integral-mind 0.1.0

package/dist/hooks.js

@@ -0,0 +1,261 @@
+import { appendFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveConfig } from "./config.js";
+import { redactSecrets } from "./redact.js";
+import { ImClient } from "./client.js";
+/**
+ * Claude Code session-end hook: `im hooks install claude` wires a
+ * SessionEnd entry into ~/.claude/settings.json; at session end Claude
+ * Code invokes `... hooks claude-session-end` with a JSON payload on
+ * stdin ({ session_id, transcript_path, cwd, reason }), and this module
+ * reshapes the transcript into the session envelope, redacts it, and
+ * pushes it.
+ *
+ * Contract: the hook process ALWAYS exits 0. A failing push must never
+ * break or block the Claude session — failures are appended to
+ * ~/.local/state/integral-mind/hooks.log instead.
+ */
+const HOOK_MARKER = "hooks claude-session-end";
+export function claudeSettingsPath(env = process.env) {
+    return env.INTEGRAL_MIND_CLAUDE_SETTINGS ?? join(homedir(), ".claude", "settings.json");
+}
+export function hookLogPath(env = process.env) {
+    return (env.INTEGRAL_MIND_HOOK_LOG ?? join(homedir(), ".local", "state", "integral-mind", "hooks.log"));
+}
+/** The command Claude Code will run: absolute node + absolute cli.js. */
+export function hookCommand() {
+    const cliPath = fileURLToPath(new URL("./cli.js", import.meta.url));
+    return `${JSON.stringify(process.execPath)} ${JSON.stringify(cliPath)} ${HOOK_MARKER}`;
+}
+/**
+ * A missing file is an empty config; anything else that prevents reading
+ * or parsing ABORTS the operation — installing over unreadable settings
+ * would silently erase whatever Claude Code had configured.
+ */
+async function readSettings(path) {
+    let raw;
+    try {
+        raw = await readFile(path, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw new Error(`Cannot read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`${path} is not valid JSON — fix or remove it before installing the hook (refusing to overwrite it)`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`${path} does not contain a JSON object — refusing to overwrite it`);
+    }
+    return parsed;
+}
+/** Atomic replace: write a sibling temp file, then rename over the target. */
+async function writeSettings(path, serialized) {
+    await mkdir(dirname(path), { recursive: true });
+    const tmp = `${path}.integral-mind-${process.pid}.tmp`;
+    await writeFile(tmp, serialized);
+    await rename(tmp, path);
+}
+/**
+ * Read-modify-write that never silently discards a concurrent update.
+ * Cooperative locking is impossible here — Claude Code writes
+ * settings.json without honoring any lock we could take — so instead of
+ * pretending to prevent the race, we detect losing it: after the atomic
+ * rename, re-read the file; if it no longer matches what we wrote,
+ * another writer won mid-cycle, and the loop re-applies our modification
+ * on top of THEIR fresh state. Either our write is the visible state or
+ * it is re-merged — nothing is dropped without a retry.
+ * Returns false when `modify` decides there is nothing to change.
+ */
+async function updateSettings(path, modify) {
+    for (let attempt = 0; attempt < 5; attempt++) {
+        const settings = await readSettings(path);
+        const next = modify(settings);
+        if (next === null)
+            return false;
+        const serialized = `${JSON.stringify(next, null, 2)}\n`;
+        await writeSettings(path, serialized);
+        const after = await readFile(path, "utf8").catch(() => null);
+        if (after === serialized)
+            return true;
+        // A concurrent writer overlapped; loop to re-apply on their state.
+    }
+    throw new Error(`${path} keeps changing while updating it — is a session ending? Retry shortly.`);
+}
+/**
+ * Ours = the command *ends with* our subcommand AND references this CLI
+ * (cli.js, the npm package name, or a bare `im`). A foreign command that
+ * merely mentions the marker somewhere in its arguments is not claimed.
+ */
+function isOurs(entry) {
+    return (entry.hooks ?? []).some((h) => {
+        const command = h.command?.trim() ?? "";
+        if (!command.endsWith(HOOK_MARKER))
+            return false;
+        if (command === hookCommand())
+            return true; // exact current install
+        // Package identity, not just "some cli.js": the path must contain this
+        // package's name (npm: node_modules/integral-mind/...; repo checkout:
+        // apps/im-cli/...), or be the bare bin / npx invocation.
