opencode-secrets-obfuscation 0.1.0 → 0.1.2

package/src/config/options.ts

@@ -1,76 +0,0 @@
-export type Limits = {
-  sourceBytes: number; totalSourceBytes: number; sourceCount: number; secretCount: number
-  secretBytes: number; indexBytes: number; inputBytes: number; outputBytes: number
-  traversalDepth: number; traversalNodes: number; activeSessions: number
-  handlesPerSession: number; activeCalls: number; workingBytes: number
-  callTimeoutMs: number; idleTimeoutMs: number
-}
-
-export type SourceDescriptor = { id: string; type: "file"; format: "dotenv"; path: string; required: boolean; keys: string[] }
-export type PluginOptions = {
-  version: 1
-  sources: SourceDescriptor[]
-  limits: Limits
-}
-
-export class OptionsError extends Error {
-  readonly code = "CONFIG_INVALID"
-  readonly path: string
-  constructor(path = "options") { super("CONFIG_INVALID"); this.name = "OptionsError"; this.path = path }
-}
-
-const ceilings: Limits = {
-  sourceBytes: 1_048_576, totalSourceBytes: 2_097_152, sourceCount: 4,
-  secretCount: 1000, secretBytes: 16_384, indexBytes: 8_388_608,
-  inputBytes: 1_048_576, outputBytes: 2_097_152, traversalDepth: 32,
-  traversalNodes: 50_000, activeSessions: 8, handlesPerSession: 2048,
-  activeCalls: 4, workingBytes: 33_554_432, callTimeoutMs: 30_000, idleTimeoutMs: 5_000,
-}
-const keys = (value: object, allowed: readonly string[], path: string): void => {
-  for (const key of Object.keys(value)) if (!allowed.includes(key)) throw new OptionsError(`${path}.${key}`)
-}
-function checked(value: unknown, path: string, seen: Set<object>): Record<string, unknown> {
-  if (typeof value !== "object" || value === null || (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) || (Array.isArray(value) && Object.getPrototypeOf(value) !== Array.prototype)) throw new OptionsError(path)
-  if (seen.has(value)) throw new OptionsError(path)
-  seen.add(value)
-  for (const key of Object.keys(value)) {
-    const descriptor = Object.getOwnPropertyDescriptor(value, key)
-    if (!descriptor || !("value" in descriptor)) throw new OptionsError(`${path}.${key}`)
-    if (typeof descriptor.value === "object" && descriptor.value !== null) checked(descriptor.value, `${path}.${key}`, seen)
-  }
-  seen.delete(value)
-  return value as Record<string, unknown>
-}
-const string = (value: unknown, path: string, pattern?: RegExp): string => {
-  if (typeof value !== "string" || value.length === 0 || value.length > 256 || (pattern && !pattern.test(value)) || /\$\{(?:env|file):/i.test(value)) throw new OptionsError(path)
-  return value
-}
-const list = (value: unknown, path: string): unknown[] => { if (!Array.isArray(value)) throw new OptionsError(path); return value }
-
-function parseOptionsUnsafe(input: unknown): PluginOptions {
-  const seen = new Set<object>(); const options = checked(input, "options", seen)
-  keys(options, ["version", "sources", "limits"], "options")
-  if (options.version !== 1) throw new OptionsError("options.version")
-
-  const sources = list(options.sources, "options.sources").map((raw, i) => {
-    const source = checked(raw, `sources[${i}]`, seen); keys(source, ["id", "type", "format", "path", "required", "keys"], `sources[${i}]`)
