fdeops 3.7.2 → 3.7.3

package/bin/fde.js

@@ -111,9 +111,17 @@ function resolveEngagement() {
       }
     } catch (_) {}
   }
-  // 4) workspace dir name matches an engagement slug
+  // 4) workspace dir name matches an engagement slug. This is a convenience,
+  // NOT a binding - an unbound directory that merely happens to be named like a
+  // client (a fork, a demo, a second client with the same codename) would
+  // otherwise attach to that client's memory silently and get written into.
+  // Never silent: warn on stderr so cross-client contamination can't happen
+  // unnoticed, and tell the user how to make the binding explicit.
   const guess = path.join(ENGAGEMENTS_ROOT, slugify(path.basename(cwd)), '.fde')
-  if (fs.existsSync(guess)) return guess
+  if (fs.existsSync(guess)) {
+    process.stderr.write(`⚠ resolved engagement by directory name ("${slugify(path.basename(cwd))}"), not a saved binding. If this is the right client, run \`fde resume --init ${slugify(path.basename(cwd))}\` here to bind it; if not, you are about to read/write the WRONG client's memory.\n`)
+    return guess
+  }
   // 5) in-repo .fde (engagement-approved only)
   if (fs.existsSync(path.join(cwd, '.fde'))) return path.join(cwd, '.fde')
   return null
@@ -157,7 +165,9 @@ function sectionBody(md, heading) {
 // zero-effort floor when NO token exists anywhere - prose like "escalated to CTO,
 // resolved amicably" must not flip a client amber forever.
 function computeSignals(eng) {
-  const ctx = readEng(eng, 'context.md'); const stake = readEng(eng, 'stakeholders.md'); const risks = readEng(eng, 'risks.md')
+  // readClean, not readEng: status/dashboard echo topRisk and stakeholder lines
+  // to the terminal and the rendered HTML - a <private> risk must never surface.
+  const ctx = readClean(eng, 'context.md'); const stake = readClean(eng, 'stakeholders.md'); const risks = readClean(eng, 'risks.md')
   const phase = (ctx.match(/phase[:* ]+\**([a-z-]+)/i) || [])[1] || '?'
   let latest = null
   for (const l of stake.split('\n')) {
@@ -463,7 +473,7 @@ function cmdScan() {
   const sec = grepFiles(confFiles, /(api[_-]?key|secret|password|token)\s*[:=]\s*['"][^'"]{8,}/i, 10)
     .filter(h => !/example|template|test|sample|placeholder/i.test(h.file + h.text))
   sec.length
-    ? sec.forEach(h => out.push(`  ${h.file}:${h.line}  ${h.text.replace(/(['"])([^'"]{4})[^'"]+(['"])/, '$1$2…REDACTED$3')}`))
+    ? sec.forEach(h => out.push(`  ${h.file}:${h.line}  ${h.text.replace(/(['"])[^'"]+(['"])/, '$1REDACTED$2')}`))
     : out.push('  none found')
   out.push('  (grep-grade check - run gitleaks or trufflehog for real secret coverage)')
 
@@ -661,7 +671,10 @@ function cmdReceipts(args) {
   for (const f of ['decisions.md', 'delivery.md', 'risks.md', 'stakeholders.md', 'context.md', 'success.md', 'brief.md', 'reality.md']) {
     const p = path.join(eng, f)
     if (!fs.existsSync(p)) continue
-    fs.readFileSync(p, 'utf8').split('\n').forEach((l, i) => {
+    // readClean, not raw read: receipts must not grep sealed <private> notes back
+    // out. Redaction can shift line numbers past a multi-line block; the file:line
+    // is advisory, and not leaking a sealed secret is worth an approximate number.
+    readClean(eng, f).split('\n').forEach((l, i) => {
       if (rx.test(l)) { console.log(`${f}:${i + 1}  ${l.trim().slice(0, 160)}`); found++ }
     })
   }
@@ -725,9 +738,14 @@ function escapeHtml(s) {
 // Closed pairs are redacted; an unclosed <private> redacts to end-of-text so a
 // forgotten closing tag can never leak the rest of the file.
 function stripPrivate(md) {
+  // Redact <private> before <!-- --> so a private block that itself contains a
+  // comment can't survive. Closed pairs first; then any unclosed <private> to
+  // end-of-text so a forgotten close tag never leaks the rest of the file.
+  // Case-insensitive (<PRIVATE> too). This is the ONE redactor every read path
+  // that can reach the model or a shared artifact must go through - see readClean.
   return md
-    .replace(/<private>[\s\S]*?<\/private>/gi, '(private - redacted from dashboard)')
-    .replace(/<private>[\s\S]*$/i, '(private - redacted from dashboard)')
+    .replace(/<private>[\s\S]*?<\/private>/gi, '(private - redacted)')
+    .replace(/<private>[\s\S]*$/i, '(private - redacted)')
     .replace(/<!--[\s\S]*?-->/g, '')
 }
 

package/hooks/pre-compact

@@ -56,19 +56,40 @@ MARKER="[fdeops context preserved"
 [ -f "$CONTEXT_FILE" ] || exit 0
 