+        return (/(^|[\/"'\s])(integral-mind|im-cli)[\/"']/.test(command) ||
+            command === `im ${HOOK_MARKER}` ||
+            command === `npx integral-mind ${HOOK_MARKER}`);
+    });
+}
+/** Idempotent: a second install is a no-op. Returns what happened. */
+export async function installClaudeHook(env = process.env) {
+    const wrote = await updateSettings(claudeSettingsPath(env), (settings) => {
+        const sessionEnd = settings.hooks?.SessionEnd ?? [];
+        if (sessionEnd.some(isOurs))
+            return null;
+        return {
+            ...settings,
+            hooks: {
+                ...settings.hooks,
+                SessionEnd: [...sessionEnd, { hooks: [{ type: "command", command: hookCommand() }] }],
+            },
+        };
+    });
+    return wrote ? "installed" : "already-installed";
+}
+/** Removes only our entries; other hooks survive untouched. */
+export async function uninstallClaudeHook(env = process.env) {
+    const wrote = await updateSettings(claudeSettingsPath(env), (settings) => {
+        const sessionEnd = settings.hooks?.SessionEnd ?? [];
+        const kept = sessionEnd.filter((entry) => !isOurs(entry));
+        if (kept.length === sessionEnd.length)
+            return null;
+        const hooks = { ...settings.hooks };
+        if (kept.length > 0)
+            hooks.SessionEnd = kept;
+        else
+            delete hooks.SessionEnd;
+        const next = { ...settings };
+        if (Object.keys(hooks).length > 0)
+            next.hooks = hooks;
+        else
+            delete next.hooks;
+        return next;
+    });
+    return wrote ? "uninstalled" : "not-installed";
+}
+/**
+ * Lenient Claude Code transcript (.jsonl) reader: keeps user/assistant
+ * text, renders tool activity as short placeholders, skips everything it
+ * doesn't recognize. Transcript format drift must degrade, not throw.
+ */
+export function parseTranscript(jsonl) {
+    const messages = [];
+    for (const line of jsonl.split("\n")) {
+        if (!line.trim())
+            continue;
+        let obj;
+        try {
+            obj = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const type = obj.type;
+        if (type !== "user" && type !== "assistant")
+            continue;
+        const message = obj.message;
+        if (!message)
+            continue;
+        const role = message.role === "assistant" ? "assistant" : "user";
+        const content = renderContent(message.content);
+        if (!content.trim())
+            continue;
+        const ts = typeof obj.timestamp === "string" ? obj.timestamp : undefined;
+        messages.push({ role, content, ...(ts ? { ts } : {}) });
+    }
+    return messages;
+}
+function renderContent(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    const parts = [];
+    for (const block of content) {
+        if (typeof block !== "object" || block === null)
+            continue;
+        const b = block;
+        if (b.type === "text" && typeof b.text === "string")
+            parts.push(b.text);
+        else if (b.type === "tool_use" && typeof b.name === "string")
+            parts.push(`[tool_use: ${b.name}]`);
+        else if (b.type === "tool_result")
+            parts.push("[tool_result]");
+    }
+    return parts.join("\n");
+}
+export function defaultSessionEndDeps(env = process.env) {
+    return {
+        pushSession: async (envelope) => {
+            const resolved = await resolveConfig(env);
+            if ("error" in resolved)
+                throw new Error(resolved.error);
+            return new ImClient(resolved).pushSession(envelope);
+        },
+        log: async (line) => {
+            const path = hookLogPath(env);
+            await mkdir(dirname(path), { recursive: true });
+            await appendFile(path, `${new Date().toISOString()} ${line}\n`);
+        },
+        readTranscript: (path) => readFile(path, "utf8"),
+    };
+}
+/**
+ * The hook entrypoint. Never throws; always resolves 0 so Claude Code is
+ * never blocked by a failing push.
