opencode-secrets-obfuscation 0.1.0 → 0.1.2

package/src/sanitize/index.ts

@@ -1,454 +0,0 @@
-/** Pure, bounded sanitization primitives. Host adapters must validate their own final bytes. */
-
-export interface Pattern {
-  readonly text: string
-  readonly replacement?: string
-  readonly entry?: string
-  /** Additional lexical/transport spellings belonging to this same entry. */
-  readonly representations?: readonly string[]
-}
-
-export interface Interval {
-  start: number
-  end: number
-  patterns: string[]
-}
-
-export interface Budget {
-  readonly maxOutputBytes?: number
-  readonly maxDepth?: number
-  readonly maxNodes?: number
-  readonly maxMatches?: number
-}
-
-const DEFAULT_MAX_OUTPUT_BYTES = 2 * 1024 * 1024
-const DEFAULT_MAX_DEPTH = 32
-const DEFAULT_MAX_NODES = 50_000
-const DEFAULT_MAX_MATCHES = 50_000
-// These are hard operation ceilings, not merely defaults. Explicit callers may
-// request less, but may not opt out of bounded work by supplying a larger value.
-const MAX_OUTPUT_BYTES = DEFAULT_MAX_OUTPUT_BYTES
-const MAX_DEPTH = DEFAULT_MAX_DEPTH
-const MAX_NODES = DEFAULT_MAX_NODES
-const MAX_MATCHES = DEFAULT_MAX_MATCHES
-const MAX_OBJECT_KEYS = MAX_NODES
-const MAX_PATTERN_COUNT = 4_096
-const MAX_PATTERN_TEXT = 65_536
-const MAX_REPRESENTATIONS = 16
-const MAX_INDEX_ENTRIES = 65_536
-const MAX_IDENTITY_ENTRIES = 50_000
-const MAX_PATTERN_BYTES = 4 * 1024 * 1024
-const MAX_TEMP_BYTES = 8 * 1024 * 1024
-
-type Reservation = { release(): void }
-let reservedPatternBytes = 0
-let reservedIndexEntries = 0
-let reservedIdentityEntries = 0
-let reservedTempBytes = 0
-
-function reserveOperation(patterns: readonly (Pattern | string)[] | undefined, inputBytes: number): Reservation | null {
-  try {
-    if (patterns !== undefined && !Array.isArray(patterns)) return null
-    const count = patterns?.length ?? 0
-    if (count > MAX_PATTERN_COUNT) return null
-    let patternBytes = 0
-    for (const item of patterns ?? []) {
-      const text = typeof item === "string" ? item : (() => {
-        if (item === null || typeof item !== "object") return null
-        const descriptor = Object.getOwnPropertyDescriptor(item, "text")
-        return descriptor && "value" in descriptor && typeof descriptor.value === "string" ? descriptor.value : null
-      })()
-      if (text === null) return null
-      patternBytes += encoder.encode(text).byteLength
-      if (patternBytes > MAX_PATTERN_BYTES) return null
-    }
-    const indexEntries = count * MAX_REPRESENTATIONS
-    const identityEntries = count
-    const tempBytes = inputBytes + patternBytes
-    if (!Number.isSafeInteger(inputBytes) || inputBytes < 0 || indexEntries > MAX_INDEX_ENTRIES || identityEntries > MAX_IDENTITY_ENTRIES || tempBytes > MAX_TEMP_BYTES) return null
-    if (reservedPatternBytes > MAX_PATTERN_BYTES - patternBytes || reservedIndexEntries > MAX_INDEX_ENTRIES - indexEntries || reservedIdentityEntries > MAX_IDENTITY_ENTRIES - identityEntries || reservedTempBytes > MAX_TEMP_BYTES - tempBytes) return null
-    reservedPatternBytes += patternBytes; reservedIndexEntries += indexEntries; reservedIdentityEntries += identityEntries; reservedTempBytes += tempBytes
-    let released = false
-    return { release: () => { if (released) return; released = true; reservedPatternBytes -= patternBytes; reservedIndexEntries -= indexEntries; reservedIdentityEntries -= identityEntries; reservedTempBytes -= tempBytes } }
-  } catch { return null }
-}
-
-export const RESERVED_OUTPUT_INVENTORY = Object.freeze([
-  "true", "false", "null", "REDACTED", "SANITIZATION_UNAVAILABLE",
-  "INVALID_CREDENTIAL", "ACCESS_DENIED", "UNAVAILABLE", "error", "content", "text",
-])
-
-export interface Representations {
-  readonly semantic: string
-  readonly dotenv: readonly string[]
-  readonly json: string
-  readonly percent: readonly string[]
-  readonly base64: readonly string[]
-}
-
