opencode-secrets-obfuscation 0.1.1 → 0.1.3

package/README.md

@@ -1 +1,21 @@
-# opencode-secrets-obfuscation\n\nTransparent OpenCode V2 secret substitution. The plugin loads explicitly configured dotenv values privately and substitutes opaque secret-<uuid> handles through existing OpenCode hooks. It does not register model-visible tools or make plugin-owned network requests.\n\nInstall with: opencode plugin add opencode-secrets-obfuscation@0.1.1\nConfigure the published package in opencode.jsonc with the options documented at https://github.com/jfomhover/opencode-secrets-obfuscation/blob/main/INSTALL.md.\n
+# opencode-secrets-obfuscation
+
+> **Experimental software — use at your own risk.** This plugin is provided as-is, without guarantees of security, correctness, or suitability for production use. Review the code and test it in an isolated environment before trusting it with real credentials. A bug or misconfiguration could expose secrets.
+
+## Why use it?
+
+OpenCode agents and their tools may need credentials, but raw secrets should not appear in model-visible prompts, conversation history, tool results, or logs.
+
+This plugin keeps configured dotenv values private and substitutes opaque secret-<uuid> handles across existing OpenCode session, model, HTTP, and tool surfaces. It does not register model-visible tools and does not make credential or other plugin-owned network requests.
+
+## Installation
+
+Install with: opencode plugin add opencode-secrets-obfuscation@0.1.3
+
+Configure the published package in opencode.jsonc with the options documented at https://github.com/jfomhhover/opencode-secrets-obfuscation/blob/main/INSTALL.md.
+
+## Important limitations
+
+- Experimental OpenCode V2 plugin; no production security guarantees.
+- An authorized tool or process may still exfiltrate a credential it receives.
+- Use synthetic credentials first and review the code for your environment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-secrets-obfuscation",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Transparent OpenCode V2 secret substitution plugin",
   "license": "MIT",
   "repository": {

package/plugin.mjs

@@ -2726,12 +2726,20 @@ var ceilings = {
   outputBytes: 2097152,
   traversalDepth: 32,
   traversalNodes: 5e4,
-  activeSessions: 8,
-  handlesPerSession: 2048,
-  activeCalls: 4,
-  workingBytes: 33554432,
-  callTimeoutMs: 3e4,
-  idleTimeoutMs: 5e3
+  workingBytes: 33554432
+};
+var DEFAULT_LIMITS = {
+  sourceBytes: 65536,
+  totalSourceBytes: 131072,
+  sourceCount: 2,
+  secretCount: 50,
+  secretBytes: 4096,
+  indexBytes: 1048576,
+  inputBytes: 32768,
+  outputBytes: 65536,
+  traversalDepth: 8,
+  traversalNodes: 1e3,
+  workingBytes: 1048576
 };
 var keys = (value, allowed, path3) => {
   for (const key of Object.keys(value)) if (!allowed.includes(key)) throw new OptionsError(`${path3}.${key}`);
@@ -2772,7 +2780,7 @@ function parseOptionsUnsafe(input) {
     return { id: string(source.id, `sources[${i}].id`, /^[A-Za-z][A-Za-z0-9._-]*$/), type: "file", format: "dotenv", path: path3, required: source.required, keys: sourceKeys };
   });
   if (sources.length === 0 || sources.length > ceilings.sourceCount || new Set(sources.map((s) => s.id)).size !== sources.length) throw new OptionsError("sources");
-  const configuredLimits = checked(options2.limits, "options.limits", seen);
+  const configuredLimits = checked(options2.limits === void 0 ? DEFAULT_LIMITS : options2.limits, "options.limits", seen);
   keys(configuredLimits, Object.keys(ceilings), "limits");
   const limits = {};
   for (const key of Object.keys(ceilings)) {
@@ -2801,7 +2809,7 @@ import * as path2 from "node:path";
 import { randomBytes as systemRandomBytes } from "node:crypto";
 
 // src/budgets/index.ts
-var dimensions = /* @__PURE__ */ new Set(["sourceCount", "sourceBytes", "totalSourceBytes", "secretCount", "secretBytes", "indexBytes", "inputBytes", "outputBytes", "traversalDepth", "traversalNodes", "activeSessions", "handlesPerSession", "activeCalls", "workingBytes", "calls", "nodes", "depth", "sessions", "handles"]);
+var dimensions = /* @__PURE__ */ new Set(["sourceCount", "sourceBytes", "totalSourceBytes", "secretCount", "secretBytes", "indexBytes", "inputBytes", "outputBytes", "traversalDepth", "traversalNodes", "workingBytes", "calls", "nodes", "depth", "sessions", "handles"]);
 var BudgetLedger = class {
   used = /* @__PURE__ */ new Map();
   limits;
@@ -2863,7 +2871,7 @@ var ActivationStore = class {
   active = true;
   constructor(options2) {
     if (!options2 || typeof options2.location?.directory !== "string" || !Number.isInteger(options2.generation) || options2.generation < 0) throw new Error("invalid");
-    this.budget = options2.budget ?? new BudgetLedger({ activeSessions: 1, handles: 65536, handlesPerSession: 1, secretCount: 65536, secretBytes: 128 * 1024 * 1024, indexBytes: 128 * 1024 * 1024, workingBytes: 128 * 1024 * 1024 });
+    this.budget = options2.budget ?? new BudgetLedger({ handles: 65536, secretCount: 65536, secretBytes: 128 * 1024 * 1024, indexBytes: 128 * 1024 * 1024, workingBytes: 128 * 1024 * 1024 });
     this.random = options2.randomBytes ?? (() => new Uint8Array(systemRandomBytes(16)));
   }
   register(value) {
@@ -3506,6 +3514,7 @@ async function redactRequest(request, state) {
   request.headers.forEach((value, name) => {
     record[name] = value;
   });
+  const originalHeaders = { ...record };
   if (redactHeaders(record, state, { skipAuth: true, strict: true }) === "withheld") return "withheld";
   delete record["content-length"];
   let body;
@@ -3520,6 +3529,9 @@ async function redactRequest(request, state) {
       if (safe !== read.text) body = safe;
     }
   }
+  const headersChanged = Object.keys(record).length !== Object.keys(originalHeaders).length || Object.keys(record).some((name) => record[name] !== originalHeaders[name]);
+  if (body === void 0 && !headersChanged) return request;
+  if (body !== void 0) record["content-length"] = String(encoder2.encode(body).byteLength);
   try {
     return new Request(request, {
       headers: record,
@@ -3648,9 +3660,7 @@ var realRuntimeFactory = (options2, location) => {
     }
   }
   const budget = new BudgetLedger({
-    activeSessions: options2.limits.activeSessions,
     handles: options2.limits.secretCount,
-    handlesPerSession: options2.limits.handlesPerSession,
     secretCount: options2.limits.secretCount,
     secretBytes: options2.limits.secretBytes,
     indexBytes: options2.limits.indexBytes,