dsh-harbor-evolution 0.8.2 → 0.9.2

package/lib/composer-context.js

@@ -0,0 +1,56 @@
+const TOKEN_PATTERN = 'hctx_[A-Za-z0-9_-]{20,80}'
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function rawReferencePattern(token, global = false) {
+  const ref = token ? escapeRegExp(token) : TOKEN_PATTERN
+  return new RegExp(`@harbor(?:\\[[^\\]\\r\\n]{0,300}\\])?\\(${ref}\\)[ \\t]?`, global ? 'g' : '')
+}
+
+function occurrenceRanges(occurrences, token) {
+  return (Array.isArray(occurrences) ? occurrences : [])
+    .filter(item => item?.source === 'harbor' && (!token || item.ref === token))
+    .map(item => ({ start: Number(item.offset), end: Number(item.offset) + Number(item.length) }))
+    .filter(item => Number.isSafeInteger(item.start) && Number.isSafeInteger(item.end) && item.start >= 0 && item.end >= item.start)
+    .sort((left, right) => right.start - left.start)
+}
+
+/** Locate literal Harbor references that are not owned by another structured chip. */
+export function rawHarborReferenceRanges(value, occurrences = [], token) {
+  const draft = String(value ?? '')
+  const occupied = (Array.isArray(occurrences) ? occurrences : [])
+    .map(item => ({ start: Number(item?.offset), end: Number(item?.offset) + Number(item?.length) }))
+    .filter(item => Number.isSafeInteger(item.start) && Number.isSafeInteger(item.end) && item.start >= 0 && item.end >= item.start)
+  return [...draft.matchAll(rawReferencePattern(token, true))]
+    .map(match => ({ start: match.index, end: match.index + match[0].length }))
+    .filter(range => !occupied.some(item => range.start < item.end && item.start < range.end))
+    .sort((left, right) => right.start - left.start)
+}
+
+/** Remove Harbor references while preserving all non-reference draft text. */
+export function stripHarborReferences(value, occurrences = [], token) {
+  let draft = String(value ?? '')
+  const ranges = [...occurrenceRanges(occurrences, token), ...rawHarborReferenceRanges(draft, occurrences, token)]
+    .sort((left, right) => right.start - left.start)
+  for (const range of ranges) {
+    if (range.end > draft.length) continue
+    const end = draft[range.end] === ' ' ? range.end + 1 : range.end
+    draft = draft.slice(0, range.start) + draft.slice(end)
+  }
+  return draft
+}
+
+export function hasHarborReference(value, occurrences = [], token) {
+  if (!token) return false
+  if ((Array.isArray(occurrences) ? occurrences : []).some(item => item?.source === 'harbor' && item.ref === token)) return true
+  return rawHarborReferenceRanges(value, occurrences, token).length > 0
+}
+
+/** Enforce one explicit Harbor reference and retain the latest user-authored body. */
+export function withHarborReference(value, reference, prompt = '', occurrences = []) {
+  const retained = stripHarborReferences(value, occurrences).replace(/^[ \t]+/, '')
+  const body = retained || String(prompt ?? '')
+  return `${reference}${body ? ` ${body}` : ''}`
+}