-function base64(bytes: Uint8Array): string {
-  let binary = ""
-  for (const byte of bytes) binary += String.fromCharCode(byte)
-  return Buffer.from(binary, "binary").toString("base64")
-}
-
-/** The finite, versioned representation inventory used by the pure MVP matcher. */
-export function representationsFor(value: string): Representations | null {
-  const reservation = typeof value === "string" ? reserveOperation(undefined, encoder.encode(value).byteLength) : null
-  try {
-    if (typeof value !== "string" || value.length > MAX_PATTERN_TEXT) return null
-    const bytes = encoder.encode(value)
-    if (bytes.byteLength > MAX_PATTERN_TEXT * 3) return null
-    const encoded = Array.from(bytes, (byte) => {
-    const character = String.fromCharCode(byte)
-    return /[A-Za-z0-9\-_.!~*'()]/u.test(character) ? character : `%${byte.toString(16).padStart(2, "0")}`
-    }).join("")
-    const percentUpper = encoded.replace(/%[0-9a-f]{2}/g, (part) => part.toUpperCase())
-    const padded = base64(bytes)
-    const url = padded.replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "")
-    const doubleQuoted = `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\n", "\\n").replaceAll("\r", "\\r").replaceAll("\t", "\\t")}"`
-    const singleQuoted = `'${value}'`
-    const dotenv = [doubleQuoted, singleQuoted]
-    if (/^[^\s#'"\\\r\n]+$/u.test(value)) dotenv.push(value)
-    const result = {
-      semantic: value,
-      dotenv,
-      json: JSON.stringify(value).slice(1, -1),
-      percent: [encoded, percentUpper],
-      base64: [padded, padded.replace(/=+$/u, ""), url],
-    }
-    return result.dotenv.length + result.percent.length + result.base64.length > MAX_REPRESENTATIONS ? null : result
-  } catch {
-    return null
-  } finally { reservation?.release() }
-}
-
-export function patternRepresentations(pattern: Pattern): string[] | null {
-  const reservation = reserveOperation([pattern], 0)
-  try {
-    if (typeof pattern?.text !== "string") return null
-    const derived = representationsFor(pattern.text)
-    if (derived === null) return null
-    const result = [...new Set([pattern.text, ...derived.dotenv, derived.json, ...derived.percent, ...derived.base64])]
-    return result.length > MAX_REPRESENTATIONS ? null : result
-  } catch {
-    return null
-  } finally { reservation?.release() }
-}
-
-const encoder = new TextEncoder()
-const REDACTION = "[REDACTED]"
-const UUID_TEMPLATE = [
-  ..."secret-",
-  ...Array.from({ length: 8 }, () => "h"), "-",
-  ...Array.from({ length: 4 }, () => "h"), "-", "4", ...Array.from({ length: 3 }, () => "h"), "-",
-  "v", ...Array.from({ length: 3 }, () => "h"), "-", ...Array.from({ length: 12 }, () => "h"),
-]
-
-function uuidLanguageContains(value: string): boolean {
-  if (value.length === 0 || value.length > UUID_TEMPLATE.length) return false
-  const hex = /^[0-9a-f]$/i
-  for (let start = 0; start <= UUID_TEMPLATE.length - value.length; start++) {
-    let fits = true
-    for (let i = 0; i < value.length; i++) {
-      const slot = UUID_TEMPLATE[start + i]
-      const character = value[i]
-      const slotMatches = slot === "h" ? hex.test(character ?? "") : slot === "v" ? /^[89ab]$/i.test(character ?? "") : slot === character
-      if (slot === undefined || character === undefined || !slotMatches) {
-        fits = false
-        break
-      }
-    }
-    if (fits) return true
-  }
-  return false
-}
-
-export interface AdmissionResult {
-  readonly ok: boolean
-  readonly code?: "SANITIZATION_UNAVAILABLE"
-}
-
-/** Admission is deliberately all-or-nothing and emits only a fixed safe failure. */
-export function admitPatterns(patterns: readonly Pattern[]): AdmissionResult {
-  const reservation = reserveOperation(patterns, 0)
-  if (reservation === null) return { ok: false, code: "SANITIZATION_UNAVAILABLE" }
-  try {
-  for (const pattern of patterns) {
