dsh-harbor-evolution 0.8.3 → 0.9.2

package/lib/session-diagnostic.js

@@ -215,7 +215,6 @@ export class SessionDiagnosticService {
       schema_version: 1,
       capability: 'historical-generation-evaluation',
       jobKind: 'historical-generation-evaluation',
-      projectRoot: identity.projectRoot,
       scope: 'exact-cwd',
       order: 'last-activity-desc',
       ...(createdAfter === undefined ? {} : { createdAfter: new Date(createdAfter).toISOString() }),

package/lib/session-redaction.js

@@ -1,20 +1,17 @@
 import { canonicalDigest } from './session-selection.js'
+import {
+  containsCredentialText,
+  containsLocalPath,
+  containsOpaqueSecretText,
+  redactCredentialTextWithCount,
+  redactLocalPathsWithCount,
+  redactOpaqueSecretTextWithCount,
+} from './credential-redaction.js'
 
 const MAX_MESSAGE_CHARS = 4_000
 const MAX_TRANSCRIPT_MESSAGES = 80
 const MAX_OBSERVATION_BYTES = 512 * 1024
 
-const SECRET_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,
-  /\b(?:authorization\s*[:=]\s*(?:bearer\s+)?|bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi,
-  /\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|secret|password|passwd)\s*[:=]\s*["']?[^\s,"'}\]]{4,}/gi,
-  /\b(?:sk|rk|pk)-[A-Za-z0-9_-]{12,}\b/g,
-  /\bgh[opusr]_[A-Za-z0-9]{20,}\b/g,
-  /\bAKIA[0-9A-Z]{16}\b/g,
-]
-
-const ABSOLUTE_PATH = /(?:[A-Za-z]:\\(?:[^\s<>:"|?*]+\\)+[^\s<>:"|?*]*|\/(?:Users|home|private|tmp|var|etc|opt|Volumes|workspace)(?:\/[A-Za-z0-9._ @+-]+)+)/g
-
 function replaceCanaries(value, canaries) {
   let text = value
   let replacements = 0
@@ -29,20 +26,13 @@ function replaceCanaries(value, canaries) {
 
 function replaceSecrets(value, canaries = []) {
   const canaryResult = replaceCanaries(value, canaries)
-  value = canaryResult.text
-  let text = value
-  let replacements = canaryResult.replacements
-  for (const pattern of SECRET_PATTERNS) {
-    text = text.replace(pattern, () => {
-      replacements += 1
-      return '[REDACTED_SECRET]'
-    })
+  const credentials = redactCredentialTextWithCount(canaryResult.text, '[REDACTED_SECRET]', false)
+  const opaque = redactOpaqueSecretTextWithCount(credentials.text, '[REDACTED_SECRET]')
+  const paths = redactLocalPathsWithCount(opaque.text, '[REDACTED_PATH]')
+  return {
+    text: paths.text,
+    replacements: canaryResult.replacements + credentials.replacements + opaque.replacements + paths.replacements,
   }
-  text = text.replace(ABSOLUTE_PATH, () => {
-    replacements += 1
-    return '[REDACTED_PATH]'
-  })
-  return { text, replacements }
 }
 
 function sanitizeText(value, maxChars = MAX_MESSAGE_CHARS, canaries = []) {
@@ -181,14 +171,10 @@ function assertNoSecret(value, canaries = []) {
       throw new Error('SESSION_REDACTION_FAILED: a raw Session id survived the redaction pipeline')
     }
   }
-  for (const pattern of SECRET_PATTERNS) {
-    pattern.lastIndex = 0
-    if (pattern.test(serialized)) {
-      throw new Error('SESSION_REDACTION_FAILED: a credential-shaped value survived the redaction pipeline')
-    }
+  if (containsCredentialText(serialized) || containsOpaqueSecretText(serialized)) {
+    throw new Error('SESSION_REDACTION_FAILED: a credential-shaped value survived the redaction pipeline')
   }
-  ABSOLUTE_PATH.lastIndex = 0
-  if (ABSOLUTE_PATH.test(serialized)) {
+  if (containsLocalPath(serialized)) {
     throw new Error('SESSION_REDACTION_FAILED: an absolute local path survived the redaction pipeline')
   }
   if (Buffer.byteLength(serialized) > MAX_OBSERVATION_BYTES) {

package/lib/session-selection.js

@@ -1,6 +1,7 @@
 import { createHash, randomBytes } from 'node:crypto'
 import path from 'node:path'
 
