pi-harness-runtime 0.9.6 → 0.9.10

package/packages/cookie-sanitizer/dist/infer-provider.js

@@ -0,0 +1,96 @@
+/**
+ * Provider inference — figure out which provider a cookie dump belongs to
+ * without the user having to organize by subfolder.
+ *
+ * Three inference passes, first hit wins:
+ *   1. Filename hint    (e.g. `minimax-*.txt`, `*minimax.json` → "minimax")
+ *   2. Dominant domain  (≥ 80% of cookies on `*.minimax.io` → "minimax")
+ *   3. Nothing           → null (caller will surface a friendly error)
+ *
+ * Provider hint from SyncOptions overrides all of the above.
+ */
+const FILENAME_HINTS = [
+    { pattern: /minimax/i, provider: "minimax" },
+    { pattern: /anthropic|claude/i, provider: "anthropic" },
+    { pattern: /openai|gpt|chatgpt/i, provider: "openai" },
+    { pattern: /glm|z\.ai|zhipuai/i, provider: "glm" },
+    { pattern: /openrouter/i, provider: "openrouter" },
+];
+const DOMAIN_HINTS = [
+    { pattern: /\.minimax\.io$|^minimax\.io$/i, provider: "minimax" },
+    { pattern: /\.anthropic\.com$|^anthropic\.com$/i, provider: "anthropic" },
+    {
+        pattern: /\.openai\.com$|^openai\.com$|\.chatgpt\.com$|^chatgpt\.com$/i,
+        provider: "openai",
+    },
+    {
+        pattern: /\.z\.ai$|^z\.ai$|\.zhipuai\.cn$|^zhipuai\.cn$/i,
+        provider: "glm",
+    },
+    { pattern: /\.openrouter\.ai$|^openrouter\.ai$/i, provider: "openrouter" },
+];
+/** Returns the first provider whose filename pattern matches, or null. */
+export function inferProviderFromFilename(filename) {
+    if (!filename)
+        return null;
+    for (const { pattern, provider } of FILENAME_HINTS) {
+        if (pattern.test(filename))
+            return provider;
+    }
+    return null;
+}
+/** Returns the provider whose domain is the dominant (≥ 80%) match. */
+export function inferProviderFromCookies(cookies) {
+    if (!Array.isArray(cookies) || cookies.length === 0)
+        return null;
+    const counts = new Map();
+    let total = 0;
+    for (const c of cookies) {
+        if (!c.domain)
+            continue;
+        total += 1;
+        for (const { pattern, provider } of DOMAIN_HINTS) {
+            if (pattern.test(c.domain.toLowerCase())) {
+                counts.set(provider, (counts.get(provider) ?? 0) + 1);
+                break;
+            }
+        }
+    }
+    if (total === 0)
+        return null;
+    const threshold = Math.ceil(total * 0.8); // ≥ 80 %
+    let best = null;
+    for (const [provider, count] of counts) {
+        if (count >= threshold && (!best || count > best.count)) {
+            best = { provider, count };
+        }
+    }
+    return best?.provider ?? null;
+}
+/**
+ * Combined inference: hint → filename → dominant domain → null.
+ *
+ * If `filename` is provided it takes priority over domain inference
+ * (filename hints are explicit). Domain inference is the fallback.
+ */
+export function inferProvider(filename, cookies, hint) {
+    if (hint)
+        return hint;
+    if (filename) {
+        const fromName = inferProviderFromFilename(filename);
+        if (fromName)
+            return fromName;
+    }
+    return inferProviderFromCookies(cookies);
+}
+/**
+ * Build a list of provider rules used by other parts of the package.
+ * Exposed for UI display (e.g. "which providers does this sanitizer know?").
+ */
+export function knownProviders() {
+    const set = new Set();
+    for (const { provider } of FILENAME_HINTS)
+        set.add(provider);
+    return Array.from(set);
+}
+//# sourceMappingURL=infer-provider.js.map

