hammoc 1.3.0 → 1.5.0

package/packages/server/dist/utils/effortUtils.js

@@ -0,0 +1,36 @@
+/**
+ * Effort Utilities
+ * Shared resolution of ThinkingEffort levels against model capabilities.
+ */
+/**
+ * Clamp unsupported effort levels:
+ *   · 'max'   → 'high' unless model supports it (Opus 4.6+, Sonnet 4.6)
+ *   · 'xhigh' → 'high' unless model supports it (Opus 4.7 only)
+ * Other levels pass through unchanged.
+ */
+export function clampEffortForModel(effort, model) {
+    if (!effort)
+        return effort;
+    const supportsMax = !!model && (model === 'opus' || model === 'sonnet' ||
+        model.includes('opus-4-6') || model.includes('opus-4-7') || model.includes('sonnet-4-6'));
+    const supportsXHigh = !!model && (model === 'opus' || model.includes('opus-4-7'));
+    if (effort === 'max' && !supportsMax)
+        return 'high';
+    if (effort === 'xhigh' && !supportsXHigh)
+        return 'high';
+    return effort;
+}
+/**
+ * Whether the model supports Anthropic's adaptive thinking mode
+ * (`thinking: { type: 'adaptive' }`). Opus 4.7 requires adaptive;
+ * Opus 4.6 and Sonnet 4.6 accept adaptive as the recommended mode.
+ * Older models (Sonnet 4.5, Opus 4.5, Haiku, Sonnet 4, etc.) do NOT
+ * support adaptive and must stay on the legacy `maxThinkingTokens` path.
+ */
+export function supportsAdaptiveThinking(model) {
+    if (!model)
+        return false;
+    return (model === 'opus' || model === 'sonnet' ||
+        model.includes('opus-4-6') || model.includes('opus-4-7') || model.includes('sonnet-4-6'));
+}
+//# sourceMappingURL=effortUtils.js.map

package/packages/server/dist/utils/effortUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effortUtils.js","sourceRoot":"","sources":["../../src/utils/effortUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAkC,EAAE,KAAyB;IAC/F,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,IAAI,CAC7B,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ;QACtC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CACzF,CAAC;IACF,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC;IACpD,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAyB;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CACL,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ;QACtC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CACzF,CAAC;AACJ,CAAC"}

package/packages/server/dist/utils/gitignoreFilter.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Story 28.0.5 (Task 5): thin wrapper around `ignore` (kaelzhang/node-ignore).
+ *
+ * Originally introduced as preemptive infrastructure under the placeholder
+ * label "Epic 30 Story 10" (the pre-BMad-renumbering forward reference);
+ * Story 30.1 fills the call-sites (`harnessShareScopeService` + the
+ * client-side `ShareBadge` / `ModeBanner`) by consuming `loadGitignore()` +
+ * `isIgnored()` to drive the "shared vs. local vs. fully-ignored" badges on
+ * the harness workbench tree.
+ */
+import { type Ignore } from 'ignore';
+/**
+ * Load `<rootPath>/.gitignore` into an `Ignore` matcher. Missing files yield
+ * a matcher that never excludes anything (so callers can treat "no
+ * .gitignore" as "nothing is ignored" without a separate branch).
+ */
+export declare function loadGitignore(rootPath: string): Promise<Ignore>;
+/**
+ * Test a relative path against the matcher. Input paths are normalized to
+ * POSIX separators as required by `ignore`'s contract.
+ */
+export declare function isIgnored(matcher: Ignore, relativePath: string): boolean;
+//# sourceMappingURL=gitignoreFilter.d.ts.map

package/packages/server/dist/utils/gitignoreFilter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignoreFilter.d.ts","sourceRoot":"","sources":["../../src/utils/gitignoreFilter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAsB,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEpD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAarE;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAGxE"}

