crbro-memory 2.10.0 → 2.11.0

package/dist/engine/modinstall.js

@@ -42,6 +42,7 @@ exports.modPaths = modPaths;
 exports.pathListSeparator = pathListSeparator;
 exports.sha256 = sha256;
 exports.modFiles = modFiles;
+exports.staleStaging = staleStaging;
 exports.readModState = readModState;
 exports.compareVersions = compareVersions;
 exports.installMod = installMod;
@@ -51,13 +52,17 @@ exports.formatModVerify = formatModVerify;
 exports.modSwitchedOff = modSwitchedOff;
 exports.takeModNotice = takeModNotice;
 exports.autoInstallMod = autoInstallMod;
+exports.hookRefreshSwitchedOff = hookRefreshSwitchedOff;
 exports.startModOnBoot = startModOnBoot;
+exports.takeHooksNotice = takeHooksNotice;
 exports.modNoticeOnBoot = modNoticeOnBoot;
 exports.resetModOnBoot = resetModOnBoot;
 const crypto_1 = require("crypto");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = __importDefault(require("path"));
+const installio_js_1 = require("./installio.js");
+const hookrefresh_js_1 = require("./hookrefresh.js");
 exports.MOD_NAME = 'crbro-pending';
 /** The local copy this mod grew out of: a folder in the list holding it is replaced. */
 exports.LEGACY_NAME = 'crbro-pendientes';
@@ -69,8 +74,9 @@ exports.PLUGIN_DIRS_VAR = 'CLAUDE_CODE_PLUGIN_DIRS';
 /** What the package ships but the install leaves out: tests and editor config. */
 const NOT_SHIPPED_TOP = new Set(['test', 'tsconfig.json', '.gitignore', '.npmignore', 'node_modules']);
 const NOT_SHIPPED_DIRS = new Set(['.claude-plugin/types']);
-function modPaths(home) {
-    const claudeDir = path_1.default.join(home, '.claude');
+/** Claude Code's folder is CLAUDE_CONFIG_DIR when set, as Claude Code itself reads it; ~/.claude otherwise. */
+function modPaths(home, env = process.env) {
+    const claudeDir = (0, installio_js_1.claudeDir)(home, env);
     return {
         claudeDir,
         settingsPath: path_1.default.join(claudeDir, 'settings.json'),
@@ -212,7 +218,7 @@ function readSettings(settingsPath) {
     return { ok: true, settings, indent, eol, hash };
 }
 /** Thrown by writeAtomic when settings.json changed after it was read: the caller merges again. */
-const SETTINGS_CHANGED = 'ESETTINGSCHANGED';
+const SETTINGS_CHANGED = installio_js_1.FILE_CHANGED;
 /** Errors a later start may well not meet (a file held open, an antivirus scan): never written down as a failure. */
 const TRANSIENT = new Set(['EBUSY', 'EPERM', 'EACCES', 'ENOTEMPTY', 'EEXIST', SETTINGS_CHANGED]);
 /**
@@ -226,43 +232,37 @@ const TRANSIENT = new Set(['EBUSY', 'EPERM', 'EACCES', 'ENOTEMPTY', 'EEXIST', SE
  * inherited ACL, and a hard link to settings.json is not kept.
  */
 function writeAtomic(settingsPath, settings, indent = 2, eol = '\n', expectHash) {
-    let target = settingsPath;
-    try {
-        if ((0, fs_1.lstatSync)(settingsPath).isSymbolicLink())
-            target = (0, fs_1.realpathSync)(settingsPath);
-    }
-    catch {
-        // Not there yet: written as a plain file.
-    }
-    let mode;
-    try {
-        mode = (0, fs_1.statSync)(target).mode & 0o777;
-    }
-    catch {
-        mode = undefined;
-    }
-    const tmp = `${target}.${process.pid}.tmp`;
+    // installio.writeGuarded: the same steps (symlink target, mode, line
+    // endings, hash checked again right before the rename), plus a timestamped
+    // copy of the file as it was, kept beside it (settings.json.crbro-bak-<stamp>).
+    (0, installio_js_1.writeGuarded)(settingsPath, (0, installio_js_1.jsonText)(settings, indent, eol), { expectHash });
+}
+function splitList(value, sep) {
+    return (value ?? '').split(sep).map(s => s.trim()).filter(Boolean);
+}
+const STAGING = /^crbro-pending\.(\d+)\.(tmp|old)$/;
+/**
+ * A staging or set-aside folder another run left behind, safe to remove: its
+ * owner's pid is gone (or it is this process's own). A live pid is another
+ * install under way — install-mod by hand beside a boot — and its folder is
+ * left alone, or that install would fail half way on its rename.
