patchwork-os 1.2.0-beta.2.canary.586 → 1.2.0-beta.2.canary.588
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -139,10 +139,23 @@ const MAX_BYTES = 8 * 1024;
|
|
|
139
139
|
// Case-insensitive substring match. Order: most specific first to avoid
|
|
140
140
|
// accidentally matching narrower strings (none currently overlap, but
|
|
141
141
|
// this is the convention).
|
|
142
|
+
/**
|
|
143
|
+
* Substrings that mark a key as secret-bearing.
|
|
144
|
+
*
|
|
145
|
+
* Compared against a SEPARATOR-STRIPPED, lower-cased key (see
|
|
146
|
+
* `isSensitiveKey`), so each name is written once here and matches every
|
|
147
|
+
* spelling: `api_key`, `api-key`, `apiKey`, `API_KEY`.
|
|
148
|
+
*
|
|
149
|
+
* This list previously carried the spellings by hand and drifted: it had both
|
|
150
|
+
* `client_secret` and `client-secret`, both `refresh_token` and
|
|
151
|
+
* `refresh-token` — but only `api-key` and `apikey`, never the snake_case
|
|
152
|
+
* `api_key` that recipe YAML naturally uses. A resolved `api_key` therefore
|
|
153
|
+
* reached the run log, the dashboard and the approval payload in clear text.
|
|
154
|
+
* Enumerating spellings is what failed; normalising once is the fix.
|
|
155
|
+
*/
|
|
142
156
|
const SENSITIVE_KEY_PATTERNS = [
|
|
143
157
|
"authorization",
|
|
144
|
-
"
|
|
145
|
-
"api-key",
|
|
158
|
+
"xapikey",
|
|
146
159
|
"apikey",
|
|
147
160
|
"password",
|
|
148
161
|
"passwd",
|
|
@@ -150,14 +163,10 @@ const SENSITIVE_KEY_PATTERNS = [
|
|
|
150
163
|
"token",
|
|
151
164
|
"cookie",
|
|
152
165
|
"session",
|
|
153
|
-
"private-key",
|
|
154
166
|
"privatekey",
|
|
155
|
-
"
|
|
156
|
-
"
|
|
157
|
-
"
|
|
158
|
-
"refresh_token",
|
|
159
|
-
"access-token",
|
|
160
|
-
"access_token",
|
|
167
|
+
"clientsecret",
|
|
168
|
+
"refreshtoken",
|
|
169
|
+
"accesstoken",
|
|
161
170
|
];
|
|
162
171
|
export const REDACTED = "[REDACTED]";
|
|
163
172
|
const TRUNCATED = "[truncated]";
|
|
@@ -182,9 +191,11 @@ export function redactSecretsForPrompt(ctx, secretKeys) {
|
|
|
182
191
|
return out;
|
|
183
192
|
}
|
|
184
193
|
function isSensitiveKey(key) {
|
|
185
|
-
|
|
194
|
+
// Strip separators so one pattern covers every spelling a caller might use.
|
|
195
|
+
// `api_key`, `api-key`, `apiKey` and `API_KEY` all normalise to `apikey`.
|
|
196
|
+
const normalised = key.toLowerCase().replace(/[-_\s.]/g, "");
|
|
186
197
|
for (const pattern of SENSITIVE_KEY_PATTERNS) {
|
|
187
|
-
if (
|
|
198
|
+
if (normalised.includes(pattern))
|
|
188
199
|
return true;
|
|
189
200
|
}
|
|
190
201
|
return false;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"stepObservation.js","sourceRoot":"","sources":["../../src/recipes/stepObservation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA0BH;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAA6C;IACrE,uDAAuD;IACvD,gEAAgE;IAChE,qEAAqE;IACrE,sEAAsE;IACtE,iEAAiE;IACjE,qEAAqE;IACrE,sBAAsB;IACtB;QACE,KAAK,EACH,mFAAmF;QACrF,MAAM,EAAE,4CAA4C;KACrD;IACD,yEAAyE;IACzE,wEAAwE;IACxE,kEAAkE;IAClE,wEAAwE;IACxE,wDAAwD;IACxD;QACE,KAAK,EAAE,mDAAmD;QAC1D,MAAM,EAAE,qBAAqB;KAC9B;IACD,oEAAoE;IACpE,+DAA+D;IAC/D,qEAAqE;IACrE;QACE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,8DAA8D;QAC9D,0EAA0E;QAC1E,iEAAiE;QACjE,mCAAmC;QACnC,KAAK,EAAE,8CAA8C;QACrD,MAAM,EAAE,mDAAmD;KAC5D;IACD,6DAA6D;IAC7D;QACE,KAAK,EAAE,wCAAwC;QAC/C,MAAM,EAAE,6CAA6C;KACtD;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC9C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEzD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,EAAE,CAAC;gBACN,4DAA4D;gBAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,kEAAkE;QAClE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,gEAAgE;QAChE,cAAc;QACd,IACE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAC7B,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACpB,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;gBACd,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;gBACpD,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAC3D,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,2CAA2C;gBACnD,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACjC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,sEAAsE;AACtE,EAAE;AACF,yDAAyD;AACzD,sEAAsE;AACtE,iEAAiE;AACjE,wEAAwE;AACxE,sEAAsE;AACtE,gBAAgB;AAChB,EAAE;AACF,yEAAyE;AACzE,mDAAmD;AACnD,8EAA8E;AAE9E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC;AAE3B,wEAAwE;AACxE,sEAAsE;AACtE,2BAA2B;AAC3B,MAAM,sBAAsB,GAAG;IAC7B,eAAe;IACf,
|
|
1
|
+