package/packages/server/dist/utils/gitignoreFilter.js

@@ -0,0 +1,42 @@
+/**
+ * Story 28.0.5 (Task 5): thin wrapper around `ignore` (kaelzhang/node-ignore).
+ *
+ * Originally introduced as preemptive infrastructure under the placeholder
+ * label "Epic 30 Story 10" (the pre-BMad-renumbering forward reference);
+ * Story 30.1 fills the call-sites (`harnessShareScopeService` + the
+ * client-side `ShareBadge` / `ModeBanner`) by consuming `loadGitignore()` +
+ * `isIgnored()` to drive the "shared vs. local vs. fully-ignored" badges on
+ * the harness workbench tree.
+ */
+import fs from 'fs/promises';
+import path from 'path';
+import ignoreFactory from 'ignore';
+/**
+ * Load `<rootPath>/.gitignore` into an `Ignore` matcher. Missing files yield
+ * a matcher that never excludes anything (so callers can treat "no
+ * .gitignore" as "nothing is ignored" without a separate branch).
+ */
+export async function loadGitignore(rootPath) {
+    const matcher = ignoreFactory();
+    const gitignorePath = path.join(rootPath, '.gitignore');
+    try {
+        const content = await fs.readFile(gitignorePath, 'utf-8');
+        matcher.add(content);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+        // No .gitignore — return an empty matcher.
+    }
+    return matcher;
+}
+/**
+ * Test a relative path against the matcher. Input paths are normalized to
+ * POSIX separators as required by `ignore`'s contract.
+ */
+export function isIgnored(matcher, relativePath) {
+    const posix = relativePath.replace(/\\/g, '/');
+    return matcher.ignores(posix);
+}
+//# sourceMappingURL=gitignoreFilter.js.map

package/packages/server/dist/utils/gitignoreFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignoreFilter.js","sourceRoot":"","sources":["../../src/utils/gitignoreFilter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,aAA8B,MAAM,QAAQ,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,2CAA2C;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,YAAoB;IAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC"}

package/packages/server/dist/utils/harnessBundleSchema.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Story 30.3 (Task 4.2): Zod runtime validation of `manifest.json` inside the
+ * harness export/import bundle. Lives on the server because zod is a
+ * server-only dep — the shared package exposes only the TypeScript surface
+ * (`packages/shared/src/types/harnessBundle.ts`).
+ *
+ * Two boundaries call this schema:
+ *   - the bundle service when unpacking an import ZIP (AC5.c "malformed
+ *     manifest" branch)
+ *   - the controller when accepting an export request body (AC1, AC2, AC5)
+ *
+ * Both reuse the discriminator/value sets exported from `@hammoc/shared` so
+ * the schema and types stay in lockstep.
+ */
+import { z } from 'zod';
+/**
+ * Strict manifest schema — `bundleVersion` is locked to the literal 1 so
+ * future-version bundles fall through to the AC5.a "futureBundle" branch
+ * before this schema is even consulted (the import service inspects the raw
+ * JSON's version field first, then runs full Zod validation).
+ */
+export declare const bundleManifestSchema: z.ZodObject<{
+    bundleVersion: z.ZodLiteral<1>;
+    hammocVersion: z.ZodString;
+    claudeCodeSpecVersion: z.ZodUnion<readonly [z.ZodString, z.ZodNull]>;
+    createdAt: z.ZodString;
+    sourceProjectSlug: z.ZodString;
+    includes: z.ZodArray<z.ZodEnum<{
+        agents: "agents";
+        hooks: "hooks";
+        commands: "commands";
+        skills: "skills";
+        mcp: "mcp";
+        "claude-md": "claude-md";
+        bmad: "bmad";
+    }>>;
+    secretsPolicy: z.ZodEnum<{
+        excluded: "excluded";
+        placeholder: "placeholder";
+        "included-explicit": "included-explicit";
+    }>;
+    pluginDependencies: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        marketplace: z.ZodString;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    items: z.ZodArray<z.ZodObject<{
+        domain: z.ZodEnum<{
+            agent: "agent";
+            command: "command";
+            skill: "skill";
+            mcp: "mcp";
+            hook: "hook";
+            "claude-md": "claude-md";
+            bmad: "bmad";
+        }>;
+        identity: z.ZodString;
+        relativePath: z.ZodString;
+        sourceShareScope: z.ZodEnum<{
+            local: "local";
+            shared: "shared";
+            fullyIgnored: "fullyIgnored";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type BundleManifestParsed = z.infer<typeof bundleManifestSchema>;
+/**
+ * Loose schema used for "is this even a manifest?" detection before the
+ * strict schema runs. Lets the import service distinguish "totally garbage
+ * JSON" (no bundleVersion field at all) from "future bundle" (bundleVersion
+ * is a number outside our supported range).
+ */
+export declare const loosenedManifestSchema: z.ZodObject<{
+    bundleVersion: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const exportBundleRequestSchema: z.ZodObject<{
+    projectSlug: z.ZodString;
+    includes: z.ZodArray<z.ZodEnum<{
+        agents: "agents";
+        hooks: "hooks";
+        commands: "commands";
+        skills: "skills";
+        mcp: "mcp";
+        "claude-md": "claude-md";
+        bmad: "bmad";
+    }>>;
+    secretsPolicy: z.ZodEnum<{
+        excluded: "excluded";
+        placeholder: "placeholder";
+        "included-explicit": "included-explicit";
+    }>;
+}, z.core.$strip>;
+export declare const importApplyRequestSchema: z.ZodObject<{
+    bundleToken: z.ZodString;
+    itemActions: z.ZodRecord<z.ZodString, z.ZodEnum<{
+        rename: "rename";
+        overwrite: "overwrite";
+        skip: "skip";
+        appendSection: "appendSection";
+    }>>;
+}, z.core.$strip>;
+export declare const pluginDepsQuerySchema: z.ZodObject<{
+    projectSlug: z.ZodString;
+}, z.core.$strip>;
+//# sourceMappingURL=harnessBundleSchema.d.ts.map