-    if (pattern === null || typeof pattern !== "object" || Array.isArray(pattern)) return { ok: false, code: "SANITIZATION_UNAVAILABLE" }
-    const prototype = Object.getPrototypeOf(pattern)
-    if (prototype !== Object.prototype && prototype !== null) return { ok: false, code: "SANITIZATION_UNAVAILABLE" }
-    const names = Object.getOwnPropertyNames(pattern)
-    if (Object.getOwnPropertySymbols(pattern).length !== 0 || names.some((name) => !["text", "replacement", "entry", "representations"].includes(name))) return { ok: false, code: "SANITIZATION_UNAVAILABLE" }
-    for (const name of names) {
-      const descriptor = Object.getOwnPropertyDescriptor(pattern, name)
-      if (descriptor === undefined || !("value" in descriptor)) return { ok: false, code: "SANITIZATION_UNAVAILABLE" }
-    }
-    const representations = patternRepresentations(pattern)
-    if (representations === null) return { ok: false, code: "SANITIZATION_UNAVAILABLE" }
-    for (const representation of representations) {
-      if (representation.length === 0 || uuidLanguageContains(representation) || RESERVED_OUTPUT_INVENTORY.some((item) => item.includes(representation))) {
-        return { ok: false, code: "SANITIZATION_UNAVAILABLE" }
-      }
-    }
-  }
-  return { ok: true }
-  } catch { return { ok: false, code: "SANITIZATION_UNAVAILABLE" } } finally { reservation.release() }
-}
-
-function normalizedBudget(budget: Budget): Required<Budget> | null {
-  try {
-    if (budget === null || typeof budget !== "object" || Array.isArray(budget)) return null
-    const prototype = Object.getPrototypeOf(budget)
-    if (prototype !== Object.prototype && prototype !== null) return null
-    const names = Object.getOwnPropertyNames(budget)
-    if (Object.getOwnPropertySymbols(budget).length !== 0 || names.some((name) => !["maxOutputBytes", "maxDepth", "maxNodes", "maxMatches"].includes(name))) return null
-    const data: Record<string, unknown> = {}
-    for (const name of names) {
-      const descriptor = Object.getOwnPropertyDescriptor(budget, name)
-      if (descriptor === undefined || !("value" in descriptor)) return null
-      data[name] = descriptor.value
-    }
-    const values = {
-      maxOutputBytes: (data.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES) as number,
-      maxDepth: (data.maxDepth ?? DEFAULT_MAX_DEPTH) as number,
-      maxNodes: (data.maxNodes ?? DEFAULT_MAX_NODES) as number,
-      maxMatches: (data.maxMatches ?? DEFAULT_MAX_MATCHES) as number,
-    }
-    const valid =
-      typeof values.maxOutputBytes === "number" && Number.isSafeInteger(values.maxOutputBytes) && values.maxOutputBytes >= 0 && values.maxOutputBytes <= MAX_OUTPUT_BYTES &&
-      typeof values.maxDepth === "number" && Number.isSafeInteger(values.maxDepth) && values.maxDepth >= 0 && values.maxDepth <= MAX_DEPTH &&
-      typeof values.maxNodes === "number" && Number.isSafeInteger(values.maxNodes) && values.maxNodes >= 0 && values.maxNodes <= MAX_NODES &&
-      typeof values.maxMatches === "number" && Number.isSafeInteger(values.maxMatches) && values.maxMatches >= 0 && values.maxMatches <= MAX_MATCHES
-    return valid ? values as Required<Budget> : null
-  } catch { return null }
-}
-
-function collectIntervalsBounded(input: string, patterns: readonly (Pattern | string)[], budget: Required<Budget>): Interval[] | null {
-  if (typeof input !== "string" || !Array.isArray(patterns) || patterns.length > MAX_PATTERN_COUNT) return null
-  const found: Array<{ start: number; end: number; pattern: string }> = []
-  let matchCount = 0
-  for (const item of patterns) {
-    const texts = typeof item === "string" ? [item] : patternRepresentations(item)
-    if (texts === null) return null
-    for (const text of texts) {
-      if (text.length === 0) continue
-      let at = input.indexOf(text)
-      while (at !== -1) {
-        matchCount++
-        if (matchCount > budget.maxMatches) return null
-        found.push({ start: at, end: at + text.length, pattern: text })
