ocuclaw 1.3.2 → 1.3.4

package/dist/gateway/sanitize-connect-reason.js

@@ -0,0 +1,10 @@
+export function sanitizeConnectReason(message) {
+  return String(message ?? "")
+    .replace(
+      /(token|secret|nonce|sig|signature|authorization|password|auth)=([^\s&"']+)/gi,
+      "$1=[REDACTED]",
+    )
+    .replace(/\bbearer\s+\S+/gi, "bearer [REDACTED]")
+    .replace(/[A-Za-z0-9_\-+/.=]{40,}/g, "[REDACTED]")
+    .slice(0, 300);
+}

package/dist/gateway/sanitize-connect-reason.test.js

@@ -0,0 +1,34 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import { sanitizeConnectReason } from "./sanitize-connect-reason.ts";
+
+describe("sanitizeConnectReason", () => {
+  it("redacts token= / authorization= key-value secrets", () => {
+    assert.equal(
+      sanitizeConnectReason("connect ws://h/?token=abc123def failed"),
+      "connect ws://h/?token=[REDACTED] failed",
+    );
+    assert.equal(sanitizeConnectReason("authorization=Bearerxyz"), "authorization=[REDACTED]");
+  });
+
+  it("redacts a bearer credential", () => {
+    assert.equal(sanitizeConnectReason("got bearer shorttok here"), "got bearer [REDACTED] here");
+  });
+
+  it("redacts a long credential-shaped run (jwt / signature / nonce)", () => {
+    const jwt = "a".repeat(60);
+    assert.equal(sanitizeConnectReason(`sig ${jwt}`), "sig [REDACTED]");
+  });
+
+  it("passes a benign reason through unchanged", () => {
+    assert.equal(sanitizeConnectReason("Unexpected server response: 1008"), "Unexpected server response: 1008");
+    assert.equal(sanitizeConnectReason("first request must be connect"), "first request must be connect");
+  });
+
+  it("handles null/undefined and caps length at 300", () => {
+    assert.equal(sanitizeConnectReason(null), "");
+    assert.equal(sanitizeConnectReason(undefined), "");
+    assert.equal(sanitizeConnectReason("ok ".repeat(200)).length, 300);
+  });
+});

package/dist/index.js

@@ -64,21 +64,21 @@ export default function register(api) {
         try {
           glassesUiDispose();
         } catch (_) {
-          /* ignore: dispose is a best-effort cleanup */
+
         }
       }
       if (typeof deviceInfoDispose === "function") {
         try {
           deviceInfoDispose();
         } catch (_) {
-          /* ignore: dispose is a best-effort cleanup */
+
         }
       }
       if (typeof distillerDispose === "function") {
         try {
           distillerDispose();
         } catch (_) {
-          /* ignore: dispose is a best-effort cleanup */
+
         }
       }
       return service.stop({ logger: ctx && ctx.logger });

package/dist/runtime/channel-two-hook.js

@@ -1,10 +1,5 @@
 import { composeChannelTwoFragment } from "../domain/prompt-channel-fragments.js";
 
-/**
- * Build a before_prompt_build hook that injects the Channel-2 fragment.
- * @param {{getDisplayStartStates:Function, getDisplayCurrentStates:Function,
- *          hasConnectedAppClient:Function}} service
- */
 export function createChannelTwoHook(service, opts = {}) {
   const emitDebug = typeof opts.emitDebug === "function" ? opts.emitDebug : () => {};
   return function channelTwoBeforePromptBuild(_event, ctx) {
@@ -27,7 +22,7 @@ export function createChannelTwoHook(service, opts = {}) {
         { sessionKey }, () => ({ chars: fragment.length }));
       return { appendSystemContext: fragment };
     } catch (_err) {
-      // Defensive: any state-read failure yields no injection.
+
       return undefined;
     }
   };

package/dist/runtime/container-env.js

@@ -1,8 +1,5 @@
 import fs from "node:fs";
 
-// Marker files written by the container runtimes themselves: Docker creates
-// /.dockerenv, Podman creates /run/.containerenv. Kubernetes-style runtimes
-// leave neither — detection there would need heuristics too fragile to ship.
 const CONTAINER_MARKER_PATHS = ["/.dockerenv", "/run/.containerenv"];
 
 export function isLoopbackBindAddress(address) {
@@ -22,8 +19,7 @@ export function isContainerEnvironment(deps = {}) {
     try {
       if (existsSync(markerPath)) return true;
     } catch {
-      // No filesystem signal beats a startup failure: treat unreadable markers
-      // as "not a container" and keep the relay booting.
+
     }
   }
   return false;