package/packages/cookie-sanitizer/dist/infer-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infer-provider.js","sourceRoot":"","sources":["../src/infer-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,cAAc,GAAqD;IACxE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE;IAC5C,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE;IACvD,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACtD,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE;IAClD,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;CAClD,CAAC;AAEF,MAAM,YAAY,GAAqD;IACtE,EAAE,OAAO,EAAE,+BAA+B,EAAE,QAAQ,EAAE,SAAS,EAAE;IACjE,EAAE,OAAO,EAAE,qCAAqC,EAAE,QAAQ,EAAE,WAAW,EAAE;IACzE;QACC,OAAO,EAAE,8DAA8D;QACvE,QAAQ,EAAE,QAAQ;KAClB;IACD;QACC,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,KAAK;KACf;IACD,EAAE,OAAO,EAAE,qCAAqC,EAAE,QAAQ,EAAE,YAAY,EAAE;CAC1E,CAAC;AAEF,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,cAAc,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB,CACvC,OAA0B;IAE1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,SAAS;QACxB,KAAK,IAAI,CAAC,CAAC;QACX,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtD,MAAM;YACP,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS;IACnD,IAAI,IAAI,GAAmD,IAAI,CAAC;IAChE,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACxC,IAAI,KAAK,IAAI,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC5B,QAA4B,EAC5B,OAA0B,EAC1B,IAAiB;IAEjB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAC/B,CAAC;IACD,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAc,CAAC;IAClC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,cAAc;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC"}

package/packages/cookie-sanitizer/dist/normalize.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Normalize step — dedupe, drop invalid/expired, set provider.
+ *
+ * Rules (applied in order):
+ *  1. Drop cookies with empty `name` or `value`.
+ *  2. Drop cookies whose domain doesn't match the inferred provider.
+ *  3. Drop expired cookies (expires in the past, not session).
+ *  4. Dedupe by `(domain, name)` — keep the LAST entry (most recent wins).
+ *  5. Mark each surviving cookie with the provider id.
+ *
+ * SEC-001: Cookie values are not touched here, but never logged.
+ */
+import type { CanonicalCookie, ProviderId } from "./types.js";
+/** Returns true if the cookie's domain matches the given provider's domain scope. */
+export declare function domainMatchesProvider(domain: string, provider: ProviderId): boolean;
+/** Returns true if the cookie is expired (in the past). Session cookies never expire. */
+export declare function isExpired(cookie: CanonicalCookie, nowSec?: number): boolean;
+/**
+ * Normalize the union of all parsed cookies.
+ *
+ * @param cookies     Raw cookies from all parsed files
+ * @param provider    Inferred (or hinted) provider; used for domain filtering and tagging
+ * @param nowSec      Override for the current Unix seconds (test seam)
+ */
+export declare function normalize(cookies: CanonicalCookie[], provider: ProviderId, nowSec?: number): CanonicalCookie[];
+//# sourceMappingURL=normalize.d.ts.map

package/packages/cookie-sanitizer/dist/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../src/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE9D,qFAAqF;AACrF,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,UAAU,GAClB,OAAO,CA4BT;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CACxB,MAAM,EAAE,eAAe,EACvB,MAAM,GAAE,MAAsC,GAC5C,OAAO,CAIT;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CACxB,OAAO,EAAE,eAAe,EAAE,EAC1B,QAAQ,EAAE,UAAU,EACpB,MAAM,GAAE,MAAsC,GAC5C,eAAe,EAAE,CAqBnB"}

