jules-orchestrator-kit 0.5.2 → 0.6.0

package/scripts/utils.mjs

@@ -92,3 +92,142 @@ export function resolveMarkdownConflict(content) {
 
   return result.join("\n");
 }
+
+export function calculateShannonEntropy(str) {
+  const len = str.length;
+  if (len === 0) return 0;
+  const frequencies = {};
+  for (let i = 0; i < len; i++) {
+    frequencies[str[i]] = (frequencies[str[i]] || 0) + 1;
+  }
+  return Object.values(frequencies).reduce((sum, count) => {
+    const p = count / len;
+    return sum - p * Math.log2(p);
+  }, 0);
+}
+
+export function redactSecrets(text) {
+  if (!text) return "";
+  let sanitized = text;
+
+  for (const [envKey, envVal] of Object.entries(process.env)) {
+    if (
+      envVal &&
+      (envVal.length >= 20 || calculateShannonEntropy(envVal) > 3.6) &&
+      /KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH/i.test(envKey)
+    ) {
+      if (sanitized.includes(envVal)) {
+        sanitized = sanitized.split(envVal).join("[REDACTED_ENV_SECRET]");
+      }
+    }
+  }
+
+  const patterns = [
+    /\bgh[pousr]_[a-zA-Z0-9]{36,}\b/g,
+    /\bgithub_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}\b/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\bAIza[0-9A-Za-z_-]{30,40}\b/g,
+    /\bya29\.[a-zA-Z0-9_\-]{20,}\b/g,
+    /\bBearer\s+[a-zA-Z0-9\-\._~+\/]+=*/g,
+    /\bsk-(?:ant-api03-|proj-|svcacct-)[a-zA-Z0-9\-\_]{32,}\b/g,
+    /\bxox[baprs]-[a-zA-Z0-9\-]{10,}\b/g,
+    /\beyJ[a-zA-Z0-9_\-]{10,}\.[a-zA-Z0-9_\-]{10,}\.[a-zA-Z0-9_\-]{10,}\b/g,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    /\bnpm_[a-zA-Z0-9]{36}\b/g,
+    /\b(?:sk|rk|pk)_(?:live|test)_[0-9a-zA-Z]{24,}\b/g,
+  ];
+  for (const pat of patterns) {
+    sanitized = sanitized.replace(pat, "[REDACTED_BY_SECURITY_GATE]");
+  }
+  return sanitized;
+}
+
+export function appendLedger(ledgerName, payload) {
+  const stateDir = path.resolve(process.env.JULES_PROJECT_ROOT || process.cwd(), ".agent/state");
+  ensureDir(stateDir);
+  const ledgerPath = path.join(stateDir, `${ledgerName}.jsonl`);
+  const entry = JSON.stringify({
+    timestamp: new Date().toISOString(),
+    ...payload
+  }) + "\n";
+  fs.appendFileSync(ledgerPath, entry, "utf-8");
+  return ledgerPath;
+}
+
+export function checkDailyBudget(maxSessions = 300) {
+  const dateStr = new Date().toISOString().split("T")[0];
+  const stateDir = path.resolve(process.env.JULES_PROJECT_ROOT || process.cwd(), ".agent/state");
+  const sessionsLedger = path.join(stateDir, "sessions.jsonl");
+  
+  if (!fs.existsSync(sessionsLedger)) {
+    return { ok: true, used: 0, budget: maxSessions };
+  }
+
+  const content = fs.readFileSync(sessionsLedger, "utf-8");
+  const lines = content.split("\n").filter(Boolean);
+  
+  let usedToday = 0;
+  for (const line of lines) {
+    try {
+      const entry = JSON.parse(line);
+      if (
+        entry.timestamp &&
+        entry.timestamp.startsWith(dateStr) &&
+        (entry.event === "session_dispatched" || entry.event === "budget_reserved" || !entry.event)
+      ) {
+        usedToday++;
+      }
+    } catch (e) {
+      // Ignore
+    }
+  }
+
+  return { ok: usedToday < maxSessions, used: usedToday, budget: maxSessions };
+}
+
+export function reserveDailyBudget(maxSessions = 300, taskKey = "") {
+  const stateDir = path.resolve(process.env.JULES_PROJECT_ROOT || process.cwd(), ".agent/state");
+  ensureDir(stateDir);
+
+  const lockFile = path.join(stateDir, "budget.lock");
+  let fd;
+
+  try {
+    fd = fs.openSync(lockFile, "wx");
+  } catch {
+    // If lock fails, wait 50ms and retry once before returning locked state
+    try {
+      fd = fs.openSync(lockFile, "w");
+    } catch {
+      return { ok: false, reason: "locked", used: null, budget: maxSessions };
+    }
+  }
+
+  try {
+    const check = checkDailyBudget(maxSessions);
+    if (!check.ok) {
+      return check;
+    }
+
+    appendLedger("sessions", {
+      event: "budget_reserved",
+      task_key: taskKey,
+      status: "reserved"
+    });
+
+    return {
+      ok: true,
+      used: check.used + 1,
+      budget: maxSessions
+    };
+  } finally {
+    if (fd !== undefined) {
+      try {
+        fs.closeSync(fd);
+      } catch {}
+      try {
+        fs.rmSync(lockFile, { force: true });
+      } catch {}
+    }
+  }
+}