-        at = input.indexOf(text, at + 1)
-      }
-    }
-  }
-  found.sort((a, b) => a.start - b.start || a.end - b.end)
-  const result: Interval[] = []
-  for (const match of found) {
-    const previous = result[result.length - 1]
-    if (previous !== undefined && match.start <= previous.end) {
-      previous.end = Math.max(previous.end, match.end)
-      if (!previous.patterns.includes(match.pattern)) previous.patterns.push(match.pattern)
-    } else {
-      result.push({ start: match.start, end: match.end, patterns: [match.pattern] })
-    }
-  }
-  return result
-}
-
-export function collectIntervals(input: string, patterns: readonly (Pattern | string)[], budget: Budget = {}): Interval[] {
-  const reservation = typeof input === "string" ? reserveOperation(patterns, encoder.encode(input).byteLength) : null
-  if (reservation === null) return []
-  try {
-    if (typeof input !== "string") return []
-    const normalized = normalizedBudget(budget)
-    return normalized === null ? [] : (collectIntervalsBounded(input, patterns, normalized) ?? [])
-  } catch { return [] } finally { reservation.release() }
-}
-
-function withinBytes(value: string, budget: Required<Budget>): boolean {
-  return encoder.encode(value).byteLength <= budget.maxOutputBytes
-}
-
-function bytes(value: string): number {
-  return encoder.encode(value).byteLength
-}
-
-/** One-pass replacement followed by a final boundary scan; null means safely withheld. */
-export function sanitizeText(input: string, patterns: readonly Pattern[], budget: Budget = {}): string | null {
-  const reservation = typeof input === "string" ? reserveOperation(patterns, encoder.encode(input).byteLength) : null
-  if (reservation === null) return null
-  try {
-  if (typeof input !== "string") return null
-  const normalized = normalizedBudget(budget)
-  if (normalized === null || !withinBytes(input, normalized)) return null
-  const intervals = collectIntervalsBounded(input, patterns, normalized)
-  if (intervals === null) return null
-  let output = ""
-  let cursor = 0
-  for (const interval of intervals) {
-    const prefix = input.slice(cursor, interval.start)
-    const matches = patterns.filter((pattern) => {
-      const representations = patternRepresentations(pattern)
-      return representations !== null && representations.some((text) => interval.patterns.includes(text))
-    })
-    const entries = new Set(matches.map((pattern) => pattern.entry ?? pattern.text))
-    const replacement = entries.size === 1 && matches[0]?.replacement !== undefined ? matches[0].replacement : REDACTION
-    if (bytes(output) + bytes(prefix) + bytes(replacement) > normalized.maxOutputBytes) return null
-    const next = output + prefix + replacement
-    if (!withinBytes(next, normalized)) return null
-    output = next
-    cursor = interval.end
-  }
-  const suffix = input.slice(cursor)
-  if (bytes(output) + bytes(suffix) > normalized.maxOutputBytes) return null
-  const final = output + suffix
-  if (!withinBytes(final, normalized) || collectIntervalsBounded(final, patterns, normalized)?.length !== 0) return null
-  return final
-  } catch { return null } finally { reservation.release() }
-}
-
-export type SecretScan = "clean" | "match" | "unverifiable"
-
-/**
- * Bounded containment scan that materializes no output: `"clean"` means every
- * representation was verified absent, `"match"` means at least one occurrence
- * exists (including when the match budget is exhausted), and `"unverifiable"`
- * means the scan could not run to completion (oversize input, unadmitted
- * patterns, exhausted reservations). Fail-closed callers must treat
- * `"unverifiable"` exactly like `"match"`.
- */
-export function scanForSecrets(input: string, patterns: readonly Pattern[], budget: Budget = {}): SecretScan {
-  try {
-    // UTF-8 bytes are always >= UTF-16 units; bound the encoding work first.
