openplanr 1.13.2 → 1.14.0

package/dist/services/operate/read-only-providers.js

@@ -0,0 +1,286 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { parseStrictJson } from './evidence-import.js';
+import { minimalSubprocessEnvironment } from './subprocess-env.js';
+import { OperateError } from './types.js';
+const execFileAsync = promisify(execFile);
+const MAX_PROVIDER_OUTPUT = 5 * 1024 * 1024;
+const DEFAULT_REMOTE_TIMEOUT_MS = 20_000;
+const DEFAULT_REMOTE_MAX_BYTES = 5 * 1024 * 1024;
+function minimalEnvironment(extra = {}) {
+    return minimalSubprocessEnvironment(extra);
+}
+const GIT_READ_COMMANDS = new Set([
+    'diff',
+    'log',
+    'show',
+    'status',
+    'tag',
+    'rev-parse',
+    'ls-files',
+    'branch',
+]);
+export function assertGitReadOnlyArgs(args) {
+    const forbiddenRepositoryOverrides = [
+        '-C',
+        '-c',
+        '--git-dir',
+        '--work-tree',
+        '--namespace',
+        '--exec-path',
+        '--config-env',
+    ];
+    if (args.some((argument) => forbiddenRepositoryOverrides.some((option) => argument === option || argument.startsWith(`${option}=`)))) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Git repository and configuration overrides are forbidden for evidence.');
+    }
+    const command = args.find((argument) => !argument.startsWith('-'));
+    if (!command || !GIT_READ_COMMANDS.has(command)) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `Git operation is not allowlisted for evidence: ${command ?? '(missing)'}.`);
+    }
+    const forbidden = new Set([
+        'commit',
+        'checkout',
+        'switch',
+        'reset',
+        'clean',
+        'push',
+        'pull',
+        'fetch',
+        'merge',
+        'rebase',
+        'cherry-pick',
+        'apply',
+        'am',
+        'gc',
+        'config',
+        'remote',
+    ]);
+    if (args.some((argument) => forbidden.has(argument))) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Git mutation is forbidden.');
+    }
+}
+export async function executeGitReadOnly(projectRoot, args, options = {}) {
+    assertGitReadOnlyArgs(args);
+    const { stdout } = await execFileAsync('git', args, {
+        cwd: projectRoot,
+        env: minimalEnvironment(),
+        maxBuffer: MAX_PROVIDER_OUTPUT,
+        timeout: Math.max(1, Math.min(options.timeoutMs ?? 15_000, 15_000)),
+    });
+    return stdout;
+}
+const GH_READ_COMMANDS = {
+    issue: new Set(['list', 'view']),
+    pr: new Set(['list', 'view', 'checks']),
+    release: new Set(['list', 'view']),
+    run: new Set(['list', 'view']),
+    repo: new Set(['view']),
+    auth: new Set(['status', 'token']),
+};
+export function assertGitHubReadOnlyArgs(args) {
+    const [resource, action] = args;
+    if (!resource || !action || !GH_READ_COMMANDS[resource]?.has(action)) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `GitHub operation is not allowlisted for evidence: ${resource ?? ''} ${action ?? ''}`.trim());
+    }
+    if (args.includes('--web') || args.includes('--jq') || args.includes('--template')) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'GitHub evidence cannot open browsers or execute output templates.');
+    }
+}
+export async function executeGitHubReadOnly(projectRoot, args, options = {}) {
+    assertGitHubReadOnlyArgs(args);
+    const host = process.env.GH_HOST ?? 'github.com';
+    const allowedHosts = options.allowedHosts ?? ['github.com'];
+    if (!allowedHosts.includes(host)) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `GitHub host ${host} is not allowlisted.`);
+    }
+    const { stdout } = await execFileAsync('gh', args, {
+        cwd: projectRoot,
+        env: minimalEnvironment({ GH_HOST: host, GH_PROMPT_DISABLED: '1' }),
+        maxBuffer: MAX_PROVIDER_OUTPUT,
+        timeout: Math.max(1, Math.min(options.timeoutMs ?? 20_000, 20_000)),
+    });
+    return stdout;
+}
+function normalizedAllowedHosts(hosts) {
+    return new Set(hosts.map((host) => host.trim().toLowerCase()).filter(Boolean));
+}
+export function assertReadOnlyRestRequest(endpoint, method, allowedHosts) {
+    const url = new URL(endpoint);
+    const normalizedMethod = method.toUpperCase();
+    if (normalizedMethod !== 'GET' && normalizedMethod !== 'HEAD') {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `Remote evidence permits GET and HEAD only, not ${normalizedMethod}.`);
+    }
+    if (url.protocol !== 'https:' ||
+        url.username ||
+        url.password ||
+        (url.port && url.port !== '443') ||
+        !normalizedAllowedHosts(allowedHosts).has(url.hostname.toLowerCase())) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `Remote evidence host is not allowlisted: ${url.hostname || '(missing)'}.`);
+    }
+    return url;
+}
+function boundedPositiveInteger(value, fallback, maximum) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence limits must be positive integers.');
+    }
+    return Math.min(value, maximum);
+}
+async function readBoundedResponseText(response, maxBytes) {