+ */
+function staleStaging(name, isAlive = pidAlive) {
+    const m = STAGING.exec(name);
+    if (!m)
+        return false;
+    const pid = Number(m[1]);
+    return pid === process.pid || !isAlive(pid);
+}
+function pidAlive(pid) {
     try {
-        let text = JSON.stringify(settings, null, indent) + '\n';
-        if (eol !== '\n')
-            text = text.replace(/\n/g, eol);
-        (0, fs_1.writeFileSync)(tmp, text, mode === undefined ? 'utf8' : { encoding: 'utf8', mode });
-        if (expectHash !== undefined && settingsFingerprint(target) !== expectHash) {
-            const changed = new Error(`${settingsPath} changed while it was being written.`);
-            changed.code = SETTINGS_CHANGED;
-            throw changed;
-        }
-        (0, fs_1.renameSync)(tmp, target);
+        process.kill(pid, 0);
+        return true;
     }
     catch (e) {
-        (0, fs_1.rmSync)(tmp, { force: true });
-        throw e;
+        return e.code === 'EPERM';
     }
 }
-function splitList(value, sep) {
-    return (value ?? '').split(sep).map(s => s.trim()).filter(Boolean);
-}
-const STAGING = /^crbro-pending\.\d+\.(tmp|old)$/;
 function copyFailed(installedDir, e) {
     const err = new Error(`could not replace ${installedDir} (${e.message}).\n` +
         '     Close the sessions and terminals using that folder and run it again.');
@@ -280,7 +280,7 @@ function copyMod(packageDir, installedDir) {
     (0, fs_1.mkdirSync)(parent, { recursive: true });
     // A staging or set-aside folder left by a run that failed half way: its pid is gone.
     for (const name of (0, fs_1.readdirSync)(parent)) {
-        if (STAGING.test(name))
+        if (staleStaging(name))
             (0, fs_1.rmSync)(path_1.default.join(parent, name), { recursive: true, force: true, maxRetries: 3 });
     }
     const staging = `${installedDir}.${process.pid}.tmp`;
@@ -326,7 +326,7 @@ async function copyModAsync(packageDir, installedDir) {
     const parent = path_1.default.dirname(installedDir);
     await fs_1.promises.mkdir(parent, { recursive: true });
     for (const name of await fs_1.promises.readdir(parent)) {
-        if (STAGING.test(name))
+        if (staleStaging(name))
             await fs_1.promises.rm(path_1.default.join(parent, name), { recursive: true, force: true, maxRetries: 3 });
     }
     const staging = `${installedDir}.${process.pid}.tmp`;
@@ -1290,33 +1290,67 @@ async function autoInstallMod(opts) {
     }
 }
 let onBoot = null;
+/** The refresh of installed hook copies (hookrefresh.ts), started beside the mod's install, once per process. */
+let hooksOnBoot = null;
+let hooksResult = null;
+let hooksNoticeTaken = false;
+/** CRBRO_HOOK_REFRESH=0 (off, false, no) keeps installed hook copies as they are. */
+function hookRefreshSwitchedOff(env = process.env) {
+    return exports.MOD_OFF_VALUES.has(String(env.CRBRO_HOOK_REFRESH ?? '').trim().toLowerCase());
+}
 /**
  * What crbro_boot calls first: starts the automatic install the first time in
  * this process and returns the function to call once the boot has its answer
  * ready. That function waits for the install until `budgetMs` after the start
  * and takes the notice waiting to be said, or null. Neither throws. A boot
  * that fails never calls it, so it never takes a notice it cannot hand over.
+ *
+ * It also starts, once per process, the refresh of the hook copies CRBRO
+ * installed (hookrefresh.ts): unmodified copies of an older release are
+ * replaced by this one's. That part does not depend on CRBRO_MOD (it never
+ * adds anything, only keeps current what is there); CRBRO_HOOK_REFRESH=0
+ * turns it off. Its notice is taken with takeHooksNotice().
