greprag 5.80.0 → 5.82.0

package/dist/env-redaction.js

@@ -0,0 +1,157 @@
+"use strict";
+// adr: adr/secret-scrubber.md
+/** Env-var redaction map — the CLIENT-ONLY `.env` / `process.env` walker.
+ *
+ *  Builds the value → `[REDACTED:VAR_NAME]` map the Stop hook hands to
+ *  scrubString as pass 1. Lives beside the hook (never in the filesystem-free
+ *  detector module): it reads the user's `.env` files and the process
+ *  environment, which the API worker must never touch.
+ *
+ *  Classification — WHICH environment values are secrets — is the whole point
+ *  of this file. The environment is not a secret store: on any machine it is
+ *  mostly paths (CLAUDE_PROJECT_DIR, PWD, PATH, TEMP, APPDATA, USERPROFILE…)
+ *  and harness bookkeeping. Redacting those corrupts stored text — a learned
+ *  procedure whose steps read `cd "[REDACTED:CLAUDE_PROJECT_DIR]/game"` cannot
+ *  be replayed. So:
+ *
+ *    1. a PATH-SHAPED value is never a secret, whatever its source or name;
+ *    2. a `.env` value is a declared secret — redact it (minus rule 1);
+ *    3. a `process.env` value is redacted only when its NAME is secret-shaped
+ *       (KEY / TOKEN / SECRET / PASSWORD / …) or its VALUE trips the pattern +
+ *       entropy detector — i.e. the same judgement the scrubber already makes.
+ *
+ *  Pure classification (isPathLikeValue / isSecretShapedKey /
+ *  isRedactableEnvEntry / collectRedactionEntries) is split from the file I/O
+ *  (buildRedactionMap) so the boundary is unit-testable without a hook.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_REDACTABLE_LENGTH = void 0;
+exports.isPathLikeValue = isPathLikeValue;
+exports.isSecretShapedKey = isSecretShapedKey;
+exports.isRedactableEnvEntry = isRedactableEnvEntry;
+exports.parseDotenv = parseDotenv;
+exports.collectRedactionEntries = collectRedactionEntries;
+exports.buildRedactionMap = buildRedactionMap;
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const secret_scrubber_1 = require("./secret-scrubber");
+/** Values shorter than this are never mapped (too short to be a credential,
+ *  too common as a substring). Pre-existing threshold. */
+exports.MIN_REDACTABLE_LENGTH = 16;
+/** A value that starts like a filesystem path — absolute (drive letter, UNC,
+ *  leading slash), home-relative, or dot-relative. A PATH-style list starts with
+ *  its first entry, so it qualifies too. */
+const PATH_LIKE_RE = /^(?:[A-Za-z]:[\\/]|\\\\|[\\/]|~(?:[\\/]|$)|\.{1,2}[\\/])/;
+/** Variable names that declare a credential. Anchored on `_`/`-`/start/end so
+ *  KEYBOARD_LAYOUT, PATHEXT and friends do not match. */
+const SECRET_KEY_RE = /(?:^|[_-])(?:KEYS?|TOKENS?|SECRETS?|PASS|PASSWORD|PASSWD|PWD|CREDENTIALS?|AUTH|PRIVATE|DSN|SIGNING|SIGNATURE|SALT|CERT|COOKIE|BEARER|LICENSE)(?:[_-]|$)/i;
+function isPathLikeValue(value) {
+    return PATH_LIKE_RE.test(value);
+}
+function isSecretShapedKey(key) {
+    return SECRET_KEY_RE.test(key);
+}
+/** Should this environment entry go into the redaction map? PURE. */
+function isRedactableEnvEntry(key, value, source) {
+    if (!value || value.length < exports.MIN_REDACTABLE_LENGTH)
+        return false;
+    if (isPathLikeValue(value))
+        return false; // rule 1: a path is never a secret
+    if (source === 'dotenv')
+        return true; // rule 2: .env is a declared secret store
+    if (isSecretShapedKey(key))
+        return true; // rule 3a: the name says credential
+    return (0, secret_scrubber_1.scrubString)(value) !== value; // rule 3b: the value looks like one
+}
+/** Parse `.env` text into [key, value] pairs (quotes stripped). PURE. */
+function parseDotenv(raw) {
+    const out = [];
+    for (const line of raw.split('\n')) {
+        const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.+?)\s*$/);
+        if (!m)
+            continue;
+        let value = m[2].trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        out.push([m[1], value]);
+    }
+    return out;
+}
+/** Fold `.env` entries + a process environment into the longest-first redaction
+ *  map. PURE — the caller supplies both. */
+function collectRedactionEntries(dotenv, env) {
+    const entries = [];
+    const seenValues = new Set();
+    const add = (key, value, source) => {
+        if (seenValues.has(value))
+            return;
+        if (!isRedactableEnvEntry(key, value, source))
+            return;
+        seenValues.add(value);
+        entries.push([value, `[REDACTED:${key}]`]);
+    };
+    for (const [key, value] of dotenv)
+        add(key, value, 'dotenv');
+    for (const [key, value] of Object.entries(env)) {
+        if (typeof value === 'string')
+            add(key, value, 'process');
+    }
+    // Longest first so a longer secret wins before any substring of it.
+    entries.sort((a, b) => b[0].length - a[0].length);
+    return entries;
+}
+/** Build the redaction map from the `.env` files above `cwd` (8 levels) and
+ *  the process environment. The one I/O entry point. */
+function buildRedactionMap(cwd, env = process.env) {
+    const dotenv = [];
+    let dir = path.resolve(cwd);
+    for (let depth = 0; depth < 8; depth++) {
+        const envPath = path.join(dir, '.env');
+        if (fs.existsSync(envPath)) {
+            try {
+                dotenv.push(...parseDotenv(fs.readFileSync(envPath, 'utf-8')));
+            }
+            catch { /* skip */ }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return collectRedactionEntries(dotenv, env);
+}

