nexusmem 0.10.4 → 0.11.0

package/dist/cli/recorder.js

@@ -0,0 +1,225 @@
+#!/usr/bin/env node
+
+// src/shell/recorder.ts
+import { appendFile, mkdir } from "fs/promises";
+import { dirname } from "path";
+
+// src/conversation/redact.ts
+var REDACTION_MARK = "[redacted]";
+var MARK = REDACTION_MARK;
+var NOT_MARK = String.raw`(?!\[redacted\])`;
+var keepPrefix = (groups) => `${groups[0]}${MARK}`;
+var SECRET_KEYWORD = String.raw`(?:(?:pass(?:word|wd|phrase)|secret|credential|api[_-]?key|(?:access|private|secret|client|signing|encryption|master)[_-]?key)s?|token)`;
+var SECRET_KEY = String.raw`(?:[A-Za-z0-9_.-]{0,100}?${SECRET_KEYWORD}|(?:-{1,2}|(?:[A-Za-z0-9]{1,40}[_.-]){1,8})pass)(?:[_.-][A-Za-z0-9]{1,40}){0,8}`;
+var TYPE_WORD = String.raw`(?:string|number|boolean|bool|int|str|null|undefined|none|nil|true|false|any|unknown|object)(?=[\s;,)|\]}>]|$)`;
+var SECRET_VALUE = String.raw`(?:"(?:\\.|[^"\\\r\n]){1,500}"|'(?:\\.|[^'\\\r\n]){1,500}'|\x60(?:\\.|[^\x60\\\r\n]){1,500}\x60|"(?!")[^\r\n]+|'(?!')[^\r\n]+|\x60(?!\x60)[^\r\n]+|[^\s'"\x60]+)`;
+var SAME_COMMAND = String.raw`[^\n|;&]{0,500}?`;
+var NOT_FLAG_OR_REDIRECT = String.raw`(?![-<>|&;])`;
+var AUTH_SCHEME = String.raw`(?:bearer|basic|token|digest|negotiate|ntlm)`;
+var CURL_USER = String.raw`\bcurl(?=[ \t])${SAME_COMMAND}[ \t](?:-u|--user)(?:[ \t]+|=)?`;
+var RULES = [
+  {
+    name: "private-key-block",
+    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    highConfidence: true
+  },
+  { name: "aws-access-key", pattern: /\bAKIA[0-9A-Z]{16}\b/g, highConfidence: true },
+  { name: "github-token", pattern: /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, highConfidence: true },
+  { name: "slack-token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, highConfidence: true },
+  {
+    name: "jwt",
+    pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
+    highConfidence: true
+  },
+  // scheme://user:password@host -- the password may itself contain `@`, so the host starts after the last one.
+  {
+    name: "uri-credentials",
+    pattern: new RegExp(
+      String.raw`(\b[a-z][a-z0-9+.-]{1,30}://[^\s/?#'"@:]*:)${NOT_MARK}[^\s/?#'"]+(?=@[^\s/?#'"@]*(?:[/?#\s'"]|$))`,
+      "gi"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // An option whose name ends in `bearer` (`--oauth2-bearer x`) always takes a credential, whatever
+  // the token looks like. The prose-shaped rule below cannot cover it: it needs a digit, so an
+  // all-alphabetic token would survive.
+  {
+    name: "bearer-option-arg",
+    pattern: new RegExp(
+      String.raw`(?<=^|[\s'"(])(-{1,2}[A-Za-z0-9_.-]{0,40}bearer[ \t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,
+      "gi"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // A bearer token outside a header (`Bearer x`); it must contain a digit so "bearer authentication" is left alone.
+  {
+    name: "bearer-token",
+    pattern: new RegExp(String.raw`(\bbearer[ \t]+)${NOT_MARK}(?=[A-Za-z0-9._~+/-]*\d)[A-Za-z0-9._~+/-]{16,}=*`, "gi"),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // Tool-anchored password arguments: `-p` means port or parents almost everywhere else. Case-sensitive (`-P` is mysql's port).
+  // mysql takes only the compact `-psecret` form; `-p secret` means "prompt, then use database secret".
+  {
+    name: "mysql-password-arg",
+    pattern: new RegExp(
+      String.raw`(\b(?:mysql|mysqldump|mysqladmin|mysqlimport|mysqlsh|mariadb|mariadb-dump)(?=[ \t])${SAME_COMMAND}[ \t]-p)${NOT_MARK}(?=\S)${SECRET_VALUE}`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // Only sshpass's own options may precede -p, so a wrapped `ssh -p 22` is never read as the password.