  */
 function startModOnBoot(opts = {}) {
     try {
         const home = opts.home ?? (0, os_1.homedir)();
         const env = opts.env ?? process.env;
-        if (modSwitchedOff(env) || !(0, fs_1.existsSync)(modPaths(home).claudeDir))
-            return async () => null;
-        if (!onBoot) {
-            const packageDir = opts.packageDir ?? path_1.default.join(__dirname, '..', '..', 'mods', exports.MOD_NAME);
-            onBoot = autoInstallMod({ ...opts, home, env, packageDir })
-                .catch(e => ({ action: 'failed', reason: e.message }));
+        if (!hooksOnBoot && !hookRefreshSwitchedOff(env)) {
+            hooksOnBoot = new Promise(resolve => setImmediate(() => {
+                try {
+                    resolve((0, hookrefresh_js_1.refreshHooks)({ home, env }));
+                }
+                catch {
+                    resolve([]);
+                }
+            })).then(copies => { hooksResult = copies; return copies; });
         }
-        const running = onBoot;
+        const hooks = hooksOnBoot ?? Promise.resolve([]);
         let timer;
         const budget = new Promise(resolve => {
             timer = setTimeout(resolve, opts.budgetMs ?? exports.BOOT_BUDGET_MS);
             timer.unref?.();
         });
+        if (modSwitchedOff(env) || !(0, fs_1.existsSync)(modPaths(home, env).claudeDir)) {
+            return async () => {
+                try {
+                    await Promise.race([hooks, budget]);
+                }
+                catch { /* never fails the boot */ }
+                if (timer)
+                    clearTimeout(timer);
+                return null;
+            };
+        }
+        if (!onBoot) {
+            const packageDir = opts.packageDir ?? path_1.default.join(__dirname, '..', '..', 'mods', exports.MOD_NAME);
+            onBoot = autoInstallMod({ ...opts, home, env, packageDir })
+                .catch(e => ({ action: 'failed', reason: e.message }));
+        }
+        const running = onBoot;
         return async () => {
             try {
-                await Promise.race([running, budget]);
+                await Promise.race([Promise.all([running, hooks]), budget]);
                 if (timer)
                     clearTimeout(timer);
                 return takeModNotice(home, opts.now);
@@ -1330,6 +1364,22 @@ function startModOnBoot(opts = {}) {
         return async () => null;
     }
 }
+/**
+ * The boot's notice about installed hooks, once per process, if the refresh
+ * has finished: copies left alone because somebody edited them, or a refresh
+ * that failed. Each edited copy is told once (remembered in its manifest).
+ */
+function takeHooksNotice() {
+    if (hooksNoticeTaken || !hooksResult)
+        return null;
+    hooksNoticeTaken = true;
+    try {
+        return (0, hookrefresh_js_1.hooksNotice)(hooksResult);
+    }
+    catch {
+        return null;
+    }
+}
 /** startModOnBoot and its notice in one call. */
 async function modNoticeOnBoot(opts = {}) {
     return startModOnBoot(opts)();
@@ -1337,6 +1387,9 @@ async function modNoticeOnBoot(opts = {}) {
 /** Tests only: the next boot in this process behaves as the first boot of a new process. */
 function resetModOnBoot() {
     onBoot = null;
+    hooksOnBoot = null;
+    hooksResult = null;
+    hooksNoticeTaken = false;
     handedOver.clear();
 }
 //# sourceMappingURL=modinstall.js.map

package/dist/engine/prefrontal.js

@@ -3,9 +3,11 @@
 // Active context, hot topics, and global map (clustering + bridges)
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Prefrontal = void 0;
+exports.sortOpenItems = sortOpenItems;
 const fs_js_1 = require("../utils/fs.js");
 const hash_js_1 = require("../utils/hash.js");
 const secrets_js_1 = require("./secrets.js");
+const heat_js_1 = require("./heat.js");
 /** How many resolved items to keep around as a reminder. */
 const RECENTLY_CLOSED_CAP = 15;
 /** Normalise a stored entry: v1 brains hold plain strings. */
@@ -22,6 +24,15 @@ function normalizeContext(ctx) {
         recently_closed: ctx?.recently_closed || [],
     };
 }
+/**
+ * The one order open items are read in, whatever the scope: what is due
+ * first, then the newest. A cap applied after it keeps what matters now; the
+ * insertion order kept the oldest, so a boot without a project showed the
+ * twelve items nobody had touched in months.