package/dist/harness-limits.js

@@ -0,0 +1,17 @@
+"use strict";
+/** MIRROR of `packages/core/src/harness-limits.ts`; KEEP IN SYNC.
+ *
+ *  Core is the canonical owner — the server derives the Persona content limit
+ *  from it. The CLI ships as a zero-dependency `tsc` artifact and cannot import
+ *  `@greprag/core` at runtime, the same constraint that mirrors
+ *  `turn-provenance.ts` and `secret-scrubber.ts`.
+ *  adr: adr/announce-inline-budget.md
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ANNOUNCE_HARNESS_CAP = void 0;
+/** Bytes of hook output Claude Code will inline. Past this the harness swaps the
+ *  payload for a `<persisted-output>` stub plus a 2KB preview and tells nobody.
+ *  MEASURED 2026-09-03 with an 80-marker ruler, not guessed, and true of both raw
+ *  stdout and the `additionalContext` envelope. The cap is PER HOOK INVOCATION,
+ *  which is why Persona rides its own SessionStart hook and gets the full 2048. */
+exports.ANNOUNCE_HARNESS_CAP = 2048;

package/dist/hook-runtime.js

@@ -140,10 +140,20 @@ async function apiCall(url, apiKey, body) {
     }
     return res.json();
 }
+/** Hook REGISTRATION points that are not legal `hookSpecificOutput.hookEventName`
+ *  values. The harness validates that field against a fixed enum and rejects the
+ *  WHOLE payload on a miss — silently, from the emitting hook's point of view, so
+ *  the failure looks like "the context never arrived" rather than a schema error.
+ *  A hook that echoes its own event name back is therefore a live trap: correct for
+ *  SessionStart, fatal for PostCompact. Map them here, once, instead of relying on
+ *  every call site to remember. */
+const EVENT_NAME_ALIASES = {
+    PostCompact: 'SessionStart',
+};
 function writeAdditionalContext(hookEventName, additionalContext) {
     process.stdout.write(JSON.stringify({
         hookSpecificOutput: {
-            hookEventName,
+            hookEventName: EVENT_NAME_ALIASES[hookEventName] || hookEventName,
             additionalContext,
         },
     }) + '\n');