-    const path = string(source.path, `sources[${i}].path`)
-    if (path.includes("\0") || path.startsWith("/") || path.startsWith("\\") || /^[A-Za-z]:/.test(path) || path.split(/[\\/]/).some(segment => segment === "." || segment === "..")) throw new OptionsError(`sources[${i}].path`)
-    if (source.type !== "file" || source.format !== "dotenv" || typeof source.required !== "boolean") throw new OptionsError(`sources[${i}]`)
-    const sourceKeys = list(source.keys, `sources[${i}].keys`).map((key, keyIndex) => string(key, `sources[${i}].keys[${keyIndex}]`, /^[A-Za-z_][A-Za-z0-9_]*$/))
-    if (sourceKeys.length === 0 || new Set(sourceKeys).size !== sourceKeys.length) throw new OptionsError(`sources[${i}].keys`)
-    return { id: string(source.id, `sources[${i}].id` , /^[A-Za-z][A-Za-z0-9._-]*$/), type: "file", format: "dotenv", path, required: source.required, keys: sourceKeys } as SourceDescriptor
-  })
-  if (sources.length === 0 || sources.length > ceilings.sourceCount || new Set(sources.map(s => s.id)).size !== sources.length) throw new OptionsError("sources")
-  const configuredLimits = checked(options.limits, "options.limits", seen); keys(configuredLimits, Object.keys(ceilings), "limits")
-  const limits = {} as Limits
-  for (const key of Object.keys(ceilings) as (keyof Limits)[]) { const value = configuredLimits[key]; if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > ceilings[key]) throw new OptionsError(`limits.${key}`); limits[key] = value }
-  return { version: 1, sources, limits }
-}
-
-export function parseOptions(input: unknown): PluginOptions {
-  try { return parseOptionsUnsafe(input) } catch (error) {
-    if (error instanceof OptionsError) throw error
-    throw new OptionsError()
-  }
-}

package/src/diagnostics/README.md

@@ -1,4 +0,0 @@
-# Placeholder: safe diagnostics
-
-Fixed non-echoing codes, manifest/coverage status and safe audit records.
-Never log maps, raw input, error causes or credential-derived indexes. No code yet.

package/src/opencode/v2/filter.ts

@@ -1,350 +0,0 @@
-import { sanitizeText, scanForSecrets, verifyCeilingBytes, type Budget, type Pattern } from "../../sanitize/index.ts"
-
-/** Fixed replacement/withheld token; part of the reserved output inventory. */
-export const WITHHELD = "SANITIZATION_UNAVAILABLE"
-const encoder = new TextEncoder()
-const decoder = new TextDecoder()
-/** Provider authentication stays in its transport-auth channel (design §8). */
-const AUTH_CHANNEL = new Set(["authorization", "api-key", "x-api-key", "proxy-authorization"])
-const NULL_BODY_STATUS = new Set([101, 204, 205, 304])
-
-export interface FilterState {
-  readonly patterns: readonly Pattern[]
-  readonly budget: Required<Budget>
-  readonly maxInputBytes: number
-}
-
-export const hasSecrets = (state: FilterState): boolean => state.patterns.length > 0
-
-interface WalkCounters { nodes: number }
-
-interface WalkResult {
-  readonly value: unknown
-  readonly changed: boolean
-}
-
-/**
- * In-place, bounded walker over plain JSON-like host data. Strings are run
- * through the reviewed sanitizer; only a fixed token ever replaces text.
- * Non-plain objects (signals, class instances) are never serialized into a
- * model payload by contract and are skipped rather than arbitrarily invoked.