 # Avoid unbounded growth: skip if we already preserved today.
-if grep -q "$MARKER" "$CONTEXT_FILE" 2>/dev/null; then
-  LAST=$(grep "$MARKER" "$CONTEXT_FILE" | tail -1)
+if grep -Fq "$MARKER" "$CONTEXT_FILE" 2>/dev/null; then
+  LAST=$(grep -F "$MARKER" "$CONTEXT_FILE" | tail -1)
   if echo "$LAST" | grep -q "$(date -u +%Y-%m-%d)"; then
     exit 0
   fi
 fi
 
+# Redact <private> before extracting lines - this content is appended to
+# context.md, which session-start loads into the model. A closed private block
+# collapses to one placeholder line, so its inner text can't be tail'd or
+# grepped out tag-stripped. Case-insensitive, mirrors the JS /gi redactor.
+strip_private() {
+  awk '
+    BEGIN { inblock = 0 }
+    {
+      line = $0
+      lc = tolower(line)
+      if (inblock) { if (index(lc, "</private>") > 0) { inblock = 0 } next }
+      if (index(lc, "<private>") > 0) {
+        print "(private - redacted)"
+        if (index(lc, "</private>") == 0) { inblock = 1 }
+        next
+      }
+      print line
+    }
+  ' "$1"
+}
+
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 LAST_DECISIONS=""
 OPEN_RISKS=""
 
-[ -f "$DECISIONS_FILE" ] && LAST_DECISIONS=$(tail -20 "$DECISIONS_FILE" 2>/dev/null)
-[ -f "$RISKS_FILE" ] && OPEN_RISKS=$(grep -iE "open|active|unresolved" "$RISKS_FILE" 2>/dev/null | head -8)
+[ -f "$DECISIONS_FILE" ] && LAST_DECISIONS=$(strip_private "$DECISIONS_FILE" 2>/dev/null | tail -20)
+[ -f "$RISKS_FILE" ] && OPEN_RISKS=$(strip_private "$RISKS_FILE" 2>/dev/null | grep -iE "open|active|unresolved" | head -8)
 
 cat >> "$CONTEXT_FILE" 2>/dev/null << EOF
 

package/hooks/session-start

@@ -86,17 +86,21 @@ fi
 # closing tag), so a line-based state machine matches the real usage; an
 # unclosed <private> redacts to end-of-file, same as the JS regex fallback.
 strip_private() {
+  # Detection is case-insensitive (matches the JS /gi redactor) - <PRIVATE>,
+  # <Private>, <private> all redact. Detect on a lowercased copy of the line;
+  # never print the original when a tag is present.
   awk '
     BEGIN { inblock = 0 }
     {
       line = $0
+      lc = tolower(line)
       if (inblock) {
-        if (index(line, "</private>") > 0) { inblock = 0 }
+        if (index(lc, "</private>") > 0) { inblock = 0 }
         next
       }
-      if (index(line, "<private>") > 0) {
+      if (index(lc, "<private>") > 0) {
         print "(private - redacted)"
-        if (index(line, "</private>") == 0) { inblock = 1 }
+        if (index(lc, "</private>") == 0) { inblock = 1 }
         next
       }
       print line

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "fdeops",
-  "version": "3.7.2",
+  "version": "3.7.3",
   "description": "Field kit for engineers embedded in client work - a real CLI (recon, memory, portfolio), one @fde skill with field judgment on top, and hooks that make it automatic. Claude Code plugin and any agent that loads skills.",
   "bin": {
     "fdeops": "bin/install.js",
     "fde": "bin/fde.js"
   },
   "scripts": {
-    "check": "node bin/check.js",
-    "prepublishOnly": "node bin/check.js"
+    "check": "node bin/check.js && npm test",
+    "test": "node --test test/*.test.js",
+    "prepublishOnly": "node bin/check.js && npm test"
   },
   "files": [
     "bin/",