{"version":3,"file":"stepObservation.js","sourceRoot":"","sources":["../../src/recipes/stepObservation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA0BH;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAA6C;IACrE,uDAAuD;IACvD,gEAAgE;IAChE,qEAAqE;IACrE,sEAAsE;IACtE,iEAAiE;IACjE,qEAAqE;IACrE,sBAAsB;IACtB;QACE,KAAK,EACH,mFAAmF;QACrF,MAAM,EAAE,4CAA4C;KACrD;IACD,yEAAyE;IACzE,wEAAwE;IACxE,kEAAkE;IAClE,wEAAwE;IACxE,wDAAwD;IACxD;QACE,KAAK,EAAE,mDAAmD;QAC1D,MAAM,EAAE,qBAAqB;KAC9B;IACD,oEAAoE;IACpE,+DAA+D;IAC/D,qEAAqE;IACrE;QACE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,8DAA8D;QAC9D,0EAA0E;QAC1E,iEAAiE;QACjE,mCAAmC;QACnC,KAAK,EAAE,8CAA8C;QACrD,MAAM,EAAE,mDAAmD;KAC5D;IACD,6DAA6D;IAC7D;QACE,KAAK,EAAE,wCAAwC;QAC/C,MAAM,EAAE,6CAA6C;KACtD;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC9C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEzD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,EAAE,CAAC;gBACN,4DAA4D;gBAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,kEAAkE;QAClE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,gEAAgE;QAChE,cAAc;QACd,IACE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAC7B,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACpB,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;gBACd,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;gBACpD,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAC3D,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,2CAA2C;gBACnD,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACjC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,sEAAsE;AACtE,EAAE;AACF,yDAAyD;AACzD,sEAAsE;AACtE,iEAAiE;AACjE,wEAAwE;AACxE,sEAAsE;AACtE,gBAAgB;AAChB,EAAE;AACF,yEAAyE;AACzE,mDAAmD;AACnD,8EAA8E;AAE9E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC;AAE3B,wEAAwE;AACxE,sEAAsE;AACtE,2BAA2B;AAC3B;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG;IAC7B,eAAe;IACf,SAAS;IACT,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,cAAc;IACd,cAAc;IACd,aAAa;CACd,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AACrC,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAM,EACN,UAA+B;IAE/B,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACtC,MAAM,GAAG,GAA2B,EAAE,GAAG,GAAG,EAAE,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACnD,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,KAAc,EACd,OAAO,IAAI,OAAO,EAAU;IAE5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC;QAAE,OAAO,YAAY,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAE1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,GAAG,CAAC;YAC1C,IAAI,OAAO,CAAC,KAAK,UAAU;gBAAE,OAAO,YAAY,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/C,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACjD,CAAC;IACD,sEAAsE;IACtE,mEAAmE;IACnE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE/C,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,uEAAuE;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO;QACL,CAAC,SAAS,CAAC,EAAE,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;QACtC,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "patchwork-os",
|
|
3
|
-
"version": "1.2.0-beta.2.canary.
|
|
3
|
+
"version": "1.2.0-beta.2.canary.588",
|
|
4
4
|
"description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -23,13 +23,25 @@ responsibilities:
|
|
|
23
23
|
- Turn a stated request into a task on the user's personal list
|
|
24
24
|
- Never act on a request it merely READ somewhere; only one the user made
|
|
25
25
|
|
|
26
|
-
# Matches the recipe's actual steps
|
|
27
|
-
# `tasks-read` covers the list read
|
|
28
|
-
#
|
|
29
|
-
# looks like
|
|
26
|
+
# Matches the recipe's actual steps AND its `allowWrites`. `tasks` covers
|
|
27
|
+
# todoist.create_task; `tasks-read` covers the list read; `fs-write` covers the
|
|
28
|
+
# file.append receipt step. Nothing aspirational — an `owns` entry with no step
|
|
29
|
+
# to attach an observation to can never earn anything, it just looks like
|
|
30
|
+
# coverage.
|
|
31
|
+
#
|
|
32
|
+
# `fs-write` was missing while the recipe already declared file.append, and the
|
|
33
|
+
# failure was silent in the worst direction: an unowned class does not error,
|
|
34
|
+
# the gate floors it to L0, and because fs-write is reversible the write
|
|
35
|
+
# happened anyway. So the receipt was written, the observation accrued against
|
|
36
|
+
# a class the worker did not own, and `workers shadow` printed a NOT OWNED
|
|
37
|
+
# warning nothing acted on. Adding it cannot widen anything — trust is per
|
|
38
|
+
# (worker × class), so evidence earned on a reversible file write can never
|
|
39
|
+
# unlock the compensable todoist write. Guarded by
|
|
40
|
+
# src/workers/__tests__/manifestCoversRecipeWrites.test.ts.
|
|
30
41
|
owns:
|
|
31
42
|
- tasks-read
|
|
32
43
|
- tasks
|
|
44
|
+
- fs-write
|
|
33
45
|
|
|
34
46
|
# Capped at 1, BELOW the compensable auto-allow rung (L2), so every write stays
|
|
35
47
|
# human-approved no matter how much trust accrues. That is the point of the
|