jinzd-ai-cli 0.4.233 → 0.4.234

package/dist/chunk-KCEO2XJ4.js

@@ -0,0 +1,420 @@
+#!/usr/bin/env node
+import {
+  atomicWriteFileSync
+} from "./chunk-IW3Q7AE5.js";
+
+// src/security/redactor.ts
+var DEFAULT_PATTERNS = [
+  // password: xxx / password = xxx / password="xxx"
+  // Covers YAML / JSON / shell-ish / env-file forms.
+  { kind: "password", regex: /\b(password|passwd|pwd)\s*[:=]\s*["']?([^\s"',;{}]{4,200})["']?/gi },
+  // PGPASSWORD=xxx (explicit bash env-var form, separate rule because no quotes usually)
+  { kind: "pgpassword-env", regex: /\b(PGPASSWORD)=([^\s"']{4,200})/g },
+  // JDBC/PG/MySQL/Mongo connection strings with inline credentials
+  // postgresql://user:pass@host/db → redact pass
+  { kind: "db-uri-password", regex: /(\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^:\s]+:)([^@\s]+)(@)/gi },
+  // Anthropic API keys
+  { kind: "anthropic-key", regex: /(sk-ant-[a-zA-Z0-9_-]{90,})/g },
+  // L6 (v0.4.108): Zhipu / GLM API keys — `<24+ hex/base64-ish>.<32+>`
+  // Two segments separated by a dot, each safely identifiable by length
+  // and char class. Conservative on the lower bound so we don't eat
+  // version strings like `1.0.0` or filenames.
+  { kind: "zhipu-key", regex: /\b([a-zA-Z0-9]{24,}\.[a-zA-Z0-9]{32,})\b/g },
+  // OpenAI / generic sk- keys — requires length ≥32 to avoid eating short identifiers
+  { kind: "openai-key", regex: /(sk-(?:proj-)?[a-zA-Z0-9_-]{32,})/g },
+  // GitHub personal access tokens
+  { kind: "github-pat", regex: /\b(ghp_[a-zA-Z0-9]{36})\b/g },
+  { kind: "github-oauth", regex: /\b(gho_[a-zA-Z0-9]{36})\b/g },
+  { kind: "github-install", regex: /\b(ghs_[a-zA-Z0-9]{36})\b/g },
+  // Slack tokens
+  { kind: "slack-bot", regex: /\b(xoxb-\d+-\d+-[a-zA-Z0-9]+)\b/g },
+  { kind: "slack-user", regex: /\b(xoxp-\d+-\d+-\d+-[a-zA-Z0-9]+)\b/g },
+  // AWS access key IDs (AKIA...) and secret access keys are context-dependent;
+  // we only catch the ID because secret key alone is indistinguishable from random base64.
+  { kind: "aws-access-key-id", regex: /\b(AKIA[0-9A-Z]{16})\b/g },
+  // Google API keys
+  { kind: "google-api-key", regex: /\b(AIza[0-9A-Za-z_-]{35})\b/g },
+  // Generic "api_key": "..." / "apiKey": "..." / api-key=xxx
+  { kind: "api-key", regex: /\b(api[_-]?key)\s*[:=]\s*["']?([a-zA-Z0-9_\-.]{16,200})["']?/gi },
+  // Generic token: xxx (only when value looks token-shaped; avoids eating human prose)
+  { kind: "token", regex: /\b(token|access[_-]?token|bearer[_-]?token)\s*[:=]\s*["']?([a-zA-Z0-9_\-.]{20,300})["']?/gi },
+  // Bearer <token> in Authorization headers
+  { kind: "bearer", regex: /\b(Authorization:\s*Bearer\s+)([a-zA-Z0-9_\-.=]{20,500})/g },
+  // Private key PEM blocks — catch the header+footer together
+  // P2-PERF-02: PEM bodies use strict Base64 + =\n — narrowed char class avoids backtracking
+  { kind: "private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[ \t\n\r]*[A-Za-z0-9+/=\n\r-]*[ \t\n\r]*-----END [A-Z ]*PRIVATE KEY-----/g }
+];
+var MAX_CUSTOM = 32;
+var MAX_PATTERN_LEN = 500;
+var SUSPICIOUS_REDOS = /\([^)]*[+*][^)]*\)\s*[+*{]/;
+var MAX_REDACT_INPUT = 512e3;
+function render(placeholder, kind) {
+  return placeholder.replace("{kind}", kind);
+}
+function redactString(input, options) {
+  if (!options.enabled || !input) return { redacted: input, hits: [] };
+  if (input.length > MAX_REDACT_INPUT) return { redacted: input, hits: [] };
+  const placeholder = options.placeholder ?? "[REDACTED:{kind}]";
+  const customSrcs = (options.customRegexes ?? []).slice(0, MAX_CUSTOM);
+  const patterns = [
+    ...options.patterns ?? DEFAULT_PATTERNS,
+    ...customSrcs.flatMap((src, i) => {
+      if (typeof src !== "string" || src.length === 0 || src.length > MAX_PATTERN_LEN) return [];
+      try {
+        const flags = src.match(/^\/.*\/([gimsuy]*)$/)?.[1] ?? "";
