knodin 0.10.6 → 0.10.7

package/dist/src/credential-patterns.js

@@ -0,0 +1,90 @@
+/**
+ * One credential-pattern set, shared by every redactor.
+ *
+ * knodin previously carried two independent lists — one in `diagnostics.ts` for
+ * recorded failures, one in `output-compression.ts` for captured command output
+ * — and they drifted apart in OPPOSITE directions. Diagnostics knew Slack and
+ * OpenAI but not AWS or JWTs; output compression knew AWS and JWTs but missed
+ * Slack, OpenAI and GitHub's fine-grained tokens. Neither list was a superset of
+ * the other, so a credential redacted on one path was disclosed on the other,
+ * and patching either one alone would only let them drift again (KNODIN-11).
+ *
+ * Callers keep their own replacement text: diagnostics collapses a match to a
+ * single marker, output compression names the provider. `preservedGroups` is
+ * what makes that possible — the leading captures a caller may echo back
+ * verbatim, so `password=` survives while its value does not.
+ *
+ * Fresh `RegExp` objects are built per call. A shared global regex carries
+ * `lastIndex` between uses, which turns a redactor into something that depends
+ * on what it scrubbed previously.
+ */
+export function credentialPatterns() {
+    return [
+        {
+            // `name=value` in any of its spellings. An optional auth scheme is
+            // consumed BEFORE the value, because `authorization: Bearer <token>`
+            // otherwise matches only the word "Bearer" — redacting the label and
+            // preserving the credential, exactly inverted (KNODIN-10).
+            label: "credential",
+            pattern: /\b(authorization|password|passwd|secret|token|api[_-]?key)(\s*[:=]\s*)(?:(?:bearer|basic|digest|token)\s+)?[^\s,;]+/gi,
+            preservedGroups: 2,
+        },
+        {
+            // GitHub issues every format with an UNDERSCORE. A hyphen-only pattern
+            // matched a shape GitHub never mints and missed every shape it does, so
+            // both separators are accepted. `github_pat` is listed explicitly: it
+            // does not fit the gh[pousr] shape.
+            label: "github-token",
+            pattern: /\b(?:gh[pousr]|github_pat)[-_]\w{20,}\b/g,
+            preservedGroups: 0,
+        },
+        {
+            label: "slack-token",
+            pattern: /\bxox[baprse]-[A-Za-z0-9-]{10,}\b/g,
+            preservedGroups: 0,
+        },
+        {
+            label: "openai-key",
+            pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g,
+            preservedGroups: 0,
+        },
+        {
+            label: "aws-access-key",
+            pattern: /\bAKIA[A-Z0-9]{16}\b/g,
+            preservedGroups: 0,
+        },
+        {
+            label: "jwt",
+            pattern: /\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g,
+            preservedGroups: 0,
+        },
+        {
+            // Bearer outside an `authorization:` assignment — a bare header line, or
+            // a curl command echoed into a log.
+            label: "bearer-token",
+            pattern: /\b(Bearer\s+)[-\w.~+/]{12,}=*/gi,
+            preservedGroups: 1,
+        },
+    ];
+}
+/**
+ * Apply every shared pattern, letting the caller render the replacement.
+ *
+ * `marker` receives the provider label; preserved groups are prepended to
+ * whatever it returns.
+ */
+export function redactCredentials(text, marker) {
+    let result = text;
+    let count = 0;
+    for (const { label, pattern, preservedGroups } of credentialPatterns()) {
+        result = result.replace(pattern, (...values) => {
+            count++;
+            const kept = values
+                .slice(1, 1 + preservedGroups)
+                .map((value) => (typeof value === "string" ? value : ""))
+                .join("");
+            return `${kept}${marker(label)}`;
+        });
+    }
+    return { text: result, count };
+}