+ */
+function sortOpenItems(items) {
+    return [...items].sort((a, b) => (a.due || '9999').localeCompare(b.due || '9999') || String(b.added || '').localeCompare(String(a.added || '')));
+}
 function projectView(ctx, project) {
     if (!project)
         return ctx;
@@ -29,8 +40,7 @@ function projectView(ctx, project) {
     return {
         ...ctx, active_topics: ctx.project_topics?.[project] || [],
         project_topics: ctx.project_topics?.[project] ? { [project]: ctx.project_topics[project] } : {},
-        pending_tasks: ctx.pending_tasks.map(toTask).filter(visible)
-            .sort((a, b) => (a.due || '9999').localeCompare(b.due || '9999') || b.added.localeCompare(a.added)),
+        pending_tasks: sortOpenItems(ctx.pending_tasks.map(toTask).filter(visible)),
         recently_closed: (ctx.recently_closed || []).filter(visible),
     };
 }
@@ -72,6 +82,7 @@ class Prefrontal {
         let resolved = [];
         let discarded = [];
         let redacted = [];
+        let added;
         const saved = await (0, fs_js_1.updateJSON)(this.brain.paths.activeContext(), current => {
             const ctx = normalizeContext(current);
             if (updates.clear) {
@@ -113,6 +124,7 @@ class Prefrontal {
                     Object.assign(existing, metadata);
                 else
                     tasks.push({ id, text, added: (0, fs_js_1.now)(), status: 'open', ...metadata });
+                added = { ...(existing ?? tasks[tasks.length - 1]) };
             }
             // Id, exact text, or a case-insensitive substring of at least 8 chars in
             // either direction — the same predicate for resolving and discarding.
@@ -142,7 +154,8 @@ class Prefrontal {
             ctx.last_updated = (0, fs_js_1.now)();
             return ctx;
         });
-        return { ...projectView(saved, updates.project), resolved, discarded, written: true, ...(redacted.length ? { redacted } : {}) };
+        return { ...projectView(saved, updates.project), resolved, discarded, written: true,
+            ...(redacted.length ? { redacted } : {}), ...(added ? { added } : {}) };
     }
     /**
      * Record which session was logged last. Nothing else in the context moves.
@@ -181,10 +194,20 @@ class Prefrontal {
     async getGlobalMap() {
         const ids = await (0, fs_js_1.listJSONFiles)(this.brain.paths.cortex);
         const neurons = [];
+        // Heat lives in the derived heat state since 2.11; a neuron file keeps
+        // the value it had when heat stopped being written into it.
+        const calor = (await (0, heat_js_1.readHeatState)(this.brain))?.neurons || {};
         for (const id of ids) {
-            const neuron = await (0, fs_js_1.readJSON)(this.brain.paths.neuron(id));
-            if (neuron)
-                neurons.push(neuron);
+            // 2.11 (C1): an unreadable neuron is skipped, not the end of maintenance or the map.
+            let neuron = null;
+            try {
+                neuron = await (0, fs_js_1.readJSON)(this.brain.paths.neuron(id));
+            }
+            catch { /* corrupt: skipped */ }
+            if (!neuron)
+                continue;
+            const h = calor[neuron.id]?.heat;
+            neurons.push(typeof h === 'number' ? { ...neuron, heat: h } : neuron);
         }
         // Build clusters by domain
         const domainGroups = {};

package/dist/engine/quarantine.js

@@ -0,0 +1,204 @@
+"use strict";
+// ─── Quarantine: the copy kept before anything is removed ────────
+//
+// Every destructive path (forget, forget entire, merge_into, compact, a day
+// log forgotten) writes here first, so a removal can be undone. Until 2.11 it
+// grew without limit and in clear: 824 files and 5.3 MB on the reference
+// brain, a whole 1 MB neuron copied for every batch of a split, including the
+// credentials somebody forgot on purpose. Now:
+//
+//  - forgetting SOME entries keeps those entries and what restore needs to
+//    put them back (dates, retirements, provenance, checks), not the neuron;
+//  - copies older than CRBRO_QUARANTINE_DAYS (default 180; 0 keeps them
+//    forever) are pruned by consolidate and maintenance, which say how many;
+//  - with CRBRO_ENCRYPT_AT_REST=1 new copies are sealed (atrest.ts).
