engineering-memory 1.11.0 → 1.11.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/dist/src/runtime/bridge-service.js

@@ -1019,16 +1019,26 @@ export class BridgeService {
             if (!run || typeof run.id !== 'string')
                 throw refuse('The inspection response has no run identity.', 'memory.sync_status');
             if (run.state === 'inventory' || run.state === 'planning') {
-                for (let offset = 0; offset < snapshot.files.length; offset += 1000) {
-                    const page = cleanJson({
+                for (let offset = 0; offset < snapshot.files.length;) {
+                    const page = {
                         projectId: input.projectId,
                         runId: run.id,
-                        files: snapshot.files.slice(offset, offset + 1000),
-                    });
-                    assertSafeToPersist(page);
+                        files: [],
+                    };
+                    let bytes = Buffer.byteLength(JSON.stringify(page));
+                    while (offset < snapshot.files.length && page.files.length < 1000) {
+                        const file = snapshot.files[offset];
+                        const addedBytes = Buffer.byteLength(JSON.stringify(file)) + (page.files.length ? 1 : 0);
+                        if (page.files.length && bytes + addedBytes > 64 * 1024)
+                            break;
+                        page.files.push(file);
+                        bytes += addedBytes;
+                        offset += 1;
+                    }
+                    assertSafeToPersist(cleanJson(page));
                     await this.dependencies.client.request('/memory/sync/inventory', {
                         method: 'POST',
-                        body: page,
+                        body: cleanJson(page),
                     });
                 }
                 await this.dependencies.client.request('/memory/sync/inventory', {