+        const body = src.replace(/^\/(.*)\/[gimsuy]*$/, "$1");
+        if (SUSPICIOUS_REDOS.test(body)) return [];
+        const regex = new RegExp(body, flags.includes("g") ? flags : flags + "g");
+        return [{ kind: `custom-${i}`, regex }];
+      } catch {
+        return [];
+      }
+    })
+  ];
+  let redacted = input;
+  const hits = [];
+  for (const { kind, regex } of patterns) {
+    const rx = new RegExp(regex.source, regex.flags);
+    const captureCount = new RegExp(rx.source + "|").exec("").length - 1;
+    redacted = redacted.replace(rx, (...args) => {
+      const match = args[0];
+      const g1 = captureCount >= 1 ? args[1] : void 0;
+      const g2 = captureCount >= 2 ? args[2] : void 0;
+      const offset = args[1 + captureCount];
+      if (captureCount >= 2 && typeof g2 === "string") {
+        hits.push({ kind, start: offset + (g1?.length ?? 0), length: g2.length, secret: g2 });
+        return `${g1}${render(placeholder, kind)}`;
+      }
+      hits.push({ kind, start: offset, length: match.length, secret: g1 ?? match });
+      return render(placeholder, kind);
+    });
+  }
+  return { redacted, hits };
+}
+function redactJson(value, options) {
+  if (!options.enabled) return { value, hits: [] };
+  const allHits = [];
+  function walk(v) {
+    if (typeof v === "string") {
+      const r = redactString(v, options);
+      allHits.push(...r.hits);
+      return r.redacted;
+    }
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === "object") {
+      const out = {};
+      for (const [k, vv] of Object.entries(v)) {
+        out[k] = walk(vv);
+      }
+      return out;
+    }
+    return v;
+  }
+  const redacted = walk(value);
+  return { value: redacted, hits: allHits };
+}
+function scanString(input, options) {
+  const { hits } = redactString(input, { ...options, enabled: true });
+  return hits;
+}
+
+// src/session/session-index.ts
+import { existsSync, readFileSync as readFileSync2, readdirSync, statSync } from "fs";
+import { join } from "path";
+
+// src/session/session-meta.ts
+import { readFileSync, openSync, readSync, closeSync } from "fs";
+function safeDate(value) {
+  const d = new Date(value);
+  return isNaN(d.getTime()) ? /* @__PURE__ */ new Date(0) : d;
+}
+function extractJsonField(header, field) {
+  const re = new RegExp(`"${field}"\\s*:\\s*"([^"]*)"`, "i");
+  const m = header.match(re);
+  return m ? m[1] : void 0;
+}
+function extractJsonNumberField(header, field) {
+  const m = header.match(new RegExp(`"${field}"\\s*:\\s*(\\d+)`));
+  return m ? Number(m[1]) : void 0;
+}
+function readSessionMeta(filePath) {
+  const HEADER_SIZE = 1024;
+  let header;
+  try {
+    const fd = openSync(filePath, "r");
+    const buf = Buffer.alloc(HEADER_SIZE);
+    const bytesRead = readSync(fd, buf, 0, HEADER_SIZE, 0);
+    closeSync(fd);
+    header = buf.toString("utf-8", 0, bytesRead);
+  } catch {
+    return null;
+  }
+  const id = extractJsonField(header, "id");
+  const provider = extractJsonField(header, "provider");
+  const model = extractJsonField(header, "model");
+  const created = extractJsonField(header, "created");
+  const updated = extractJsonField(header, "updated");
+  const title = extractJsonField(header, "title");
+  if (id && provider && model) {
+    let messageCount = extractJsonNumberField(header, "messageCount");
+    if (messageCount === void 0) {
+      messageCount = 0;
+      try {
+        const full = readFileSync(filePath, "utf-8");
+        const matches = full.match(/"role"\s*:/g);
+        messageCount = matches ? matches.length : 0;
+      } catch {
+      }
+    }
+    let branchCount;
+    let activeBranch;
+    try {
+      const brMatch = header.match(/"branches"\s*:\s*\[/);
+      if (brMatch) {
+        const parentMatches = header.match(/"parentBranchId"/g);