+//
+// File names: `<id>.<stamp>.json` (a whole neuron or log, the 2.x format a
+// previous version can still restore), `<id>.<stamp>.entries.json` (some
+// entries), each with `.enc` appended when sealed. The stamp sorts lexically,
+// so the name alone orders the copies of one id.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_QUARANTINE_DAYS = void 0;
+exports.quarantineDays = quarantineDays;
+exports.stampNow = stampNow;
+exports.writeQuarantine = writeQuarantine;
+exports.readQuarantine = readQuarantine;
+exports.listQuarantine = listQuarantine;
+exports.pruneQuarantine = pruneQuarantine;
+exports.quarantineStats = quarantineStats;
+exports.entriesAsNeuron = entriesAsNeuron;
+exports.isEntriesCopy = isEntriesCopy;
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const atrest_js_1 = require("./atrest.js");
+const fs_js_1 = require("../utils/fs.js");
+exports.DEFAULT_QUARANTINE_DAYS = 180;
+/** Retention in days from the environment; 0 means forever. Bad values fall back to the default. */
+function quarantineDays(env = process.env) {
+    const raw = (env['CRBRO_QUARANTINE_DAYS'] || '').trim();
+    if (!raw)
+        return exports.DEFAULT_QUARANTINE_DAYS;
+    const n = Number(raw);
+    return Number.isInteger(n) && n >= 0 ? n : exports.DEFAULT_QUARANTINE_DAYS;
+}
+function stampNow() {
+    return (0, fs_js_1.now)().replace(/[:.]/g, '-');
+}
+/** "2026-11-13T10-20-30-123Z" → ISO, or null. */
+function stampToIso(stamp) {
+    const m = stamp.match(/^(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z$/);
+    return m ? `${m[1]}T${m[2]}:${m[3]}:${m[4]}.${m[5]}Z` : null;
+}
+function parseName(file) {
+    const sealed = file.endsWith('.json.enc');
+    if (!sealed && !file.endsWith('.json'))
+        return null;
+    const base = file.slice(0, file.length - (sealed ? '.json.enc'.length : '.json'.length));
+    const entries = base.endsWith('.entries');
+    const core = entries ? base.slice(0, -'.entries'.length) : base;
+    const m = core.match(/^(.*)\.(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z)$/);
+    if (!m)
+        return { base, id: core, stamp: '', kind: entries ? 'entries' : 'whole', sealed };
+    return { base, id: m[1], stamp: m[2], kind: entries ? 'entries' : 'whole', sealed };
+}
+/** Write one copy; sealed when the switch is on. Throws rather than write in clear without a key. */
+async function writeQuarantine(dir, id, data, kind = 'whole') {
+    await node_fs_1.promises.mkdir(dir, { recursive: true });
+    const { data: bytes, sealed } = (0, atrest_js_1.maybeSeal)(Buffer.from(JSON.stringify(data, null, 2), 'utf8'));
+    const name = `${id}.${stampNow()}${kind === 'entries' ? '.entries' : ''}.json${sealed ? '.enc' : ''}`;
+    const target = node_path_1.default.join(dir, name);
+    const tmp = `${target}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+    await node_fs_1.promises.writeFile(tmp, bytes);
+    try {
+        await node_fs_1.promises.rename(tmp, target);
+    }
+    catch (err) {
+        await node_fs_1.promises.unlink(tmp).catch(() => { });
+        throw err;
+    }
+    return target;
+}
+async function readQuarantine(file) {
+    let raw;
+    try {
+        raw = await node_fs_1.promises.readFile(file);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+    return JSON.parse((0, fs_js_1.stripBOM)((0, atrest_js_1.unseal)(raw).toString('utf8')));
+}
+/** Copies in the folder, optionally of one id, newest first. */
+async function listQuarantine(dir, id) {
+    let names;
+    try {
+        names = await node_fs_1.promises.readdir(dir);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const file of names) {
+        if (file.endsWith('.tmp'))
+            continue;
+        const p = parseName(file);
+        if (!p)
+            continue;
+        if (id !== undefined && p.id !== id)
+            continue;
+        let taken = p.stamp ? stampToIso(p.stamp) : null;
+        if (!taken) {
+            try {
+                taken = (await node_fs_1.promises.stat(node_path_1.default.join(dir, file))).mtime.toISOString();
+            }
+            catch {
+                continue;
+            }
+        }
+        out.push({ file, base: p.base, id: p.id, kind: p.kind, sealed: p.sealed, taken });
+    }
+    return out.sort((a, b) => (a.taken < b.taken ? 1 : a.taken > b.taken ? -1 : a.file < b.file ? 1 : -1));
+}
+/**
+ * Delete copies older than `days` (0 = keep forever). Returns what went, or
+ * would go with dryRun. Only files this module names are ever touched.