package/runtime/dist/src/runtime/offline-outbox.js

@@ -4,14 +4,139 @@ import { join } from 'node:path';
 import { assertManagedPath, ensureManagedDirectory, readJson, removeFile, writeJson, } from '../utilities/files.js';
 import { sha256, stableStringify } from '../utilities/hash.js';
 const sensitiveKeyPattern = /(authorization|password|passcode|secret|token|cookie|email|phone|mobile|customer|account|user.?id|user.?name)/i;
-const emailPattern = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i;
+const emailSource = '(?:^|[^\\p{L}\\p{N}._%+-])[\\p{L}\\p{N}._%+-]{1,64}@([\\p{L}\\p{N}.-]+\\.[\\p{L}]{2,63})(?=$|[^\\p{L}\\p{N}.-])';
+const emailPattern = new RegExp(emailSource, 'iu');
+const emailMatchPattern = new RegExp(emailSource, 'giu');
 const phonePattern = /\+\d[\d ()-]{7,}\d/;
+const repositoryPathFields = new Set([
+    'path',
+    'paths',
+    'originalPath',
+    'changedPaths',
+    'pathPatterns',
+    'evidencePaths',
+    'screenPathPatterns',
+    'componentPathPatterns',
+    'pathChanges',
+    'templatePath',
+]);
+const topLevelDomains = new Set([
+    'com',
+    'net',
+    'org',
+    'edu',
+    'gov',
+    'mil',
+    'int',
+    'info',
+    'biz',
+    'name',
+    'pro',
+    'mobi',
+    'tel',
+    'asia',
+    'jobs',
+    'coop',
+    'aero',
+    'museum',
+    'travel',
+    'app',
+    'dev',
+    'cloud',
+    'online',
+    'site',
+    'store',
+    'tech',
+    'space',
+    'website',
+    'digital',
+    'agency',
+    'systems',
+    'solutions',
+    'email',
+    'xyz',
+    'top',
+    'club',
+    'live',
+    'life',
+    'world',
+    'today',
+    'network',
+    'group',
+    'company',
+    'center',
+    'media',
+    'studio',
+    'design',
+    'software',
+    'tools',
+    'works',
+    'team',
+    'zone',
+    'one',
+    'ltd',
+    'inc',
+    'llc',
+    'gmbh',
+    'shop',
+    'page',
+    'blog',
+    'wiki',
+    'news',
+    'art',
+    'link',
+    'host',
+    'press',
+    'fyi',
+    'test',
+    'example',
+    'invalid',
+    'local',
+    'localhost',
+    'internal',
+]);
+const countryCodeTopLevelDomains = new Set('ac ad ae af ag ai al am ao aq ar as at au aw ax az ba bb bd be bf bg bh bi bj bm bn bo br bs bt bw by bz ca cc cd cf cg ch ci ck cl cm cn co cr cu cv cw cx cy cz de dj dk dm do dz ec ee eg er es et eu fi fj fk fm fo fr ga gd ge gf gg gh gi gl gm gn gp gq gr gs gt gu gw gy hk hm hn hr ht hu id ie il im in io iq ir is it je jm jo jp ke kg kh ki km kn kp kr kw ky kz la lb lc li lk lr ls lt lu lv ly ma mc md me mg mh mk ml mm mn mo mp mq mr ms mt mu mv mw mx my mz na nc ne nf ng ni nl no np nr nu nz om pa pe pf pg ph pk pl pm pn pr ps pt pw py qa re ro rs ru rw sa sb sc sd se sg sh si sk sl sm sn so sr ss st su sv sx sy sz tc td tf tg th tj tk tl tm tn to tr tt tv tw tz ua ug uk us uy uz va vc ve vg vi vn vu wf ws ye yt za zm zw'.split(' '));
+function isTopLevelDomain(label) {
+    const value = label.toLowerCase();
+    return countryCodeTopLevelDomains.has(value) || topLevelDomains.has(value);
+}
+const extensionTopLevelDomains = new Set([
+    'ai',
+    'app',
+    'as',
+    'cc',
+    'md',
+    'ml',
+    'mm',
+    'pl',
+    'py',
+    'rs',
+    'sh',
+    'so',
+]);
+function hasEmailAddress(value, repositoryPath) {
+    if (!repositoryPath)
+        return emailPattern.test(value);
+    for (const match of value.matchAll(emailMatchPattern)) {
+        const labels = (match[1] ?? '').split('.');
+        const last = (labels[labels.length - 1] ?? '').toLowerCase();
+        if (isTopLevelDomain(last) && !extensionTopLevelDomains.has(last))
+            return true;
+        const beforeExtension = (labels[labels.length - 2] ?? '').toLowerCase();
+        if (labels.length >= 3 &&
+            topLevelDomains.has(beforeExtension) &&
+            !extensionTopLevelDomains.has(beforeExtension))
+            return true;
+    }
+    return false;
+}
+const knownCredentialPattern = /\b(?:A(?:KI|SI)A[0-9A-Z]{16}|gh[pousr]_[A-Z0-9]{30,}|github_pat_[A-Z0-9_]{30,}|sk_live_[A-Z0-9]{16,}|rk_live_[A-Z0-9]{16,}|xox[baprs]-[A-Z0-9-]{12,}|AIza[A-Z0-9_-]{35}|sk-(?:proj-)?[A-Z0-9_-]{20,})\b/i;
 const bearerPattern = /\bbearer\s+[a-z0-9._~-]+/i;
 const jwtPattern = /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/;
 const privateKeyPattern = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/;
 const credentialUrlPattern = /\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:[^\s/@]+@/i;
 const ipv4Pattern = /\b(?:\d{1,3}\.){3}\d{1,3}\b/;
-const personalHomePathPattern = /(?:^|[\s"'(])(?:[A-Z]:[\\/]+Users[\\/]+[^\\/\s"']+(?:[\\/]|(?=$|\s))|\/(?:Users|home)\/[^/\s"']+(?:\/|(?=$|\s)))/i;
+const personalHomePathPattern = /(?:[A-Z]:[\\/](?:Users|Documents and Settings)[\\/][^\\/\s"'<>:|?*]+|(?:^|[\s"'(<=])\/(?:Users|home)\/[^/\s"'<>*]+)(?:[\\/]|$)/i;
 export class OfflineOutbox {
     root;
     queues = new Map();
@@ -155,15 +280,17 @@ export function assertSafeToPersist(value, key = '') {
         throw new Error(`Sensitive field cannot be persisted: ${key}`);
     }
     if (typeof value === 'string') {
-        if (emailPattern.test(value) ||
+        const repositoryPath = repositoryPathFields.has(key);
+        if (hasEmailAddress(value, repositoryPath) ||
             phonePattern.test(value) ||
             bearerPattern.test(value) ||
             jwtPattern.test(value) ||
             privateKeyPattern.test(value) ||
+            knownCredentialPattern.test(value) ||
             credentialUrlPattern.test(value) ||
-            ipv4Pattern.test(value) ||
-            personalHomePathPattern.test(value)) {
-            throw new Error('PII or credentials cannot be persisted');
+            personalHomePathPattern.test(value) ||
+            (!repositoryPath && ipv4Pattern.test(value))) {
+            throw new Error(`PII or credentials cannot be persisted: ${key} ${value}`);
         }
         return;
     }
@@ -199,13 +326,13 @@ export function redactForCache(value) {
         return null;
     }
 }
-function redactValue(value) {
+function redactValue(value, key = '') {
     if (typeof value === 'string') {
-        assertSafeToPersist(value);
+        assertSafeToPersist(value, key);
         return value;
     }
     if (Array.isArray(value)) {
-        return value.map((entry) => redactValue(entry));
+        return value.map((entry) => redactValue(entry, key));
     }
     if (value !== null && typeof value === 'object') {
         const result = {};
@@ -213,7 +340,7 @@ function redactValue(value) {
             if (sensitiveKeyPattern.test(key)) {
                 continue;
             }
-            result[key] = redactValue(entry);
+            result[key] = redactValue(entry, key);
         }
         return result;
     }