package/dist/runtime/debug-bundle-handler.js

@@ -0,0 +1,159 @@
+import { assembleBundle, chunkZip } from "../domain/debug-bundle.js";
+import { buildBundlePreview } from "../domain/debug-bundle-preview.js";
+
+function computeAvailableSpanMs(dumpResult) {
+  const now = dumpResult && typeof dumpResult.nowMs === "number" ? dumpResult.nowMs : 0;
+  if (dumpResult && typeof dumpResult.oldestMatchedMs === "number") {
+    return Math.max(0, now - dumpResult.oldestMatchedMs);
+  }
+  const events = dumpResult && dumpResult.events;
+  if (!Array.isArray(events) || events.length === 0) return 0;
+  let min = Infinity;
+  for (const e of events) {
+    const ts = e && typeof e.ts === "number" ? e.ts : null;
+    if (ts !== null && ts < min) min = ts;
+  }
+  if (!Number.isFinite(min)) return 0;
+  return Math.max(0, now - min);
+}
+
+export async function handleDebugBundleRequest(deps, clientId, msg) {
+  if (!deps.gatesOn()) {
+    deps.emit("capture_refused", { requestId: msg.requestId, reason: "gates_off" });
+
+    deps.send(clientId, {
+      type: "debug-bundle-error",
+      requestId: msg.requestId,
+      reason: "upload_not_allowed",
+    });
+    return;
+  }
+  deps.emit("capture_requested", {
+    requestId: msg.requestId,
+    redactionMode: msg.redactionMode,
+  });
+
+  const windowMs =
+    typeof msg.windowMs === "number" && Number.isFinite(msg.windowMs) && msg.windowMs > 0
+      ? Math.floor(msg.windowMs)
+      : null;
+  const dumpResult = deps.dump(
+    windowMs ? { categories: deps.preset, sinceAgeMs: windowMs } : { categories: deps.preset },
+  );
+
+  if (!dumpResult || dumpResult.ok === false) {
+    deps.emit("capture_failed", { requestId: msg.requestId, reason: "dump_failed" });
+    deps.send(clientId, { type: "debug-bundle-error", requestId: msg.requestId, reason: "dump_failed" });
+    return;
+  }
+  const availableSpanMs = computeAvailableSpanMs(dumpResult);
+
+  try {
+    const bundle = assembleBundle(dumpResult, {
+      installId: msg.installId,
+      build: deps.build,
+      redactionMode: msg.redactionMode || "structural",
+      ringCappedWindow: false,
+      idSalt: deps.idSalt,
+      maxZipBytes: deps.maxZipBytes,
+      chunkBytes: deps.chunkBytes,
+      note: msg.note,
+    });
+    deps.emit("bundle_assembled", {
+      requestId: msg.requestId,
+      categories: bundle.metadata.categories.length,
+      totalBytes: bundle.metadata.totalBytes,
+      ringCappedWindow: bundle.metadata.window.ringCappedWindow,
+    });
+    const bundleId = deps.newBundleId();
+    deps.cachePut(bundleId, {
+      zip: bundle.zip,
+      metadataJson: JSON.stringify(bundle.metadata),
+      bundleSha256: bundle.bundleSha256,
+      cachedMs: deps.now(),
+    });
+
+    const frameMetadataJson = JSON.stringify({
+      ...bundle.metadata,
+      zipBytes: bundle.zip.length,
+      availableSpanMs,
+    });
+    deps.send(clientId, {
+      type: "debug-bundle-meta",
+      requestId: msg.requestId,
+      bundleId,
+      metadataJson: frameMetadataJson,
+    });
+
+    deps.send(clientId, {
+      type: "debug-bundle-preview",
+      requestId: msg.requestId,
+      bundleId,
+      sampleJson: JSON.stringify(buildBundlePreview(bundle.files, { maxEvents: 15, maxCharsPerEvent: 80 })),
+    });
+    deps.emit("bundle_cached", {
+      requestId: msg.requestId,
+      bundleId,
+      parts: bundle.chunks.length,
+    });
+  } catch (err) {
+
+    deps.emit("upload_failed", { requestId: msg.requestId, reason: "assembly_failed" });
+    deps.send(clientId, { type: "debug-bundle-error", requestId: msg.requestId, reason: "assembly_failed" });
+    return;
+  }
+}
+
+export async function handleDebugBundleSave(deps, clientId, msg) {
+  if (!deps.gatesOn()) {
+    deps.emit("save_refused", { requestId: msg.requestId, reason: "upload_not_allowed" });
+    deps.send(clientId, { type: "debug-bundle-error", requestId: msg.requestId, reason: "upload_not_allowed" });
+    return;
+  }
+  const entry = deps.cacheGet(msg.bundleId);
+  if (!entry) {
+    deps.emit("save_expired", { requestId: msg.requestId, bundleId: msg.bundleId });
+    deps.send(clientId, { type: "debug-bundle-error", requestId: msg.requestId, reason: "bundle_expired" });
+    return;
+  }
+
+  const reporterNote = typeof msg.note === "string" ? msg.note : "";
+  let sidecarMetadataJson;
+  try {
+    sidecarMetadataJson = JSON.stringify(
+      { ...JSON.parse(entry.metadataJson), reporterNote, reporterRedactionMode: "off" },
+      null,
+      2,
+    );
+  } catch {
+    sidecarMetadataJson = entry.metadataJson;
+  }
+  try {
+    const { savedPath, fileSize } = deps.saveBundle({ bundleId: msg.bundleId, savedMs: deps.now(), zip: entry.zip, metadataJson: sidecarMetadataJson });
+    deps.emit("bundle_written", { requestId: msg.requestId, bundleId: msg.bundleId, fileSize });
+    deps.send(clientId, { type: "debug-bundle-saved", requestId: msg.requestId, bundleId: msg.bundleId, savedPath, fileSize });
+  } catch {
+    deps.emit("save_failed", { requestId: msg.requestId, reason: "save_failed" });
+    deps.send(clientId, { type: "debug-bundle-error", requestId: msg.requestId, reason: "save_failed" });
+  }
+
+}
+
+export async function handleDebugBundleFetch(deps, clientId, msg) {
+  if (!deps.gatesOn()) {
+    deps.emit("fetch_refused", { requestId: msg.requestId, reason: "upload_not_allowed" });
+    deps.send(clientId, { type: "debug-bundle-error", requestId: msg.requestId, reason: "upload_not_allowed" });
+    return;
+  }
+  const entry = deps.cacheGet(msg.bundleId);
+  if (!entry) {
+    deps.emit("fetch_expired", { requestId: msg.requestId, bundleId: msg.bundleId });
+    deps.send(clientId, { type: "debug-bundle-error", requestId: msg.requestId, reason: "bundle_expired" });
+    return;
+  }
+  const chunks = chunkZip(entry.zip, deps.chunkBytes);
+  for (const chunk of chunks) {
+    deps.send(clientId, { type: "debug-bundle", requestId: msg.requestId, bundleId: msg.bundleId, partIndex: chunk.partIndex, partCount: chunk.partCount, partBase64: chunk.partBase64, bundleSha256: entry.bundleSha256 });
+  }
+  deps.emit("handoff_complete", { requestId: msg.requestId, bundleId: msg.bundleId, parts: chunks.length });
+}

