opencode-self-improvement 0.8.7 → 0.8.8

package/README.md

@@ -50,6 +50,33 @@ LLMs waste a lot of tokens reading and re-reading your code and asking you for c
 - Automatically looks for insights when you complete the verification gates (tests, linting, etc)
 - Always defaults to memories first before sending a prompt to the LLM, which saves tokens! 
 
+## Secret redaction
+
+`src/secrets.ts` provides one best-effort credential rule set. It runs over the
+auto-capture prompt before that prompt leaves the plugin, at the write gate
+before content is hashed or analysed, and again in `appendMemory`, the final
+write choke point used by gated writes and the viewer's edit/restore-entry
+paths. Credential-shaped values in memory content become `[redacted]`.
+Credential-shaped `scope`, `tags`, or `issue` metadata is rejected instead of
+being silently rewritten.
+
+The rules cover OpenAI `sk-` tokens; GitHub `ghp_`, `gho_`, and `github_pat_`
+tokens; Slack `xoxb-` and `xoxp-` tokens; AWS `AKIA` access-key IDs; Google
+`AIza` API keys; bearer tokens containing digits; PEM private-key blocks; and
+high-entropy values assigned to names ending in `_KEY`, `_TOKEN`, `_SECRET`,
+or `_PASSWORD` (plus `password`). This is deliberately best-effort, not a
+guarantee: it can miss hex-only secrets, passwords with few character classes,
+and credentials written in prose without an assignment.
+
+`memory_remember` still replies `Remembered` when content was redacted, so the
+stored text can differ from what was sent. Redaction is forward-only: existing
+stores are not scrubbed, and `memory_export` writes whatever is already stored
+verbatim. See [issue #74](https://github.com/abogartz/opencode-self-improvement/issues/74)
+for the separate existing-store work.
+
+Auto-capture is off by default, so capture-prompt redaction protects opt-in
+installs. The write-gate and `appendMemory` checks apply to every install.
+
 ## Token cost, on purpose
 
 Memory plugins have a reputation for burning tokens and busting the provider's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {

package/src/capture.ts

@@ -8,6 +8,7 @@
 // never a throw.
 import { STATUSES, TYPES } from "./types.ts";
 import { flattenMemoryText } from "./sanitize.ts";
+import { redactSecrets } from "./secrets.ts";
 
 export interface CaptureOptions {
   model: string; // "provider/id"
@@ -46,7 +47,7 @@ export function buildCapturePrompt(transcript: string, max = 3): string {
     "- If nothing is worth remembering, output [ ].",
     "",
     "Transcript:",
-    transcript,
+    redactSecrets(transcript),
   ].join("\n");
 }
 
@@ -152,15 +153,23 @@ export function flattenTranscript(msgs: unknown): string {
       const role =
         typeof info?.role === "string" ? info.role : typeof m.role === "string" ? m.role : "";
       let text = "";
+      let hadPrivatePart = false;
       if (Array.isArray(m.parts)) {
         text = m.parts
-          .map((p) =>
-            p && typeof p === "object" ? (p as Record<string, unknown>).text : undefined,
-          )
+          .map((p) => {
+            if (!p || typeof p !== "object") return undefined;
+            const part = p as Record<string, unknown>;
+            const partType = typeof part.type === "string" ? part.type.toLowerCase() : "";
+            if (partType === "reasoning" || partType === "thinking") {
+              hadPrivatePart = true;
+              return undefined;
+            }
+            return part.text;
+          })
           .filter((t): t is string => typeof t === "string" && t.length > 0)
           .join(" ");
       }
-      if (!text) {
+      if (!text && !hadPrivatePart) {
         for (const k of ["text", "content"]) {
           if (typeof m[k] === "string") {
             text = m[k] as string;

package/src/gates.ts

@@ -15,6 +15,7 @@ import {
 } from "./memory.ts";
 import { chainId, contentHash, record, recordWriteBlocked } from "./evidence.ts";
 import { flattenMemoryText } from "./sanitize.ts";
+import { containsSecret, redactSecrets } from "./secrets.ts";
 import {
   displayCall,
   extractCallForms,
@@ -251,6 +252,34 @@ export async function runWriteGate(
     };
   }
 