-    if (typeof input !== "string" || input.length > MAX_TEMP_BYTES) return "unverifiable"
-    const reservation = reserveOperation(patterns, encoder.encode(input).byteLength)
-    if (reservation === null) return "unverifiable"
-    try {
-      const normalized = normalizedBudget(budget)
-      if (normalized === null || !Array.isArray(patterns) || patterns.length > MAX_PATTERN_COUNT) return "unverifiable"
-      for (const item of patterns) {
-        const texts = patternRepresentations(item as Pattern)
-        if (texts === null) return "unverifiable"
-        for (const text of texts) {
-          // One occurrence decides the verdict; no matches are accumulated.
-          if (text.length > 0 && input.indexOf(text) !== -1) return "match"
-        }
-      }
-      return "clean"
-    } finally {
-      reservation.release()
-    }
-  } catch {
-    return "unverifiable"
-  }
-}
-
-/**
- * Largest input (bytes) a scan can verify for this pattern set: the operation
- * ceiling (`MAX_TEMP_BYTES`) minus the admitted pattern bytes. Invalid pattern
- * sets collapse to 0 so every non-empty body is withheld rather than passed.
- */
-export function verifyCeilingBytes(patterns: readonly Pattern[]): number {
-  try {
-    if (!Array.isArray(patterns)) return 0
-    let patternBytes = 0
-    for (const item of patterns) {
-      if (item === null || typeof item !== "object" || typeof (item as Pattern).text !== "string") return 0
-      patternBytes += encoder.encode((item as Pattern).text).byteLength
-      if (patternBytes > MAX_PATTERN_BYTES) return 0
-    }
-    return MAX_TEMP_BYTES - patternBytes
-  } catch {
-    return 0
-  }
-}
-
-export interface TextSink { readonly content: readonly [{ readonly type: "text"; readonly text: string }] }
-
-export function canonicalTextSink(parts: readonly string[], patterns: readonly Pattern[], budget: Budget = {}): TextSink | null {
-  let reservation: Reservation | null = null
-  try {
-    if (!Array.isArray(parts)) return null
-    let inputBytes = 0
-    for (const part of parts) {
-      if (typeof part !== "string") return null
-      inputBytes += encoder.encode(part).byteLength
-    }
-    reservation = reserveOperation(patterns, inputBytes)
-    if (reservation === null) return null
-    const normalized = normalizedBudget(budget)
-    if (normalized === null) return null
-    let joined = ""
-    for (let i = 0; i < parts.length; i++) {
-      const part = parts[i]
-      if (typeof part !== "string") return null
-      const separatorBytes = i > 0 ? bytes("\n") : 0
-      if (bytes(joined) + separatorBytes + bytes(part) > normalized.maxOutputBytes) return null
-      if (i > 0) joined += "\n"
-      joined += part
-    }
-    const text = sanitizeText(joined, patterns, budget)
-    return text === null ? null : { content: [{ type: "text", text }] }
-  } catch { return null } finally { reservation?.release() }
-}
-
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return false
-  const prototype = Object.getPrototypeOf(value)
-  return prototype === Object.prototype || prototype === null
-}
-
-/** Canonical JSON-like projection for plain data; accessors, arrays and non-finite numbers are withheld. */
-export function projectPlain(value: unknown, patterns: readonly Pattern[], budget: Budget = {}): string | null {
-  const reservation = reserveOperation(patterns, 0)
-  if (reservation === null) return null
-  try {
-  const normalized = normalizedBudget(budget)
-  if (normalized === null) return null
-  let nodes = 0
-  const active = new Set<object>()
-  const visit = (current: unknown, depth: number): string | null => {
-    nodes++
-    if (nodes > normalized.maxNodes || depth > normalized.maxDepth) return null
-    if (current === null) return "null"
-    if (typeof current === "string") {
-      const safe = sanitizeText(current, patterns, normalized)
-      return safe === null ? null : JSON.stringify(safe)
-    }
-    if (typeof current === "boolean") return current ? "true" : "false"
-    if (typeof current === "number") return Number.isFinite(current) ? String(current) : null
-    if (!isPlainObject(current)) return null
-    if (active.has(current)) return null
-    active.add(current)
-    const keys: string[] = []
-    // Do not materialize/sort an unbounded own-key array. The extra key is a
-    // bounded rejection probe; maxNodes also bounds the useful key set.
