ignored?.length)
+        return s;
+    if (s.cwd && !(0, captureExclusions_1.isCaptureIgnored)(s.cwd, ignored))
+        return s;
+    const { title: _t, cwd: _c, ...rest } = s;
+    return rest;
+}
+function machineId(dir) {
+    const file = path.join(dir, "machine-id");
+    try {
+        const id = fs.readFileSync(file, "utf8").trim();
+        if (/^[0-9a-f-]{36}$/.test(id))
+            return id;
+    }
+    catch { }
+    const id = crypto.randomUUID();
+    try {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        fs.writeFileSync(file, id, { mode: 0o600 });
+    }
+    catch { }
+    return id;
+}
+const MAX_SESSIONS = 200;
+function buildReport(input) {
+    const s = input.summary;
+    return {
+        machine: { id: input.machineId, name: os.hostname().slice(0, 80) },
+        at: input.at,
+        complete: input.complete,
+        scanned: s.scanned,
+        cleaned: s.cleaned,
+        redactions: s.redactions,
+        errors: s.errors,
+        skippedRecent: s.skippedRecent,
+        skippedLarge: s.skippedLarge,
+        byHarness: Object.entries(s.byHarness).map(([harness, t]) => ({ harness, files: t.files, redactions: t.redactions })),
+        leftInCursor: s.leftInCursor,
+        sessions: input.sessions
+            .slice(0, MAX_SESSIONS)
+            .map((d) => redactExcluded(d, input.ignoredPaths))
+            .map(({ cwd: _cwd, ...rest }) => rest),
+    };
+}
+async function sendReport(backendUrl, token, payload, cliVersion, fetchImpl = fetch) {
+    try {
+        const res = await fetchImpl(`${backendUrl}/api/cli/localScrub`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}`, "X-Codiedev-Cli-Version": cliVersion },
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(15_000),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/scrub/rules.js

@@ -0,0 +1,389 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scrubSecrets = scrubSecrets;
+exports.secretFindings = secretFindings;
+exports.possibleSecrets = possibleSecrets;
+exports.redactPossible = redactPossible;
+const SECRET_REF_KEY = /_(?:NAME|ID|ARN|FILE|PATH|URL|URI|HOST|REGION|BUCKET|PREFIX|ENABLED|TYPE|VERSION|COUNT)$/i;
+function looksSecret(v) {
+    if (v.includes("<") || v.includes(">"))
+        return false;
+    if (/^(your[-_]|changeme|change-me|placeholder|example|none|null|undefined|redacted|true|false)/i.test(v))
+        return false;
+    if (/[${}]/.test(v) || v.includes("$("))
+        return false;
+    if (/[()[\]{};,]/.test(v))
+        return false;
+    if (/:\/\//.test(v) || /^https?:/i.test(v))
+        return false;
+    if (/^[~./]|^[A-Za-z]:\\/.test(v))
+        return false;
+    if (/\.(pem|key|json|crt|cer|txt|log|env|conf|config|ya?ml|pub|p12|pfx|sh|js|ts|py)$/i.test(v))
+        return false;
+    if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)+$/.test(v))
+        return false;
+    if (/^[A-Za-z-]+$/.test(v))
+        return false;
+    if (/^[0-9a-f]{16,}$/i.test(v))
+        return true;
+    if (v.length >= 12 && /[0-9]/.test(v) && /[A-Za-z]/.test(v))
+        return true;
+    if (v.length >= 20 && /[+/=]/.test(v))
+        return true;
+    return false;
+}
+const PLACEHOLDER = /x{6,}|\.\.\.|your|example|placeholder|changeme|redacted|dummy|fake|<|\$\{|\*{4,}/i;
+const notPlaceholder = (v) => !PLACEHOLDER.test(v);
+const URL_PASSWORD_PLACEHOLDER = /^(?:pass(?:word)?|secret|pwd|test|admin|root|guest)$/i;
+const RULES = [
+    {
+        name: "pem-private-key",
+        re: /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g,
+    },
+    {
+        name: "jwt",
+        re: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+    },
+    { name: "openai-key", re: /\bsk-proj-[A-Za-z0-9_-]{20,}/g },
+    { name: "openai-key", re: /\bsk-[A-Za-z0-9]{20,}\b/g },
+    { name: "stripe-key", re: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g },
+    { name: "github-token", re: /\bgh[posru]_[A-Za-z0-9]{36,}/g },
+    { name: "github-token", re: /\bgithub_pat_[A-Za-z0-9_]{40,}/g },
+    { name: "aws-access-key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    { name: "google-api-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { name: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