package/packages/server/dist/utils/harnessBundleSchema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessBundleSchema.d.ts","sourceRoot":"","sources":["../../src/utils/harnessBundleSchema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAU/B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAIpC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;iBAGnC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC"}

package/packages/server/dist/utils/harnessBundleSchema.js

@@ -0,0 +1,79 @@
+/**
+ * Story 30.3 (Task 4.2): Zod runtime validation of `manifest.json` inside the
+ * harness export/import bundle. Lives on the server because zod is a
+ * server-only dep — the shared package exposes only the TypeScript surface
+ * (`packages/shared/src/types/harnessBundle.ts`).
+ *
+ * Two boundaries call this schema:
+ *   - the bundle service when unpacking an import ZIP (AC5.c "malformed
+ *     manifest" branch)
+ *   - the controller when accepting an export request body (AC1, AC2, AC5)
+ *
+ * Both reuse the discriminator/value sets exported from `@hammoc/shared` so
+ * the schema and types stay in lockstep.
+ */
+import { z } from 'zod';
+import { BUNDLE_SECTIONS, HARNESS_BUNDLE_VERSION, } from '@hammoc/shared';
+const sectionSchema = z.enum(BUNDLE_SECTIONS);
+const secretsPolicySchema = z.enum(['excluded', 'placeholder', 'included-explicit']);
+const itemDomainSchema = z.enum([
+    'claude-md',
+    'skill',
+    'mcp',
+    'hook',
+    'command',
+    'agent',
+    'bmad',
+]);
+const sourceShareScopeSchema = z.enum(['shared', 'local', 'fullyIgnored']);
+const itemActionSchema = z.enum(['overwrite', 'skip', 'rename', 'appendSection']);
+const pluginRefSchema = z.object({
+    name: z.string().min(1),
+    marketplace: z.string().min(1),
+    version: z.string().optional(),
+});
+const bundleItemSchema = z.object({
+    domain: itemDomainSchema,
+    identity: z.string().min(1),
+    relativePath: z.string().min(1),
+    sourceShareScope: sourceShareScopeSchema,
+});
+/**
+ * Strict manifest schema — `bundleVersion` is locked to the literal 1 so
+ * future-version bundles fall through to the AC5.a "futureBundle" branch
+ * before this schema is even consulted (the import service inspects the raw
+ * JSON's version field first, then runs full Zod validation).
+ */
+export const bundleManifestSchema = z.object({
+    bundleVersion: z.literal(HARNESS_BUNDLE_VERSION),
+    hammocVersion: z.string().min(1),
+    claudeCodeSpecVersion: z.union([z.string().min(1), z.null()]),
+    createdAt: z.string().min(1),
+    sourceProjectSlug: z.string().min(1),
+    includes: z.array(sectionSchema),
+    secretsPolicy: secretsPolicySchema,
+    pluginDependencies: z.array(pluginRefSchema),
+    items: z.array(bundleItemSchema),
+});
+/**
+ * Loose schema used for "is this even a manifest?" detection before the
+ * strict schema runs. Lets the import service distinguish "totally garbage
+ * JSON" (no bundleVersion field at all) from "future bundle" (bundleVersion
+ * is a number outside our supported range).
+ */
+export const loosenedManifestSchema = z.object({
+    bundleVersion: z.number().int().optional(),
+});
+export const exportBundleRequestSchema = z.object({
+    projectSlug: z.string().min(1),
+    includes: z.array(sectionSchema).min(1, 'at least one section is required'),
+    secretsPolicy: secretsPolicySchema,
+});
+export const importApplyRequestSchema = z.object({
+    bundleToken: z.string().min(1),
+    itemActions: z.record(z.string(), itemActionSchema),
+});
+export const pluginDepsQuerySchema = z.object({
+    projectSlug: z.string().min(1),
+});
+//# sourceMappingURL=harnessBundleSchema.js.map