- */
-function redactNode(current: unknown, depth: number, state: FilterState, counters: WalkCounters): WalkResult {
-  counters.nodes++
-  if (counters.nodes > state.budget.maxNodes || depth > state.budget.maxDepth) return { value: WITHHELD, changed: true }
-  if (typeof current === "string") {
-    if (current.length === 0) return { value: current, changed: false }
-    const safe = sanitizeText(current, state.patterns, state.budget)
-    if (safe === null) return { value: WITHHELD, changed: true }
-    return { value: safe, changed: safe !== current }
-  }
-  if (current === null || typeof current !== "object") return { value: current, changed: false }
-  if (Array.isArray(current)) {
-    let changed = false
-    for (let index = 0; index < current.length; index++) {
-      const result = redactNode(current[index], depth + 1, state, counters)
-      if (result.changed) {
-        current[index] = result.value
-        changed = true
-      }
-    }
-    return { value: current, changed }
-  }
-  const prototype = Object.getPrototypeOf(current)
-  if (prototype !== Object.prototype && prototype !== null) return { value: current, changed: false }
-  const record = current as Record<string, unknown>
-  let changed = false
-  for (const key of Object.keys(record)) {
-    const descriptor = Object.getOwnPropertyDescriptor(record, key)
-    if (!descriptor || !("value" in descriptor)) continue
-    const safeKey = redactString(key, state)
-    if (safeKey === null) return { value: WITHHELD, changed: true }
-    const result = redactNode(descriptor.value, depth + 1, state, counters)
-    if (result.changed || safeKey !== key) {
-      if (safeKey !== key) {
-        if (Object.prototype.hasOwnProperty.call(record, safeKey)) return { value: WITHHELD, changed: true }
-        delete record[key]
-        record[safeKey] = result.value
-      } else {
-        record[key] = result.value
-      }
-      changed = true
-    }
-  }
-  return { value: current, changed }
-}
-
-/** Sanitizes a host event tree in place. Returns true when anything changed. */
-export function redactTree(root: unknown, state: FilterState): boolean {
-  if (!hasSecrets(state)) return false
-  return redactNode(root, 0, state, { nodes: 0 }).changed
-}
-
-/** One bounded string replacement; null means safely withheld. */
-export function redactString(value: string, state: FilterState): string | null {
-  if (!hasSecrets(state)) return value
-  if (encoder.encode(value).byteLength > state.maxInputBytes) return null
-  return sanitizeText(value, state.patterns, state.budget)
-}
-
-/**
- * Conservative presence oracle: true when a candidate still intersects a
- * registered interval OR cannot be verified at all (oversize beyond the scan
- * ceiling, unadmitted patterns, exhausted budgets). `false` therefore means
- * "verified clean" — for values up to `verifyCeilingBytes(patterns)` this is a
- * containment scan and is not gated by the rewrite/output budgets.
- */
-export function containsSecret(value: string, state: FilterState): boolean {
-  if (!hasSecrets(state)) return false
-  return scanForSecrets(value, state.patterns, state.budget) !== "clean"
-}
-
-export interface HeaderOptions {
-  /** Skip provider transport-auth headers (request side only). */
-  readonly skipAuth: boolean
-  /** Withhold the whole record on the first unsafe pair instead of dropping it. */
-  readonly strict: boolean
-}
-
-/**
- * Sanitizes a plain header record in place (values, then names). Returns
- * `"withheld"` only in strict mode when any pair cannot be made safe.
- */
-export function redactHeaders(headers: Record<string, string>, state: FilterState, options: HeaderOptions): "withheld" | void {
-  if (!hasSecrets(state)) return
-  for (const name of Object.keys(headers)) {
-    if (options.skipAuth && AUTH_CHANNEL.has(name.toLowerCase())) continue
-    const value = headers[name]
-    if (typeof value !== "string") {
-      if (options.strict) return "withheld"
-      delete headers[name]
-      continue
-    }
-    const safeValue = redactString(value, state)
-    const safeName = redactString(name, state)
-    if (safeValue === null || safeName === null) {
-      if (options.strict) return "withheld"
-      delete headers[name]
-      continue
-    }
-    if (safeValue !== value) headers[name] = safeValue
-    if (safeName !== name) {
-      delete headers[name]
-      headers[safeName] = safeValue
-    }
-  }
-}
-
-/**
- * JSON-aware body rewrite for the exact published bytes: structured payloads
- * are sanitized per field and re-serialized only when something changed; the
- * final joined bytes are independently re-scanned before publication.
- */
-export function redactBody(text: string, state: FilterState): string | null {
-  if (!hasSecrets(state)) return text
-  const trimmed = text.trimStart()
-  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-    try {
-      const parsed: unknown = JSON.parse(text)
-      const result = redactNode(parsed, 0, state, { nodes: 0 })
-      if (!result.changed) return text
-      const serialized = JSON.stringify(result.value)
-      if (serialized === undefined) return null
-      if (encoder.encode(serialized).byteLength > state.maxInputBytes) return null
-      if (containsSecret(serialized, state)) return null
-      return serialized
-    } catch {
-      /* Not a JSON payload after all; fall through to raw text handling. */
-    }
-  }
-  return redactString(text, state)
-}
-
-/** Redact JSON payloads inside SSE data frames without corrupting JSON quotes. */
-function redactEventStream(text: string, state: FilterState): string | null {
-  const lines = text.split(/(\r?\n)/u)
-  for (let index = 0; index < lines.length; index += 1) {
-    const line = lines[index]!