+    { name: "gitlab-token", re: /\bgl(?:pat|dt|rt|ptt|cbt|oas|soat|ffct|imt)-[A-Za-z0-9_-]{20,}/g, validate: notPlaceholder },
+    { name: "anthropic-key", re: /\bsk-ant-(?:api|admin)\d{2}-[A-Za-z0-9_-]{40,}/g, validate: notPlaceholder },
+    { name: "convex-deploy-key", re: /\b(?:prod|dev|preview):[a-z0-9-]+\|[A-Za-z0-9+/=]{40,}/g, validate: notPlaceholder },
+    { name: "linear-key", re: /\blin_(?:api|oauth)_[A-Za-z0-9]{30,}/g, validate: notPlaceholder },
+    { name: "codiedev-key", re: /\bcdv(?:m|ci|i|d|x|h|r|a|s)?_[A-Za-z0-9]{32,}\b/g, validate: notPlaceholder },
+    { name: "codiedev-key", re: /\bcdv_(?:at|rt|dc)_[A-Za-z0-9_-]{40,}/g, validate: notPlaceholder },
+    { name: "fireworks-key", re: /\bfw_[A-Za-z0-9]{20,}/g, validate: notPlaceholder },
+    { name: "slack-webhook", re: /hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{20,}/g, validate: notPlaceholder },
+    { name: "npm-token", re: /\bnpm_[A-Za-z0-9]{36}\b/g, validate: notPlaceholder },
+    { name: "sendgrid-key", re: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, validate: notPlaceholder },
+    { name: "twilio-key", re: /\bSK[0-9a-f]{32}\b/g, validate: notPlaceholder },
+    { name: "azure-storage-key", re: /AccountKey=([A-Za-z0-9+/=]{40,})/g, group: 1, validate: notPlaceholder },
+    { name: "azure-sas", re: /[?&]sig=([A-Za-z0-9%+/=]{30,})/g, group: 1, validate: notPlaceholder },
+    {
+        name: "url-password",
+        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|mssql|sqlserver|amqps?|https?):\/\/[^:\s/"'@\\]+:([^@\s"'/\\]{6,})@[A-Za-z0-9.-]+/g,
+        group: 1,
+        validate: (v) => notPlaceholder(v) && !URL_PASSWORD_PLACEHOLDER.test(v),
+    },
+    { name: "bearer-token", re: /\bBearer\s+([A-Za-z0-9._-]{20,})/g, group: 1 },
+    {
+        name: "secret-assignment",
+        re: /\b([A-Za-z0-9_-]*?(?:SECRET[_-]?KEY|PRIVATE[_-]?KEY|CLIENT[_-]?SECRET|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|REFRESH[_-]?TOKEN|API[_-]?KEY|PASSWORD|PASSWD|SECRET|TOKEN))\\?['"]?\s*[:=]\s*(?:\\?['"])?([^\s'"\\]{8,})(?:\\?['"])?/gi,
+        group: 2,
+        validate: (v, m) => !SECRET_REF_KEY.test(m[1]) &&
+            !/public/i.test(m[1]) &&
+            !/(?:page|continuation)[_-]?token$/i.test(m[1]) &&
+            m.input[m.index - 1] !== ":" &&
+            looksSecret(v),
+    },
+];
+function scrubSecrets(input) {
+    if (!input)
+        return { text: input, redactions: [] };
+    const candidates = [];
+    for (const rule of RULES) {
+        rule.re.lastIndex = 0;
+        let m;
+        while ((m = rule.re.exec(input)) !== null) {
+            let start = m.index;
+            let end = m.index + m[0].length;
+            if (rule.group !== undefined) {
+                const gv = m[rule.group];
+                if (gv === undefined || gv === "")
+                    continue;
+                if (rule.validate && !rule.validate(gv, m))
+                    continue;
+                const rel = m[0].lastIndexOf(gv);
+                if (rel >= 0) {
+                    start = m.index + rel;
+                    end = start + gv.length;
+                }
+            }
+            else if (rule.validate && !rule.validate(m[0], m)) {
+                if (m[0].length === 0)
+                    rule.re.lastIndex++;
+                continue;
+            }
+            if (end > start)
+                candidates.push({ rule: rule.name, start, end });
+            if (m[0].length === 0)
+                rule.re.lastIndex++;
+        }
+    }
+    if (candidates.length === 0)
+        return { text: input, redactions: [] };
+    candidates.sort((a, b) => a.start - b.start || b.end - a.end);
+    const chosen = [];
+    let cursor = -1;
+    for (const c of candidates) {
+        if (c.start >= cursor) {
+            chosen.push(c);
+            cursor = c.end;
+        }
+    }
+    const parts = [];
+    let last = 0;
+    for (const c of chosen) {
+        parts.push(input.slice(last, c.start), `[REDACTED:${c.rule}]`);
+        last = c.end;
+    }
+    parts.push(input.slice(last));
