engineering-memory 1.11.1 → 1.11.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.11.1",
+  "version": "1.11.2",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/dist/src/runtime/offline-outbox.js

@@ -4,7 +4,9 @@ import { join } from 'node:path';
 import { assertManagedPath, ensureManagedDirectory, readJson, removeFile, writeJson, } from '../utilities/files.js';
 import { sha256, stableStringify } from '../utilities/hash.js';
 const sensitiveKeyPattern = /(authorization|password|passcode|secret|token|cookie|email|phone|mobile|customer|account|user.?id|user.?name)/i;
-const emailPattern = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i;
+const emailSource = '(?:^|[^\\p{L}\\p{N}._%+-])[\\p{L}\\p{N}._%+-]{1,64}@([\\p{L}\\p{N}.-]+\\.[\\p{L}]{2,63})(?=$|[^\\p{L}\\p{N}.-])';
+const emailPattern = new RegExp(emailSource, 'iu');
+const emailMatchPattern = new RegExp(emailSource, 'giu');
 const phonePattern = /\+\d[\d ()-]{7,}\d/;
 const repositoryPathFields = new Set([
     'path',
@@ -13,21 +15,128 @@ const repositoryPathFields = new Set([
     'changedPaths',
     'pathPatterns',
     'evidencePaths',
+    'screenPathPatterns',
+    'componentPathPatterns',
+    'pathChanges',
+    'templatePath',
 ]);
-const iosAssetScalePathPattern = /^(?:[\p{L}\p{N}_. -]+\/)*[\p{L}\p{N}_. -]+\.xcassets\/[\p{L}\p{N}_. -]+\.(?:appiconset|imageset)\/[\p{L}\p{N}_. -]+@[123]x\.(?:png|jpe?g)$/iu;
-function emailScanValue(value, key) {
-    if (!repositoryPathFields.has(key) ||
-        !iosAssetScalePathPattern.test(value) ||
-        value.split('/').some((part) => part === '.' || part === '..'))
-        return value;
-    return value.replace(/@[123]x(?=\.(?:png|jpe?g)$)/i, '');
+const topLevelDomains = new Set([
+    'com',
+    'net',
+    'org',
+    'edu',
+    'gov',
+    'mil',
+    'int',
+    'info',
+    'biz',
+    'name',
+    'pro',
+    'mobi',
+    'tel',
+    'asia',
+    'jobs',
+    'coop',
+    'aero',
+    'museum',
+    'travel',
+    'app',
+    'dev',
+    'cloud',
+    'online',
+    'site',
+    'store',
+    'tech',
+    'space',
+    'website',
+    'digital',
+    'agency',
+    'systems',
+    'solutions',
+    'email',
+    'xyz',
+    'top',
+    'club',
+    'live',
+    'life',
+    'world',
+    'today',
+    'network',
+    'group',
+    'company',
+    'center',
+    'media',
+    'studio',
+    'design',
+    'software',
+    'tools',
+    'works',
+    'team',
+    'zone',
+    'one',
+    'ltd',
+    'inc',
+    'llc',
+    'gmbh',
+    'shop',
+    'page',
+    'blog',
+    'wiki',
+    'news',
+    'art',
+    'link',
+    'host',
+    'press',
+    'fyi',
+    'test',
+    'example',
+    'invalid',
+    'local',
+    'localhost',
+    'internal',
+]);
+const countryCodeTopLevelDomains = new Set('ac ad ae af ag ai al am ao aq ar as at au aw ax az ba bb bd be bf bg bh bi bj bm bn bo br bs bt bw by bz ca cc cd cf cg ch ci ck cl cm cn co cr cu cv cw cx cy cz de dj dk dm do dz ec ee eg er es et eu fi fj fk fm fo fr ga gd ge gf gg gh gi gl gm gn gp gq gr gs gt gu gw gy hk hm hn hr ht hu id ie il im in io iq ir is it je jm jo jp ke kg kh ki km kn kp kr kw ky kz la lb lc li lk lr ls lt lu lv ly ma mc md me mg mh mk ml mm mn mo mp mq mr ms mt mu mv mw mx my mz na nc ne nf ng ni nl no np nr nu nz om pa pe pf pg ph pk pl pm pn pr ps pt pw py qa re ro rs ru rw sa sb sc sd se sg sh si sk sl sm sn so sr ss st su sv sx sy sz tc td tf tg th tj tk tl tm tn to tr tt tv tw tz ua ug uk us uy uz va vc ve vg vi vn vu wf ws ye yt za zm zw'.split(' '));