package/packages/server/dist/utils/harnessBundleSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessBundleSchema.js","sourceRoot":"","sources":["../../src/utils/harnessBundleSchema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,eAAe,EACf,sBAAsB,GAMvB,MAAM,gBAAgB,CAAC;AAExB,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,eAA+D,CAAC,CAAC;AAE9F,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,mBAAmB,CAAU,CAAoC,CAAC;AAEjI,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9B,WAAW;IACX,OAAO;IACP,KAAK;IACL,MAAM;IACN,SAAS;IACT,OAAO;IACP,MAAM;CACE,CAAuC,CAAC;AAElD,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAU,CAA6C,CAAC;AAEhI,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAU,CAAuC,CAAC;AAEjI,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,gBAAgB;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gBAAgB,EAAE,sBAAsB;CACzC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,aAAa,EAAE,mBAAmB;IAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACjC,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,kCAAkC,CAAC;IAC3E,aAAa,EAAE,mBAAmB;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC"}

package/packages/server/dist/utils/harnessPaths.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Story 28.0.5: Harness workbench path resolver.
+ *
+ * Resolves `~/.claude` (user scope) and `<projectRoot>/.claude` (project scope)
+ * into absolute paths and enforces that any relative path requested by the
+ * caller stays inside the resolved root. Every entry point into `harnessService`
+ * MUST route through `resolveHarnessPath` so that Windows/POSIX separator
+ * mixing, drive letters, UNC paths, and null-byte inputs cannot escape the
+ * subtree.
+ */
+import { type HarnessPathRef } from '@hammoc/shared';
+/** Return the absolute path to the user-scope harness root (`~/.claude`). */
+export declare function getUserHarnessRoot(): string;
+/** Return the absolute path to the project-scope harness root (`<project>/.claude`). */
+export declare function getProjectHarnessRoot(projectSlug: string): Promise<string>;
+export interface ResolvedHarnessPath {
+    resolvedRoot: string;
+    absolutePath: string;
+}
+/**
+ * Resolve a `HarnessPathRef` to an absolute path, guaranteed to sit inside the
+ * resolved root. Throws `HARNESS_PATH_DENIED` for any traversal attempt.
+ */
+export declare function resolveHarnessPath(ref: HarnessPathRef): Promise<ResolvedHarnessPath>;
+/**
+ * Story 29.1 (AC6): resolve the project-root `<projectRoot>/CLAUDE.md` path —
+ * the single file in the harness workbench whose location sits OUTSIDE the
+ * project's `.claude/` subtree, so `resolveHarnessPath` would reject it as a
+ * traversal. This helper accepts only `projectSlug` (no caller-supplied
+ * relative path) and returns the canonical CLAUDE.md location alongside the
+ * project root, so traversal is impossible by construction.
+ */
+export declare function resolveProjectClaudeMdPath(projectSlug: string): Promise<ResolvedHarnessPath>;
+//# sourceMappingURL=harnessPaths.d.ts.map

