codiedev 0.10.0-beta.15 → 0.10.0-beta.17

package/dist/scrub/rules.js

@@ -1,10 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GENERIC_RULES = void 0;
+exports.SHAPE_RULES = exports.isTestFile = exports.GENERIC_RULES = void 0;
 exports.shannonEntropy = shannonEntropy;
 exports.scrubSecrets = scrubSecrets;
 exports.redactSpans = redactSpans;
 exports.looksLikeTestValue = looksLikeTestValue;
+exports.locateInLine = locateInLine;
+exports.locateMarkers = locateMarkers;
+exports.namesASecret = namesASecret;
+exports.notWorthRotating = notWorthRotating;
+exports.hintOf = hintOf;
 exports.secretFindings = secretFindings;
 exports.possibleSecrets = possibleSecrets;
 exports.redactPossible = redactPossible;
@@ -228,7 +233,10 @@ function looksLikeTestValue(value) {
     const filler = parts.filter((p) => /^\d+$/.test(p) || /^(.)\1*$/.test(p)).length;
     return words >= 2 && words + filler === parts.length;
 }
-const TEST_FILE = /(?:\.test\.|\.spec\.|__tests__|(?:^|\/)tests?\/|fixtures?\/|__mocks__)/i;
+const TEST_FILE = /(?:\.test\.|\.spec\.|__tests__|__mocks__|fixtures?\/|(?:^|[\/_.-])tests?[\/_.-])/i;
+const TEST_FILE_SUFFIX = /[a-z0-9]Tests?\.\w+$/;
+const isTestFile = (file) => TEST_FILE.test(file) || TEST_FILE_SUFFIX.test(file);
+exports.isTestFile = isTestFile;
 const NAME_BEFORE = /([A-Za-z_][A-Za-z0-9_.-]{0,63})\??["']?\s*[:=]\s*\??["']?(?:Bearer\s+)?$/;
 function nameBefore(input, start, lineStart) {
     const window = input.slice(Math.max(lineStart, start - 160), start).replace(/\\[nrt]/g, " ");
@@ -238,7 +246,8 @@ function nameBefore(input, start, lineStart) {
     return m;
 }
 const FILE_PATH_FIELD = /"(?:file_path|filePath|path|target_file)"\s*:\s*"([^"]{1,400})"/g;
-const REDIRECT = /(?:>>?|\btee(?:\s+-a)?)\s*['"]?([^\s'"<>|;&()]{2,300})/g;
+const REDIRECT = /(?<![-=>\w]|\\n|\\r)(?<!^)(?:>>?|\btee(?:\s+-a)?)[ \t]*['"]?([\w.~/-]{2,300})/gm;
+const PATH_LIKE = /[./]/;
 const CONFIG_FILE = /((?:[\w.~-]+\/)*\.env(?:\.[\w-]+)?|(?:[\w.~-]+\/)*[\w.-]+\.(?:env|ya?ml|toml|ini|cfg|conf|properties|tfvars|npmrc|netrc|pgpass))(?![\w/])/g;
 const lastTwo = (p) => p.replace(/\\\//g, "/").split("/").filter(Boolean).slice(-2).join("/");
 function lastMatch(re, text) {
@@ -251,8 +260,9 @@ function fileOf(input, start, lineStart) {
     const lineEnd = input.indexOf("\n", start);
     const line = input.slice(lineStart, lineEnd === -1 ? input.length : lineEnd);
     const before = input.slice(Math.max(lineStart, start - 400), start);
-    const hit = lastMatch(FILE_PATH_FIELD, line) ?? lastMatch(REDIRECT, before) ?? lastMatch(CONFIG_FILE, before);
-    if (!hit || hit.startsWith("/dev/") || hit === "&1" || hit === "&2")
+    const redirect = lastMatch(REDIRECT, before);
+    const hit = lastMatch(FILE_PATH_FIELD, line) ?? (redirect && PATH_LIKE.test(redirect) && !/^[.\d-]+$/.test(redirect) ? redirect : undefined) ?? lastMatch(CONFIG_FILE, before);
+    if (!hit || hit.startsWith("/dev/"))
         return undefined;
     const short = lastTwo(hit);
     return short && short.length <= 120 ? short : undefined;
@@ -261,11 +271,13 @@ const TOOL_CALL_TYPE = /^(?:tool_use|function_call|custom_tool_call|tool_call|to
 const TOOL_OUTPUT_TYPE = /^(?:tool_result|function_call_output|custom_tool_call_output|tool_output|toolResult|tool\.execution_complete|mcp_tool_result)$/;