+ */
+async function pruneQuarantine(dir, opts = {}) {
+    const days = opts.days ?? quarantineDays();
+    const res = { pruned: 0, bytes: 0, files: [], days };
+    if (days <= 0)
+        return res;
+    const limite = (opts.now ?? new Date()).getTime() - days * 86_400_000;
+    for (const c of await listQuarantine(dir)) {
+        if (Date.parse(c.taken) >= limite)
+            continue;
+        const f = node_path_1.default.join(dir, c.file);
+        try {
+            const st = await node_fs_1.promises.stat(f);
+            if (!opts.dryRun)
+                await node_fs_1.promises.unlink(f);
+            res.pruned++;
+            res.bytes += st.size;
+            res.files.push(c.file);
+        }
+        catch { /* gone meanwhile */ }
+    }
+    return res;
+}
+/** Files, bytes and the oldest copy: what status and doctor show. */
+async function quarantineStats(dir) {
+    const all = await listQuarantine(dir);
+    let bytes = 0;
+    for (const c of all) {
+        try {
+            bytes += (await node_fs_1.promises.stat(node_path_1.default.join(dir, c.file))).size;
+        }
+        catch { /* gone */ }
+    }
+    return {
+        files: all.length,
+        bytes,
+        oldest: all.length ? all[all.length - 1].taken : null,
+        sealed: all.filter(c => c.sealed).length,
+    };
+}
+/**
+ * The neuron-shaped part of a partial copy, ready for unionNeuron: the
+ * entries with their sidecars and the identity of the neuron they left.
+ */
+function entriesAsNeuron(q) {
+    return {
+        id: q.neuron_id,
+        name: q.name,
+        type: q.type,
+        domain: q.domain,
+        created: q.taken_at,
+        last_accessed: q.taken_at,
+        access_count: 0,
+        heat: 0,
+        summary: '',
+        facts: q.facts || [],
+        decisions: q.decisions || [],
+        patterns: q.patterns || [],
+        preferences: q.preferences || [],
+        connections: [],
+        tags: [],
+        errors: q.errors || [],
+        debts: q.debts || [],
+        entry_dates: q.entry_dates || {},
+        ...(q.entry_status ? { entry_status: q.entry_status } : {}),
+        ...(q.entry_source ? { entry_source: q.entry_source } : {}),
+        ...(q.entry_verified ? { entry_verified: q.entry_verified } : {}),
+        ...(q.entry_verification ? { entry_verification: q.entry_verification } : {}),
+        ...(q.map ? { map: q.map } : {}),
+    };
+}
+function isEntriesCopy(x) {
+    return !!x && typeof x === 'object' && x.kind === 'entries' && x.quarantine_format === 2;
+}
+//# sourceMappingURL=quarantine.js.map

package/dist/engine/secrets.js

@@ -45,7 +45,15 @@ const PATTERNS = [
         kind: 'auth token (hex)',
         re: /\bauth[ _-]?token\b[^\S\n]{0,3}(?:[:=]|es|is)?[^\S\n]{0,3}["'`]?([0-9a-fA-F]{30,34})\b/gi,
     },
-    { kind: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+    // The whole block, not just its header: the body IS the key. Through the
+    // END line when there is one (16 KB is more than any real key); without
+    // it, every base64 token that follows (16+ characters, or a padded tail);
+    // the first ordinary word stops it. Matching only the header used to
+    // leave the body on disk while the benchmark counted it as caught.
+    {
+        kind: 'private key block',
+        re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----(?:[\s\S]{0,16384}?-----END [A-Z0-9 ]*PRIVATE KEY-----|(?:\s{1,4}(?:[A-Za-z0-9+/]{16,}={0,2}|[A-Za-z0-9+/]{2,}={1,2})(?!\S)){0,256})/g,
+    },
     { kind: 'JSON Web Token', re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
     // WordPress application password: six groups of four, anchored to the label.
     //
@@ -65,8 +73,14 @@ const PATTERNS = [
     // copula ("la contraseña es X", "the password is X") with no separator,
     // requiring the value to mix classes so plain words do not match.
     {
+        // Three shapes after the separator are prose, not a value, and are left
+        // alone (seen on a real brain): a capitalised product name ("Reset
+        // contraseña = Supabase Auth built-in"), an assignment ("contraseña:
+        // key_filename=~/.ssh/id_x") and a path ("~/.ssh/…", "/etc/…").
         kind: 'password',
-        re: /\b(?:password|passwd|contrase[nñ]a)\s*(?:es|is)?\s*[:=]\s*["'`]?([^\s"'`,;]{8,})/gi,
+        // No /i flag: the capitalised-word check needs case. The label is
+        // spelled in the three casings people write.