package/packages/server/dist/utils/harnessPaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessPaths.d.ts","sourceRoot":"","sources":["../../src/utils/harnessPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAWrE,6EAA6E;AAC7E,wBAAgB,kBAAkB,IAAI,MAAM,CAO3C;AAED,wFAAwF;AACxF,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhF;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwC1F;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyBlG"}

package/packages/server/dist/utils/harnessPaths.js

@@ -0,0 +1,124 @@
+/**
+ * Story 28.0.5: Harness workbench path resolver.
+ *
+ * Resolves `~/.claude` (user scope) and `<projectRoot>/.claude` (project scope)
+ * into absolute paths and enforces that any relative path requested by the
+ * caller stays inside the resolved root. Every entry point into `harnessService`
+ * MUST route through `resolveHarnessPath` so that Windows/POSIX separator
+ * mixing, drive letters, UNC paths, and null-byte inputs cannot escape the
+ * subtree.
+ */
+import os from 'os';
+import path from 'path';
+import { projectService } from '../services/projectService.js';
+import { HARNESS_ERRORS } from '@hammoc/shared';
+/**
+ * Test-only dependency-injection hook. When set, `getUserHarnessRoot()` returns
+ * this value instead of `~/.claude`. Production configurations leave it unset
+ * (no effect); unit tests in `harnessPaths.test.ts` / `harnessService.test.ts`
+ * redirect the user scope to a temp directory so they never touch the real
+ * home directory.
+ */
+const HOME_OVERRIDE_ENV = 'HAMMOC_HARNESS_HOME_OVERRIDE';
+/** Return the absolute path to the user-scope harness root (`~/.claude`). */
+export function getUserHarnessRoot() {
+    const override = process.env[HOME_OVERRIDE_ENV];
+    if (override && override.length > 0) {
+        return override;
+    }
+    // Node resolves %USERPROFILE% on Windows and $HOME on POSIX.
+    return path.join(os.homedir(), '.claude');
+}
+/** Return the absolute path to the project-scope harness root (`<project>/.claude`). */
+export async function getProjectHarnessRoot(projectSlug) {
+    if (!projectSlug) {
+        const err = new Error('projectSlug is required for project scope');
+        err.code = HARNESS_ERRORS.HARNESS_ROOT_MISSING.code;
+        throw err;
+    }
+    try {
+        const projectRoot = await projectService.resolveOriginalPath(projectSlug);
+        return path.join(projectRoot, '.claude');
+    }
+    catch (error) {
+        // Any failure to resolve the project (unknown slug, missing index, etc.)
+        // maps to HARNESS_ROOT_MISSING so the controller can return a uniform 404.
+        const wrapped = new Error(`Unable to resolve harness root for project "${projectSlug}": ${error.message}`);
+        wrapped.code = HARNESS_ERRORS.HARNESS_ROOT_MISSING.code;
+        throw wrapped;
+    }
+}
+/**
+ * Resolve a `HarnessPathRef` to an absolute path, guaranteed to sit inside the
+ * resolved root. Throws `HARNESS_PATH_DENIED` for any traversal attempt.
+ */
+export async function resolveHarnessPath(ref) {
+    const rel = ref.relativePath ?? '';
+    // Reject absolute paths and null bytes before touching `path.join`, since
+    // join would otherwise discard the root prefix (POSIX absolute) or let a
+    // null byte slip through to fs APIs.
+    if (rel.includes('\0')) {
+        const err = new Error('null byte in relative path');
+        err.code = HARNESS_ERRORS.HARNESS_PATH_DENIED.code;
+        throw err;
+    }
+    if (path.isAbsolute(rel)) {
+        const err = new Error('absolute path not allowed');
+        err.code = HARNESS_ERRORS.HARNESS_PATH_DENIED.code;
+        throw err;
+    }
+    // UNC inputs (`\\server\share`) on Windows: path.isAbsolute flags some of
+    // these, but on POSIX it would not — reject the prefix defensively.
+    if (rel.startsWith('\\\\') || rel.startsWith('//')) {
+        const err = new Error('UNC path not allowed');
+        err.code = HARNESS_ERRORS.HARNESS_PATH_DENIED.code;
+        throw err;
+    }
+    const resolvedRoot = ref.scope === 'user'
+        ? path.resolve(getUserHarnessRoot())
+        : path.resolve(await getProjectHarnessRoot(ref.projectSlug ?? ''));
+    const absolutePath = path.resolve(resolvedRoot, rel);
+    // Containment check: absolutePath must be the root itself or sit beneath it.
+    // `startsWith(root + sep)` avoids the false match where root="/a" and
+    // absolutePath="/abc".
+    if (absolutePath !== resolvedRoot && !absolutePath.startsWith(resolvedRoot + path.sep)) {
+        const err = new Error('path escapes harness root');
+        err.code = HARNESS_ERRORS.HARNESS_PATH_DENIED.code;
+        throw err;
+    }
+    return { resolvedRoot, absolutePath };
+}
+/**
+ * Story 29.1 (AC6): resolve the project-root `<projectRoot>/CLAUDE.md` path —
+ * the single file in the harness workbench whose location sits OUTSIDE the
+ * project's `.claude/` subtree, so `resolveHarnessPath` would reject it as a
+ * traversal. This helper accepts only `projectSlug` (no caller-supplied
+ * relative path) and returns the canonical CLAUDE.md location alongside the
+ * project root, so traversal is impossible by construction.
+ */
+export async function resolveProjectClaudeMdPath(projectSlug) {
+    if (!projectSlug || projectSlug.includes('\0')) {
+        const err = new Error('invalid projectSlug');
+        err.code = HARNESS_ERRORS.HARNESS_PATH_DENIED.code;
+        throw err;
+    }
+    // Reject traversal-bearing slugs before they reach projectService — defense in depth.
+    if (projectSlug.includes('..') || projectSlug.includes('/') || projectSlug.includes('\\')) {
+        const err = new Error('projectSlug must not contain path separators');
+        err.code = HARNESS_ERRORS.HARNESS_PATH_DENIED.code;
+        throw err;
+    }
+    let projectRoot;
+    try {
+        projectRoot = await projectService.resolveOriginalPath(projectSlug);
+    }
+    catch (error) {
+        const wrapped = new Error(`Unable to resolve project root for "${projectSlug}": ${error.message}`);
+        wrapped.code = HARNESS_ERRORS.HARNESS_ROOT_MISSING.code;
+        throw wrapped;
+    }
+    const resolvedRoot = path.resolve(projectRoot);
+    const absolutePath = path.join(resolvedRoot, 'CLAUDE.md');
+    return { resolvedRoot, absolutePath };
+}
+//# sourceMappingURL=harnessPaths.js.map