 const SHELL_TOOL = /bash|shell|exec|terminal|run_command|run_terminal/i;
 const GIT_COMMIT = /\bgit\s+(?:[^\n]*\s)?(?:commit|push)\b/;
-function locate(input, r, cache) {
-    const lineStart = input.lastIndexOf("\n", r.start - 1) + 1;
+const PASTE_LINES = 8;
+const PASTE_CHARS = 800;
+function lineAt(input, at, cache) {
+    const lineStart = input.lastIndexOf("\n", at - 1) + 1;
     let parsed = cache.get(lineStart);
     if (parsed === undefined) {
-        const lineEnd = input.indexOf("\n", r.end);
+        const lineEnd = input.indexOf("\n", at);
         try {
             parsed = JSON.parse(input.slice(lineStart, lineEnd === -1 ? input.length : lineEnd));
         }
@@ -274,12 +286,60 @@ function locate(input, r, cache) {
         }
         cache.set(lineStart, parsed);
     }
+    return parsed;
+}
+function toolForResult(input, id, cache) {
+    if (!/^[\w-]{6,}$/.test(id))
+        return undefined;
+    const at = input.indexOf(`"${id}"`);
+    if (at === -1)
+        return undefined;
+    let name;
+    const walk = (node) => {
+        if (name || !node || typeof node !== "object")
+            return;
+        if (Array.isArray(node)) {
+            node.forEach(walk);
+            return;
+        }
+        const n = node;
+        if ((n.id === id || n.call_id === id || n.toolCallId === id) && typeof n.name === "string" && TOOL_CALL_TYPE.test(typeof n.type === "string" ? n.type : "tool_use")) {
+            name = n.name;
+            return;
+        }
+        Object.values(n).forEach(walk);
+    };
+    walk(lineAt(input, at, cache));
+    return name;
+}
+function locate(input, r, cache, exact) {
+    const parsed = lineAt(input, r.start, cache);
     if (parsed === null || typeof parsed !== "object")
         return { where: "unknown" };
-    const runs = input.slice(r.start, r.end).match(/[A-Za-z0-9]{8,}/g);
-    const needle = runs ? runs.reduce((a, b) => (b.length > a.length ? b : a)) : null;
+    const runs = exact ? null : input.slice(r.start, r.end).match(/[A-Za-z0-9]{8,}/g);
+    const needle = exact ?? (runs ? runs.reduce((a, b) => (b.length > a.length ? b : a)) : null);
     if (!needle)
         return { where: "unknown" };
+    return classify(parsed, needle, input, cache);
+}
+function locateInLine(line, text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        parsed = null;
+    }
+    const fileHit = lastMatch(FILE_PATH_FIELD, line);
+    const file = fileHit && !fileHit.startsWith("/dev/") ? lastTwo(fileHit).slice(0, 120) : undefined;
+    if (parsed === null || typeof parsed !== "object")
+        return { where: "unknown", ...(file ? { file } : {}) };
+    const runs = text.match(/[A-Za-z0-9]{4,}/g);
+    const needle = runs ? runs.reduce((a, b) => (b.length > a.length ? b : a)) : null;
+    const loc = needle ? classify(parsed, needle, line, new Map()) : { where: "unknown" };
+    return { ...loc, ...(file ? { file } : {}) };
+}
+function classify(parsed, needle, input, cache) {
     let path = null;
     const walk = (node, trail) => {
         if (path)
@@ -314,32 +374,211 @@ function locate(input, r, cache) {
                 return { where: "commit", tool };
             return tool ? { where: "tool_call", tool } : { where: "tool_call" };
         }
-        if (TOOL_OUTPUT_TYPE.test(type))
-            return tool ? { where: "tool_output", tool } : { where: "tool_output" };