+    if (response.redirected || (response.status >= 300 && response.status < 400)) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Remote evidence redirects are forbidden.');
+    }
+    if (!response.ok) {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', `Remote evidence request failed with HTTP ${response.status}.`);
+    }
+    const rawLength = response.headers.get('content-length');
+    if (rawLength !== null) {
+        if (!/^\d+$/.test(rawLength) || Number(rawLength) > maxBytes) {
+            throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence Content-Length is invalid or exceeds the configured limit.');
+        }
+    }
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let bytes = 0;
+    try {
+        while (true) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            bytes += next.value.byteLength;
+            if (bytes > maxBytes) {
+                await reader
+                    .cancel('OpenPlanr remote evidence byte limit exceeded.')
+                    .catch(() => undefined);
+                throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence streamed response exceeds the configured byte limit.');
+            }
+            chunks.push(next.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const merged = Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), bytes);
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(merged);
+    }
+    catch {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence is not valid UTF-8.');
+    }
+}
+async function fetchBoundedJson(endpoint, init, options) {
+    const timeoutMs = boundedPositiveInteger(options.timeoutMs, DEFAULT_REMOTE_TIMEOUT_MS, 60_000);
+    const maxBytes = boundedPositiveInteger(options.maxBytes, DEFAULT_REMOTE_MAX_BYTES, DEFAULT_REMOTE_MAX_BYTES);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await (options.fetchImpl ?? fetch)(endpoint, {
+            ...init,
+            redirect: 'error',
+            signal: controller.signal,
+        });
+        if (response.redirected || (response.status >= 300 && response.status < 400)) {
+            throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Remote evidence redirects are forbidden.');
+        }
+        const contentType = response.headers.get('content-type') ?? '';
+        if (response.status !== 204 &&
+            contentType &&
+            !/(?:application\/json|\+json)\b/i.test(contentType)) {
+            throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence response is not JSON.');
+        }
+        const body = await readBoundedResponseText(response, maxBytes);
+        if (!body && response.status === 204)
+            return null;
+        try {
+            return parseStrictJson(body, {
+                maxBytes,
+                maxDepth: 64,
+                maxScalars: 100_000,
+                maxStringLength: maxBytes,
+            });
+        }
+        catch (error) {
+            if (error instanceof OperateError)
+                throw error;
+            throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence response contains malformed JSON.');
+        }
+    }
+    catch (error) {
+        if (error.name === 'AbortError') {
+            throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', `Remote evidence request exceeded the ${timeoutMs}ms timeout.`);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export async function executeRestReadOnlyJson(endpoint, options) {
+    const method = options.method ?? 'GET';
+    const url = assertReadOnlyRestRequest(endpoint, method, options.allowedHosts);
+    return fetchBoundedJson(url, {
+        method,
+        headers: options.headers,
+    }, options);
+}
+function stripGraphqlComments(query) {
+    return query.replace(/#[^\r\n]*/g, '').trim();
+}
+export function assertLinearReadOnlyQuery(endpoint, query) {
+    const url = new URL(endpoint);
+    if (url.protocol !== 'https:' ||
+        url.hostname !== 'api.linear.app' ||
+        url.pathname !== '/graphql' ||
+        url.username ||
+        url.password ||
+        (url.port && url.port !== '443') ||
+        url.search ||
+        url.hash) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Linear evidence endpoint must be https://api.linear.app/graphql.');
+    }
+    const normalized = stripGraphqlComments(query);
+    if (/\b(?:mutation|subscription)\b/i.test(normalized) ||
+        (!normalized.startsWith('query') && !normalized.startsWith('{'))) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Linear evidence permits GraphQL query operations only.');
+    }
+}
+export class ReadOnlyLinearTransport {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    async query(query, variables) {
+        assertLinearReadOnlyQuery(this.transport.endpoint, query);
+        return this.transport.query(query, variables);
+    }
+}
+export async function executeLinearReadOnlyQuery(input) {
+    const endpoint = input.endpoint ?? 'https://api.linear.app/graphql';
+    assertLinearReadOnlyQuery(endpoint, input.query);