package/packages/server/dist/utils/harnessPaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessPaths.js","sourceRoot":"","sources":["../../src/utils/harnessPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAuB,MAAM,gBAAgB,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AAEzD,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,6DAA6D;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAA0B,CAAC;QAC5F,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC;QACpD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,+CAA+C,WAAW,MAAO,KAAe,CAAC,OAAO,EAAE,CAClE,CAAC;QAC3B,OAAO,CAAC,IAAI,GAAG,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC;QACxD,MAAM,OAAO,CAAC;IAChB,CAAC;AACH,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAmB;IAC1D,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IAEnC,0EAA0E;IAC1E,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,4BAA4B,CAA0B,CAAC;QAC7E,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2BAA2B,CAA0B,CAAC;QAC5E,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,sBAAsB,CAA0B,CAAC;QACvE,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,KAAK,MAAM;QACvC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,qBAAqB,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;IAErE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAErD,6EAA6E;IAC7E,sEAAsE;IACtE,uBAAuB;IACvB,IAAI,YAAY,KAAK,YAAY,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2BAA2B,CAA0B,CAAC;QAC5E,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,WAAmB;IAClE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,qBAAqB,CAA0B,CAAC;QACtE,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,sFAAsF;IACtF,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1F,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,8CAA8C,CAA0B,CAAC;QAC/F,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,cAAc,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,uCAAuC,WAAW,MAAO,KAAe,CAAC,OAAO,EAAE,CAC1D,CAAC;QAC3B,OAAO,CAAC,IAAI,GAAG,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC;QACxD,MAAM,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAC1D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AACxC,CAAC"}