+        branchCount = parentMatches ? parentMatches.length + 1 : 1;
+      }
+      activeBranch = extractJsonField(header, "activeBranchId");
+    } catch {
+    }
+    return {
+      id,
+      provider,
+      model,
+      messageCount,
+      created: safeDate(created),
+      updated: safeDate(updated),
+      title: title || void 0,
+      branchCount,
+      activeBranch
+    };
+  }
+  const data = JSON.parse(readFileSync(filePath, "utf-8"));
+  return {
+    id: data.id,
+    provider: data.provider,
+    model: data.model,
+    messageCount: data.messages?.length ?? 0,
+    created: safeDate(data.created),
+    updated: safeDate(data.updated),
+    title: data.title,
+    branchCount: data.branches?.length ?? 1,
+    activeBranch: data.activeBranchId
+  };
+}
+
+// src/session/session-index.ts
+var INDEX_FILE = "sessions.index.json";
+function indexFilePath(historyDir) {
+  return join(historyDir, INDEX_FILE);
+}
+function loadIndex(historyDir) {
+  const fp = indexFilePath(historyDir);
+  if (!existsSync(fp)) return null;
+  try {
+    const data = JSON.parse(readFileSync2(fp, "utf-8"));
+    if (data?.version === 1 && data.sessions && data.invertedIndex) {
+      return data;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function saveIndex(historyDir, idx) {
+  idx.built = (/* @__PURE__ */ new Date()).toISOString();
+  const fp = indexFilePath(historyDir);
+  atomicWriteFileSync(fp, JSON.stringify(idx));
+}
+function rebuildIndex(historyDir) {
+  if (!existsSync(historyDir)) {
+    const empty = { version: 1, built: (/* @__PURE__ */ new Date()).toISOString(), sessions: {}, invertedIndex: {} };
+    return empty;
+  }
+  const files = readdirSync(historyDir).filter((f) => f.endsWith(".json"));
+  const sessions = {};
+  const invertedIndex = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const filePath = join(historyDir, file);
+    const meta = readSessionMeta(filePath);
+    if (!meta) continue;
+    let fileSize = 0;
+    try {
+      fileSize = statSync(filePath).size;
+    } catch {
+    }
+    let mtimeMs = 0;
+    try {
+      mtimeMs = statSync(filePath).mtimeMs;
+    } catch {
+    }
+    const entry = {
+      id: meta.id,
+      provider: meta.provider,
+      model: meta.model,
+      title: meta.title,
+      messageCount: meta.messageCount,
+      fileSize,
+      created: meta.created.toISOString(),
+      updated: meta.updated.toISOString(),
+      branchCount: meta.branchCount,
+      activeBranch: meta.activeBranch,
+      _mtimeMs: mtimeMs
+    };
+    sessions[meta.id] = entry;
+    addTokensToIndex(invertedIndex, meta.title ?? "", meta.id);
+  }
+  const serializedIndex = {};
+  for (const [token, ids] of invertedIndex) {
+    serializedIndex[token] = [...ids];
+  }
+  const idx = {
+    version: 1,
+    built: (/* @__PURE__ */ new Date()).toISOString(),
+    sessions,
+    invertedIndex: serializedIndex
+  };
+  saveIndex(historyDir, idx);
+  return idx;
+}
+function updateSessionInIndex(historyDir, meta, filePath) {
+  let idx = loadIndex(historyDir);
+  if (!idx) {
+    rebuildIndex(historyDir);
+    return;
+  }
+  let fileSize = 0;
+  try {
+    fileSize = statSync(filePath).size;
+  } catch {
+  }
+  let mtimeMs = 0;
+  try {
+    mtimeMs = statSync(filePath).mtimeMs;
+  } catch {
+  }
+  const id = meta.id;
+  for (const [token, ids] of Object.entries(idx.invertedIndex)) {
+    const filtered = ids.filter((sid) => sid !== id);
+    if (filtered.length === 0) {
+      delete idx.invertedIndex[token];
+    } else {
+      idx.invertedIndex[token] = filtered;
+    }
+  }
+  idx.sessions[id] = {
+    id,
+    provider: meta.provider,
+    model: meta.model,
+    title: meta.title,
+    messageCount: meta.messageCount,
+    fileSize,
+    created: meta.created.toISOString(),
+    updated: meta.updated.toISOString(),
+    _mtimeMs: mtimeMs