+  {
+    name: "sshpass-password-arg",
+    pattern: new RegExp(String.raw`(\bsshpass(?:[ \t]+-[^p\s]\S*)*[ \t]+-p[ \t]*)${NOT_MARK}(?=\S)${SECRET_VALUE}`, "g"),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  {
+    name: "mongo-password-arg",
+    pattern: new RegExp(
+      String.raw`(\bmongo(?:sh|dump|restore|export|import|stat|top|files)?(?=[ \t])${SAME_COMMAND}[ \t]-p[ \t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  {
+    name: "redis-cli-password-arg",
+    pattern: new RegExp(
+      String.raw`(\bredis-cli(?=[ \t])${SAME_COMMAND}[ \t]-a[ \t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // Quoted credentials get their own branches: `curl -u "user:pass word"` holds a space, which
+  // the unquoted branch would stop at, leaving the rest of the password in the text. Like
+  // SECRET_VALUE, they step over escaped characters so `"alice:pa\"ss"` is not cut at `\"`. Inside
+  // quotes the user name may hold a space too (`"alice smith:pw"`); only the quote ends it.
+  {
+    name: "curl-user-password",
+    pattern: new RegExp(
+      String.raw`(${CURL_USER}"(?:\\.|[^:"\\\r\n])*:)${NOT_MARK}(?:\\.|[^"\\\r\n])*|(${CURL_USER}'(?:\\.|[^:'\\\r\n])*:)${NOT_MARK}(?:\\.|[^'\\\r\n])*|(${CURL_USER}[^\s:'"]*:)${NOT_MARK}[^\s'"]+`,
+      "g"
+    ),
+    highConfidence: true,
+    render: (groups) => `${groups.find((g) => g.length > 0) ?? ""}${MARK}`
+  },
+  // Authorization: Bearer x / Basic x / token x. The scheme word is kept; it must not be mistaken for the value.
+  {
+    name: "authorization-header",
+    pattern: new RegExp(
+      String.raw`(\b(?:proxy-)?authorization["']?[ \t]*[:=][ \t]*["'\x60]?(?:${AUTH_SCHEME}[ \t]+)?)(?!${AUTH_SCHEME}[ \t])${NOT_MARK}[^\s'"\x60]+`,
+      "gi"
+    ),
+    highConfidence: false,
+    render: keepPrefix
+  },
+  // `--password secret`: a secret-named option whose value is the next argument. The flag must start a
+  // command-line word, so prose like "the `id`-token heuristic" is not read as a `-token` option.
+  {
+    name: "secret-option-arg",
+    pattern: new RegExp(
+      String.raw`(?<=^|[\s'"(])(-{1,2}${SECRET_KEY}[ \t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,
+      "gi"
+    ),
+    highConfidence: false,
+    render: keepPrefix
+  },
+  // key/token/secret/password = "value" or : value, in code, JSON, env-file, shell or prose form.
+  // The key start is an explicit non-identifier lookbehind, not `\b`: `_` is a word character, so
+  // `\b` never fired inside DB_PASSWORD and the value leaked. Found live via `scan-shell`.
+  {
+    name: "key-value-secret",
+    pattern: new RegExp(
+      String.raw`(?<![A-Za-z0-9_.-])(${SECRET_KEY})["']?[ \t]*[:=](?![=>])[ \t]*(?!${TYPE_WORD})${NOT_MARK}${SECRET_VALUE}`,
+      "gi"
+    ),
+    highConfidence: false,
+    // Keep the key name so the redaction is legible ("apiKey: [redacted]").
+    render: (groups) => `${groups[0]}: ${MARK}`
+  }
+];
+function redact(text, profile = "all") {
+  let redactedCount = 0;
+  let out = text;
+  for (const rule of RULES) {
+    if (profile === "high-confidence" && !rule.highConfidence) continue;
+    out = out.replace(rule.pattern, (...args) => {
+      redactedCount += 1;
+      const end = args.findIndex((arg2, i) => i > 0 && typeof arg2 === "number");
+      const groups = args.slice(1, end).map((g) => typeof g === "string" ? g : "");
+      return rule.render ? rule.render(groups) : MARK;
+    });
+  }
+  return { text: out, redactedCount };
+}
+
+// src/core/ids.ts
+import { createHash } from "crypto";
+function sha256Hex(input) {
+  return createHash("sha256").update(input, "utf8").digest("hex");
+}
+
+// src/shell/recorder.ts
+var HOOK_SHELLS = /* @__PURE__ */ new Set(["pwsh-hook", "bash-hook", "zsh-hook"]);
+var finiteOrNull = (v) => typeof v === "number" && Number.isFinite(v) ? v : null;
+function toHookLogLine(rawEvent, shell) {
+  if (!HOOK_SHELLS.has(shell)) return null;
+  let event;
+  try {
+    event = JSON.parse(rawEvent.trim());
+  } catch {
+    return null;
+  }
+  if (typeof event !== "object" || event === null) return null;
+  const e = event;
+  if (typeof e.ts !== "string" || typeof e.cwd !== "string" || typeof e.command !== "string" || e.command.trim() === "") return null;
+  return JSON.stringify({
+    ts: e.ts,
+    cwd: e.cwd,
+    exitCode: finiteOrNull(e.exitCode),
+    durationMs: finiteOrNull(e.durationMs),
+    command: redact(e.command).text,
+    shell,
+    // From the raw command, before redaction: the same hash hook node ids have always been derived from.