package/dist/src/diagnostics.js

@@ -6,6 +6,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import zlib from "node:zlib";
 import { compareBytes } from "./compare.js";
+import { redactCredentials } from "./credential-patterns.js";
 const CONFIG_PATH = ".knodin/diagnostics/config.json";
 const JOURNAL_PATH = ".knodin/diagnostics/events.jsonl";
 const JOURNAL_LOCK_PATH = ".knodin/diagnostics/events.lock";
@@ -528,19 +529,17 @@ function scrubText(raw, repo) {
     };
     for (const exact of [repo, os.homedir()].filter(Boolean).sort((a, b) => b.length - a.length))
         replace(new RegExp(exact.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`), "g"), "<path>");
-    // Either separator. GitHub issues its tokens with an UNDERSCORE after the
-    // prefix, so a hyphen-only pattern matched a shape GitHub never mints and
-    // missed every shape it does — a real token in an error message survived
-    // scrubbing and reached the bundle a user shares (KNODIN-10). Slack and
-    // OpenAI really do use a hyphen, so both separators must be accepted.
-    replace(/\b(?:ghp|github_pat|sk|xox[baprs])[-_][-A-Za-z0-9_]{10,}\b/g, "<secret>");
-    // The value pattern stops at whitespace, so `authorization: Bearer <token>`
-    // used to match only the word "Bearer" and leave the credential in place —
-    // the standard header form leaked the one thing worth redacting (KNODIN-10).
-    // An optional scheme is consumed first so the credential after it is the
-    // part that gets replaced. Only known schemes are skipped, so an ordinary
-    // `password=x next word` still redacts one value rather than eating prose.
-    replace(/\b(?:password|passwd|token|secret|api[_-]?key|authorization)\s*[=:]\s*(?:(?:bearer|basic|digest|token)\s+)?[^\s,;]+/gi, "<secret>");
+    // Provider credentials, from the set shared with output-compression (see
+    // credential-patterns.ts). These used to be maintained here separately, and
+    // the two lists drifted: this one knew Slack and OpenAI but not AWS keys or
+    // JWTs, while output compression knew those and missed these. A credential
+    // safe on one path was disclosed on the other (KNODIN-11).
+    //
+    // `redactCredentials` counts its own replacements, so they are added to the
+    // running total rather than counted by the local `replace` helper.
+    const credentials = redactCredentials(value, () => "<secret>");
+    value = credentials.text;
+    redactions += credentials.count;
     replace(/\b[A-Z]:\\(?:[^\s<>:"|?*]+\\)*[^\s<>:"|?*]*/g, "<path>");
     replace(/(?:^|[\s('"`])\/(?:[^\s)'"`]+\/)*[^\s)'"`]*/g, "<path>");
     replace(/\b(?:[A-Za-z0-9_.-]+\/)+(?:[A-Za-z0-9_.-]+\.[A-Za-z0-9]{1,12})\b/g, "<path>");