-    for (const key in current) {
-      if (!Object.prototype.propertyIsEnumerable.call(current, key)) continue
-      keys.push(key)
-      if (keys.length > normalized.maxNodes || keys.length > MAX_OBJECT_KEYS) return null
-    }
-    keys.sort()
-    const chunks: string[] = ["{"]
-    for (let i = 0; i < keys.length; i++) {
-      const key = keys[i]
-      if (key === undefined || collectIntervalsBounded(key, patterns, normalized)?.length !== 0) return null
-      const descriptor = Object.getOwnPropertyDescriptor(current, key)
-      if (descriptor === undefined || !("value" in descriptor)) return null
-      const child = visit(descriptor.value, depth + 1)
-      if (child === null) return null
-      if (i > 0) chunks.push(",")
-      chunks.push(JSON.stringify(key), ":", child)
-      if (!withinBytes(chunks.join(""), normalized)) return null
-    }
-    chunks.push("}")
-    const result = chunks.join("")
-    active.delete(current)
-    return withinBytes(result, normalized) ? result : null
-  }
-  const result = visit(value, 0)
-  if (result === null || collectIntervalsBounded(result, patterns, normalized)?.length !== 0 || !withinBytes(result, normalized)) return null
-  return result
-  } catch { return null } finally { reservation.release() }
-}

package/src/sources/README.md

@@ -1,5 +0,0 @@
-# Placeholder: sources
-
-Non-executing dotenv loader plus the native opened-object adapter below.
-Expected failures reject the whole snapshot. Never use shell sourcing or dotenv
-expansion into `process.env`. No implementation yet.

package/src/sources/dotenv.ts

@@ -1,133 +0,0 @@
-import * as fs from "node:fs"
-import * as path from "node:path"
-import * as os from "node:os"
-
-export type DotenvEntry = Readonly<{ key: string; value: string; lexicalValue: string }>
-export type DotenvSnapshot = Readonly<{ entries: readonly DotenvEntry[]; bytes: number }>
-export class SourceParseError extends Error { readonly code = "SOURCE_INVALID"; constructor() { super("SOURCE_INVALID"); this.name = "SourceParseError" } }
-
-export function parseDotenv(source: string, options: { maxBytes?: number; maxEntries?: number; maxValueBytes?: number } = {}): DotenvSnapshot {
-  try {
-    const limits = normalizeOptions(options)
-    if (typeof source !== "string") throw new SourceParseError()
-    const bytes = Buffer.byteLength(source, "utf8")
-    if (bytes > limits.maxBytes) throw new SourceParseError()
-    const entries: DotenvEntry[] = []; const names = new Set<string>(); let index = 0
-    while (index < source.length) {
-      const lineStart = index; const end = source.indexOf("\n", index); const lineEnd = end < 0 ? source.length : end; let line = source.slice(index, lineEnd)
-      if (line.endsWith("\r")) line = line.slice(0, -1); index = end < 0 ? source.length : end + 1
-      const trimmed = line.trim(); if (trimmed === "" || trimmed.startsWith("#")) continue
-      const assignment = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*/.exec(line)
-      if (!assignment) throw new SourceParseError()
-      const key = assignment[1] as string; if (names.has(key)) throw new SourceParseError(); names.add(key)
-      let rest = line.slice(assignment[0].length); let lexical = rest; let value: string
-      if (rest.startsWith("'") || rest.startsWith('"')) {
-        const quote = rest[0] as string; let content = rest.slice(1); let close = quotedClose(content, quote)
-        while (close < 0) { if (index >= source.length) throw new SourceParseError(); const nextEnd = source.indexOf("\n", index); const nextLineEnd = nextEnd < 0 ? source.length : nextEnd; let next = source.slice(index, nextLineEnd); if (next.endsWith("\r")) next = next.slice(0, -1); content += "\n" + next; index = nextEnd < 0 ? source.length : nextEnd + 1; close = quotedClose(content, quote) }
-        const body = content.slice(0, close); const after = content.slice(close + 1).trim(); if (after !== "" && !after.startsWith("#")) throw new SourceParseError()
-        value = quote === '"' ? decodeDouble(body) : body; lexical = quote + body + quote