+    if (!input.token.trim()) {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Linear evidence credentials are unavailable.');
+    }
+    const requestBody = JSON.stringify({
+        query: input.query,
+        variables: input.variables ?? {},
+    });
+    if (Buffer.byteLength(requestBody) > 256 * 1024) {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Linear evidence query exceeds the request-size limit.');
+    }
+    const response = await fetchBoundedJson(new URL(endpoint), {
+        method: 'POST',
+        headers: {
+            authorization: input.token,
+            'content-type': 'application/json',
+        },
+        body: requestBody,
+    }, input);
+    if (response.errors?.length || response.data === undefined) {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Linear evidence query returned a GraphQL error.');
+    }
+    return response.data;
+}
+//# sourceMappingURL=read-only-providers.js.map

package/dist/services/operate/read-only-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only-providers.js","sourceRoot":"","sources":["../../../src/services/operate/read-only-providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,SAAS,kBAAkB,CAAC,QAA2B,EAAE;IACvD,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,KAAK;IACL,WAAW;IACX,UAAU;IACV,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,MAAM,4BAA4B,GAAG;QACnC,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,aAAa;QACb,aAAa;QACb,aAAa;QACb,cAAc;KACf,CAAC;IACF,IACE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACrB,4BAA4B,CAAC,IAAI,CAC/B,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CACF,EACD,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,kDAAkD,OAAO,IAAI,WAAW,GAAG,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;QACxB,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,MAAM;QACN,OAAO;QACP,OAAO;QACP,QAAQ;QACR,aAAa;QACb,OAAO;QACP,IAAI;QACJ,IAAI;QACJ,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,YAAY,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,IAAc,EACd,UAAkC,EAAE;IAEpC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;QAClD,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,kBAAkB,EAAE;QACzB,SAAS,EAAE,mBAAmB;QAC9B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;KACpE,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,gBAAgB,GAAgC;IACpD,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,qDAAqD,QAAQ,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmB,EACnB,IAAc,EACd,UAA2D,EAAE;IAE7D,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,YAAY,CAAC;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,eAAe,IAAI,sBAAsB,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;QACjD,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC;QACnE,SAAS,EAAE,mBAAmB;QAC9B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;KACpE,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD,SAAS,sBAAsB,CAAC,KAAwB;IACtD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAsB,EACtB,MAAc,EACd,YAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,gBAAgB,KAAK,KAAK,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;QAC9D,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,kDAAkD,gBAAgB,GAAG,CACtE,CAAC;IACJ,CAAC;IACD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC;QAChC,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,4CAA4C,GAAG,CAAC,QAAQ,IAAI,WAAW,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAyB,EACzB,QAAgB,EAChB,OAAe;IAEf,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAkB,EAAE,QAAgB;IACzE,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,4EAA4E,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACrB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM;qBACT,MAAM,CAAC,gDAAgD,CAAC;qBACxD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,sEAAsE,CACvE,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACzC,KAAK,CACN,CAAC;IACF,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,qCAAqC,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAa,EACb,IAAiB,EACjB,OAAoC;IAEpC,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,yBAAyB,EAAE,MAAM,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,sBAAsB,CACrC,OAAO,CAAC,QAAQ,EAChB,wBAAwB,EACxB,wBAAwB,CACzB,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,QAAQ,EAAE;YAC5D,GAAG,IAAI;YACP,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/D,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;YACvB,WAAW;YACX,CAAC,iCAAiC,CAAC,IAAI,CAAC,WAAW,CAAC,EACpD,CAAC;YACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,uCAAuC,CACxC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAS,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,IAAI,EAAE;gBAC3B,QAAQ;gBACR,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,OAAO;gBACnB,eAAe,EAAE,QAAQ;aAC1B,CAAM,CAAC;QACV,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY;gBAAE,MAAM,KAAK,CAAC;YAC/C,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,mDAAmD,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAAe,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC3C,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,wCAAwC,SAAS,aAAa,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAsB,EACtB,OAGC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9E,OAAO,gBAAgB,CACrB,GAAG,EACH;QACE,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,KAAa;IACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,gBAAgB;QACjC,GAAG,CAAC,QAAQ,KAAK,UAAU;QAC3B,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC;QAChC,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI,EACR,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC/C,IACE,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC;QACjD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,wDAAwD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,SAA+B;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAEhE,KAAK,CAAC,KAAK,CAAI,KAAa,EAAE,SAA6C;QACzE,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAI,KAAK,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAKC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,gCAAgC,CAAC;IACpE,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;KACjC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAIrC,IAAI,GAAG,CAAC,QAAQ,CAAC,EACjB;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,KAAK,CAAC,KAAK;YAC1B,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,WAAW;KAClB,EACD,KAAK,CACN,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}

package/dist/services/operate/redaction.d.ts

@@ -0,0 +1,47 @@
+import { type CollectedEvidenceItem, type OperatingEvidenceItem, type OperatingSensitivity } from './types.js';
+export declare function compareSensitivity(left: OperatingSensitivity, right: OperatingSensitivity): number;
+export declare function maximumSensitivity(values: readonly OperatingSensitivity[]): OperatingSensitivity;
+export declare function assertSensitivityAllowed(sensitivity: OperatingSensitivity, ceiling: OperatingSensitivity): void;
+export declare function normalizeUntrustedText(value: string): string;
+export interface RedactionResult {
+    value: string;
+    redactions: string[];
+    inputDigest: `sha256:${string}`;
+}
+export interface EmbeddedInstructionInspection {
+    annotations: string[];
+    quarantined: boolean;
+}
+/**
+ * Classify instruction-shaped text before it is placed in an advisor pack.
+ *
+ * Evidence is allowed to discuss prompts and tools, so ordinary control-like
+ * prose is annotated and then inert-framed. Direct tool/credential
+ * exfiltration instructions are quarantined instead of being sent to a model.
+ */
+export declare function inspectEmbeddedInstructions(input: string): EmbeddedInstructionInspection;
+export interface AdvisorEvidenceText {
+    value: string;
+    annotations: string[];
+    quarantined: boolean;
+    reason: string | null;
+}
+/**
+ * Redact, inspect, and deterministically frame one evidence excerpt.
+ *
+ * The digest-derived boundary prevents evidence from manufacturing a matching
+ * closing marker. The framed value remains plain text inside the JSON advisor
+ * pack and is never promoted to a system/developer instruction.
+ */
+export declare function prepareAdvisorEvidenceText(input: {
+    evidenceId: string;
+    digest: `sha256:${string}`;
+    value: string;
+}): AdvisorEvidenceText;
+export declare function redactSensitiveText(input: string, options?: {
+    redactPii?: boolean;
+}): RedactionResult;
+export declare function containsSecret(value: string): boolean;
+export declare function sanitizeEvidenceItem(input: CollectedEvidenceItem): OperatingEvidenceItem;
+export declare function sanitizeGeneratedPlainText(value: string): string;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/services/operate/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/services/operate/redaction.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,qBAAqB,EAE1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AA+HpB,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,oBAAoB,GAC1B,MAAM,CAER;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,GAAG,oBAAoB,CAKhG;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,oBAAoB,EACjC,OAAO,EAAE,oBAAoB,GAC5B,IAAI,CAON;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,UAAU,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,6BAA6B,CAcxF;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,mBAAmB,CAqDtB;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,eAAe,CAsBjB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAWrD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,qBAAqB,CAmCxF;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMhE"}

package/dist/services/operate/redaction.js

@@ -0,0 +1,279 @@
+import { sha256Digest } from './canonical.js';
+import { OperateError, } from './types.js';
+const SENSITIVITY_RANK = {
+    public: 0,
+    internal: 1,
+    confidential: 2,
+    restricted: 3,
+};
+const BIDI_AND_INVISIBLE = 
+// biome-ignore lint/suspicious/noControlCharactersInRegex: untrusted evidence must strip C0/C1 and bidi controls.
+/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g;
+// biome-ignore lint/suspicious/noControlCharactersInRegex: ANSI stripping intentionally recognizes ESC and BEL.