package/packages/server/dist/utils/pathUtils.d.ts

@@ -15,8 +15,9 @@ export declare function isProtectedPath(relativePath: string): boolean;
 /** Maximum file size for full content response (1MB) */
 export declare const MAX_FILE_SIZE: number;
 /**
- * Detect if a file is binary by reading the first 8192 bytes
- * and checking for null byte presence.
+ * Detect if a file is binary.
+ * 1. Extension allowlist for formats whose headers lack null bytes (e.g. ZIP, PDF).
+ * 2. Fallback: read first 8192 bytes and check for null byte presence.
  * @param filePath Absolute path to the file
  * @returns true if the file appears to be binary
  */

package/packages/server/dist/utils/pathUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pathUtils.d.ts","sourceRoot":"","sources":["../../src/utils/pathUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,iDAAkD,CAAC;AAErF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAI7D;AAED,wDAAwD;AACxD,eAAO,MAAM,aAAa,QAAkB,CAAC;AAK7C;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBrE;AA2BD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGpD"}
+{"version":3,"file":"pathUtils.d.ts","sourceRoot":"","sources":["../../src/utils/pathUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,iDAAkD,CAAC;AAErF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAI7D;AAED,wDAAwD;AACxD,eAAO,MAAM,aAAa,QAAkB,CAAC;AAyB7C;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBrE;AA2BD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGpD"}

package/packages/server/dist/utils/pathUtils.js

@@ -23,12 +23,36 @@ export const MAX_FILE_SIZE = 1 * 1024 * 1024;
 /** Number of bytes to read for binary detection */
 const BINARY_CHECK_BYTES = 8192;
 /**
- * Detect if a file is binary by reading the first 8192 bytes
- * and checking for null byte presence.
+ * Extensions whose magic bytes do not contain null (0x00) and therefore
+ * evade the null-byte heuristic below. Detected by extension up front.
+ */
+const BINARY_EXTENSIONS = new Set([
+    // Archives
+    '.zip', '.gz', '.tar', '.tgz', '.bz2', '.7z', '.rar', '.xz',
+    // Documents
+    '.pdf', '.doc', '.docx', '.xls', '.xlsx', '.ppt', '.pptx',
+    // Executables / libraries
+    '.exe', '.dll', '.so', '.dylib', '.class', '.jar', '.wasm',
+    // Databases
+    '.db', '.sqlite', '.sqlite3', '.mdb',
+    // Media (some already detected by null bytes, but listing for clarity)
+    '.mp3', '.mp4', '.avi', '.mov', '.wav', '.ogg', '.flac', '.webm',
+    '.webp', '.ico', '.bmp', '.tiff', '.heic',
+    // Fonts
+    '.ttf', '.otf', '.woff', '.woff2', '.eot',
+]);
+/**
+ * Detect if a file is binary.
+ * 1. Extension allowlist for formats whose headers lack null bytes (e.g. ZIP, PDF).
+ * 2. Fallback: read first 8192 bytes and check for null byte presence.
  * @param filePath Absolute path to the file
  * @returns true if the file appears to be binary
  */
 export async function isBinaryFile(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (BINARY_EXTENSIONS.has(ext)) {
+        return true;
+    }
     const handle = await fs.open(filePath, 'r');
     try {
         const buffer = Buffer.alloc(BINARY_CHECK_BYTES);

package/packages/server/dist/utils/pathUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"pathUtils.js","sourceRoot":"","sources":["../../src/utils/pathUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AAErF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,YAAoD,CAAC,CAAC;AAC9F,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7C,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAE1E,2CAA2C;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,qCAAqC;AACrC,MAAM,QAAQ,GAA2B;IACvC,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,kBAAkB;IAC3B,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,YAAY;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AACrD,CAAC"}
+{"version":3,"file":"pathUtils.js","sourceRoot":"","sources":["../../src/utils/pathUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AAErF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,YAAoD,CAAC,CAAC;AAC9F,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7C,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;IAC3D,YAAY;IACZ,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IACzD,0BAA0B;IAC1B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO;IAC1D,YAAY;IACZ,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM;IACpC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAChE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IACzC,QAAQ;IACR,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;CAC1C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAE1E,2CAA2C;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,qCAAqC;AACrC,MAAM,QAAQ,GAA2B;IACvC,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,kBAAkB;IAC3B,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,YAAY;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AACrD,CAAC"}