-      } else { const comment = rest.indexOf("#"); if (comment >= 0) rest = rest.slice(0, comment); value = rest.trimEnd(); lexical = value }
-      if (Buffer.byteLength(value, "utf8") > limits.maxValueBytes || entries.length >= limits.maxEntries) throw new SourceParseError()
-      entries.push(Object.freeze({ key, value, lexicalValue: lexical }))
-      void lineStart
-    }
-    return Object.freeze({ entries: Object.freeze(entries), bytes })
-  } catch (error) { if (error instanceof SourceParseError) throw error; throw new SourceParseError() }
-}
-
-function normalizeOptions(options: unknown): { maxBytes: number; maxEntries: number; maxValueBytes: number } {
-  if (options === null || typeof options !== "object" || Array.isArray(options)) throw new SourceParseError()
-  const prototype = Object.getPrototypeOf(options)
-  if (prototype !== Object.prototype && prototype !== null) throw new SourceParseError()
-  const names = Object.getOwnPropertyNames(options)
-  if (Object.getOwnPropertySymbols(options).length !== 0 || names.some(name => !["maxBytes", "maxEntries", "maxValueBytes"].includes(name))) throw new SourceParseError()
-  const values: Record<string, unknown> = {}
-  for (const name of names) {
-    const descriptor = Object.getOwnPropertyDescriptor(options, name)
-    if (!descriptor || !("value" in descriptor)) throw new SourceParseError()
-    values[name] = descriptor.value
-  }
-  const result: { maxBytes: number; maxEntries: number; maxValueBytes: number } = {
-    maxBytes: values.maxBytes === undefined ? 1_048_576 : values.maxBytes as number,
-    maxEntries: values.maxEntries === undefined ? 1_000 : values.maxEntries as number,
-    maxValueBytes: values.maxValueBytes === undefined ? 16_384 : values.maxValueBytes as number,
-  }
-  if (![result.maxBytes, result.maxEntries, result.maxValueBytes].every(value => typeof value === "number" && Number.isSafeInteger(value) && value > 0)) throw new SourceParseError()
-  return result
-}
-
-function decodeDouble(value: string): string {
-  return value.replace(/\\([\\"nrt])/g, (_match, escaped: string) => ({ "\\": "\\", '"': '"', n: "\n", r: "\r", t: "\t" })[escaped] ?? escaped)
-}
-
-function quotedClose(value: string, quote: string): number {
-  for (let i = 0; i < value.length; i++) {
-    if (value[i] === quote) return i
-    if (value[i] !== "\\") continue
-    const escaped = value[++i]
-    if (escaped === undefined) throw new SourceParseError()
-    const valid = quote === '"' ? '\\"nrt'.includes(escaped) : escaped === quote || escaped === "\\"
-    if (!valid) throw new SourceParseError()
-  }
-  return -1
-}
-
-/** Load a dotenv file from the filesystem, returning a parsed snapshot.
- *
- * Fail-closed: returns `SourceParseError` if the path is inaccessible, the
- * file cannot be read, the content is not a valid dotnet snapshot, or the
- * options violate limits.  No external state or credentials are exposed in
- * error messages.
- *
- * The caller is responsible for ensuring the path is authorized; this function
- * does not perform ACL checks itself and assumes the caller has permission to
- * read the nominated location.
- */
-export function loadDotenvFile(
-  filePath: string,
-  options: { maxBytes?: number; maxEntries?: number; maxValueBytes?: number } = {}
-): DotenvSnapshot {
-  try {
-    const resolved = path.resolve(filePath)
-    const stat = fs.lstatSync(resolved)
-    if (!stat.isFile() || stat.isSymbolicLink()) throw new SourceParseError()
-    const noFollow = (fs.constants as { O_NOFOLLOW?: number }).O_NOFOLLOW ?? 0
-    const descriptor = fs.openSync(resolved, fs.constants.O_RDONLY | noFollow)
-    try {
-      const opened = fs.fstatSync(descriptor)
-      if (!opened.isFile()) throw new SourceParseError()
-      const raw = fs.readFileSync(descriptor, "utf8")
-      return parseDotenv(raw, options)
-    } finally {
-      fs.closeSync(descriptor)
-    }
-  } catch (e) {
-    throw new SourceParseError()
-  }
-}
-
-/** Load dotenv from the process's resolved configuration directory.