-        if (n.role === "user" || (type === "user" && i === 0))
-            return { where: "prompt" };
+        if (TOOL_OUTPUT_TYPE.test(type)) {
+            const id = n.tool_use_id ?? n.call_id ?? n.toolCallId;
+            const named = tool ?? (typeof id === "string" ? toolForResult(input, id, cache) : undefined);
+            return named ? { where: "tool_output", tool: named } : { where: "tool_output" };
+        }
+        if (n.role === "user" || (type === "user" && i === 0)) {
+            const line = frames[0].node;
+            if (frames.some((f) => f.key === "toolUseResult")) {
+                const content = line.message?.content;
+                const id = Array.isArray(content) ? content.find((c) => c && typeof c === "object" && "tool_use_id" in c)?.tool_use_id : undefined;
+                const named = typeof id === "string" ? toolForResult(input, id, cache) : undefined;
+                return named ? { where: "tool_output", tool: named } : { where: "tool_output" };
+            }
+            if (line.isMeta === true || line.isCompactSummary === true)
+                return { where: "attached" };
+            const text = frames[frames.length - 1].node;
+            if (typeof text === "string" && (text.length >= PASTE_CHARS || text.split("\n").length >= PASTE_LINES))
+                return { where: "pasted" };
+            return { where: "typed" };
+        }
         if (n.role === "assistant" || (type === "assistant" && i === 0))
             return { where: "assistant" };
     }
     return { where: "unknown" };
 }
+function locateMarkers(scrubbed, rule) {
+    const marker = `[REDACTED:${rule}]`;
+    const cache = new Map();
+    const out = [];
+    for (let at = scrubbed.indexOf(marker); at !== -1; at = scrubbed.indexOf(marker, at + marker.length)) {
+        const loc = locate(scrubbed, { rule, start: at, end: at + marker.length }, cache, marker);
+        if (!out.some((l) => l.where === loc.where && l.tool === loc.tool))
+            out.push(loc);
+        if (out.length >= 16)
+            break;
+    }
+    return out;
+}
+exports.SHAPE_RULES = new Set([
+    "secret-assignment", "bearer-token", "jwt", "pem-private-key", "url-password", "curl-auth-header", "curl-auth-user",
+]);
+const FILLER_WORD = /secret|password|passwd|passw|pass|pwd|token|apikey|key|auth|bearer|basic|api|app|access|refresh|client|user|name|admin|root|guest|test(?:ing)?|dummy|sample|example|demo|default|change(?:me|it)?|service|local(?:host)?|super|your|mine|my|the|new|old|temp|tmp|dev|prod|stag(?:ing)?|value|string|here|foo|bar|baz|qux|private|public|hello|world|welcome|letmein/gi;
+const LEET = { "0": "o", "1": "l", "3": "e", "4": "a", "5": "s", "7": "t", "@": "a", $: "s" };
+function madeOfFillerWords(v) {
+    const residue = (t) => {
+        FILLER_WORD.lastIndex = 0;
+        if (!FILLER_WORD.test(t))
+            return Infinity;
+        return t.replace(FILLER_WORD, "").replace(/[^A-Za-z]/g, "").length;
+    };
+    return residue(v) <= 3 || residue(v.replace(/[013457@$]/g, (c) => LEET[c])) <= 3;
+}
+function hasCountingRuns(v) {
+    const t = v;
+    const need = t.length > 24 ? 3 : 2;
+    let runs = 0;
+    for (let i = 0; i + 2 < t.length; i++) {
+        const a = t.charCodeAt(i);