-    if (!line.startsWith("data:") || line.endsWith("\n") || line.endsWith("\r")) continue
-    const payload = line.slice(5).trimStart()
-    if (payload === "[DONE]" || payload.length === 0) continue
-    try {
-      const parsed: unknown = JSON.parse(payload)
-      if (!redactTree(parsed, state)) continue
-      const serialized = JSON.stringify(parsed)
-      if (serialized === undefined || containsSecret(serialized, state)) return null
-      lines[index] = `data: ${serialized}`
-    } catch {
-      return null
-    }
-  }
-  return lines.join("")
-}
-
-/**
- * Bounded body read: accumulates at most `limit` payload bytes and returns the
- * decoded text with its actual byte size. `null` means the body exceeded the
- * limit or could not be read (both are withhold conditions for callers). On
- * overflow the reader is abandoned rather than cancelled: cancelling one branch
- * of Node's tee'd clone blocks forever when the sibling branch is never read,
- * and an abandoned reader leaves the sibling (original) branch intact for the
- * publish decision. Neither branch is ever forwarded after an overflow.
- */
-async function readBoundedBody(body: ReadableStream<Uint8Array> | null, limit: number): Promise<{ text: string; bytes: number } | null> {
-  if (body === null) return { text: "", bytes: 0 }
-  try {
-    const reader = body.getReader()
-    const chunks: Uint8Array[] = []
-    let total = 0
-    for (;;) {
-      const { done, value } = await reader.read()
-      if (done) break
-      if (value === undefined || value.byteLength === 0) continue
-      total += value.byteLength
-      if (total > limit) return null
-      chunks.push(value)
-    }
-    const merged = new Uint8Array(total)
-    let offset = 0
-    for (const chunk of chunks) {
-      merged.set(chunk, offset)
-      offset += chunk.byteLength
-    }
-    return { text: decoder.decode(merged), bytes: total }
-  } catch {
-    return null
-  }
-}
-
-/**
- * One-shot, bounded replacement of a native provider `Request`. Bodies at or
- * below the rewrite ceiling (`maxInputBytes`) are rewritten and re-scanned as
- * before. Larger bodies up to the verify ceiling (8 MiB minus pattern bytes)
- * are containment-scanned instead: a verified-clean body is passed through
- * unchanged, anything that still intersects a registered representation — or
- * cannot be verified — withholds the whole request. Beyond the verify ceiling
- * (or a declared content-length above it) the request is withheld without
- * reading. The caller must stop with a fixed defect on `"withheld"` rather
- * than pass the original through.
- */
-export async function redactRequest(request: Request, state: FilterState): Promise<Request | "withheld"> {
-  if (!hasSecrets(state)) return request
-  const verifyCeiling = verifyCeilingBytes(state.patterns)
-  const declared = Number(request.headers.get("content-length") ?? Number.NaN)
-  if (Number.isFinite(declared) && declared > verifyCeiling) return "withheld"
-  const record: Record<string, string> = {}
-  request.headers.forEach((value, name) => {
-    record[name] = value
-  })
-  if (redactHeaders(record, state, { skipAuth: true, strict: true }) === "withheld") return "withheld"
-  delete record["content-length"]
-  let body: string | undefined
-  if (request.body !== null) {
-    const read = await readBoundedBody(request.clone().body, verifyCeiling)
-    if (read === null) return "withheld"
-    if (read.bytes > state.maxInputBytes) {
-      // Verify-only zone: rewriting is out of budget, so pass the original
-      // only after proving it clean; otherwise withhold.