+  };
+  const tokens = tokenize(meta.title ?? "");
+  for (const token of tokens) {
+    const existing = idx.invertedIndex[token] ?? [];
+    if (!existing.includes(id)) {
+      existing.push(id);
+      idx.invertedIndex[token] = existing;
+    }
+  }
+  saveIndex(historyDir, idx);
+}
+function removeSessionFromIndex(historyDir, id) {
+  const idx = loadIndex(historyDir);
+  if (!idx) return;
+  delete idx.sessions[id];
+  for (const [token, ids] of Object.entries(idx.invertedIndex)) {
+    const filtered = ids.filter((sid) => sid !== id);
+    if (filtered.length === 0) {
+      delete idx.invertedIndex[token];
+    } else {
+      idx.invertedIndex[token] = filtered;
+    }
+  }
+  saveIndex(historyDir, idx);
+}
+function listFromIndex(historyDir, opts) {
+  let idx = loadIndex(historyDir);
+  if (!idx) {
+    idx = rebuildIndex(historyDir);
+  }
+  return Object.values(idx.sessions).map((entry) => ({
+    id: entry.id,
+    provider: entry.provider,
+    model: entry.model,
+    title: entry.title,
+    messageCount: entry.messageCount,
+    created: new Date(entry.created),
+    updated: new Date(entry.updated),
+    fileSize: opts?.includeFileSize ? entry.fileSize : void 0,
+    branchCount: entry.branchCount,
+    activeBranch: entry.activeBranch
+  })).sort((a, b) => b.updated.getTime() - a.updated.getTime());
+}
+function searchCandidates(historyDir, query) {
+  const idx = loadIndex(historyDir);
+  if (!idx) return null;
+  const queryTokens = tokenize(query.toLowerCase());
+  if (queryTokens.length === 0) return null;
+  const scoreMap = /* @__PURE__ */ new Map();
+  for (const token of queryTokens) {
+    const matchingIds = idx.invertedIndex[token];
+    if (!matchingIds) continue;
+    for (const sid of matchingIds) {
+      scoreMap.set(sid, (scoreMap.get(sid) ?? 0) + 1);
+    }
+  }
+  const candidates = [...scoreMap.entries()].filter(([, score]) => score > 0).sort((a, b) => {
+    const scoreDiff = b[1] - a[1];
+    if (scoreDiff !== 0) return scoreDiff;
+    const aMeta = idx.sessions[a[0]];
+    const bMeta = idx.sessions[b[0]];
+    return (bMeta?.updated ?? "").localeCompare(aMeta?.updated ?? "");
+  }).map(([sid]) => sid);
+  return candidates.length > 0 ? candidates : null;
+}
+function getIndexMtimeMap(historyDir) {
+  const idx = loadIndex(historyDir);
+  if (!idx) return null;
+  const map = {};
+  for (const entry of Object.values(idx.sessions)) {
+    map[entry.id] = entry._mtimeMs;
+  }
+  return map;
+}
+function addTokensToIndex(invertedIndex, text, sessionId) {
+  for (const token of tokenize(text)) {
+    const s = invertedIndex.get(token) ?? /* @__PURE__ */ new Set();
+    s.add(sessionId);
+    invertedIndex.set(token, s);
+  }
+}
+function tokenize(text) {
+  const tokens = /* @__PURE__ */ new Set();
+  const cjkOnly = text.replace(/[^\u4e00-\u9fff\u3400-\u4dbf]/g, "");
+  for (let i = 0; i < cjkOnly.length - 1; i++) {
+    tokens.add(cjkOnly.slice(i, i + 2));
+  }
+  const english = text.replace(/[\u4e00-\u9fff\u3400-\u4dbf]/g, " ").toLowerCase();
+  const words = english.split(/[^a-z0-9]+/).filter((w) => w.length >= 2);
+  for (const w of words) tokens.add(w);
+  return [...tokens];
+}
+
+export {
+  DEFAULT_PATTERNS,
+  redactString,
+  redactJson,
+  scanString,
+  safeDate,
+  readSessionMeta,
+  updateSessionInIndex,
+  removeSessionFromIndex,
+  listFromIndex,
+  searchCandidates,
+  getIndexMtimeMap
+};

package/dist/{chunk-5PKNKJYP.js → chunk-L5PNAQ6O.js}

@@ -8,7 +8,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-ACTO5C6K.js";
+} from "./chunk-3KTSJ2EL.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-TJK7AU65.js → chunk-TAXIG7HH.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   VERSION
-} from "./chunk-ACTO5C6K.js";
+} from "./chunk-3KTSJ2EL.js";
 
 // src/cli/ci-format.ts
 var DEFAULT_CI_THRESHOLDS = {