+    return { text: parts.join(""), redactions: chosen };
+}
+const TOOL_CALL_TYPE = /^(?:tool_use|function_call|custom_tool_call|tool_call|toolCall|tool_request|tool\.execution_start|server_tool_use|mcp_tool_use)$/;
+const TOOL_OUTPUT_TYPE = /^(?:tool_result|function_call_output|custom_tool_call_output|tool_output|toolResult|tool\.execution_complete|mcp_tool_result)$/;
+const SHELL_TOOL = /bash|shell|exec|terminal|run_command|run_terminal/i;
+const GIT_COMMIT = /\bgit\s+(?:[^\n]*\s)?(?:commit|push)\b/;
+function locate(input, r, cache) {
+    const lineStart = input.lastIndexOf("\n", r.start - 1) + 1;
+    let parsed = cache.get(lineStart);
+    if (parsed === undefined) {
+        const lineEnd = input.indexOf("\n", r.end);
+        try {
+            parsed = JSON.parse(input.slice(lineStart, lineEnd === -1 ? input.length : lineEnd));
+        }
+        catch {
+            parsed = null;
+        }
+        cache.set(lineStart, parsed);
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return { where: "unknown" };
+    const runs = input.slice(r.start, r.end).match(/[A-Za-z0-9]{8,}/g);
+    const needle = runs ? runs.reduce((a, b) => (b.length > a.length ? b : a)) : null;
+    if (!needle)
+        return { where: "unknown" };
+    let path = null;
+    const walk = (node, trail) => {
+        if (path)
+            return;
+        if (typeof node === "string") {
+            if (node.includes(needle))
+                path = trail;
+            return;
+        }
+        if (!node || typeof node !== "object")
+            return;
+        if (Array.isArray(node)) {
+            node.forEach((c) => walk(c, [...trail, { node: c }]));
+            return;
+        }
+        for (const [k, c] of Object.entries(node))
+            walk(c, [...trail, { node: c, key: k }]);
+    };
+    walk(parsed, [{ node: parsed }]);
+    if (!path)
+        return { where: "unknown" };
+    const frames = path;
+    for (let i = frames.length - 1; i >= 0; i--) {
+        const n = frames[i].node;
+        if (!n || typeof n !== "object" || Array.isArray(n))
+            continue;
+        const type = typeof n.type === "string" ? n.type : "";
+        const tool = typeof n.name === "string" ? n.name : typeof n.toolName === "string" ? n.toolName : undefined;
+        if (TOOL_CALL_TYPE.test(type)) {
+            const args = JSON.stringify(n.input ?? n.arguments ?? n.args ?? "");
+            if (tool && SHELL_TOOL.test(tool) && GIT_COMMIT.test(args))
+                return { where: "commit", tool };
+            return tool ? { where: "tool_call", tool } : { where: "tool_call" };
+        }
+        if (TOOL_OUTPUT_TYPE.test(type))
+            return tool ? { where: "tool_output", tool } : { where: "tool_output" };
+        if (n.role === "user" || (type === "user" && i === 0))
+            return { where: "prompt" };
+        if (n.role === "assistant" || (type === "assistant" && i === 0))
+            return { where: "assistant" };
+    }
+    return { where: "unknown" };
+}
+const MAX_LOCATIONS = 8;
+function secretFindings(input, redactions) {
+    const seen = new Map();
+    const cache = new Map();
+    for (const r of redactions) {
+        let value = input.slice(r.start, r.end);
+        if (r.rule === "pem-private-key")
+            value = value.split("-----END")[0];
+        const hint = value.replace(/[^A-Za-z0-9]/g, "").slice(-4);
+        if (!hint)
+            continue;
+        const key = `${r.rule}\u0000${hint}`;
+        const finding = seen.get(key) ?? { rule: r.rule, hint, locations: [] };
+        seen.set(key, finding);
+        const loc = locate(input, r, cache);
+        if (finding.locations.length < MAX_LOCATIONS && !finding.locations.some((l) => l.where === loc.where && l.tool === loc.tool)) {
+            finding.locations.push(loc);
+        }
+    }
+    return [...seen.values()];
+}
+const KEYISH_ASSIGNMENT = /\b([A-Za-z][A-Za-z0-9_-]*?(?:KEY|CREDENTIALS?|CREDS?|AUTH|SIGNATURE|SIGNING[_-]?KEY|SALT|DSN|PASS|PWD|PASSPHRASE|CONN(?:ECTION)?[_-]?STRING|COOKIE))\\?['"]?\s*[:=]\s*(?:\\?['"])?([A-Za-z0-9+/=_.-]{20,200})(?:\\?['"])?/gi;