-      if (scanForSecrets(read.text, state.patterns, state.budget) !== "clean") return "withheld"
-    } else {
-      const safe = redactBody(read.text, state)
-      if (safe === null) return "withheld"
-      if (safe !== read.text) body = safe
-    }
-  }
-  try {
-    return new Request(request, {
-      headers: record,
-      ...(body === undefined ? {} : { body }),
-      signal: request.signal,
-    })
-  } catch {
-    return "withheld"
-  }
-}
-
-/**
- * Inbound response projection: every header pair is sanitized (dropped when
- * unsafe). Bodies at or below the rewrite ceiling are rewritten and re-scanned;
- * larger bodies up to the verify ceiling are containment-scanned and published
- * unchanged only when verified clean. Beyond the verify ceiling (or a declared
- * content-length above it) the body is withheld as an empty payload. The
- * original response is never returned unexamined once a registered value
- * exists.
- */
-export async function redactResponse(response: Response, state: FilterState): Promise<Response> {
-  if (!hasSecrets(state)) return response
-  const headers: Record<string, string> = {}
-  response.headers.forEach((value, name) => {
-    headers[name] = value
-  })
-  redactHeaders(headers, state, { skipAuth: false, strict: false })
-  const status = response.status
-  const nullBody = NULL_BODY_STATUS.has(status)
-  if (nullBody) {
-    try {
-      return new Response(null, { status, headers })
-    } catch {
-      return new Response(null, { status: 502 })
-    }
-  }
-  const verifyCeiling = verifyCeilingBytes(state.patterns)
-  const declared = Number(response.headers.get("content-length") ?? Number.NaN)
-  if (Number.isFinite(declared) && declared > verifyCeiling) {
-    try {
-      return new Response(null, { status, headers })
-    } catch {
-      return new Response(null, { status: 502 })
-    }
-  }
-  const read = await readBoundedBody(response.clone().body, verifyCeiling)
-  if (read === null) {
-    try {
-      return new Response(null, { status, headers })
-    } catch {
-      return new Response(null, { status: 502 })
-    }
-  }
-  let body: string
-  if (read.bytes > state.maxInputBytes) {
-    body = scanForSecrets(read.text, state.patterns, state.budget) === "clean" ? read.text : ""
-  } else if ((headers["content-type"] ?? "").toLowerCase().includes("text/event-stream")) {
-    body = redactEventStream(read.text, state) ?? ""
-  } else {
-    const safe = redactBody(read.text, state)
-    body = safe === null ? "" : safe
-  }
-  try {
-    return new Response(body, { status, headers })
-  } catch {
-    return new Response(null, { status: 502 })
-  }
-}
-
-/**
- * Drops positional `mention` offsets from a prompt after a rewrite; offsets
- * cannot be trusted once text lengths changed. Attachment identity (uri/id)
- * lives on the parent record and is preserved.
- */
-export function dropMentions(root: unknown): void {
-  const walk = (node: unknown, depth: number, counters: WalkCounters): void => {
-    counters.nodes++
-    if (counters.nodes > 10_000 || depth > 32) return
-    if (Array.isArray(node)) {
-      for (const item of node) walk(item, depth + 1, counters)
-      return
-    }
-    if (!node || typeof node !== "object") return
-    const prototype = Object.getPrototypeOf(node)
-    if (prototype !== Object.prototype && prototype !== null) return
-    const record = node as Record<string, unknown>
-    for (const key of Object.keys(record)) {
-      if (key === "mention" && record[key] && typeof record[key] === "object") {
-        delete record[key]
-        continue
-      }
-      walk(record[key], depth + 1, counters)
-    }
-  }
-  walk(root, 0, { nodes: 0 })
-}

package/src/opencode/v2/index.ts

@@ -1,86 +0,0 @@
-import { Plugin } from "@opencode/plugin/effect"
-import type { Context } from "@opencode/plugin/effect/plugin"
-import { Tool } from "@opencode/schema/tool"
-import { Effect } from "effect"
-import type { SessionHooks } from "@opencode/plugin/effect/session"
-import type { ToolHooks } from "@opencode/plugin/effect/tool"
-import { parseOptions, type PluginOptions } from "../../config/options.ts"
-import type { Scope } from "effect"
-import { realRuntimeFactory } from "./runtime.ts"
-
-/**
- * The core track owns policy, source loading, storage and sanitization. This
- * narrow boundary is intentional: no host event is converted to a guessed
- * core shape, and no secret-bearing value crosses the plugin boundary.