+    commandHash: sha256Hex(e.command).slice(0, 12)
+  });
+}
+async function recordShellEvent(rawEvent, logPath, shell) {
+  const line = toHookLogLine(rawEvent, shell);
+  if (!line) return false;
+  await mkdir(dirname(logPath), { recursive: true });
+  await appendFile(logPath, `${line}
+`, { encoding: "utf8", mode: 384 });
+  return true;
+}
+
+// src/cli/recorder.ts
+var MAX_EVENT_BYTES = 1e6;
+var drop = () => process.exit(1);
+process.on("uncaughtException", drop);
+process.on("unhandledRejection", drop);
+function arg(name) {
+  const i = process.argv.indexOf(name);
+  return i === -1 ? void 0 : process.argv[i + 1];
+}
+async function main() {
+  const logPath = arg("--log");
+  const shell = arg("--shell");
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    size += chunk.length;
+    if (size > MAX_EVENT_BYTES) drop();
+    chunks.push(chunk);
+  }
+  const ok = logPath && shell ? await recordShellEvent(Buffer.concat(chunks).toString("utf8"), logPath, shell) : false;
+  process.exit(ok ? 0 : 1);
+}
+main().catch(drop);
+//# sourceMappingURL=recorder.js.map

package/dist/cli/recorder.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/shell/recorder.ts","../../src/conversation/redact.ts","../../src/core/ids.ts","../../src/cli/recorder.ts"],"sourcesContent":["import { appendFile, mkdir } from 'node:fs/promises';\nimport { dirname } from 'node:path';\nimport { redact } from '../conversation/redact.js';\nimport { sha256Hex } from '../core/ids.js';\n\n/**\n * The only writer of the shell hook log. A hook hands one raw command event\n * to this code over stdin; the raw command exists only in memory here --\n * hashed, then redacted -- and only the redacted line is ever persisted.\n */\n\nconst HOOK_SHELLS: ReadonlySet<string> = new Set(['pwsh-hook', 'bash-hook', 'zsh-hook']);\n\nconst finiteOrNull = (v: unknown): number | null => (typeof v === 'number' && Number.isFinite(v) ? v : null);\n\n/** The redacted hook-log line for one raw event, or null for anything malformed (which is then dropped, never written raw). */\nexport function toHookLogLine(rawEvent: string, shell: string): string | null {\n  if (!HOOK_SHELLS.has(shell)) return null;\n  let event: unknown;\n  try {\n    // Windows PowerShell's redirected stdin can append its encoding's BOM when the pipe is closed;\n    // String#trim strips U+FEFF (ECMAScript whitespace), JSON.parse alone does not.\n    event = JSON.parse(rawEvent.trim());\n  } catch {\n    // Deliberately swallowed: a JSON.parse error message quotes the input, i.e. the raw command.\n    return null;\n  }\n  if (typeof event !== 'object' || event === null) return null;\n  const e = event as Record<string, unknown>;\n  if (typeof e.ts !== 'string' || typeof e.cwd !== 'string' || typeof e.command !== 'string' || e.command.trim() === '') return null;\n\n  return JSON.stringify({\n    ts: e.ts,\n    cwd: e.cwd,\n    exitCode: finiteOrNull(e.exitCode),\n    durationMs: finiteOrNull(e.durationMs),\n    command: redact(e.command).text,\n    shell,\n    // From the raw command, before redaction: the same hash hook node ids have always been derived from.\n    commandHash: sha256Hex(e.command).slice(0, 12),\n  });\n}\n\n/** Appends the redacted line in one write -- no temp file, so nothing raw can be left behind by a crash. */\nexport async function recordShellEvent(rawEvent: string, logPath: string, shell: string): Promise<boolean> {\n  const line = toHookLogLine(rawEvent, shell);\n  if (!line) return false;\n  await mkdir(dirname(logPath), { recursive: true });\n  await appendFile(logPath, `${line}\\n`, { encoding: 'utf8', mode: 0o600 });\n  return true;\n}\n","/**\n * Best-effort secret redaction for collected text before it is ever written\n * to the FTS index.\n *\n * This is a safety net, not a guarantee -- pattern-based redaction cannot\n * catch every shape a secret can take. It exists because conversation text\n * is the collector most likely to contain something sensitive (a pasted\n * credential, a key a user asked for help debugging), but a committed `.env`\n * or a hard-coded key makes the code-diff collector a real second candidate,\n * which is what the `high-confidence` profile below is for.