+const ANSI_ESCAPE = /\u001b(?:\[[0-?]*[ -/]*[@-~]|\][^\u0007]*(?:\u0007|\u001b\\))/g;
+const EMBEDDED_INSTRUCTION_PATTERNS = [
+    {
+        label: 'instruction-override',
+        pattern: /\b(?:ignore|disregard|override|forget)\s+(?:all\s+)?(?:previous|prior|system|developer|user)\s+(?:instructions?|messages?|prompts?)\b/gi,
+        risk: 'annotate',
+    },
+    {
+        label: 'role-control-marker',
+        pattern: /(?:<\s*\/?\s*(?:system|assistant|developer|tool)\b|\[\s*INST\s*]|\b(?:system|developer)\s+(?:message|prompt)\s*:)/gi,
+        risk: 'annotate',
+    },
+    {
+        label: 'identity-override',
+        pattern: /\b(?:you are now|act as|pretend to be|switch roles? to)\b/gi,
+        risk: 'annotate',
+    },
+    {
+        label: 'output-control',
+        pattern: /\b(?:return|respond|reply|output)\s+(?:only|exactly|with)\b|\bdo not (?:mention|reveal|disclose)\b/gi,
+        risk: 'annotate',
+    },
+    {
+        label: 'secret-exfiltration',
+        pattern: /\b(?:read|print|dump|reveal|exfiltrate|upload|send)\b[\s\S]{0,96}\b(?:process\.env|environment variables?|credentials?|secrets?|tokens?|private keys?)\b/gi,
+        risk: 'quarantine',
+    },
+    {
+        label: 'tool-invocation-directive',
+        pattern: /\b(?:call|invoke|use|run)\s+(?:the\s+)?(?:shell|terminal|browser|network|file|filesystem)\s+(?:tool|command)\b/gi,
+        risk: 'annotate',
+    },
+    {
+        label: 'remote-execution-text',
+        pattern: /\b(?:curl|wget)\s+https?:\/\/|\b(?:eval|exec)\s*\(/gi,
+        risk: 'annotate',
+    },
+    {
+        label: 'obfuscated-execution-directive',
+        pattern: /\batob\s*\([\s\S]{0,256}\b(?:eval|exec)\b/gi,
+        risk: 'quarantine',
+    },
+];
+const SECRET_PATTERNS = [
+    {
+        label: 'private-key',
+        pattern: /-----BEGIN(?: [A-Z0-9]+)? PRIVATE KEY-----[\s\S]*?-----END(?: [A-Z0-9]+)? PRIVATE KEY-----/g,
+        replacement: '[REDACTED_PRIVATE_KEY]',
+    },
+    {
+        label: 'authorization',
+        pattern: /\b(?:authorization|proxy-authorization)\s*:\s*(?:bearer|basic)\s+\S+/gi,
+        replacement: 'authorization: [REDACTED]',
+    },
+    {
+        label: 'known-token',
+        pattern: /\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|lin_api_[A-Za-z0-9_-]{20,}|sk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}|[sr]k_live_[A-Za-z0-9]{16,}|xox[baprs]-[A-Za-z0-9-]{20,}|npm_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{30,})\b/g,
+        replacement: '[REDACTED_TOKEN]',
+    },
+    {
+        label: 'jwt',
+        pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
+        replacement: '[REDACTED_JWT]',
+    },
+    {
+        label: 'secret-assignment',
+        pattern: /^([ \t]*(?:export[ \t]+)?[A-Za-z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|API_?KEY|PRIVATE_?KEY)[A-Za-z0-9_]*[ \t]*[=:][ \t]*)(.+)$/gim,
+        replacement: '$1[REDACTED]',
+    },
+    {
+        label: 'structured-secret',
+        pattern: /((?:"|')?(?:api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|password|passwd|secret|token)(?:"|')?[ \t]*[:=][ \t]*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,}\]\r\n#]+)/gi,
+        replacement: '$1"[REDACTED]"',
+    },
+    {
+        label: 'credential-url',
+        pattern: /\b(https?:\/\/)[^/\s:@]+:[^@\s/]+@/gi,
+        replacement: '$1[REDACTED]@',
+    },
+];
+const PII_PATTERNS = [
+    {
+        label: 'email',
+        pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,
+        replacement: '[REDACTED_EMAIL]',
+    },
+    {
+        label: 'user-home',
+        pattern: /(?:\/Users\/|\/home\/)[^/\s"'`]+/g,
+        replacement: '/home/[REDACTED_USER]',
+    },
+    {
+        label: 'windows-home',
+        pattern: /\b[A-Z]:\\Users\\[^\\\s"'`]+/gi,
+        replacement: 'C:\\Users\\[REDACTED_USER]',
+    },
+];
+export function compareSensitivity(left, right) {
+    return SENSITIVITY_RANK[left] - SENSITIVITY_RANK[right];
+}
+export function maximumSensitivity(values) {
+    return values.reduce((maximum, value) => (compareSensitivity(value, maximum) > 0 ? value : maximum), 'public');
+}
+export function assertSensitivityAllowed(sensitivity, ceiling) {
+    if (compareSensitivity(sensitivity, ceiling) > 0) {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', `Evidence sensitivity ${sensitivity} exceeds the configured ${ceiling} ceiling.`);
+    }
+}
+export function normalizeUntrustedText(value) {
+    return value.normalize('NFC').replace(ANSI_ESCAPE, '').replace(BIDI_AND_INVISIBLE, '');
+}
+/**
+ * Classify instruction-shaped text before it is placed in an advisor pack.