+  const credentialMetadata = [
+    containsSecret(candidate.scope) ? "scope" : undefined,
+    candidate.tags?.some(containsSecret) ? "tags" : undefined,
+    containsSecret(candidate.issue) ? "issue" : undefined,
+  ].filter((field): field is string => field !== undefined);
+  if (credentialMetadata.length) {
+    await recordWriteBlocked(
+      4,
+      "credential_in_metadata",
+      credentialMetadata.map((field) => `field=${field}`),
+      chain,
+    );
+    return {
+      action: "blocked",
+      reason: "credential_in_metadata",
+      chain,
+      hint: `Credential-shaped value in ${credentialMetadata.join(", ")}; remove it and retry. Only memory content is redacted automatically.`,
+    };
+  }
+
+  // This is the common boundary for manual, imported and auto-captured writes.
+  // Scrub content before hashing, analysis and persistence. Metadata is
+  // rejected above rather than silently changing where a row can be found.
+  candidate = {
+    ...candidate,
+    content: redactSecrets(candidate.content),
+  };
+
   const ch = contentHash(candidate.content);
   await record("gate_start", {
     chain,

package/src/index.ts

@@ -66,6 +66,7 @@ import { getCurrent, setCurrent } from "./state.ts";
 import { resolveRepo, setRepoScope, rememberSessionDir, sessionDir } from "./repokey.ts";
 import { readLines } from "./logfmt.ts";
 import { buildCapturePrompt, flattenTranscript, parseCandidates, parseModelRef } from "./capture.ts";
+import { redactSecrets } from "./secrets.ts";
 import { flattenMemoryText } from "./sanitize.ts";
 
 // Tool/input boundaries are zod schemas (src/schema.ts): the JSON Schema the
@@ -939,7 +940,8 @@ const impl = {
                   );
                   await record(
                     `auto_capture_${outcome.action}`,
-                    { session: sid, type: c.type, scope: c.scope, reason: outcome.reason ?? "" },
+                    // A blocked credential-shaped scope must not reach the evidence log either.
+                    { session: sid, type: c.type, scope: redactSecrets(c.scope), reason: outcome.reason ?? "" },
                     false,
                   );
                 }

package/src/memory.ts

@@ -11,6 +11,7 @@ import { getCurrent } from "./state.ts";
 import { appendLog, ensureDir, formatLine, parseLine, readLines, writeAtomic, type Fields } from "./logfmt.ts";
 import { withStoreLock, LOCK_WRITE } from "./lock.ts";
 import { blockedTs } from "./blocklist.ts";
+import { containsSecret, redactSecrets } from "./secrets.ts";
 import { flattenMemoryText } from "./sanitize.ts";
 
 export type MemoryStatus = "open" | "settled";
@@ -159,11 +160,12 @@ async function existingTs(file: string): Promise<Set<string>> {
   return set;
 }
 