\n */\n\ninterface Rule {\n  name: string;\n  pattern: RegExp;\n  /**\n   * The match is a secret by its own shape, with no reliance on the\n   * surrounding text. Only these rules are safe to run over source code:\n   * the shape rules match strings nothing else produces, while the\n   * key/value rule matches ordinary code such as\n   * `const apiKey = process.env.API_KEY` and would corrupt the very lines\n   * a diff is indexed for.\n   */\n  highConfidence: boolean;\n  /** Replacement built from the capture groups; without it the whole match becomes the marker. */\n  render?: (groups: readonly string[]) => string;\n}\n\nexport const REDACTION_MARK = '[redacted]';\nconst MARK = REDACTION_MARK;\n// Every rule refuses to re-match its own marker, so redacting twice changes nothing.\nconst NOT_MARK = String.raw`(?!\\[redacted\\])`;\nconst keepPrefix = (groups: readonly string[]): string => `${groups[0]}${MARK}`;\n\n// The keyword may sit anywhere inside an identifier (DB_PASSWORD, OPENAI_API_KEY, dbPassword, --api-key).\n// `token` is singular only: plural keys (max_tokens, rawTokens) are LLM token counts, not credentials.\nconst SECRET_KEYWORD = String.raw`(?:(?:pass(?:word|wd|phrase)|secret|credential|api[_-]?key|(?:access|private|secret|client|signing|encryption|master)[_-]?key)s?|token)`;\n// Bare `pass` needs a prefix component or dashes (DB_PASS, --pass), so prose like \"first pass: x\" and `bypass` never match.\n// Bounded so a long identifier run full of keywords stays linear, not quadratic.\nconst SECRET_KEY = String.raw`(?:[A-Za-z0-9_.-]{0,100}?${SECRET_KEYWORD}|(?:-{1,2}|(?:[A-Za-z0-9]{1,40}[_.-]){1,8})pass)(?:[_.-][A-Za-z0-9]{1,40}){0,8}`;\n// Type annotations (`password: string`) are not values; everything else is hidden, however short.\nconst TYPE_WORD = String.raw`(?:string|number|boolean|bool|int|str|null|undefined|none|nil|true|false|any|unknown|object)(?=[\\s;,)|\\]}>]|$)`;\n// A quoted value runs to its *closing* quote: an escaped quote inside it (--password \"pa\\\"ss\")\n// must not end the match, or the tail after it survives redaction. Bounded so an ordinary value\n// stops at its own quote; one the bound cannot close (over 500 chars, or never closed) fails\n// closed and takes the rest of the line rather than none of it.\nconst SECRET_VALUE = String.raw`(?:\"(?:\\\\.|[^\"\\\\\\r\\n]){1,500}\"|'(?:\\\\.|[^'\\\\\\r\\n]){1,500}'|\\x60(?:\\\\.|[^\\x60\\\\\\r\\n]){1,500}\\x60|\"(?!\")[^\\r\\n]+|'(?!')[^\\r\\n]+|\\x60(?!\\x60)[^\\r\\n]+|[^\\s'\"\\x60]+)`;\n// The rest of one shell command: stops at a pipe, `;`, `&` or newline so a tool name never reaches into the next command.\nconst SAME_COMMAND = String.raw`[^\\n|;&]{0,500}?`;\n// A next argument that is a flag or a redirection is not a value.\nconst NOT_FLAG_OR_REDIRECT = String.raw`(?![-<>|&;])`;\nconst AUTH_SCHEME = String.raw`(?:bearer|basic|token|digest|negotiate|ntlm)`;\n/** Everything up to and including curl's credential flag, shared by that rule's quoted and bare branches. */\nconst CURL_USER = String.raw`\\bcurl(?=[ \\t])${SAME_COMMAND}[ \\t](?:-u|--user)(?:[ \\t]+|=)?`;\n\nconst RULES: Rule[] = [\n  {\n    name: 'private-key-block',\n    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,\n    highConfidence: true,\n  },\n  { name: 'aws-access-key', pattern: /\\bAKIA[0-9A-Z]{16}\\b/g, highConfidence: true },\n  { name: 'github-token', pattern: /\\bgh[pousr]_[A-Za-z0-9]{20,}\\b/g, highConfidence: true },\n  { name: 'slack-token', pattern: /\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b/g, highConfidence: true },\n  {\n    name: 'jwt',\n    pattern: /\\beyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\b/g,\n    highConfidence: true,\n  },\n  // scheme://user:password@host -- the password may itself contain `@`, so the host starts after the last one.\n  {\n    name: 'uri-credentials',\n    pattern: new RegExp(\n      String.raw`(\\b[a-z][a-z0-9+.-]{1,30}://[^\\s/?