+ *
+ * Evidence is allowed to discuss prompts and tools, so ordinary control-like
+ * prose is annotated and then inert-framed. Direct tool/credential
+ * exfiltration instructions are quarantined instead of being sent to a model.
+ */
+export function inspectEmbeddedInstructions(input) {
+    const value = normalizeUntrustedText(input);
+    const annotations = [];
+    let quarantined = false;
+    for (const candidate of EMBEDDED_INSTRUCTION_PATTERNS) {
+        candidate.pattern.lastIndex = 0;
+        if (!candidate.pattern.test(value))
+            continue;
+        annotations.push(candidate.label);
+        quarantined ||= candidate.risk === 'quarantine';
+    }
+    return {
+        annotations: [...new Set(annotations)].sort(),
+        quarantined,
+    };
+}
+/**
+ * Redact, inspect, and deterministically frame one evidence excerpt.
+ *
+ * The digest-derived boundary prevents evidence from manufacturing a matching
+ * closing marker. The framed value remains plain text inside the JSON advisor
+ * pack and is never promoted to a system/developer instruction.
+ */
+export function prepareAdvisorEvidenceText(input) {
+    if (Buffer.byteLength(input.value, 'utf8') > 16 * 1024) {
+        return {
+            value: '',
+            annotations: ['oversized-evidence'],
+            quarantined: true,
+            reason: 'Evidence excerpt exceeds the bounded advisor-pack size.',
+        };
+    }
+    let redacted;
+    try {
+        redacted = redactSensitiveText(input.value);
+    }
+    catch {
+        return {
+            value: '',
+            annotations: ['unredactable-sensitive-content'],
+            quarantined: true,
+            reason: 'Evidence could not be safely redacted for advisor use.',
+        };
+    }
+    const inspection = inspectEmbeddedInstructions(redacted.value);
+    const annotations = [
+        ...inspection.annotations,
+        ...(redacted.redactions.length > 0 ? ['sensitive-content-redacted'] : []),
+    ].sort();
+    if (inspection.quarantined) {
+        return {
+            value: '',
+            annotations,
+            quarantined: true,
+            reason: 'Evidence contains a direct tool, execution, or secret-exfiltration instruction.',
+        };
+    }
+    const token = sha256Digest(Buffer.from(`${input.evidenceId}\0${input.digest}\0${redacted.inputDigest}`)).slice('sha256:'.length, 'sha256:'.length + 20);
+    const opening = `<<<OPENPLANR_UNTRUSTED_EVIDENCE:${token}>>>`;
+    const closing = `<<<END_OPENPLANR_UNTRUSTED_EVIDENCE:${token}>>>`;
+    const escaped = redacted.value
+        .replaceAll(opening, '[ESCAPED_EVIDENCE_BOUNDARY]')
+        .replaceAll(closing, '[ESCAPED_EVIDENCE_BOUNDARY]');
+    return {
+        value: [
+            opening,
+            `evidence_id=${input.evidenceId}`,
+            `annotations=${annotations.length > 0 ? annotations.join(',') : 'none'}`,
+            escaped,
+            closing,
+        ].join('\n'),
+        annotations,
+        quarantined: false,
+        reason: null,
+    };
+}
+export function redactSensitiveText(input, options = {}) {
+    const inputDigest = sha256Digest(Buffer.from(input));
+    let value = normalizeUntrustedText(input);
+    const redactions = [];
+    for (const candidate of [
+        ...SECRET_PATTERNS,
+        ...(options.redactPii === false ? [] : PII_PATTERNS),
+    ]) {
+        candidate.pattern.lastIndex = 0;
+        if (candidate.pattern.test(value)) {
+            redactions.push(candidate.label);
+            candidate.pattern.lastIndex = 0;
+            value = value.replace(candidate.pattern, candidate.replacement);
+        }
+    }
+    if (containsSecret(value)) {
+        throw new OperateError('E_OPERATE_SECRET_DETECTED', 'Evidence still contains a secret-like value after redaction.');
+    }
+    return { value, redactions: [...new Set(redactions)].sort(), inputDigest };
+}
+export function containsSecret(value) {
+    const candidate = value
+        .replace(/(?:"|')?(?:api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|password|passwd|secret|token)(?:"|')?[ \t]*[:=][ \t]*(?:"|')?\[REDACTED(?:_[A-Z_]+)?\](?:"|')?/gi, '')