+ */
+export async function runClaudeSessionEnd(stdinJson, deps) {
+    try {
+        const payload = JSON.parse(stdinJson);
+        if (!payload.transcript_path) {
+            await deps.log("skip: no transcript_path in hook payload");
+            return 0;
+        }
+        const messages = parseTranscript(await deps.readTranscript(payload.transcript_path));
+        if (messages.length < 2) {
+            await deps.log(`skip: transcript has ${messages.length} usable message(s)`);
+            return 0;
+        }
+        const project = payload.cwd ? basename(payload.cwd) : "unknown-project";
+        const envelope = {
+            agent: "claude-code",
+            title: `Claude Code — ${project}${payload.session_id ? ` (${payload.session_id.slice(0, 8)})` : ""}`,
+            ...(messages[0]?.ts ? { started_at: messages[0].ts } : {}),
+            messages,
+        };
+        let redactedCount = 0;
+        for (const message of messages) {
+            const { text, findings } = redactSecrets(message.content);
+            message.content = text;
+            redactedCount += findings.reduce((sum, f) => sum + f.count, 0);
+        }
+        // The title embeds the cwd basename — hook metadata gets the same
+        // redaction contract as message content.
+        const titleScrub = redactSecrets(String(envelope.title));
+        envelope.title = titleScrub.text;
+        redactedCount += titleScrub.findings.reduce((sum, f) => sum + f.count, 0);
+        const result = await deps.pushSession(envelope);
+        await deps.log(`pushed session ${String(result.source_id)} (${messages.length} messages, ${redactedCount} redaction(s), deduplicated=${String(result.deduplicated)})`);
+    }
+    catch (err) {
+        // Swallow everything: the log line is the only side effect of failure.
+        await deps
+            .log(`push failed: ${err instanceof Error ? err.message : String(err)}`)
+            .catch(() => { });
+    }
+    return 0;
+}
+//# sourceMappingURL=hooks.js.map

package/dist/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,GAAG,CAAC,6BAA6B,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,OAAO,CACL,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,WAAW;IACzB,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC;AACzF,CAAC;AAUD;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,6FAA6F,CACrG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4DAA4D,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,UAAkB;IAC3D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,GAAG,IAAI,kBAAkB,OAAO,CAAC,GAAG,MAAM,CAAC;IACvD,MAAM,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACjC,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,MAAyD;IAEzD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACxD,MAAM,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QACtC,mEAAmE;IACrE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yEAAyE,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,KAA8C;IAC5D,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,OAAO,KAAK,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,yDAAyD;QACzD,OAAO,CACL,0CAA0C,CAAC,IAAI,CAAC,OAAO,CAAC;YACxD,OAAO,KAAK,MAAM,WAAW,EAAE;YAC/B,OAAO,KAAK,qBAAqB,WAAW,EAAE,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE;QACvE,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO;YACL,GAAG,QAAQ;YACX,KAAK,EAAE;gBACL,GAAG,QAAQ,CAAC,KAAK;gBACjB,UAAU,EAAE,CAAC,GAAG,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;aACtF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACnD,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE;QACvE,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEnD,MAAM,KAAK,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;;YACxC,OAAO,KAAK,CAAC,UAAU,CAAC;QAC7B,MAAM,IAAI,GAAkB,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC;AACjD,CAAC;AAMD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,OAA2D,CAAC;QAChF,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QAC9B,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACnE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1D,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;aACjC,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAQD,MAAM,UAAU,qBAAqB,CACnC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC9B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,OAAO,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACzD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;QAClE,CAAC;QACD,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,IAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAInC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QACrF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,GAAG,CAAC,wBAAwB,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACxE,MAAM,QAAQ,GAA4B;YACxC,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,iBAAiB,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACpG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,QAAQ;SACT,CAAC;QAEF,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1D,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YACvB,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,kEAAkE;QAClE,yCAAyC;QACzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,QAAQ,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC;QACjC,aAAa,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,GAAG,CACZ,kBAAkB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,MAAM,cAAc,aAAa,+BAA+B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CACvJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,MAAM,IAAI;aACP,GAAG,CAAC,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;aACvE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/redact.js

@@ -0,0 +1,77 @@
+// Order matters: structured/specific shapes run before the generic
+// high-entropy catch-all so findings carry the most precise type.