#'\"@:]*:)${NOT_MARK}[^\\s/?#'\"]+(?=@[^\\s/?#'\"@]*(?:[/?#\\s'\"]|$))`,\n      'gi',\n    ),\n    highConfidence: true,\n    render: keepPrefix,\n  },\n  // An option whose name ends in `bearer` (`--oauth2-bearer x`) always takes a credential, whatever\n  // the token looks like. The prose-shaped rule below cannot cover it: it needs a digit, so an\n  // all-alphabetic token would survive.\n  {\n    name: 'bearer-option-arg',\n    pattern: new RegExp(\n      String.raw`(?<=^|[\\s'\"(])(-{1,2}[A-Za-z0-9_.-]{0,40}bearer[ \\t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,\n      'gi',\n    ),\n    highConfidence: true,\n    render: keepPrefix,\n  },\n  // A bearer token outside a header (`Bearer x`); it must contain a digit so \"bearer authentication\" is left alone.\n  {\n    name: 'bearer-token',\n    pattern: new RegExp(String.raw`(\\bbearer[ \\t]+)${NOT_MARK}(?=[A-Za-z0-9._~+/-]*\\d)[A-Za-z0-9._~+/-]{16,}=*`, 'gi'),\n    highConfidence: true,\n    render: keepPrefix,\n  },\n  // Tool-anchored password arguments: `-p` means port or parents almost everywhere else. Case-sensitive (`-P` is mysql's port).\n  // mysql takes only the compact `-psecret` form; `-p secret` means \"prompt, then use database secret\".\n  {\n    name: 'mysql-password-arg',\n    pattern: new RegExp(\n      String.raw`(\\b(?:mysql|mysqldump|mysqladmin|mysqlimport|mysqlsh|mariadb|mariadb-dump)(?=[ \\t])${SAME_COMMAND}[ \\t]-p)${NOT_MARK}(?=\\S)${SECRET_VALUE}`,\n      'g',\n    ),\n    highConfidence: true,\n    render: keepPrefix,\n  },\n  // Only sshpass's own options may precede -p, so a wrapped `ssh -p 22` is never read as the password.\n  {\n    name: 'sshpass-password-arg',\n    pattern: new RegExp(String.raw`(\\bsshpass(?:[ \\t]+-[^p\\s]\\S*)*[ \\t]+-p[ \\t]*)${NOT_MARK}(?=\\S)${SECRET_VALUE}`, 'g'),\n    highConfidence: true,\n    render: keepPrefix,\n  },\n  {\n    name: 'mongo-password-arg',\n    pattern: new RegExp(\n      String.raw`(\\bmongo(?:sh|dump|restore|export|import|stat|top|files)?(?=[ \\t])${SAME_COMMAND}[ \\t]-p[ \\t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,\n      'g',\n    ),\n    highConfidence: true,\n    render: keepPrefix,\n  },\n  {\n    name: 'redis-cli-password-arg',\n    pattern: new RegExp(\n      String.raw`(\\bredis-cli(?=[ \\t])${SAME_COMMAND}[ \\t]-a[ \\t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,\n      'g',\n    ),\n    highConfidence: true,\n    render: keepPrefix,\n  },\n  // Quoted credentials get their own branches: `curl -u \"user:pass word\"` holds a space, which\n  // the unquoted branch would stop at, leaving the rest of the password in the text. Like\n  // SECRET_VALUE, they step over escaped characters so `\"alice:pa\\\"ss\"` is not cut at `\\\"`. Inside\n  // quotes the user name may hold a space too (`\"alice smith:pw\"`); only the quote ends it.\n  {\n    name: 'curl-user-password',\n    pattern: new RegExp(\n      String.raw`(${CURL_USER}\"(?:\\\\.|[^:\"\\\\\\r\\n])*:)${NOT_MARK}(?:\\\\.|[^\"\\\\\\r\\n])*|(${CURL_USER}'(?:\\\\.|[^:'\\\\\\r\\n])*:)${NOT_MARK}(?:\\\\.|[^'\\\\\\r\\n])*|(${CURL_USER}[^\\s:'\"]*:)${NOT_MARK}[^\\s'\"]+`,\n      'g',\n    ),\n    highConfidence: true,\n    render: (groups) => `${groups.find((g) => g.length > 0) ?? ''}${MARK}`,\n  },\n  // Authorization: Bearer x / Basic x / token x. The scheme word is kept; it must not be mistaken for the value.\n  {\n    name: 'authorization-header',\n    pattern: new RegExp(\n      String.raw`(\\b(?:proxy-)?authorization[\"']?[ \\t]*[:=][ \\t]*[\"'\\x60]?(?:${AUTH_SCHEME}[ \\t]+)?)(?!${AUTH_SCHEME}[ \\t])${NOT_MARK}[^\\s'\"\\x60]+`,\n      'gi',\n    ),\n    highConfidence: false,\n    render: keepPrefix,\n  },\n  // `--password secret`: a secret-named option whose value is the next argument. The flag must start a\n  // command-line word, so prose like \"the `id`-token heuristic\" is not read as a `-token` option.\n  {\n    name: 'secret-option-arg',\n    pattern: new RegExp(\n      String.raw`(?