+const NOT_SECRET_NAME = /(?:cache|idempoten|partition|sort|primary|foreign|composite|unique|hash|etag|checksum|digest|storage|object|row|item|react|list|map|lookup|index|public|publishable|pub|page|continuation|cursor|nonce|trace|span|request|correlation|commit|sha|fingerprint|kid|key[_-]?id|keyof|monkey|turkey|hotkey|shortcut)/i;
+const PREFIXED_TOKEN = /\b((?!pk_)[a-z][a-z0-9]{1,9}_(?:live|prod|secret|sk|key|token|api)_)([A-Za-z0-9]{24,})\b/g;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function shannon(v) {
+    const counts = new Map();
+    for (const c of v)
+        counts.set(c, (counts.get(c) ?? 0) + 1);
+    let h = 0;
+    for (const n of counts.values()) {
+        const p = n / v.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+function randomLooking(v) {
+    if (v.length < 20 || UUID.test(v))
+        return false;
+    if (/^\d+$/.test(v) || /^[A-Za-z]+$/.test(v))
+        return false;
+    if (/[._-]{2}|^[._-]|[._-]$/.test(v))
+        return false;
+    if (/\.[a-z]{2,4}$/i.test(v) || /^[a-z]+(?:[._-][a-z]+)+$/i.test(v))
+        return false;
+    if (PLACEHOLDER.test(v))
+        return false;
+    if (v.includes("/") && v.includes("-"))
+        return false;
+    if (/^[a-z0-9]+(?:[_-][a-z0-9]+){2,}$/.test(v))
+        return false;
+    if (!/[0-9]/.test(v) || !/[A-Za-z]/.test(v))
+        return false;
+    return shannon(v) >= 3.5;
+}
+function shapeOf(v) {
+    if (/^[0-9a-f]+$/i.test(v))
+        return "hex";
+    if (/[+/=]/.test(v))
+        return "base64";
+    return "alnum";
+}
+const LONG_RUN = /[A-Za-z0-9+/=_-]{16,}/g;
+const maskRuns = (s) => s.replace(LONG_RUN, (r) => (/[0-9]/.test(r) && /[A-Za-z]/.test(r) ? "••••" : r));
+function containingText(text, start, end, cache) {
+    const lineStart = text.lastIndexOf("\n", start - 1) + 1;
+    const lineEndRaw = text.indexOf("\n", end);
+    const raw = text.slice(lineStart, lineEndRaw === -1 ? text.length : lineEndRaw);
+    let parsed = cache.get(lineStart);
+    if (parsed === undefined) {
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            parsed = null;
+        }
+        cache.set(lineStart, parsed);
+    }
+    const value = text.slice(start, end);
+    let hit = null;
+    const walk = (node) => {
+        if (hit !== null)
+            return;
+        if (typeof node === "string") {
+            if (!node.includes(value))
+                return;
+            if (/^[[{]/.test(node.trim())) {
+                try {
+                    walk(JSON.parse(node));
+                }
+                catch { }
+            }
+            if (hit === null)
+                hit = node;
+            return;
+        }
+        if (node && typeof node === "object")
+            for (const c of Object.values(node))
+                walk(c);
+    };
+    if (parsed !== null)
+        walk(parsed);
+    return hit ?? raw;
+}
+function snippetAround(text, start, end, hint, cache) {
+    const value = text.slice(start, end);
+    const host = containingText(text, start, end, cache);
+    const at = host.indexOf(value);
+    const from = Math.max(0, at - 40);
+    const to = Math.min(host.length, at + value.length + 40);
+    const before = maskRuns(host.slice(from, at));
+    const after = maskRuns(host.slice(at + value.length, to));
+    return `${from > 0 ? "…" : ""}${before}••••${hint}${after}${to < host.length ? "…" : ""}`.replace(/\s+/g, " ").trim();
+}
+const MAX_POSSIBLE = 20;
+function possibleSecrets(text, limit = MAX_POSSIBLE) {
+    if (!text)
+        return [];
+    const found = new Map();
+    const cache = new Map();
+    const add = (label, prefix, value, start) => {
+        const end = start + value.length;
+        const hint = value.replace(/[^A-Za-z0-9]/g, "").slice(-4);
+        const key = `${label.toLowerCase()}\u0000${hint}\u0000${value.length}`;
+        let item = found.get(key);
+        if (!item) {
+            if (found.size >= limit)
+                return;
+            item = { label, prefix, hint, length: value.length, shape: shapeOf(value), snippet: snippetAround(text, start, end, hint, cache), locations: [], spans: [] };
+            found.set(key, item);
+        }