+export const REDACTION_RULES = [
+    {
+        type: "pem-block",
+        pattern: /-----BEGIN [A-Z0-9 ]{0,48}PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]{0,48}PRIVATE KEY-----/g,
+    },
+    { type: "anthropic-api-key", pattern: /\bsk-ant-[A-Za-z0-9_-]{16,}\b/g },
+    { type: "openai-api-key", pattern: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\b/g },
+    { type: "integral-mind-token", pattern: /\bimk_[A-Za-z0-9_-]{16,}\b/g },
+    { type: "aws-access-key", pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g },
+    { type: "github-token", pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g },
+    { type: "github-fine-grained-token", pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
+    { type: "google-api-key", pattern: /\bAIza[A-Za-z0-9_-]{30,}\b/g },
+    { type: "slack-token", pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g },
+    { type: "stripe-key", pattern: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}\b/g },
+    { type: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+    {
+        // Square brackets are excluded so an earlier rule's [REDACTED:…]
+        // placeholder (which contains a colon) can never re-match as user:pass.
+        type: "connection-string",
+        pattern: /\b[a-z][a-z0-9+.-]{1,24}:\/\/[^\s:@/[\]]{1,64}:[^\s@[\]]{1,256}@[^\s"'`]+/gi,
+    },
+    {
+        type: "assignment-secret",
+        pattern: /\b((?:api[_-]?key|secret|token|passwd|password|credential)[a-z0-9_-]*)(\s*[:=]\s*)["']?(?!\[REDACTED)[^\s"']{8,}["']?/gi,
+    },
+];
+const HIGH_ENTROPY_CANDIDATE = /\b[A-Za-z0-9+/=_-]{32,}\b/g;
+const ENTROPY_THRESHOLD = 4.2;
+export function shannonEntropy(value) {
+    const counts = new Map();
+    for (const ch of value)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const p = count / value.length;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+export function redactSecrets(text) {
+    const counts = new Map();
+    let out = text;
+    for (const rule of REDACTION_RULES) {
+        out = out.replace(rule.pattern, (match, ...rest) => {
+            counts.set(rule.type, (counts.get(rule.type) ?? 0) + 1);
+            if (rule.type === "assignment-secret") {
+                // Keep the key name; replace only the value.
+                const [name, sep] = rest;
+                return `${name}${sep}[REDACTED:${rule.type}]`;
+            }
+            return `[REDACTED:${rule.type}]`;
+        });
+    }
+    out = out.replace(HIGH_ENTROPY_CANDIDATE, (match) => {
+        if (match.startsWith("[REDACTED"))
+            return match;
+        // Long hex (git SHAs) and uuid-ish strings are common in transcripts;
+        // only redact when entropy says "random secret", not "identifier".
+        if (shannonEntropy(match) < ENTROPY_THRESHOLD)
+            return match;
+        counts.set("high-entropy-string", (counts.get("high-entropy-string") ?? 0) + 1);
+        return "[REDACTED:high-entropy-string]";
+    });
+    const findings = [...counts.entries()]
+        .map(([type, count]) => ({ type, count }))
+        .sort((a, b) => a.type.localeCompare(b.type));
+    return { text: out, findings };
+}
+export function summarizeFindings(findings) {
+    if (findings.length === 0)
+        return "redaction: nothing to scrub";
+    const parts = findings.map((f) => `${f.type}×${f.count}`);
+    return `redaction: scrubbed ${parts.join(", ")}`;
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAsBA,mEAAmE;AACnE,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EACL,6FAA6F;KAChG;IACD,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACxE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACpF,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACvE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0CAA0C,EAAE;IAC/E,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,+CAA+C,EAAE;IAClF,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACnF,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAClE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACrE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,2CAA2C,EAAE;IAC5E,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,oEAAoE,EAAE;IAC9F;QACE,iEAAiE;QACjE,wEAAwE;QACxE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,6EAA6E;KACvF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EACL,yHAAyH;KAC5H;CACF,CAAC;AAEF,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAC5D,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,GAAG,GAAG,IAAI,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;YACjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACtC,6CAA6C;gBAC7C,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAwB,CAAC;gBAC7C,OAAO,GAAG,IAAI,GAAG,GAAG,aAAa,IAAI,CAAC,IAAI,GAAG,CAAC;YAChD,CAAC;YACD,OAAO,aAAa,IAAI,CAAC,IAAI,GAAG,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE;QAClD,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,sEAAsE;QACtE,mEAAmE;QACnE,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,iBAAiB;YAAE,OAAO,KAAK,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,OAAO,gCAAgC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAA4B;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,6BAA6B,CAAC;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,OAAO,uBAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC"}