<=^|[\\s'\"(])(-{1,2}${SECRET_KEY}[ \\t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,\n      'gi',\n    ),\n    highConfidence: false,\n    render: keepPrefix,\n  },\n  // key/token/secret/password = \"value\" or : value, in code, JSON, env-file, shell or prose form.\n  // The key start is an explicit non-identifier lookbehind, not `\\b`: `_` is a word character, so\n  // `\\b` never fired inside DB_PASSWORD and the value leaked. Found live via `scan-shell`.\n  {\n    name: 'key-value-secret',\n    pattern: new RegExp(\n      String.raw`(?<![A-Za-z0-9_.-])(${SECRET_KEY})[\"']?[ \\t]*[:=](?![=>])[ \\t]*(?!${TYPE_WORD})${NOT_MARK}${SECRET_VALUE}`,\n      'gi',\n    ),\n    highConfidence: false,\n    // Keep the key name so the redaction is legible (\"apiKey: [redacted]\").\n    render: (groups) => `${groups[0]}: ${MARK}`,\n  },\n];\n\nexport interface RedactResult {\n  text: string;\n  redactedCount: number;\n}\n\n/**\n * `all` runs every rule -- the right trade for prose, where a false positive\n * costs a mangled sentence. `high-confidence` runs only the shape rules, for\n * text that *is* code and must survive redaction intact.\n */\nexport type RedactProfile = 'all' | 'high-confidence';\n\nexport function redact(text: string, profile: RedactProfile = 'all'): RedactResult {\n  let redactedCount = 0;\n  let out = text;\n\n  for (const rule of RULES) {\n    if (profile === 'high-confidence' && !rule.highConfidence) continue;\n    out = out.replace(rule.pattern, (...args: unknown[]) => {\n      redactedCount += 1;\n      // `replace` passes (match, ...groups, offset, wholeString): the groups end at the first\n      // number. Slicing by type keeps a match offset from ever being mistaken for a group.\n      const end = args.findIndex((arg, i) => i > 0 && typeof arg === 'number');\n      const groups = args.slice(1, end).map((g) => (typeof g === 'string' ? g : ''));\n      return rule.render ? rule.render(groups) : MARK;\n    });\n  }\n\n  return { text: out, redactedCount };\n}\n","import { createHash } from 'node:crypto';\nimport type { NodeKind } from './types.js';\n\n/** NUL cannot appear in any of our key components, so it is a safe joiner. */\nconst KEY_SEP = '\\u0000';\n\nexport function sha256Hex(input: string): string {\n  return createHash('sha256').update(input, 'utf8').digest('hex');\n}\n\n/**\n * Content-addressed node id.\n *\n * `naturalKey` must be whatever uniquely identifies the event at its source\n * (a commit sha, a `timestamp:command` pair, ...). Re-running `sync` then\n * re-derives the exact same id, which makes ingestion idempotent without\n * relying on a cursor being correct.\n */\nexport function makeNodeId(projectId: string, kind: NodeKind, naturalKey: string): string {\n  return sha256Hex([projectId, kind, naturalKey].join(KEY_SEP)).slice(0, 24);\n}\n","/**\n * Entry point the installed shell hooks run once per command:\n *\n *   <hook> | node recorder.js --log <path> --shell <pwsh-hook|bash-hook|zsh-hook>\n *\n * Bundled separately from the CLI so it starts fast. Silent by design: it\n * never writes to stdout or stderr and creates no temp files, so no failure\n * path -- a bad event, an unwritable log, a crash -- can echo the command it\n * received anywhere. On any failure the event is dropped.\n */\nimport { recordShellEvent } from '../shell/recorder.js';\n\nconst MAX_EVENT_BYTES = 1_000_000;\n\nconst drop = (): never => process.exit(1);\nprocess.on('uncaughtException', drop);\nprocess.on('unhandledRejection', drop);\n\nfunction arg(name: string): string | undefined {\n  const i = process.argv.indexOf(name);\n  return i === -1 ? undefined : process.argv[i + 1];\n}\n\nasync function main(): Promise<void> {\n  const logPath = arg('--log');\n  const shell = arg('--shell');\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of process.stdin) {\n    size += (chunk as Buffer).length;\n    if (size > MAX_EVENT_BYTES) drop();\n    chunks.push(chunk as Buffer);\n  }\n  const ok = logPath && shell ? await recordShellEvent(Buffer.concat(chunks).toString('utf8'), logPath, shell) : false;\n  process.exit(ok ? 