package/lib/credential-redaction.js

@@ -0,0 +1,155 @@
+const SENSITIVE_ASSIGNMENT_NAMES = [
+  'authorization', 'cookie', 'cookies', 'token', 'auth[_-]?token',
+  'access[_-]?token', 'refresh[_-]?token', 'session[_-]?token',
+  'api[_-]?key', 'access[_-]?key', 'client[_-]?secret', 'secret',
+  'secret[_-]?key', 'secret[_-]?access[_-]?key', 'private[_-]?key',
+  'password', 'passwd',
+].join('|')
+
+// Environment variables commonly namespace a sensitive suffix, for example
+// OPENAI_API_KEY, MY_ACCESS_TOKEN, or AWS_SECRET_ACCESS_KEY. Keep each namespace
+// segment unambiguous and bound the segment count: an unbounded repetition whose
+// inner token could also consume "-" caused catastrophic backtracking on benign
+// hyphenated text.
+const SENSITIVE_ASSIGNMENT_KEY = `(?:[A-Za-z][A-Za-z0-9]*[_-]){0,16}(?:${SENSITIVE_ASSIGNMENT_NAMES})`
+const ASSIGNMENT_VALUE = new RegExp(
+  `(^|[^A-Za-z0-9_])(["'\`]?)(${SENSITIVE_ASSIGNMENT_KEY})\\2\\s*[:=][^\\r\\n]*`,
+  'gim',
+)
+const ASSIGNMENT_VALUE_TEST = new RegExp(
+  `(^|[^A-Za-z0-9_])(["'\`]?)(${SENSITIVE_ASSIGNMENT_KEY})\\2\\s*[:=]`,
+  'im',
+)
+const QUOTED_AUTH_VALUE = /(["'`])(Bearer|Basic)\s+[^\r\n]*/gi
+const AUTH_VALUE = /\b(Bearer|Basic)\s+[^\s,;"'`<>]+/gi
+const AUTH_VALUE_TEST = /\b(?:Bearer|Basic)\s+(?:["'`]|[^\s,;"'`<>])/i
+const URL_USERINFO_VALUE = /\b([A-Za-z][A-Za-z0-9+.-]{0,31}:\/\/)(?!\[REDACTED[^\]]*\]@)([^/\s?#@"'`<>]+)@/gi
+const URL_USERINFO_VALUE_TEST = /\b[A-Za-z][A-Za-z0-9+.-]{0,31}:\/\/(?!\[REDACTED[^\]]*\]@)[^/\s?#@"'`<>]+@/i
+const POSIX_LOCAL_PATH = /(?<![A-Za-z0-9:/])\/(?:[^/\r\n"'`<>,;]+\/)+[^/\r\n"'`<>,;]*|(?<![A-Za-z0-9:/])\/[A-Za-z0-9._~+-]+(?=$|[\s"'`<>,;])/g
+const POSIX_LOCAL_PATH_TEST = /(?<![A-Za-z0-9:/])\/(?:[^/\r\n"'`<>,;]+\/)+[^/\r\n"'`<>,;]*|(?<![A-Za-z0-9:/])\/[A-Za-z0-9._~+-]+(?=$|[\s"'`<>,;])/
+const WINDOWS_LOCAL_PATH = /(?:\b[A-Za-z]:\\|\\\\)[^\r\n"'`<>,;]*/g
+const WINDOWS_LOCAL_PATH_TEST = /(?:\b[A-Za-z]:\\|\\\\)[^\r\n"'`<>,;]*/
+const SENSITIVE_CONTAINER_KEY = /authorization|cookie|token|api[_-]?key|secret|password|request[_-]?headers/i
+const SENSITIVE_CONTAINER_SUFFIXES = [
+  /headers?$/,
+  /headermaps?$/,
+  /env$/,
+  /env(?:vars?|maps?)$/,
+  /environment$/,
+  /environment(?:variables?|vars?|maps?)$/,
+  /credentials?$/,
+  /credentials?(?:maps?|stores?|values?)$/,
+]
+
+const OPAQUE_SECRET_RULES = [
+  {
+    kind: 'pem',
+    // No footer is still sensitive: fail closed from the BEGIN line through
+    // the end of the string instead of returning a truncated private key.
+    pattern: /-----BEGIN [^-\r\n]{1,80}-----[\s\S]*?(?:-----END [^-\r\n]{1,80}-----|$)/gi,
+  },
+  {
+    kind: 'token',
+    pattern: /\b(?:sk|rk|pk)-(?:proj-)?[A-Za-z0-9_-]{12,}\b|\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b|\bxox[a-z]?-[A-Za-z0-9-]{10,}\b/gi,
+  },
+  {
+    kind: 'jwt',
+    pattern: /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g,
+  },
+  {
+    kind: 'aws',
+    pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+  },
+]
+
+function replacementFor(replacement, kind) {
+  return typeof replacement === 'function' ? replacement(kind) : replacement
+}
+
+export function isSensitiveCredentialContainerKey(value) {
+  const key = String(value ?? '')
+  if (SENSITIVE_CONTAINER_KEY.test(key)) return true
+  const canonical = key.replace(/[^A-Za-z0-9]/g, '').toLowerCase()
+  return SENSITIVE_CONTAINER_SUFFIXES.some(pattern => pattern.test(canonical))
+}
+
+export function redactCredentialTextWithCount(value, replacement = '[REDACTED]', preserveKey = true) {
+  let replacements = 0
+  let text = String(value ?? '').replace(
+    ASSIGNMENT_VALUE,
+    (_match, prefix, quote, key) => {
+      replacements += 1
+      return preserveKey ? `${prefix}${quote}${key}${quote}=${replacement}` : `${prefix}${replacement}`
+    },
+  )
+  text = text.replace(QUOTED_AUTH_VALUE, (_match, quote, scheme) => {
+    replacements += 1
+    return preserveKey ? `${quote}${scheme} ${replacement}${quote}` : replacement
+  })
+  text = text.replace(AUTH_VALUE, (_match, scheme) => {
+    replacements += 1
+    return preserveKey ? `${scheme} ${replacement}` : replacement
+  })
+  text = text.replace(URL_USERINFO_VALUE, (_match, scheme) => {
+    replacements += 1
+    return preserveKey ? `${scheme}${replacement}@` : scheme
+  })
+  return { text, replacements }
+}
+
+export function redactCredentialText(value, replacement = '[REDACTED]') {
+  return redactCredentialTextWithCount(value, replacement).text
+}
+
+export function containsCredentialText(value) {
+  const text = String(value ?? '')
+  return ASSIGNMENT_VALUE_TEST.test(text) || AUTH_VALUE_TEST.test(text) || URL_USERINFO_VALUE_TEST.test(text)
+}
+
+export function redactOpaqueSecretTextWithCount(value, replacement = '[REDACTED]') {
+  let text = String(value ?? '')
+  let replacements = 0
+  for (const rule of OPAQUE_SECRET_RULES) {
+    text = text.replace(rule.pattern, () => {
+      replacements += 1
+      return replacementFor(replacement, rule.kind)
+    })
+  }
+  return { text, replacements }
+}
+
+export function redactOpaqueSecretText(value, replacement = '[REDACTED]') {
+  return redactOpaqueSecretTextWithCount(value, replacement).text
+}
+
+export function containsOpaqueSecretText(value) {
+  const text = String(value ?? '')
+  return OPAQUE_SECRET_RULES.some(rule => {
+    rule.pattern.lastIndex = 0
+    const matched = rule.pattern.test(text)
+    rule.pattern.lastIndex = 0
+    return matched
+  })
+}
+
+export function redactLocalPathsWithCount(value, replacement = '[local path]') {
+  let replacements = 0
+  let text = String(value ?? '').replace(POSIX_LOCAL_PATH, () => {
+    replacements += 1
+    return replacement
+  })
+  text = text.replace(WINDOWS_LOCAL_PATH, () => {
+    replacements += 1
+    return replacement
+  })
+  return { text, replacements }
+}
+
+export function redactLocalPaths(value, replacement = '[local path]') {
+  return redactLocalPathsWithCount(value, replacement).text
+}
+
+export function containsLocalPath(value) {
+  const text = String(value ?? '')
+  return POSIX_LOCAL_PATH_TEST.test(text) || WINDOWS_LOCAL_PATH_TEST.test(text)
+}