- */
-export interface CoreRuntime {
-  readonly close: () => Effect.Effect<void>
-  readonly session: {
-    readonly prompt: (event: SessionHooks["prompt"]) => Effect.Effect<void>
-    readonly context: (event: SessionHooks["context"]) => Effect.Effect<void>
-    readonly compaction: (event: SessionHooks["compaction"]) => Effect.Effect<void>
-    readonly generate: (event: SessionHooks["generate"]) => Effect.Effect<void>
-    readonly title: (event: SessionHooks["title"]) => Effect.Effect<void>
-    readonly modelRequest: (event: SessionHooks["model.request"]) => Effect.Effect<void>
-    readonly httpRequest: (event: SessionHooks["http.request"]) => Effect.Effect<void>
-    readonly httpResponse: (event: SessionHooks["http.response"]) => Effect.Effect<void>
-  }
-  readonly tool: {
-    readonly before: (event: ToolHooks["execute.before"]) => Effect.Effect<void, Tool.Error>
-    readonly after: (event: ToolHooks["execute.after"]) => Effect.Effect<void>
-  }
-}
-
-export type CoreRuntimeFactory = (options: PluginOptions, location: Context["location"]) => Effect.Effect<CoreRuntime, never, never>
-
-export const unavailableRuntime: CoreRuntime = {
-  close: () => Effect.void,
-  session: {
-    prompt: () => Effect.void,
-    context: () => Effect.void,
-    compaction: () => Effect.void,
-    generate: () => Effect.void,
-    title: () => Effect.void,
-    modelRequest: () => Effect.void,
-    httpRequest: () => Effect.void,
-    httpResponse: () => Effect.void,
-  },
-  tool: {
-    before: () => Effect.void,
-    after: () => Effect.void,
-  },
-}
-
-export const unavailableRuntimeFactory: CoreRuntimeFactory = () => Effect.succeed(unavailableRuntime)
-
-/** Build the native V2 Effect entrypoint around an injected, qualified core. */
-export const makeEffect = (factory: CoreRuntimeFactory = unavailableRuntimeFactory) =>
-  (ctx: Context): Effect.Effect<void, never, Scope.Scope> => Effect.gen(function* () {
-    const runtime = yield* Effect.suspend((): Effect.Effect<CoreRuntime, never, never> => {
-      try {
-        return factory(parseOptions(ctx.options), ctx.location)
-      } catch {
-        return Effect.succeed(unavailableRuntime)
-      }
-    })
-    yield* Effect.addFinalizer(() => runtime.close())
-
-    yield* ctx.session.hook("prompt", (event) => runtime.session.prompt(event))
-    yield* ctx.session.hook("context", (event) => runtime.session.context(event))
-    yield* ctx.session.hook("compaction", (event) => runtime.session.compaction(event))
-    yield* ctx.session.hook("generate", (event) => runtime.session.generate(event))
-    yield* ctx.session.hook("title", (event) => runtime.session.title(event))
-    yield* ctx.session.hook("model.request", (event) => runtime.session.modelRequest(event))
-    yield* ctx.session.hook("http.request", (event) => runtime.session.httpRequest(event))
-    yield* ctx.session.hook("http.response", (event) => runtime.session.httpResponse(event))
-    yield* ctx.tool.hook("execute.before", (event) => runtime.tool.before(event))
-    yield* ctx.tool.hook("execute.after", (event) => runtime.tool.after(event))
-
-  })
-
-const plugin = Plugin.define({
-  id: "opencode-secrets-obfuscation",
-  effect: makeEffect(realRuntimeFactory),
-})
-
-export default plugin