0 : 1);\n}\n\nmain().catch(drop);\n"],"mappings":";;;AAAA,SAAS,YAAY,aAAa;AAClC,SAAS,eAAe;;;AC2BjB,IAAM,iBAAiB;AAC9B,IAAM,OAAO;AAEb,IAAM,WAAW,OAAO;AACxB,IAAM,aAAa,CAAC,WAAsC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI;AAI7E,IAAM,iBAAiB,OAAO;AAG9B,IAAM,aAAa,OAAO,+BAA+B,cAAc;AAEvE,IAAM,YAAY,OAAO;AAKzB,IAAM,eAAe,OAAO;AAE5B,IAAM,eAAe,OAAO;AAE5B,IAAM,uBAAuB,OAAO;AACpC,IAAM,cAAc,OAAO;AAE3B,IAAM,YAAY,OAAO,qBAAqB,YAAY;AAE1D,IAAM,QAAgB;AAAA,EACpB;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,gBAAgB;AAAA,EAClB;AAAA,EACA,EAAE,MAAM,kBAAkB,SAAS,yBAAyB,gBAAgB,KAAK;AAAA,EACjF,EAAE,MAAM,gBAAgB,SAAS,mCAAmC,gBAAgB,KAAK;AAAA,EACzF,EAAE,MAAM,eAAe,SAAS,qCAAqC,gBAAgB,KAAK;AAAA,EAC1F;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,gBAAgB;AAAA,EAClB;AAAA;AAAA,EAEA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI;AAAA,MACX,OAAO,iDAAiD,QAAQ;AAAA,MAChE;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI;AAAA,MACX,OAAO,4DAA4D,oBAAoB,GAAG,QAAQ,GAAG,YAAY;AAAA,MACjH;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI,OAAO,OAAO,sBAAsB,QAAQ,oDAAoD,IAAI;AAAA,IACjH,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI;AAAA,MACX,OAAO,yFAAyF,YAAY,WAAW,QAAQ,SAAS,YAAY;AAAA,MACpJ;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAAA;AAAA,EAEA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI,OAAO,OAAO,oDAAoD,QAAQ,SAAS,YAAY,IAAI,GAAG;AAAA,IACnH,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI;AAAA,MACX,OAAO,wEAAwE,YAAY,iBAAiB,oBAAoB,GAAG,QAAQ,GAAG,YAAY;AAAA,MAC1J;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI;AAAA,MACX,OAAO,2BAA2B,YAAY,iBAAiB,oBAAoB,GAAG,QAAQ,GAAG,YAAY;AAAA,MAC7G;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI;AAAA,MACX,OAAO,OAAO,SAAS,0BAA0B,QAAQ,wBAAwB,SAAS,0BAA0B,QAAQ,wBAAwB,SAAS,cAAc,QAAQ;AAAA,MACnL;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,IAChB,QAAQ,CAAC,WAAW,GAAG,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,IAAI;AAAA,EACtE;AAAA;AAAA,EAEA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI;AAAA,MACX,OAAO,kEAAkE,WAAW,eAAe,WAAW,SAAS,QAAQ;AAAA,MAC/H;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI;AAAA,MACX,OAAO,2BAA2B,UAAU,UAAU,oBAAoB,GAAG,QAAQ,GAAG,YAAY;AAAA,MACpG;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,IAAI;AAAA,MACX,OAAO,0BAA0B,UAAU,oCAAoC,SAAS,IAAI,QAAQ,GAAG,YAAY;AAAA,MACnH;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA;AAAA,IAEhB,QAAQ,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI;AAAA,EAC3C;AACF;AAcO,SAAS,OAAO,MAAc,UAAyB,OAAqB;AACjF,MAAI,gBAAgB;AACpB,MAAI,MAAM;AAEV,aAAW,QAAQ,OAAO;AACxB,QAAI,YAAY,qBAAqB,CAAC,KAAK,eAAgB;AAC3D,UAAM,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAoB;AACtD,uBAAiB;AAGjB,YAAM,MAAM,KAAK,UAAU,CAACA,MAAK,MAAM,IAAI,KAAK,OAAOA,SAAQ,QAAQ;AACvE,YAAM,SAAS,KAAK,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,MAAO,OAAO,MAAM,WAAW,IAAI,EAAG;AAC7E,aAAO,KAAK,SAAS,KAAK,OAAO,MAAM,IAAI;AAAA,IAC7C,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,MAAM,KAAK,cAAc;AACpC;;;ACpNA,SAAS,kBAAkB;AAMpB,SAAS,UAAU,OAAuB;AAC/C,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,KAAK;AAChE;;;AFGA,IAAM,cAAmC,oBAAI,IAAI,CAAC,aAAa,aAAa,UAAU,CAAC;AAEvF,IAAM,eAAe,CAAC,MAA+B,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC,IAAI,IAAI;AAGhG,SAAS,cAAc,UAAkB,OAA8B;AAC5E,MAAI,CAAC,YAAY,IAAI,KAAK,EAAG,QAAO;AACpC,MAAI;AACJ,MAAI;AAGF,YAAQ,KAAK,MAAM,SAAS,KAAK,CAAC;AAAA,EACpC,QAAQ;AAEN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,OAAO,YAAY,OAAO,EAAE,QAAQ,YAAY,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,KAAK,MAAM,GAAI,QAAO;AAE9H,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI,EAAE;AAAA,IACN,KAAK,EAAE;AAAA,IACP,UAAU,aAAa,EAAE,QAAQ;AAAA,IACjC,YAAY,aAAa,EAAE,UAAU;AAAA,IACrC,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,IAC3B;AAAA;AAAA,IAEA,aAAa,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,EAAE;AAAA,EAC/C,CAAC;AACH;AAGA,eAAsB,iBAAiB,UAAkB,SAAiB,OAAiC;AACzG,QAAM,OAAO,cAAc,UAAU,KAAK;AAC1C,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,MAAM,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACjD,QAAM,WAAW,SAAS,GAAG,IAAI;AAAA,GAAM,EAAE,UAAU,QAAQ,MAAM,IAAM,CAAC;AACxE,SAAO;AACT;;;AGtCA,IAAM,kBAAkB;AAExB,IAAM,OAAO,MAAa,QAAQ,KAAK,CAAC;AACxC,QAAQ,GAAG,qBAAqB,IAAI;AACpC,QAAQ,GAAG,sBAAsB,IAAI;AAErC,SAAS,IAAI,MAAkC;AAC7C,QAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI;AACnC,SAAO,MAAM,KAAK,SAAY,QAAQ,KAAK,IAAI,CAAC;AAClD;AAEA,eAAe,OAAsB;AACnC,QAAM,UAAU,IAAI,OAAO;AAC3B,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO;AACX,mBAAiB,SAAS,QAAQ,OAAO;AACvC,YAAS,MAAiB;AAC1B,QAAI,OAAO,gBAAiB,MAAK;AACjC,WAAO,KAAK,KAAe;AAAA,EAC7B;AACA,QAAM,KAAK,WAAW,QAAQ,MAAM,iBAAiB,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,GAAG,SAAS,KAAK,IAAI;AAC/G,UAAQ,KAAK,KAAK,IAAI,CAAC;AACzB;AAEA,KAAK,EAAE,MAAM,IAAI;","names":["arg"]}