+        if (!/[A-Za-z0-9]/.test(t[i]) || t.charCodeAt(i + 1) !== a + 1 || t.charCodeAt(i + 2) !== a + 2)
+            continue;
+        if (++runs >= need)
+            return true;
+        i += 2;
+    }
+    return false;
+}
+const WORD_PAIRS = new Set(("ab ac ad ae ag ai ak al am an ao ap ar as at au av aw ax ay az ba be bi bj bl bo br bs bu by ca ce ch ci ck cl co " +
+    "cr cs ct cu cy da db de dg di dm do dr ds du dw dy ea eb ec ed ee ef eg ei el em en eo ep er es et eu ev ew ex ey " +
+    "fa fe ff fi fl fo fr ft fu ga ge gh gi gl gn go gr gs gu gy ha hc he hi ho hs ht hu ia ib ic id ie if ig il im in " +
+    "io ip ir is it iu iv ix iz ja je jo ju ka ke ki kn ko ks ku la ld le lf li lk ll lm lo lp ls lt lu lv ly ma mb me " +
+    "mi mm mo mp ms mu my na nc nd ne nf ng ni nk nm nn no ns nt nv ny oa ob oc od oe of og oi ok ol om on oo op or os " +
+    "ot ou ov ow ox oz pa pe ph pi pl po pp pr ps pt pu py qu ra rc rd re rg ri rk rl rm rn ro rr rs rt ru ry sa sc se " +
+    "sh si sk sl sm sn so sp ss st su sw sy ta te th ti tl to tr ts tt tu tw ty ua ub uc ud ue ug ui ul um un uo up ur " +
+    "us ut va ve vi vo vu wa we wh wi wo ws xp xt ya yc ye yl ym yn yo yp ys yt za ze zi zo").split(" "));
+function readsAsWord(t) {
+    if (t.length < 3 || !/^(?:[a-z]+|[A-Z]+|[A-Z][a-z]+)$/.test(t))
+        return false;
+    const l = t.toLowerCase();
+    if (!/[aeiouy]/.test(l))
+        return false;
+    let odd = 0;
+    for (let i = 0; i + 1 < l.length; i++)
+        if (!WORD_PAIRS.has(l.slice(i, i + 2)))
+            odd++;
+    return odd <= (l.length >= 7 ? 1 : 0);
+}
+function namesASecret(v) {
+    if (/^arn:[a-z-]+:/i.test(v))
+        return true;
+    if (/^(?:vault|ssm|secretsmanager|keyvault|op|ref|env|file):/i.test(v))
+        return true;
+    if (/(?:^|\/)secrets?\//i.test(v))
+        return true;
+    const tokens = v
+        .replace(/([a-z])([A-Z])/g, "$1 $2")
+        .replace(/([A-Za-z])(\d)/g, "$1 $2")
+        .replace(/(\d)([A-Za-z])/g, "$1 $2")
+        .split(/[^A-Za-z0-9]+/)
+        .filter(Boolean);
+    let total = 0;
+    let letters = 0;
+    let inWords = 0;
+    for (const t of tokens) {
+        total += t.length;
+        if (/^\d+$/.test(t))
+            continue;
+        letters += t.length;
+        if (readsAsWord(t))
+            inWords += t.length;
+    }
+    return inWords >= 6 && inWords / letters >= 0.7 && letters / total >= 0.5;
+}
+const DAY_MS = 24 * 60 * 60 * 1000;
+function jwtNotWorthRotating(v, now) {
+    const parts = v.split(".");
+    if (parts.length < 3)
+        return true;
+    let payload;
+    try {
+        payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
+    }
+    catch {
+        return true;
+    }
+    if (!payload || typeof payload.exp !== "number")
+        return false;
+    if (payload.exp * 1000 < now + DAY_MS)
+        return true;
+    return typeof payload.iat === "number" && (payload.exp - payload.iat) * 1000 <= DAY_MS;
+}
+function pemBody(block) {
+    return block
+        .replace(/-----BEGIN[A-Z ]*PRIVATE KEY-----/, "")
+        .split("-----END")[0]
+        .split(/\\r|\\n|\r|\n/)
+        .filter((l) => !l.includes(":"))
+        .join("")
+        .replace(/\s+/g, "");
+}
+function notWorthRotating(k, now = Date.now()) {
+    const { rule, name, file } = k;
+    const value = k.value.trim();