+import { containsCredentialText, containsLocalPath, containsOpaqueSecretText } from './credential-redaction.js'
 import { foldSessionDiagnosticIndex } from './session-projection.js'
 
 function canonicalize(value) {
@@ -45,9 +46,10 @@ function safeIdentity(value, rawSessionId) {
   const text = typeof value === 'string' ? value : ''
   if (rawSessionId && text.includes(rawSessionId)) return '[redacted-identity]'
   if (
-    /(?:api[_-]?key|token|secret|password|authorization|bearer\s+)/i.test(text)
-    || /(?:^|[\\/])(?:Users|home|private|tmp|var|etc|opt|Volumes)(?:[\\/]|$)/.test(text)
-    || /\b(?:sk|rk|pk)-[A-Za-z0-9_-]{12,}\b/.test(text)
+    containsCredentialText(text)
+    || containsOpaqueSecretText(text)
+    || containsLocalPath(text)
+    || /(?:api[_-]?key|token|secret|password|authorization)/i.test(text)
   ) return '[redacted-identity]'
   return text.slice(0, 160)
 }

package/lib/trial-selection.js

@@ -0,0 +1,46 @@
+import { randomBytes } from 'node:crypto'
+import { localObjectDigest } from './interaction-objects.js'
+
+export const MAX_SELECTED_TRIALS = 1000
+
+/** Server-owned, frozen IDs/revisions; a query can never silently expand later. */
+export class TrialSelectionRegistry {
+  constructor({ now = Date.now, ttlMs = 15 * 60_000, maxEntries = 256 } = {}) {
+    this.now = now
+    this.ttlMs = ttlMs
+    this.maxEntries = maxEntries
+    this.entries = new Map()
+  }
+  issue({ sessionId, projectRoot, workspace, job, mode, filters, trials }) {
+    for (const [id, entry] of this.entries) if (entry.expiresAtMs <= this.now()) this.entries.delete(id)
+    if (!['explicit', 'query-snapshot'].includes(mode) || !trials?.length || trials.length > MAX_SELECTED_TRIALS) throw new Error('HARBOR_SELECTION_INVALID: Select 1–1000 Trials.')
+    if (this.entries.size >= this.maxEntries) throw new Error('HARBOR_SELECTION_LIMIT: Too many selections; wait for old selections to expire.')
+    const members = trials.map(trial => ({ id: trial.id, revision: localObjectDigest(trial) }))
+    if (new Set(members.map(item => item.id)).size !== members.length || members.some(item => !item.id)) throw new Error('HARBOR_SELECTION_INVALID: Trial identities must be unique.')
+    const filterDigest = localObjectDigest(filters ?? {})
+    const sourceDigest = localObjectDigest({ mode, filterDigest, members })
+    const id = `hsel_${randomBytes(18).toString('base64url')}`
+    const ref = { kind: 'trial-set', id, job, stage: 'judge', sourceDigest, selectionCount: members.length }
+    const entry = { ref, sessionId: String(sessionId), projectRoot, workspace, job, mode, filterDigest, members, expiresAtMs: this.now() + this.ttlMs }
+    this.entries.set(id, structuredClone(entry))
+    return { ref, count: members.length, mode, filterDigest, expiresAt: new Date(entry.expiresAtMs).toISOString() }
+  }
+  owned(ref, owner) {
+    const entry = this.entries.get(ref.id)
+    if (!entry || entry.expiresAtMs <= this.now()) throw new Error('HARBOR_SELECTION_EXPIRED: Select the Trial set again.')
+    if (entry.sessionId !== String(owner.sessionId) || entry.projectRoot !== owner.projectRoot || entry.workspace !== owner.workspace || entry.job !== ref.job || entry.ref.sourceDigest !== ref.sourceDigest || entry.ref.selectionCount !== ref.selectionCount) throw new Error('HARBOR_SELECTION_DENIED: Selection does not belong to this Session and Job.')
+    return entry
+  }
+  memberIds(ref, owner) {
+    return this.owned(ref, owner).members.map(member => member.id)
+  }
+  resolve(ref, owner, currentTrials) {
+    const entry = this.owned(ref, owner)
+    const byId = new Map(currentTrials.map(trial => [trial.id, trial]))
+    for (const member of entry.members) {
+      const current = byId.get(member.id)
+      if (!current || localObjectDigest(current) !== member.revision) throw new Error('HARBOR_CONTEXT_STALE_SELECTION: Selected Trials changed. Reselect before continuing.')
+    }
+    return { ref: { ...entry.ref }, value: { mode: entry.mode, filterDigest: entry.filterDigest, count: entry.members.length, members: entry.members, trials: entry.members.map(member => byId.get(member.id)) } }
+  }
+}