package/packages/cookie-sanitizer/dist/normalize.js

@@ -0,0 +1,75 @@
+/**
+ * Normalize step — dedupe, drop invalid/expired, set provider.
+ *
+ * Rules (applied in order):
+ *  1. Drop cookies with empty `name` or `value`.
+ *  2. Drop cookies whose domain doesn't match the inferred provider.
+ *  3. Drop expired cookies (expires in the past, not session).
+ *  4. Dedupe by `(domain, name)` — keep the LAST entry (most recent wins).
+ *  5. Mark each surviving cookie with the provider id.
+ *
+ * SEC-001: Cookie values are not touched here, but never logged.
+ */
+/** Returns true if the cookie's domain matches the given provider's domain scope. */
+export function domainMatchesProvider(domain, provider) {
+    if (!domain)
+        return false;
+    const d = domain.toLowerCase();
+    switch (provider) {
+        case "minimax":
+            return d === "minimax.io" || d.endsWith(".minimax.io");
+        case "anthropic":
+            return d === "anthropic.com" || d.endsWith(".anthropic.com");
+        case "openai":
+            return (d === "openai.com" ||
+                d.endsWith(".openai.com") ||
+                d === "chatgpt.com" ||
+                d.endsWith(".chatgpt.com"));
+        case "glm":
+            return (d === "z.ai" ||
+                d.endsWith(".z.ai") ||
+                d === "zhipuai.cn" ||
+                d.endsWith(".zhipuai.cn"));
+        case "openrouter":
+            return d === "openrouter.ai" || d.endsWith(".openrouter.ai");
+        default:
+            // Unknown provider — accept all and let downstream reject.
+            return true;
+    }
+}
+/** Returns true if the cookie is expired (in the past). Session cookies never expire. */
+export function isExpired(cookie, nowSec = Math.floor(Date.now() / 1000)) {
+    if (cookie.expires == null)
+        return false; // session cookie
+    if (cookie.expires <= 0)
+        return false; // 0 = session in Netscape
+    return cookie.expires < nowSec;
+}
+/**
+ * Normalize the union of all parsed cookies.
+ *
+ * @param cookies     Raw cookies from all parsed files
+ * @param provider    Inferred (or hinted) provider; used for domain filtering and tagging
+ * @param nowSec      Override for the current Unix seconds (test seam)
+ */
+export function normalize(cookies, provider, nowSec = Math.floor(Date.now() / 1000)) {
+    if (!Array.isArray(cookies) || cookies.length === 0)
+        return [];
+    const dedup = new Map();
+    for (const c of cookies) {
+        // Rule 1: empty fields.
+        if (!c.name || !c.value)
+            continue;
+        // Rule 2: domain must match provider (skip for unknown provider).
+        if (provider && !domainMatchesProvider(c.domain, provider))
+            continue;
+        // Rule 3: expired.
+        if (isExpired(c, nowSec))
+            continue;
+        // Rule 4 + 5: dedupe by (domain, name); last wins. Tag with provider.
+        const key = `${c.domain}::${c.name}`;
+        dedup.set(key, { ...c, provider });
+    }
+    return Array.from(dedup.values());
+}
+//# sourceMappingURL=normalize.js.map

package/packages/cookie-sanitizer/dist/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../src/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CACpC,MAAc,EACd,QAAoB;IAEpB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,SAAS;YACb,OAAO,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACxD,KAAK,WAAW;YACf,OAAO,CAAC,KAAK,eAAe,IAAI,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC9D,KAAK,QAAQ;YACZ,OAAO,CACN,CAAC,KAAK,YAAY;gBAClB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACzB,CAAC,KAAK,aAAa;gBACnB,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC1B,CAAC;QACH,KAAK,KAAK;YACT,OAAO,CACN,CAAC,KAAK,MAAM;gBACZ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACnB,CAAC,KAAK,YAAY;gBAClB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CACzB,CAAC;QACH,KAAK,YAAY;YAChB,OAAO,CAAC,KAAK,eAAe,IAAI,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC9D;YACC,2DAA2D;YAC3D,OAAO,IAAI,CAAC;IACd,CAAC;AACF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CACxB,MAAuB,EACvB,MAAM,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAE9C,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,iBAAiB;IAC3D,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,0BAA0B;IACjE,OAAO,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACxB,OAA0B,EAC1B,QAAoB,EACpB,MAAM,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAE9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEjD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,wBAAwB;QACxB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,SAAS;QAElC,kEAAkE;QAClE,IAAI,QAAQ,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,SAAS;QAErE,mBAAmB;QACnB,IAAI,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC;YAAE,SAAS;QAEnC,sEAAsE;QACtE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/packages/cookie-sanitizer/dist/parse-json.d.ts