+    if (looksLikeTestValue(value))
+        return true;
+    if (exports.SHAPE_RULES.has(rule) && file && (0, exports.isTestFile)(file))
+        return true;
+    if (rule === "pem-private-key") {
+        const body = pemBody(value);
+        return body.length < 60 || !/^[A-Za-z0-9+/=]+$/.test(body) || shannonEntropy(body) < 4;
+    }
+    if (PLACEHOLDER.test(value))
+        return true;
+    if (hasCountingRuns(value))
+        return true;
+    if (rule === "aws-access-key" && value.startsWith("ASIA"))
+        return true;
+    if (name && /(?:session|security)[_-]?token$/i.test(name))
+        return true;
+    if (/^(?:IQoJ|FwoG|FQoG|AQoD)[A-Za-z0-9+/]{20,}/.test(value))
+        return true;
+    if (value.startsWith("eyJ"))
+        return jwtNotWorthRotating(value, now);
+    if (!exports.SHAPE_RULES.has(rule))
+        return false;
+    if (name && /^x-atlassian-token$/i.test(name))
+        return true;
+    let secret = value;
+    if (rule === "curl-auth-user") {
+        const at = value.indexOf(":");
+        const user = value.slice(0, at).replace(/["']/g, "");
+        secret = value.slice(at + 1).replace(/["']/g, "");
+        if (at < 0 || !secret || secret === user)
+            return true;
+    }
+    if (rule === "url-password" && name && secret === name)
+        return true;
+    if (secret.includes("$"))
+        return true;
+    if (/^[A-Za-z._-]+$/.test(secret))
+        return true;
+    if (/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/.test(secret))
+        return true;
+    if (madeOfFillerWords(secret))
+        return true;
+    if (rule === "secret-assignment" && namesASecret(secret))
+        return true;
+    return rule !== "url-password" && shannonEntropy(secret) < 3;
+}
+function hintOf(rule, value) {
+    const body = rule === "pem-private-key" ? value.split("-----END")[0].replace(/\\[nr]/g, "") : value;
+    return body.replace(/[^A-Za-z0-9]/g, "").slice(-4);
+}
 const MAX_LOCATIONS = 8;
 function secretFindings(input, redactions, opts = {}) {
     const seen = new Map();
     const cache = new Map();
     for (const r of redactions) {
-        let value = input.slice(r.start, r.end);
-        if (r.rule === "pem-private-key")
-            value = value.split("-----END")[0];
-        const hint = value.replace(/[^A-Za-z0-9]/g, "").slice(-4);
+        const value = input.slice(r.start, r.end);
+        const hint = hintOf(r.rule, value);
         if (!hint)
             continue;
         const lineStart = input.lastIndexOf("\n", r.start - 1) + 1;
         const name = nameBefore(input, r.start, lineStart);
         const file = fileOf(input, r.start, lineStart);
-        if (looksLikeTestValue(value))
-            continue;
-        if (exports.GENERIC_RULES.has(r.rule) && file && TEST_FILE.test(file))
+        if (notWorthRotating({ rule: r.rule, value, ...(name ? { name } : {}), ...(file ? { file } : {}) }, opts.now))
             continue;
         if (opts.skip?.({ rule: r.rule, value, ...(name ? { name } : {}), ...(file ? { file } : {}) }))
             continue;

package/dist/teamSkillContext.js

@@ -4,7 +4,7 @@ exports.TEAM_SKILL_CONTEXT = void 0;
 exports.teamSkillSessionOutput = teamSkillSessionOutput;
 exports.TEAM_SKILL_CONTEXT = `This machine is connected to Codiedev, the team's artifact and skill library.
