halfcycle 0.3.32 → 0.3.33

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.3.32",
+  "version": "0.3.33",
   "description": "Halfcycle Method bundle — resolution-stub slash commands, remote method-delivery registration, and governance-hook wiring for a Halfcycle engagement repo. It ships NO worker role files: a project's roles are authored from that project's own recorded decisions at orchestration kickoff (FX-2, W3-F-27).",
   "commands": [
     {

package/bin/bin.bundle.mjs

@@ -14721,6 +14721,31 @@ var HALFCYCLE_HOOK_WIRING_PATHS = [
   .../* @__PURE__ */ new Set([SETTINGS_REL, ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.script), VENDORED_BIN_REL])
 ];
 
+// ../core/dist/secret-shape.js
+var SECRET_SHAPE_PATTERNS = [
+  // Assignment to a credential-named identifier: `apiKey = "..."`, `secret: '...'`,
+  // `password=...`, `token = ...`, `access_key: ...` — the value need not be quoted.
+  /\b(?:api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer)\b\s*[:=]\s*\S+/i,
+  // Connection strings that embed credentials: `scheme://user:pass@host`.
+  /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@/i,
+  // Bearer / authorization header values.
+  /\bauthorization\b\s*[:=]\s*['"]?\s*bearer\s+\S+/i,
+  // PEM / private-key block headers.
+  /-----BEGIN\s+(?:RSA\s+|EC\s+|OPENSSH\s+|DSA\s+)?PRIVATE\s+KEY-----/,
+  // JWT shape: three base64url segments separated by dots.
+  /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/,
+  // A long high-entropy hex/base64 run adjacent to a credential-ish word on the
+  // same line — a raw key literal. Kept last (broadest, most likely false-drop).
+  /\b(?:key|token|secret|credential)\b[\s\S]{0,40}[A-Za-z0-9+/_-]{32,}/i
+];
+function looksLikeSecret(text) {
+  for (const pattern of SECRET_SHAPE_PATTERNS) {
+    if (pattern.test(text))
+      return true;
+  }
+  return false;
+}
+
 // dist/control-origin.js
 var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
 function resolveControlOrigin(env) {
@@ -15169,8 +15194,16 @@ var stateRecordSchema = external_exports.discriminatedUnion("recordKind", [
   interventionRecordSchema
 ]);
 
+// ../events/dist/control-characters.js
+var CONTROL_CHARACTER_CLASS = "\\p{Cc}";
+var CONTROL_CHARACTER = new RegExp(CONTROL_CHARACTER_CLASS, "u");
+function hasControlCharacter(text) {
+  return CONTROL_CHARACTER.test(text);
+}
+
 // ../events/dist/phase-identity.js
 var PHASE_SEGMENT_PREFIX = "phase-";
+var PHASE_NAME_MAX_BYTES = 200;
 function isValidPhaseIdentity(identity) {
   if (typeof identity === "number")
     return Number.isInteger(identity) && identity >= 0;
@@ -15182,12 +15215,22 @@ function isValidPhaseIdentity(identity) {
     return false;
   if (identity.includes("\\"))
     return false;
-  if (identity.includes("\0"))
-    return false;
   if (identity.startsWith("."))
     return false;
+  if (hasControlCharacter(identity))
+    return false;
+  if (utf8ByteLength(identity) > PHASE_NAME_MAX_BYTES)
+    return false;
   return true;
 }
+function utf8ByteLength(text) {
+  let bytes = 0;
+  for (const ch of text) {
+    const cp = ch.codePointAt(0);
+    bytes += cp < 128 ? 1 : cp < 2048 ? 2 : cp < 65536 ? 3 : 4;
+  }
+  return bytes;
+}
 var InvalidPhaseIdentityError = class extends Error {
   /** The value that was refused, exactly as supplied. */
   identity;
@@ -15771,29 +15814,6 @@ function getWiringStatus(pathspecs, cwd) {
 }
 
 // dist/screen/secret-shape.js
-var SECRET_SHAPE_PATTERNS = [
-  // Assignment to a credential-named identifier: `apiKey = "..."`, `secret: '...'`,
-  // `password=...`, `token = ...`, `access_key: ...` — the value need not be quoted.
-  /\b(?:api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer)\b\s*[:=]\s*\S+/i,
-  // Connection strings that embed credentials: `scheme://user:pass@host`.
-  /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@/i,
-  // Bearer / authorization header values.
-  /\bauthorization\b\s*[:=]\s*['"]?\s*bearer\s+\S+/i,
-  // PEM / private-key block headers.
-  /-----BEGIN\s+(?:RSA\s+|EC\s+|OPENSSH\s+|DSA\s+)?PRIVATE\s+KEY-----/,
-  // JWT shape: three base64url segments separated by dots.
-  /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/,
-  // A long high-entropy hex/base64 run adjacent to a credential-ish word on the
-  // same line — a raw key literal. Kept last (broadest, most likely false-drop).
-  /\b(?:key|token|secret|credential)\b[\s\S]{0,40}[A-Za-z0-9+/_-]{32,}/i
-];
-function looksLikeSecret(text) {
-  for (const pattern of SECRET_SHAPE_PATTERNS) {
-    if (pattern.test(text))
-      return true;
-  }
-  return false;
-}
 function screenExcerpts(excerpts) {
   return excerpts.filter((e) => !looksLikeSecret(e.text));
 }

package/dist/bin.d.ts

@@ -8,7 +8,7 @@
  * Subcommands:
  *   halfcycle [install] [target-repo]        — install into target (default: cwd)
  *   halfcycle check-drift <target>           — report bundle drift for the re-sync gate
- *   halfcycle build-record <phase>           — assemble the phase Build Record (D1)
+ *   halfcycle build-record <phase>           — fetch a closed phase's Build Record and write it
  *   halfcycle open-phase <phase>             — open a phase, with its entry decision
  *   halfcycle close-phase <phase>            — record a phase's acceptance and close it
  *   halfcycle uninstall [--remove-credential] — take back what the installer wrote here