package/packages/server/dist/utils/secretHeuristic.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Story 30.1 (Task 1): single source of truth for secret-pattern heuristics
+ * used by the harness write paths.
+ *
+ * Replaces four drifted SECRET_PATTERNS definitions (harnessAgentService,
+ * harnessCommandService, harnessHookService, harnessMcpService). Drift
+ * before this module:
+ *
+ *   - agent / command / hook : 32-char base64 unanchored, Bearer unanchored
+ *   - mcp                    : 40-char base64 anchored,   Bearer anchored
+ *
+ * Canonical chosen here (Story 30.1 sub-spike 1.0, option (b)):
+ *   - 32-char base64 unanchored, Bearer unanchored
+ *
+ * Rationale: detection-rate first; Story 30.1 AC4.c provides a per-save
+ * "mark not a secret" opt-out that absorbs false positives, whereas missed
+ * detections silently leak credentials. MCP's stricter anchors were a local
+ * accident, not a deliberate spec decision.
+ *
+ * Two entry points are exposed because the four services walk two distinct
+ * shapes:
+ *
+ *   - detectSecretsInText  → string body (agent / command / hook commands)
+ *                            returns matched line numbers (1-based)
+ *   - detectSecretsInValue → arbitrary JSON-like value (mcp config)
+ *                            returns matched dot-paths
+ *
+ * Both strip `${ENV_VAR}` references first so legitimate env-var indirection
+ * (`Authorization: 'Bearer ${GH_TOKEN}'`) does not raise false positives.
+ */
+export interface SecretPattern {
+    name: string;
+    re: RegExp;
+    /**
+     * Optional minimum Shannon entropy (bits/char) gate for matched substrings.
+     * Story 30.3 spike #2: applies to the loose base64 pattern only. Natural
+     * English compounds (PascalCase identifiers, prose) sit at ~3.5–3.9; real
+     * base64-encoded tokens sit at ≥ 4.0 due to a-z/A-Z/0-9 uniform distribution.
+     * Other patterns keep their anchored prefixes (Bearer/sk-/AKIA/xox-) which
+     * already gate false positives — no entropy check needed.
+     */
+    minEntropy?: number;
+}
+export declare const SECRET_PATTERNS: readonly SecretPattern[];
+export declare const ENV_REF_RE: RegExp;
+/**
+ * Shannon entropy in bits/char of an arbitrary string. Used by patterns that
+ * opt in via `minEntropy` (currently the loose base64 pattern only).
+ */
+export declare function shannonEntropy(s: string): number;
+export interface DetectSecretsTextResult {
+    matched: boolean;
+    patternNames: string[];
+    lines: number[];
+}
+export interface DetectSecretsValueResult {
+    matched: boolean;
+    patternNames: string[];
+    paths: string[];
+}
+/**
+ * Line-based scanner for textual command / prompt bodies (agent system
+ * prompts, slash command bodies, hook command/prompt strings).
+ */
+export declare function detectSecretsInText(text: string): DetectSecretsTextResult;
+/**
+ * Object-walk scanner for JSON-like values (mcp server config). Each string
+ * leaf is evaluated against the canonical patterns; matches are reported as
+ * dot-paths (`env.GITHUB_TOKEN`, `headers.Authorization`, ...).
+ */
+export declare function detectSecretsInValue(value: unknown, basePath?: string[]): DetectSecretsValueResult;
+//# sourceMappingURL=secretHeuristic.d.ts.map

package/packages/server/dist/utils/secretHeuristic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretHeuristic.d.ts","sourceRoot":"","sources":["../../src/utils/secretHeuristic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAMnD,CAAC;AAEF,eAAO,MAAM,UAAU,QAAkC,CAAC;AAE1D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAWhD;AAkCD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAQD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CA0BzE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,EAAO,GACtB,wBAAwB,CAgC1B"}