+function isTopLevelDomain(label) {
+    const value = label.toLowerCase();
+    return countryCodeTopLevelDomains.has(value) || topLevelDomains.has(value);
+}
+const extensionTopLevelDomains = new Set([
+    'ai',
+    'app',
+    'as',
+    'cc',
+    'md',
+    'ml',
+    'mm',
+    'pl',
+    'py',
+    'rs',
+    'sh',
+    'so',
+]);
+function hasEmailAddress(value, repositoryPath) {
+    if (!repositoryPath)
+        return emailPattern.test(value);
+    for (const match of value.matchAll(emailMatchPattern)) {
+        const labels = (match[1] ?? '').split('.');
+        const last = (labels[labels.length - 1] ?? '').toLowerCase();
+        if (isTopLevelDomain(last) && !extensionTopLevelDomains.has(last))
+            return true;
+        const beforeExtension = (labels[labels.length - 2] ?? '').toLowerCase();
+        if (labels.length >= 3 &&
+            topLevelDomains.has(beforeExtension) &&
+            !extensionTopLevelDomains.has(beforeExtension))
+            return true;
+    }
+    return false;
 }
+const knownCredentialPattern = /\b(?:A(?:KI|SI)A[0-9A-Z]{16}|gh[pousr]_[A-Z0-9]{30,}|github_pat_[A-Z0-9_]{30,}|sk_live_[A-Z0-9]{16,}|rk_live_[A-Z0-9]{16,}|xox[baprs]-[A-Z0-9-]{12,}|AIza[A-Z0-9_-]{35}|sk-(?:proj-)?[A-Z0-9_-]{20,})\b/i;
 const bearerPattern = /\bbearer\s+[a-z0-9._~-]+/i;
 const jwtPattern = /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/;
 const privateKeyPattern = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/;
 const credentialUrlPattern = /\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:[^\s/@]+@/i;
 const ipv4Pattern = /\b(?:\d{1,3}\.){3}\d{1,3}\b/;
-const personalHomePathPattern = /(?:^|[\s"'(])(?:[A-Z]:[\\/]+Users[\\/]+[^\\/\s"']+(?:[\\/]|(?=$|\s))|\/(?:Users|home)\/[^/\s"']+(?:\/|(?=$|\s)))/i;
+const personalHomePathPattern = /(?:[A-Z]:[\\/](?:Users|Documents and Settings)[\\/][^\\/\s"'<>:|?*]+|(?:^|[\s"'(<=])\/(?:Users|home)\/[^/\s"'<>*]+)(?:[\\/]|$)/i;
 export class OfflineOutbox {
     root;
     queues = new Map();
@@ -171,15 +280,17 @@ export function assertSafeToPersist(value, key = '') {
         throw new Error(`Sensitive field cannot be persisted: ${key}`);
     }
     if (typeof value === 'string') {
-        if (emailPattern.test(emailScanValue(value, key)) ||
+        const repositoryPath = repositoryPathFields.has(key);
+        if (hasEmailAddress(value, repositoryPath) ||
             phonePattern.test(value) ||
             bearerPattern.test(value) ||
             jwtPattern.test(value) ||
             privateKeyPattern.test(value) ||
+            knownCredentialPattern.test(value) ||
             credentialUrlPattern.test(value) ||
-            ipv4Pattern.test(value) ||
-            personalHomePathPattern.test(value)) {
-            throw new Error('PII or credentials cannot be persisted');
+            personalHomePathPattern.test(value) ||
+            (!repositoryPath && ipv4Pattern.test(value))) {
+            throw new Error(`PII or credentials cannot be persisted: ${key} ${value}`);
         }
         return;
     }