package/package.json

@@ -1,70 +1,71 @@
-{
-  "name": "nexusmem",
-  "version": "0.10.4",
-  "description": "Local-first persistent memory for AI coding agents. Indexes git history, shell commands with exit codes, project docs and (opt-in) assistant transcripts into an embedded SQLite database, then serves back a ranked, token-budgeted context slice over MCP or the CLI.",
-  "mcpName": "io.github.yaminbkk/nexusmem",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/yaminbkk/NexusMem.git"
-  },
-  "homepage": "https://github.com/yaminbkk/NexusMem#readme",
-  "bugs": {
-    "url": "https://github.com/yaminbkk/NexusMem/issues"
-  },
-  "type": "module",
-  "engines": {
-    "node": ">=22"
-  },
-  "bin": {
-    "nexusmem": "dist/cli/index.js"
-  },
-  "files": [
-    "dist",
-    "README.md",
-    "CHANGELOG.md"
-  ],
-  "scripts": {
-    "dev": "tsx src/cli/index.ts",
-    "build": "tsup",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "smoke": "tsx scripts/smoke-package.ts",
-    "bench": "tsx scripts/benchmark.ts",
-    "eval": "tsx scripts/eval.ts",
-    "prepublishOnly": "npm run typecheck && npm test && npm run build"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "better-sqlite3": "^12.2.0",
-    "commander": "^14.0.0",
-    "picocolors": "^1.1.1",
-    "sqlite-vec": "^0.1.9",
-    "zod": "^4.0.5"
-  },
-  "devDependencies": {
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/node": "^24.0.0",
-    "tsup": "^8.5.0",
-    "tsx": "^4.20.0",
-    "typescript": "^5.8.0",
-    "vitest": "^3.2.0"
-  },
-  "keywords": [
-    "ai",
-    "shell-history",
-    "exit-codes",
-    "memory",
-    "context",
-    "mcp",
-    "local-first",
-    "sqlite",
-    "agent"
-  ],
-  "allowScripts": {
-    "better-sqlite3@12.11.1": true,
-    "esbuild@0.27.7": true,
-    "esbuild@0.28.1": true
-  }
-}
+{
+  "name": "nexusmem",
+  "version": "0.11.0",
+  "description": "Local-first persistent memory for AI coding agents. Indexes git history, shell commands with exit codes, project docs and (opt-in) assistant transcripts into an embedded SQLite database, then serves back a ranked, token-budgeted context slice over MCP or the CLI.",
+  "mcpName": "io.github.yaminbkk/nexusmem",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/yaminbkk/NexusMem.git"
+  },
+  "homepage": "https://github.com/yaminbkk/NexusMem#readme",
+  "bugs": {
+    "url": "https://github.com/yaminbkk/NexusMem/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "bin": {
+    "nexusmem": "dist/cli/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "dev": "tsx src/cli/index.ts",
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "smoke": "tsx scripts/smoke-package.ts",
+    "bench": "tsx scripts/benchmark.ts",
+    "bench:hook": "tsx scripts/bench-agent-hook.ts",
+    "eval": "tsx scripts/eval.ts",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "better-sqlite3": "^12.2.0",
+    "commander": "^14.0.0",
+    "picocolors": "^1.1.1",
+    "sqlite-vec": "^0.1.9",
+    "zod": "^4.0.5"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "^24.0.0",
+    "tsup": "^8.5.0",
+    "tsx": "^4.20.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.2.0"
+  },
+  "keywords": [
+    "ai",
+    "shell-history",
+    "exit-codes",
+    "memory",
+    "context",
+    "mcp",
+    "local-first",
+    "sqlite",
+    "agent"
+  ],
+  "allowScripts": {
+    "better-sqlite3@12.11.1": true,
+    "esbuild@0.27.7": true,
+    "esbuild@0.28.1": true
+  }
+}