+        re: /\b(?:[Pp]assword|PASSWORD|[Pp]asswd|PASSWD|[Cc]ontrase[nñ]a|CONTRASE[NÑ]A)\s*(?:es|is|ES|IS)?\s*[:=]\s*["'`]?(?![A-Z][a-z]+(?![^\s"'`,;]))(?![A-Za-z_]+=)(?!~?\/)([^\s"'`,;]{8,})/g,
     },
     {
         // "clave" is also the Spanish adjective "key/important": "Decisión clave:
@@ -89,6 +103,26 @@ const PATTERNS = [
         kind: 'password (prose)',
         re: /\b(?:password|passwd|contrase[nñ]a|clave)\b(?:\s+(?:de|del|of|for)\s+[^\s]{1,30})?\s+(?:es|is)\s+["'`]?((?=[^\s"'`,;]*[A-Za-z])(?=[^\s"'`,;]*[0-9])[^\s"'`,;]{8,})/gi,
     },
+    {
+        // The label with no separator and no copula, as people really jot it:
+        // "PASS Xy7#kk22w", "la contraseña Xy7kk22W (la del panel)". Without a
+        // separator the value carries the whole burden of proof, so it must mix
+        // three of lower case, upper case, digit and symbol — the rule that keeps
+        // "clave" the adjective out (2.9.1). Case-sensitive labels for the same
+        // reason. "pass" in lower case is an English verb ("pass userId42 to…"),
+        // so it gets its own rule below; "clave" stays out of this one entirely.
+        kind: 'password',
+        re: /\b(?:PASS|PASSWORD|PASSWD|[Pp]assword|[Pp]asswd|[Cc]ontrase[nñ]a|CONTRASE[NÑ]A)\b[^\S\n]+["'`]?((?:(?=[^\s"'`,;()]*[a-z])(?=[^\s"'`,;()]*[A-Z])(?=[^\s"'`,;()]*[0-9])|(?=[^\s"'`,;()]*[a-z])(?=[^\s"'`,;()]*[A-Z])(?=[^\s"'`,;()]*[!@#$%^&*+=?~])|(?=[^\s"'`,;()]*[a-z])(?=[^\s"'`,;()]*[0-9])(?=[^\s"'`,;()]*[!@#$%^&*+=?~])|(?=[^\s"'`,;()]*[A-Z])(?=[^\s"'`,;()]*[0-9])(?=[^\s"'`,;()]*[!@#$%^&*+=?~]))[^\s"'`,;()]{8,})/g,
+    },
+    {
+        // "pass" as a label: "user admin pass: Xy7kk22w", "pass Xy7#kk22w".
+        // With ":"/"=" the value needs a letter and a digit or symbol ("pass:
+        // completed" is a test report). Without a separator it needs a letter, a
+        // digit AND a symbol, and may not start with $ or - — that is what keeps
+        // "pass userId42 to the helper", "pass user_id2" and "pass $TOKEN2" out.
+        kind: 'password',
+        re: /\b(?:PASS|[Pp]ass)\b(?:[^\S\n]*[:=][^\S\n]*["'`]?((?=[^\s"'`,;()]*[A-Za-z])(?=[^\s"'`,;()]*[0-9!@#$%^&*+=?~])[^\s"'`,;()]{8,})|[^\S\n]+["'`]?(?![$-])((?=[^\s"'`,;()]*[A-Za-z])(?=[^\s"'`,;()]*[0-9])(?=[^\s"'`,;()]*[!@#$%^&*+=?~])[^\s"'`,;()]{8,}))/g,
+    },
     {
         // A credential dictated in two pieces to slip past filters: "the token
         // starts with ghp_ and continues with <body>". Needs a credential noun,
@@ -133,9 +167,11 @@ function findSecrets(text) {
         re.lastIndex = 0;
         let m;
         while ((m = re.exec(text)) !== null) {
-            // For the labelled-password pattern, redact only the value, not the label.
-            const value = m[1] !== undefined ? m[1] : m[0];
-            const at = m[1] !== undefined ? m.index + m[0].indexOf(m[1]) : m.index;
+            // For the labelled patterns, redact only the value, not the label. A
+            // pattern with alternatives captures the value in whichever group matched.
+            const group = m.slice(1).find(g => g !== undefined);
+            const value = group !== undefined ? group : m[0];
+            const at = group !== undefined ? m.index + m[0].lastIndexOf(group) : m.index;
             hits.push({ kind, index: at, length: value.length });
             if (m[0].length === 0)
                 re.lastIndex++;

package/dist/engine/shelf.js

@@ -103,19 +103,39 @@ const VERSIONED = [
 ];
 const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 const VERSIONED_RE = new RegExp(`(?:^|[^a-z0-9.])(?:${VERSIONED.map(escape).join('|')})[\\s-]?v?\\d+(?:\\.\\d+)*(?![\\d.]*\\d)`, 'i');
+/**
+ * X.Y.Z as a version, but not a thousands-separated number: in Spanish
+ * "1.200.000 visitas" is a count, and it made the fact volatile (2.11).