+        .replace(/\[REDACTED(?:_[A-Z_]+)?\]/g, '');
+    return SECRET_PATTERNS.some(({ pattern }) => {
+        pattern.lastIndex = 0;
+        return pattern.test(candidate);
+    });
+}
+export function sanitizeEvidenceItem(input) {
+    const redacted = redactSensitiveText(input.content);
+    const repository = input.repository
+        ? {
+            componentId: input.repository.componentId,
+            canonicalRemote: input.repository.canonicalRemote,
+            revision: input.repository.revision,
+            configuredBranch: input.repository.configuredBranch,
+            dirtyFingerprint: input.repository.dirtyFingerprint,
+        }
+        : undefined;
+    return {
+        id: input.id,
+        source: input.source,
+        location: input.location,
+        digest: sha256Digest(redacted.value),
+        collectedAt: input.collectedAt,
+        observedFrom: input.observedFrom ?? null,
+        observedTo: input.observedTo ?? null,
+        freshness: input.freshness,
+        sensitivity: input.sensitivity,
+        claimTypes: [...new Set(input.claimTypes)].sort(),
+        ...(repository ? { repository } : {}),
+        ...(input.metric
+            ? {
+                metric: {
+                    identity: sanitizeGeneratedPlainText(input.metric.identity),
+                    query: sanitizeGeneratedPlainText(input.metric.query),
+                    observedFrom: input.metric.observedFrom,
+                    observedTo: input.metric.observedTo,
+                },
+            }
+            : {}),
+        summary: redacted.value.slice(0, 4_096),
+    };
+}
+export function sanitizeGeneratedPlainText(value) {
+    const redacted = redactSensitiveText(value);
+    return redacted.value
+        .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, '[REMOVED_SCRIPT]')
+        .replace(/\b(?:javascript|vbscript):/gi, 'blocked:')
+        .replace(/!\[[^\]]*]\((?:https?:|data:)[^)]+\)/gi, '[REMOTE_IMAGE_REMOVED]');
+}
+//# sourceMappingURL=redaction.js.map

package/dist/services/operate/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/services/operate/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAEL,YAAY,GAGb,MAAM,YAAY,CAAC;AAEpB,MAAM,gBAAgB,GAAyC;IAC7D,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,CAAC;IACX,YAAY,EAAE,CAAC;IACf,UAAU,EAAE,CAAC;CACd,CAAC;AAEF,MAAM,kBAAkB;AACtB,kHAAkH;AAClH,qGAAqG,CAAC;AACxG,gHAAgH;AAChH,MAAM,WAAW,GAAG,gEAAgE,CAAC;AAErF,MAAM,6BAA6B,GAI9B;IACH;QACE,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EACL,yIAAyI;QAC3I,IAAI,EAAE,UAAU;KACjB;IACD;QACE,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EACL,qHAAqH;QACvH,IAAI,EAAE,UAAU;KACjB;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,6DAA6D;QACtE,IAAI,EAAE,UAAU;KACjB;IACD;QACE,KAAK,EAAE,gBAAgB;QACvB,OAAO,EACL,sGAAsG;QACxG,IAAI,EAAE,UAAU;KACjB;IACD;QACE,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EACL,4JAA4J;QAC9J,IAAI,EAAE,YAAY;KACnB;IACD;QACE,KAAK,EAAE,2BAA2B;QAClC,OAAO,EACL,kHAAkH;QACpH,IAAI,EAAE,UAAU;KACjB;IACD;QACE,KAAK,EAAE,uBAAuB;QAC9B,OAAO,EAAE,sDAAsD;QAC/D,IAAI,EAAE,UAAU;KACjB;IACD;QACE,KAAK,EAAE,gCAAgC;QACvC,OAAO,EAAE,6CAA6C;QACtD,IAAI,EAAE,YAAY;KACnB;CACF,CAAC;AAEF,MAAM,eAAe,GAAmE;IACtF;QACE,KAAK,EAAE,aAAa;QACpB,OAAO,EACL,6FAA6F;QAC/F,WAAW,EAAE,wBAAwB;KACtC;IACD;QACE,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,wEAAwE;QACjF,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,KAAK,EAAE,aAAa;QACpB,OAAO,EACL,yPAAyP;QAC3P,WAAW,EAAE,kBAAkB;KAChC;IACD;QACE,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,oEAAoE;QAC7E,WAAW,EAAE,gBAAgB;KAC9B;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EACL,oIAAoI;QACtI,WAAW,EAAE,cAAc;KAC5B;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EACL,iNAAiN;QACnN,WAAW,EAAE,gBAAgB;KAC9B;IACD;QACE,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EAAE,eAAe;KAC7B;CACF,CAAC;AAEF,MAAM,YAAY,GAAmE;IACnF;QACE,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,6CAA6C;QACtD,WAAW,EAAE,kBAAkB;KAChC;IACD;QACE,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,4BAA4B;KAC1C;CACF,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAChC,IAA0B,EAC1B,KAA2B;IAE3B,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAuC;IACxE,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAC9E,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAiC,EACjC,OAA6B;IAE7B,IAAI,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,wBAAwB,WAAW,2BAA2B,OAAO,WAAW,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACzF,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,SAAS,IAAI,6BAA6B,EAAE,CAAC;QACtD,SAAS,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAC7C,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,WAAW,KAAK,SAAS,CAAC,IAAI,KAAK,YAAY,CAAC;IAClD,CAAC;IACD,OAAO;QACL,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;QAC7C,WAAW;KACZ,CAAC;AACJ,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACvD,OAAO;YACL,KAAK,EAAE,EAAE;YACT,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,yDAAyD;SAClE,CAAC;IACJ,CAAC;IACD,IAAI,QAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,EAAE;YACT,WAAW,EAAE,CAAC,gCAAgC,CAAC;YAC/C,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,wDAAwD;SACjE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG;QAClB,GAAG,UAAU,CAAC,WAAW;QACzB,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,EAAE;YACT,WAAW;YACX,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,iFAAiF;SAC1F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CACxB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,CAC7E,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,mCAAmC,KAAK,KAAK,CAAC;IAC9D,MAAM,OAAO,GAAG,uCAAuC,KAAK,KAAK,CAAC;IAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK;SAC3B,UAAU,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAClD,UAAU,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACtD,OAAO;QACL,KAAK,EAAE;YACL,OAAO;YACP,eAAe,KAAK,CAAC,UAAU,EAAE;YACjC,eAAe,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;YACxE,OAAO;YACP,OAAO;SACR,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,WAAW;QACX,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,UAAmC,EAAE;IAErC,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,IAAI,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,SAAS,IAAI;QACtB,GAAG,eAAe;QAClB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;KACrD,EAAE,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAChC,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,SAAS,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAChC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CACpB,2BAA2B,EAC3B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,SAAS,GAAG,KAAK;SACpB,OAAO,CACN,6MAA6M,EAC7M,EAAE,CACH;SACA,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA4B;IAC/D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU;QACjC,CAAC,CAAC;YACE,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;YACzC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,eAAe;YACjD,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;YACnC,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;YACnD,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;SACpD;QACH,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE;QACjD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,MAAM;YACd,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,QAAQ,EAAE,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAC3D,KAAK,EAAE,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;oBACrD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;oBACvC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;iBACpC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC,KAAK;SAClB,OAAO,CAAC,qCAAqC,EAAE,kBAAkB,CAAC;SAClE,OAAO,CAAC,8BAA8B,EAAE,UAAU,CAAC;SACnD,OAAO,CAAC,wCAAwC,EAAE,wBAAwB,CAAC,CAAC;AACjF,CAAC"}

package/dist/services/operate/reducer.d.ts

@@ -0,0 +1,10 @@
+import type { OperatingCheckpoint, OperatingEvent, OperatingState } from './types.js';
+/** Canonical projection is owned by planr-pipeline/protocol, never duplicated here. */
+export declare function reduceOperatingEvents(events: OperatingEvent[], options?: {
+    checkpoint?: OperatingCheckpoint | null;
+}): Promise<OperatingState>;
+export declare function verifyOperatingEvents(events: OperatingEvent[]): Promise<{
+    sequence: number;
+    hash: `sha256:${string}` | null;
+}>;
+//# sourceMappingURL=reducer.d.ts.map