+        item.spans.push({ start, end });
+        const loc = locate(text, { rule: "possible", start, end }, cache);
+        if (item.locations.length < MAX_LOCATIONS && !item.locations.some((l) => l.where === loc.where && l.tool === loc.tool))
+            item.locations.push(loc);
+    };
+    KEYISH_ASSIGNMENT.lastIndex = 0;
+    let m;
+    while ((m = KEYISH_ASSIGNMENT.exec(text)) !== null) {
+        const [whole, rawName, value] = m;
+        const name = text[m.index - 1] === "\\" ? rawName.replace(/^(?:u00[0-9a-fA-F]{2}|[ntr](?=[A-Z]))/, "") : rawName;
+        const before = text.slice(Math.max(0, m.index - 7), m.index);
+        if (/sig(?:nature)?$/i.test(name) && /(?:[?&]|\\u0026|\\u003f)$/i.test(before + rawName.slice(0, rawName.length - name.length)))
+            continue;
+        if (NOT_SECRET_NAME.test(name) || SECRET_REF_KEY.test(name))
+            continue;
+        if (text[m.index - 1] === ":" || text[m.index - 1] === ".")
+            continue;
+        if (!randomLooking(value))
+            continue;
+        add(name, undefined, value, m.index + whole.lastIndexOf(value));
+    }
+    PREFIXED_TOKEN.lastIndex = 0;
+    while ((m = PREFIXED_TOKEN.exec(text)) !== null) {
+        const [whole, prefix, body] = m;
+        if (!randomLooking(body))
+            continue;
+        const start = m.index;
+        const named = [...found.values()].find((f) => f.spans.some((sp) => sp.start < start + whole.length && start < sp.end));
+        if (named) {
+            named.prefix ??= prefix;
+            continue;
+        }
+        add(prefix.replace(/_$/, ""), prefix, whole, start);
+    }
+    return [...found.values()];
+}
+function redactPossible(text, match, rule = "reviewed-secret") {
+    const hits = possibleSecrets(text, Infinity).filter((p) => p.label.toLowerCase() === match.label.toLowerCase() && p.hint === match.hint && p.length === match.length);
+    const spans = hits.flatMap((h) => h.spans).sort((a, b) => a.start - b.start);
+    if (!spans.length)
+        return { text, redactions: [] };
+    const parts = [];
+    let last = 0;
+    const redactions = [];
+    for (const s of spans) {
+        if (s.start < last)
+            continue;
+        parts.push(text.slice(last, s.start), `[REDACTED:${rule}]`);
+        redactions.push({ rule, start: s.start, end: s.end });
+        last = s.end;
+    }
+    parts.push(text.slice(last));
+    return { text: parts.join(""), redactions };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.10.0-beta.11",
+  "version": "0.10.0-beta.13",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",
@@ -17,7 +17,8 @@
     "test:harness-binaries": "node scripts/checkHarnessBinaries.mjs",
     "test:opencode-attribution": "vitest run src/__tests__/repoResolver.test.ts src/__tests__/openCodeCapture.test.ts src/__tests__/openCodePluginGitRefs.test.ts src/__tests__/capturePayloadFinal.test.ts src/__tests__/captureDirectUpload.test.ts src/__tests__/resolveCaptureFinal.test.ts && tsc",
     "test:watch": "vitest",
-    "test:metadata-parity": "vitest run src/__tests__/sourceMetadataMatrix.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/copilotCapture.test.ts src/__tests__/piCapture.functional.test.ts src/__tests__/piHooks.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/nativeSourceParity.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/subagents.test.ts src/__tests__/transcriptModels.test.ts src/__tests__/captureRetry.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/captureExclusions.test.ts"
+    "test:metadata-parity": "vitest run src/__tests__/sourceMetadataMatrix.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/copilotCapture.test.ts src/__tests__/piCapture.functional.test.ts src/__tests__/piHooks.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/nativeSourceParity.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/subagents.test.ts src/__tests__/transcriptModels.test.ts src/__tests__/captureRetry.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/captureExclusions.test.ts",
+    "test:local-scrub-live": "npm run build && node scripts/localScrubLive.mjs"
   },
   "files": [
     "dist",