+ * Every group after the first exactly three digits = a number, not a version.
+ */
+function semverLike(t) {
+    const re = /(?:^|[^\d.])(\d{1,3}(?:\.\d{1,3}){2,})(?:-[0-9a-z.]+)?(?![\d.]*\d)/g;
+    for (const m of t.matchAll(re)) {
+        const grupos = m[1].split('.');
+        if (grupos.length !== 3)
+            continue;
+        if (grupos.slice(1).every(g => g.length === 3))
+            continue; // 1.200.000
+        return true;
+    }
+    return false;
+}
 const RULES = [
     {
         reason: 'version',
         test: (_raw, t) => /\bv\d+(?:\.\d+)+\b/.test(t) // v2.3
             || /\b(?:version|release)\s*:?\s*v?\d+(?:\.\d+)*/.test(t) // version 3.6, versión 5
-            || /(?:^|[^\d.])\d{1,3}\.\d{1,3}\.\d{1,3}(?:-[0-9a-z.]+)?(?![\d.]*\d)/.test(t) // 2.8.0, 1.4.2-beta (not a dd.mm.yyyy day)
+            || semverLike(t) // 2.8.0, 1.4.2-beta (not a dd.mm.yyyy day, not 1.200.000)
             || VERSIONED_RE.test(t), // PostgreSQL 14, Node 22
     },
     {
         reason: 'price',
         test: (_raw, t) => /[€$£¥]\s?\d|\d(?:[.,]\d+)?\s?[€$£¥]/.test(t) // $49, 29 €
             || /\b\d+(?:[.,]\d+)?\s*(?:euros?|eur|usd|dollars?|dolares|libras|pounds?|gbp|mxn|pesos)\b/.test(t)
-            || /\d[^.\n]{0,40}(?:\bal mes\b|\bpor mes\b|\/mes\b|\bper month\b|\ba month\b|\/month\b|\/mo\b|\bal ano\b|\bpor ano\b|\bper year\b|\/year\b|\/yr\b|\bmensuales?\b|\banuales?\b)/.test(t)
+            // A number right before the period ("29 al mes", "29/mes", "9.99 per month"). Not
+            // "3 informes mensuales" or "4 informes al mes" (2.11): a count of things is no
+            // price, and with money in the sentence the currency rules above already fire.
+            || /\d(?:[.,]\d+)?\s?(?:k\s?)?(?:al mes\b|por mes\b|\/mes\b|per month\b|a month\b|\/month\b|\/mo\b|al ano\b|por ano\b|per year\b|\/year\b|\/yr\b)/.test(t)
             || /\b(?:price|pricing|precio|precios|tarifa|tarifas|cuesta|cuestan|cost|costs|fee|cuota)\b[^.\n]{0,30}\d/.test(t),
     },
     {
@@ -145,7 +165,9 @@ const RULES = [
         test: (raw, t) => /\b[A-Z][A-Z0-9]*_[A-Z0-9_]+\s*=\s*\S+/.test(raw) // KEY_NAME=value
             || /(?:^|\s)--[a-z][\w-]*=\S+/.test(raw) // --max-old-space-size=4096
             || /\b[a-z][a-z0-9]*_[a-z0-9_]+\b\s*(?:=|:|de|a|en|to|at|is|es)?\s*\d/.test(t) // memory_limit de 512M
-            || /\b(?:set to|configured (?:to|as|at)|configurad[oa]s? (?:a|en|como)|fijad[oa]s? (?:a|en)|establecid[oa]s? (?:a|en)|timeout|time-out|ttl|rate limit|limit|limite|max|maximo|maximum|minimo|minimum|retries|reintentos|threshold|umbral|batch size|pool size|flag)\b[^.\n]{0,25}?\d/.test(t),
+            || /\b(?:set to|configured (?:to|as|at)|configurad[oa]s? (?:a|en|como)|fijad[oa]s? (?:a|en)|establecid[oa]s? (?:a|en)|timeout|time-out|ttl|rate limit|limit|limite|maximo|maximum|minimo|minimum|retries|reintentos|threshold|umbral|batch size|pool size|flag)\b[^.\n]{0,25}?\d/.test(t)
+            // "max" only as written in lower case: "Max Planck nacio en 1858" is a name (2.11).
+            || /\b(?:max|MAX)\b[^.\n]{0,25}?\d/.test(raw),
     },
 ];
 /** Role words, as written (first letter either case, rest lower) or as acronyms. */