package/dist/src/engine/index.js

@@ -8779,26 +8779,28 @@ export async function getOrInitDb(repoPath, options = {}) {
             else {
                 const stateDir = resolveStateDir(normalizedPath);
                 await fs.promises.mkdir(stateDir, { recursive: true });
-                // Ensure .knodin is in .gitignore. Skipped for mirrors: their state
-                // lives outside the clone, and the clone must stay byte-identical to
-                // the remote so a refetch has nothing of ours to discard.
+                // Ensure .knodin is ignored, through `.git/info/exclude` rather than
+                // `.gitignore`.
+                //
+                // `.gitignore` is a SHARED file: it is tracked by convention, so
+                // writing it put a change into someone's working tree that they did
+                // not ask for and would carry into their next commit. That is the
+                // one thing `knodin init --scope personal` promises not to do, and
+                // this ran regardless of scope — a bare `knodin index` did it too
+                // (KNODIN-1).
+                //
+                // `.git/info/exclude` has the same effect and is repo-local: git
+                // never commits it, so nothing reaches a diff or a teammate.
+                //
+                // Skipped for mirrors: their state lives outside the clone, and the
+                // clone must stay byte-identical to the remote so a refetch has
+                // nothing of ours to discard.
                 if (mayWriteToRepository(normalizedPath)) {
                     try {
-                        const gitignorePath = path.join(normalizedPath, ".gitignore");
-                        let gitignoreContent = "";
-                        if (fs.existsSync(gitignorePath)) {
-                            gitignoreContent = await fs.promises.readFile(gitignorePath, "utf-8");
-                        }
-                        const lines = gitignoreContent.split("\n").map((l) => l.trim());
-                        if (!lines.includes(".knodin") &&
-                            !lines.includes(".knodin/") &&
-                            !lines.includes("/.knodin")) {
-                            const prefix = gitignoreContent.length > 0 && !gitignoreContent.endsWith("\n") ? "\n" : "";
-                            await fs.promises.appendFile(gitignorePath, `${prefix}\n# knodin\n.knodin\n`);
-                        }
+                        await excludeStateDirectoryLocally(normalizedPath);
                     }
                     catch (e) {
-                        console.error("Failed to update .gitignore", e);
+                        console.error("Failed to exclude .knodin from git", e);
                     }
                 }
                 dbPath = path.join(stateDir, "db.sqlite");
@@ -10092,6 +10094,45 @@ function parseUnifiedDiff(stdout) {
     }
     return modifiedFiles;
 }
+/**
+ * Ignore `.knodin/` through `.git/info/exclude`, which git never commits.
+ *
+ * Resolved with `git rev-parse --git-path` rather than assembled by hand:
+ * inside a linked worktree `.git` is a FILE pointing elsewhere, so
+ * `<repo>/.git/info/exclude` is not a path that exists. Idempotent — a second
+ * call over an already-excluded repository writes nothing.
+ */
+async function excludeStateDirectoryLocally(repoPath) {
+    // A directory that is not a git repository has nothing to exclude, and git
+    // exits non-zero there. That is an ordinary state — knodin indexes plain
+    // directories — so it must not surface as an error. The previous
+    // `.gitignore` write never had to ask git anything, which is why this case
+    // only appears now.
+    let raw;
+    try {
+        raw = runGit(repoPath, ["rev-parse", "--git-path", "info/exclude"]).trim();
+    }
+    catch {
+        return;
+    }
+    if (!raw)
+        return;
+    const excludePath = path.isAbsolute(raw) ? raw : path.resolve(repoPath, raw);
+    let existing = "";
+    try {
+        existing = await fs.promises.readFile(excludePath, "utf-8");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const entries = new Set(existing.split(/\r?\n/).map((line) => line.trim()));
+    if (entries.has(".knodin") || entries.has(".knodin/") || entries.has("/.knodin"))
+        return;
+    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    await fs.promises.mkdir(path.dirname(excludePath), { recursive: true });
+    await fs.promises.appendFile(excludePath, `${prefix}.knodin/\n`, "utf-8");
+}
 function runGit(repoPath, args) {
     return child_process.execFileSync("git", args, {
         cwd: repoPath,

package/dist/src/output-compression.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { redactCredentials } from "./credential-patterns.js";
 import { resolveStateDir } from "./engine/state-paths.js";
 const DEFAULT_LINE_BUDGET = 200;
 const DEFAULT_BYTE_BUDGET = 16_384;
@@ -90,20 +91,20 @@ function splitEvent(event) {
         lines.push({ raw: "", sourceBytes: 0 });
     return lines;
 }
+/**
+ * Redact credentials from captured output.
+ *
+ * The pattern set is shared with `diagnostics.ts` (see credential-patterns.ts).
+ * It used to be maintained here separately, and the two lists drifted: this one
+ * knew AWS keys and JWTs but missed Slack, OpenAI and GitHub's fine-grained
+ * tokens, while diagnostics missed AWS and JWTs. A credential safe on one path
+ * was disclosed on the other (KNODIN-11).
+ *
+ * The provider-named markers are kept, because a reader of compressed output
+ * benefits from knowing WHAT was removed.
+ */
 function redact(text) {
-    let count = 0;
-    const replace = (pattern, replacement) => {
-        text = text.replace(pattern, (...values) => {
-            count++;
-            return typeof replacement === "string" ? replacement : replacement(...values);
-        });
-    };
-    replace(/\b(authorization|password|passwd|secret|token|api[_-]?key)\s*([:=])\s*([^\s,;]+)/gi, (_match, name, separator) => `${name}${separator}[REDACTED:credential]`);
-    replace(/\bAKIA[A-Z0-9]{16}\b/g, "[REDACTED:aws-access-key]");
-    replace(/\bgh[pousr]_\w{20,}\b/g, "[REDACTED:github-token]");
-    replace(/\bBearer\s+[-\w.~+/]{12,}=*\b/gi, "Bearer [REDACTED:bearer-token]");
-    replace(/\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g, "[REDACTED:jwt]");
-    return { text, count };
+    return redactCredentials(text, (label) => `[REDACTED:${label}]`);
 }
 function csiSequenceEnd(text, escapeIndex) {
     for (let index = escapeIndex + 2; index < text.length; index++) {

