forkit-connect 0.1.33 → 0.1.35

package/dist/v1/service.js

@@ -52,9 +52,54 @@ const SMART_INBOX_CONFIDENCE_PRIORITY = {
     low: 2,
 };
 const SMART_INBOX_FRESH_MAX_AGE_MS = 45 * 1000;
+const C2_RUNTIME_SIGNAL_SENSITIVE_METADATA_PATTERNS = [
+    /prompt(?!_?tokens?$)/i,
+    /message/i,
+    /conversation/i,
+    /transcript/i,
+    /chat/i,
+    /log(s|_?text|_?content)?$/i,
+    /secret/i,
+    /password/i,
+    /api[_-]?key/i,
+    /token(?!s?($|_?(count|in|out|total|usage)$)|Usage$)/i,
+    /authorization/i,
+    /cookie/i,
+    /private[_-]?key/i,
+    /credential/i,
+    /email/i,
+    /phone/i,
+    /ssn/i,
+    /address/i,
+    /file[_-]?(content|body|text|data)/i,
+    /model[_-]?(weight|weights|binary|blob)/i,
+    /dataset[_-]?(row|rows|sample|content|record)/i,
+];
 function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
+function isSensitiveC2RuntimeSignalMetadataKey(key) {
+    return C2_RUNTIME_SIGNAL_SENSITIVE_METADATA_PATTERNS.some((pattern) => pattern.test(key));
+}
+function sanitizeC2RuntimeSignalMetadataValue(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => sanitizeC2RuntimeSignalMetadataValue(item));
+    }
+    if (!isRecord(value)) {
+        return value;
+    }
+    return sanitizeC2RuntimeSignalMetadata(value);
+}
+function sanitizeC2RuntimeSignalMetadata(metadata) {
+    const safeMetadata = {};
+    for (const [key, value] of Object.entries(metadata)) {
+        if (isSensitiveC2RuntimeSignalMetadataKey(key)) {
+            continue;
+        }
+        safeMetadata[key] = sanitizeC2RuntimeSignalMetadataValue(value);
+    }
+    return safeMetadata;
+}
 function extractApiErrorCode(body) {
     if (!isRecord(body))
         return null;
@@ -6921,34 +6966,35 @@ class ConnectV1Service {
         return nextSession;
     }
     buildC2RuntimeSignalPayload(event, apiKey, scope) {
+        const metadata = sanitizeC2RuntimeSignalMetadata({
+            client_event_id: event.event_id, // traceable but excluded from server idempotency hash
+            runtime_gaid: event.runtime_gaid,
+            runtime_name: event.runtime_name,
+            runtime_type: event.runtime_type,
+            model_name: event.model_name,
+            discoveryHash: event.discovery_hash,
+            registrationKey: event.registration_key,
+            passportGaid: event.passport_gaid,
+            pulse_status: event.pulse_status,
+            connection_classification: event.connection_classification,
+            daemon_running: event.daemon_running,
+            shadow_candidate_reason: event.shadow_candidate_reason,
+            ...event.metadata,
+            binding_id: scope?.bindingId ?? null,
+            connect_device_id: scope?.connectDeviceId ?? null,
+            workspaceId: scope?.workspaceId ?? event.workspace_id ?? null,
+            projectId: scope?.projectId ?? event.project_id ?? null,
+            workspace_id: scope?.workspaceId ?? event.workspace_id ?? null,
+            project_id: scope?.projectId ?? event.project_id ?? null,
+            evidence_type: 'observed_runtime_session',
+        });
         return {
             gaid: event.passport_gaid,
             apiKey,
             binding_id: scope?.bindingId ?? null,
             eventType: event.event_type,
             timestamp: event.occurred_at,
-            metadata: {
-                client_event_id: event.event_id, // traceable but excluded from server idempotency hash
-                runtime_gaid: event.runtime_gaid,
-                runtime_name: event.runtime_name,
-                runtime_type: event.runtime_type,
-                model_name: event.model_name,
-                discoveryHash: event.discovery_hash,
-                registrationKey: event.registration_key,
-                passportGaid: event.passport_gaid,
-                pulse_status: event.pulse_status,
-                connection_classification: event.connection_classification,
-                daemon_running: event.daemon_running,
-                shadow_candidate_reason: event.shadow_candidate_reason,
-                ...event.metadata,
-                binding_id: scope?.bindingId ?? null,
-                connect_device_id: scope?.connectDeviceId ?? null,
-                workspaceId: scope?.workspaceId ?? event.workspace_id ?? null,
-                projectId: scope?.projectId ?? event.project_id ?? null,
-                workspace_id: scope?.workspaceId ?? event.workspace_id ?? null,
-                project_id: scope?.projectId ?? event.project_id ?? null,
-                evidence_type: 'observed_runtime_session',
-            },
+            metadata,
         };
     }
     runtimeRecommendedAction(runtimePassport) {
@@ -7132,7 +7178,7 @@ class ConnectV1Service {
                 return;
             }
             try {
-                const result = await this.getApiClient(currentState).pushRuntimeSignalEvent(this.buildC2RuntimeSignalPayload(event, apiKey, runtimeScope));
+                const result = await this.getApiClientWithSessionToken(apiKey).pushRuntimeSignalEvent(this.buildC2RuntimeSignalPayload(event, apiKey, runtimeScope));
                 if (!result.ok) {
                     // 429 rate-limit — halt the current flush cycle and respect Retry-After.
                     if (result.status === 429) {
@@ -8852,7 +8898,7 @@ class ConnectV1Service {
                         ...item.payload,
                         apiKey: resolvedRuntimeSignalApiKey,
                     };
-                    const result = await api.pushRuntimeSignalEvent(this.withRuntimeBindingPayload(payloadWithRuntimeKey, runtimeScope));
+                    const result = await this.getApiClientWithSessionToken(resolvedRuntimeSignalApiKey).pushRuntimeSignalEvent(this.withRuntimeBindingPayload(payloadWithRuntimeKey, runtimeScope));
                     if (!result.ok) {
                         const metadataValue = item.payload?.metadata;
                         const metadata = metadataValue && typeof metadataValue === 'object' && !Array.isArray(metadataValue)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forkit-connect",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "Forkit Connect Local Engine - The Global AI Governance Fabric",
   "license": "MIT",
   "main": "dist/index.js",