package/dist/runtime/display-toggle-states.js

@@ -4,24 +4,13 @@ import * as path from "node:path";
 const DEFAULTS = { emoji: false, pace: false };
 const STORE_FILENAME = "ocuclaw-display-toggles.json";
 
-/**
- * Tracks, per session, the display-feature toggle state at session start
- * (frozen on first record) and the latest reported state.
- *
- * The FROZEN start-state is persisted to stateDir so it survives a relay/plugin
- * restart — the Channel-1 prompt snapshot is also persisted, so without this the
- * Channel-2 disable stop-notice would be lost after a restart (a session that
- * started with a feature ON would re-freeze start=OFF from the first post-restart
- * send and never notice the disable). The CURRENT state is NOT persisted: it
- * re-derives from the next send, so persisting it would mean a write per turn.
- */
 export function createDisplayToggleTracker(opts = {}) {
   const limit = Number.isFinite(opts.limit) ? opts.limit : 200;
   const statePath =
     typeof opts.stateDir === "string" && opts.stateDir.trim()
       ? path.join(opts.stateDir.trim(), STORE_FILENAME)
       : null;
-  /** @type {Map<string,{start:{emoji,pace},current:{emoji,pace}}>} */
+
   const byKey = new Map();
 
   function norm(v) {
@@ -36,13 +25,13 @@ export function createDisplayToggleTracker(opts = {}) {
         for (const [k, v] of Object.entries(parsed.entries)) {
           if (v && v.start) {
             const start = norm(v.start);
-            // current re-derives on the next send; seed it from start until then.
+
             byKey.set(k, { start, current: { ...start } });
           }
         }
       }
     } catch (_e) {
-      // Missing/corrupt store is non-fatal: start empty.
+
     }
   }
 
@@ -55,7 +44,7 @@ export function createDisplayToggleTracker(opts = {}) {
       fs.writeFileSync(tmp, JSON.stringify({ version: 1, entries }), { mode: 0o600 });
       fs.renameSync(tmp, statePath);
     } catch (_e) {
-      // Best-effort persistence.
+
     }
   }
 
@@ -76,10 +65,10 @@ export function createDisplayToggleTracker(opts = {}) {
       if (!existing) {
         byKey.set(sessionKey, { start: cur, current: cur });
         evictIfNeeded();
-        persist(); // a new frozen start-state was recorded
+        persist();
         return;
       }
-      existing.current = cur; // start stays frozen; no persist (start unchanged)
+      existing.current = cur;
     },
     getStart(sessionKey) {
       const e = byKey.get(sessionKey);