-// Append a durable memory. Only the gate's GATE-4 promotion step calls this.
+// Append a durable memory. GATE-4 promotions and the viewer's edit/restore-entry
+// paths all call this single write choke point.
 export async function appendMemory(input: AppendMemoryInput): Promise<string> {
   // Absolute floor: every write SHOULD arrive through the gate,
-  // which rejects oversized content politely; the viewer's restore/edit paths
-  // do not, so nothing oversized leaves this function either.
+  // which rejects invalid input politely; viewer writes do not, so enforce the
+  // same storage rules here before anything reaches disk.
   if (typeof input.content !== "string") throw new Error("memory content must be a string");
   if (input.content.length > MAX_CONTENT_CHARS) {
     throw new Error(`memory content exceeds ${MAX_CONTENT_CHARS} chars (${input.content.length})`);
@@ -180,11 +182,22 @@ export async function appendMemory(input: AppendMemoryInput): Promise<string> {
   if (input.tags?.some((tag) => flattenMemoryText(tag) !== tag)) {
     throw new Error("memory tags must not contain control characters");
   }
-  // Repo stamp at the single write choke point: gated writes, viewer restores
-  // and edits all pass through here. Explicit "global" survives; an unscoped
-  // process (viewer) stamps nothing = global. Session identity wins over the
-  // module scope so a server hosting several workspaces stamps the writing
-  // session's repo.
+  const credentialMetadata = [
+    containsSecret(input.scope) ? "scope" : undefined,
+    input.tags?.some(containsSecret) ? "tags" : undefined,
+    containsSecret(input.issue) ? "issue" : undefined,
+  ].filter((field): field is string => field !== undefined);
+  if (credentialMetadata.length) {
+    throw new Error(
+      `memory metadata contains credential-shaped value in: ${credentialMetadata.join(", ")}`,
+    );
+  }
+  const content = redactSecrets(input.content);
+  // Repo stamp at the single write choke point: gated writes plus viewer edits
+  // and restore-entry writes all pass through here. Explicit "global" survives;
+  // an unscoped process (viewer) stamps nothing = global. Session identity wins
+  // over the module scope so a server hosting several workspaces stamps the
+  // writing session's repo.
   let repo = input.repo;
   let repoPath = input.repoPath;
   if (repo === undefined) {
@@ -214,7 +227,7 @@ export async function appendMemory(input: AppendMemoryInput): Promise<string> {
         ts,
         type: input.type,
         scope: input.scope,
-        content: input.content,
+        content,
         issue: input.issue,
         tags: input.tags?.length ? input.tags.join(",") : undefined,
         status: input.status,

package/src/secrets.ts

@@ -0,0 +1,39 @@
+// Small, conservative credential scrubber shared by capture egress and the
+// write gate. Prefix patterns are intentionally limited to well-known token
+// families; generic values are redacted only when assigned to a credential-
+// named field and they look high-entropy, so ordinary identifiers survive.
+export const REDACTED_SECRET = "[redacted]";
+
+const PRIVATE_KEY_BLOCK =
+  /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----[\s\S]*?-----END(?: [A-Z0-9]+)* PRIVATE KEY-----/g;
+const PREFIXED_SECRET =
+  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[po]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[bp]-[A-Za-z0-9-]{16,}|AKIA[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{20,})\b/g;
+// A real bearer token has digits; prose like "Bearer authentication-scheme" doesn't.
+const BEARER_SECRET = /\bBearer\s+(?=[A-Za-z0-9._~+/=-]*\d)[A-Za-z0-9._~+/=-]{16,}/gi;
+const ASSIGNED_SECRET =
+  /(\b(?:[A-Za-z][A-Za-z0-9_]*(?:_KEY|_TOKEN|_SECRET|_PASSWORD)|password)\b["']?\s*(?::|=)\s*["']?)([A-Za-z0-9+/_=.-]{16,})/gi;
+// `API_KEY=process.env.OPENAI_API_KEY` names where the key lives; keep it.
+const DOTTED_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)+$/;
+
+function looksHighEntropy(value: string): boolean {
+  if (value.length < 16 || new Set(value).size < 10) return false;
+  if (!/[0-9]/.test(value) || DOTTED_IDENTIFIER.test(value)) return false;
+  const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter((re) =>
+    re.test(value),
+  ).length;
+  return classes >= 3;
+}
+
+export function redactSecrets(text: string): string {
+  if (!text) return text;
+  let out = text.replace(PRIVATE_KEY_BLOCK, REDACTED_SECRET);
+  out = out.replace(PREFIXED_SECRET, REDACTED_SECRET);
+  out = out.replace(BEARER_SECRET, REDACTED_SECRET);
+  return out.replace(ASSIGNED_SECRET, (match, prefix: string, value: string) =>
+    looksHighEntropy(value) ? `${prefix}${REDACTED_SECRET}` : match,
+  );
+}
+
+export function containsSecret(text: string | undefined): boolean {
+  return typeof text === "string" && redactSecrets(text) !== text;
+}