- *
- * Attempts `~/.opencode-dotenv/.env`, `~/.env`, and `./.env` in order, returning
- * the first successfully parsed snapshot.  Returns `SourceParseError` if no
- * file is found or any file is unparseable.
- */
-export function loadDefaultDotenv(
-  options: { maxBytes?: number; maxEntries?: number; maxValueBytes?: number } = {}
-): DotenvSnapshot | SourceParseError {
-  const home = os.homedir()
-  const candidates: string[] = [
-    path.resolve(home, ".opencode-dotenv", ".env"),
-    path.resolve(home, ".env"),
-    path.resolve(process.cwd(), ".env"),
-  ]
-  for (const p of candidates) {
-    try {
-      const raw = fs.readFileSync(p, "utf8")
-      return parseDotenv(raw, options)
-    } catch { /* try next candidate */ }
-  }
-  return new SourceParseError()
-}
-
-export default { parseDotenv, loadDotenvFile, loadDefaultDotenv }

package/src/sources/native/README.md

@@ -1,5 +0,0 @@
-# Placeholder: native source opening
-
-P0 must prove descriptor/handle-relative opening and ACL/ancestor checks on
-Linux/ext4 and Windows/NTFS before choosing a native dependency. Unsupported
-platforms remain unsupported; no insecure path-based fallback.

package/src/store/index.ts

@@ -1,64 +0,0 @@
-import { randomBytes as systemRandomBytes } from "node:crypto"
-import { BudgetLedger, type BudgetValues } from "../budgets/index.ts"
-
-export interface StoreOptions {
-  readonly location: { readonly directory: string }
-  readonly generation: number
-  readonly randomBytes?: () => Uint8Array
-  readonly budget?: BudgetLedger
-}
-
-type Reservation = { dispose(): void }
-
-/** Private in-memory value → opaque-handle map. It has no authorization or I/O behavior. */
-export class ActivationStore {
-  private readonly entries = new Map<string, Reservation>()
-  private readonly redactions = new Map<string, string>()
-  private readonly budget: BudgetLedger
-  private readonly random: () => Uint8Array
-  private active = true
-
-  constructor(options: StoreOptions) {
-    if (!options || typeof options.location?.directory !== "string" || !Number.isInteger(options.generation) || options.generation < 0) throw new Error("invalid")
-    this.budget = options.budget ?? new BudgetLedger({ activeSessions: 1, handles: 65_536, handlesPerSession: 1, secretCount: 65_536, secretBytes: 128 * 1024 * 1024, indexBytes: 128 * 1024 * 1024, workingBytes: 128 * 1024 * 1024 })
-    this.random = options.randomBytes ?? (() => new Uint8Array(systemRandomBytes(16)))
-  }
-
-  register(value: string): string {
-    if (!this.active || typeof value !== "string" || value.length === 0) throw new Error("denied")
-    const existing = this.redactions.get(value)
-    if (existing !== undefined) return existing
-    const reservation = this.reserve({ handles: 1, secretCount: 1, secretBytes: Buffer.byteLength(value), indexBytes: Buffer.byteLength(value), workingBytes: Buffer.byteLength(value) })
-    if (reservation === undefined) throw new Error("denied")
-    const handle = this.newHandle()
-    this.entries.set(handle, reservation)
-    this.redactions.set(value, handle)
-    return handle
-  }
-
-  teardown(): void {
-    this.active = false
-    for (const reservation of this.entries.values()) reservation.dispose()
-    this.entries.clear()
-    this.redactions.clear()
-  }
-
-  private reserve(request: BudgetValues): Reservation | undefined {
-    const result = this.budget.reserve(request)
-    return result.ok ? result.value : undefined
-  }
-
-  private newHandle(): string {
-    for (let attempt = 0; attempt < 32; attempt += 1) {
-      const bytes = this.random()
-      if (!(bytes instanceof Uint8Array) || bytes.length !== 16) throw new Error("denied")
-      const copy = new Uint8Array(bytes)
-      copy[6] = (copy[6]! & 0x0f) | 0x40
-      copy[8] = (copy[8]! & 0x3f) | 0x80
-      const hex = Buffer.from(copy).toString("hex")
-      const handle = `secret-${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
-      if (!this.entries.has(handle)) return handle
-    }
-    throw new Error("denied")
-  }
-}