package/docs/releases/0.10.7.md

@@ -0,0 +1,79 @@
+# knodin 0.10.7
+
+Two fixes, both about knodin doing something to your repository or your
+credentials that you did not ask for.
+
+## knodin no longer writes to your .gitignore
+
+Indexing appended `.knodin` to `.gitignore`. That file is **shared**: tracked by
+convention, so the edit landed in your working tree and would ride into your next
+commit — and on a narrowly-scoped branch, `git add -A` swept it in.
+
+It ran regardless of scope, so a bare `knodin index` did it too. That matters
+because `knodin init --scope personal` exists precisely to promise that nothing
+reaches git.
+
+The same protection now goes to `.git/info/exclude`, which git never commits.
+The rule is resolved through `git rev-parse --git-path` rather than assembled by
+hand, because inside a linked worktree `.git` is a file and
+`<repo>/.git/info/exclude` is not a path that exists. A directory that is not a
+git repository has nothing to exclude and is left alone silently — knodin indexes
+plain directories too.
+
+### What this changed about freshness reporting
+
+Worth knowing if you have ever read the `staleness` field.
+
+Because every repository knodin touched carried that untracked `.gitignore`, its
+working tree was permanently dirty, and a dirty tree forces the reconcile path.
+So a branch switch reported `reconciled`. With a genuinely clean tree the same
+switch reports `fresh`.
+
+Nothing about the answer changed — measured directly, the query returns the
+symbols of the branch you are on, with no trace of the one you left. `fresh` is
+accurate: the graph does match the tree. Only the label is different, and it is
+different because the tree is finally clean.
+
+Three internal assertions had been reading that side effect rather than the
+behaviour they named, and now measure the returned symbols instead.
+
+## One credential-pattern set, not two
+
+knodin had **two independent secret redactors** — one for diagnostics bundles,
+one for compressed command output — each with its own list. They had drifted in
+opposite directions:
+
+| | diagnostics | output compression |
+|---|---|---|
+| GitHub classic | yes | yes |
+| GitHub fine-grained | yes | **no** |
+| Slack | yes | **no** |
+| OpenAI | yes | **no** |
+| AWS access key | **no** | yes |
+| JWT | **no** | yes |
+
+Neither list was a superset of the other, so the same log line was scrubbed on
+one path and disclosed on the other. Redaction is on by default, so nothing
+unusual had to be configured to hit this.
+
+Both now use one shared set covering every row. Each caller keeps its own
+replacement text: compressed output still names the provider, because a reader
+benefits from knowing what was removed, while diagnostics collapses to a single
+marker. Both preserve the key name and drop only the value, so `password=`
+survives and its secret does not.
+
+Tests assert every provider on **both** paths — a property no single-module test
+could hold. What redaction must leave alone is pinned too: a 40-character hex
+git SHA passes through untouched, because redacting commit SHAs would make diffs
+and review output unreadable.
+
+## Coverage
+
+Measured across all sixteen shards: 78.22% branches, 87.77% statements, 91.20%
+functions, 90.33% lines.
+
+The 77.16% recorded in 0.10.6 came from fifteen shards, the sixteenth having
+failed to write its report. That number was described at the time as a floor. It
+was not — a missing shard shrinks the denominator faster than the numerator, so
+it flattered the result. A partial-shard measurement is unusable rather than
+conservative.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "knodin",
-	"version": "0.10.6",
+	"version": "0.10.7",
 	"knodin": {
 		"compatibility": "compatible"
 	},
@@ -61,6 +61,7 @@
 		"docs/releases/0.10.4.md",
 		"docs/releases/0.10.5.md",
 		"docs/releases/0.10.6.md",
+		"docs/releases/0.10.7.md",
 		"docs/releases/0.3.0.md",
 		"docs/releases/0.4.0.md",
 		"docs/releases/0.4.1.md",