 Before a substantial coding task, run codiedev search "<brief task description>" and reuse a relevant team skill by running codiedev pull <exact-key> and following its instructions. If no skill fits, continue the task.
-Use codiedev push <file.md> to share an artifact when asked, codiedev ask "<question>" for team knowledge, and codiedev inbox to check messages. Use codiedev --help for other commands. If codiedev is unavailable, use npx codiedev@latest.`;
+Use codiedev push <file.md> to share an artifact when asked, and codiedev inbox to check messages. Use codiedev --help for other commands. If codiedev is unavailable, use npx codiedev@latest.`;
 function teamSkillSessionOutput(source, context = exports.TEAM_SKILL_CONTEXT) {
     return source === "cursor" ? { additional_context: context } : { additionalContext: context };
 }

package/dist/unreadNotice.js

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNREAD_NOTICE_INTERVAL_MS = void 0;
+exports.parseUnreadPings = parseUnreadPings;
+exports.unreadNoticeLine = unreadNoticeLine;
+exports.takeUnreadNotice = takeUnreadNotice;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const configDir_1 = require("./configDir");
+exports.UNREAD_NOTICE_INTERVAL_MS = 20 * 60 * 60 * 1000;
+const STATE_FILE = "unread-notice.json";
+function parseUnreadPings(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const v = value;
+    if (typeof v.count !== "number" || !Number.isFinite(v.count) || v.count <= 0)
+        return null;
+    return {
+        count: Math.floor(v.count),
+        newestPingId: typeof v.newestPingId === "string" ? v.newestPingId : null,
+        from: Array.isArray(v.from) ? v.from.filter((n) => typeof n === "string" && n.trim() !== "") : [],
+        senderCount: typeof v.senderCount === "number" ? v.senderCount : undefined,
+    };
+}
+function nameList(from, senderCount) {
+    if (from.length === 0)
+        return "";
+    const others = Math.max(0, senderCount - from.length);
+    const names = others > 0 ? [...from, `${others} other${others === 1 ? "" : "s"}`] : from;
+    if (names.length === 1)
+        return ` from ${names[0]}`;
+    return ` from ${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+}
+function unreadNoticeLine(u) {
+    const who = nameList(u.from, u.senderCount ?? u.from.length);
+    return (`Codiedev: ${u.count} unread message${u.count === 1 ? "" : "s"}${who}. ` +
+        "Tell the user at the start of your first reply, and offer to show them with `codiedev inbox --unread`. " +
+        'Answer one with `codiedev reply <ping-id> "<message>"`.');
+}
+function readState(dir) {
+    try {
+        const raw = JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, STATE_FILE), "utf8"));
+        if (typeof raw?.at !== "number")
+            return null;
+        return { newestPingId: typeof raw.newestPingId === "string" ? raw.newestPingId : null, at: raw.at };
+    }
+    catch {
+        return null;
+    }
+}
+function takeUnreadNotice(value, options = {}) {
+    try {
+        const unread = parseUnreadPings(value);
+        if (!unread)
+            return null;
+        const dir = options.dir ?? (0, configDir_1.codiedevStateDir)();
+        const now = options.now ?? Date.now();
+        const last = readState(dir);
+        const sameNewest = !!last && last.newestPingId === unread.newestPingId;
+        if (sameNewest && last.at <= now && now - last.at < exports.UNREAD_NOTICE_INTERVAL_MS)
+            return null;
+        fs_1.default.mkdirSync(dir, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(dir, STATE_FILE), JSON.stringify({ newestPingId: unread.newestPingId, at: now }));
+        return unreadNoticeLine(unread);
+    }
+    catch {
+        return null;
+    }
+}