@@ -0,0 +1,45 @@
+/**
+ * EditThisCookie / Chrome devtools JSON cookie export parser.
+ *
+ * Browser extension "EditThisCookie" and Chrome devtools both export
+ * cookies in this canonical shape (Chrome/Edge/Chromium cookie store):
+ *
+ * ```json
+ * [
+ *   {
+ *     "domain": ".minimax.io",
+ *     "expirationDate": 1760000000.123,
+ *     "hostOnly": false,
+ *     "httpOnly": true,
+ *     "name": "_token",
+ *     "path": "/",
+ *     "sameSite": "no_restriction",
+ *     "secure": true,
+ *     "session": false,
+ *     "storeId": "0",
+ *     "value": "...",
+ *     "id": 1
+ *   }
+ * ]
+ * ```
+ *
+ * Some tools may export a single object (not an array). Handle both.
+ *
+ * SEC-001: Cookie VALUES are returned as strings in-memory. Never logged.
+ */
+import type { CanonicalCookie } from "./types.js";
+/**
+ * Parse EditThisCookie / Chrome devtools JSON export.
+ *
+ * Accepts:
+ * - top-level array of records
+ * - top-level single object
+ *
+ * Skips:
+ * - non-object entries
+ * - records without non-empty name+value
+ *
+ * Never throws; returns empty array on parse failure.
+ */
+export declare function parseEditThisCookieJson(text: string): CanonicalCookie[];
+//# sourceMappingURL=parse-json.d.ts.map

package/packages/cookie-sanitizer/dist/parse-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-json.d.ts","sourceRoot":"","sources":["../src/parse-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAclD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,EAAE,CAyCvE"}

package/packages/cookie-sanitizer/dist/parse-json.js

@@ -0,0 +1,108 @@
+/**
+ * EditThisCookie / Chrome devtools JSON cookie export parser.
+ *
+ * Browser extension "EditThisCookie" and Chrome devtools both export
+ * cookies in this canonical shape (Chrome/Edge/Chromium cookie store):
+ *
+ * ```json
+ * [
+ *   {
+ *     "domain": ".minimax.io",
+ *     "expirationDate": 1760000000.123,
+ *     "hostOnly": false,
+ *     "httpOnly": true,
+ *     "name": "_token",
+ *     "path": "/",
+ *     "sameSite": "no_restriction",
+ *     "secure": true,
+ *     "session": false,
+ *     "storeId": "0",
+ *     "value": "...",
+ *     "id": 1
+ *   }
+ * ]
+ * ```
+ *
+ * Some tools may export a single object (not an array). Handle both.
+ *
+ * SEC-001: Cookie VALUES are returned as strings in-memory. Never logged.
+ */
+/**
+ * Parse EditThisCookie / Chrome devtools JSON export.
+ *
+ * Accepts:
+ * - top-level array of records
+ * - top-level single object
+ *
+ * Skips:
+ * - non-object entries
+ * - records without non-empty name+value
+ *
+ * Never throws; returns empty array on parse failure.
+ */
+export function parseEditThisCookieJson(text) {
+    if (typeof text !== "string" || text.length === 0)
+        return [];
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    const records = [];
+    if (Array.isArray(data)) {
+        for (const item of data) {
+            if (item && typeof item === "object" && !Array.isArray(item)) {
+                records.push(item);
+            }
+        }
+    }
+    else if (data && typeof data === "object" && !Array.isArray(data)) {
+        records.push(data);
+    }
+    const cookies = [];
+    for (const r of records) {
+        const name = asString(r.name);
+        const value = asString(r.value);
+        if (!name || !value)
+            continue;
+        const expires = asExpires(r.expirationDate, r.session);
+        cookies.push({
+            name,
+            value,
+            domain: asString(r.domain) ?? "",
+            path: asString(r.path) ?? "/",
+            expires,
+            secure: asBool(r.secure) ?? false,
+            httpOnly: asBool(r.httpOnly) ?? false,
+        });
+    }
+    return cookies;
+}
+function asString(v) {
+    if (typeof v === "string" && v.length > 0)
+        return v;
+    return undefined;
+}
+function asBool(v) {
+    if (typeof v === "boolean")
+        return v;
+    if (v === 1 || v === "1" || v === "true" || v === "TRUE")
+        return true;
+    if (v === 0 || v === "0" || v === "false" || v === "FALSE")
+        return false;
+    return undefined;
+}
+function asExpires(v, session) {
+    if (session === true || session === "true")
+        return undefined;
+    if (typeof v === "number" && Number.isFinite(v)) {
+        // EditThisCookie uses unix-seconds (with millisecond decimals sometimes).
+        // If v > 1e12, it's milliseconds — convert.
+        const seconds = v > 1e12 ? Math.floor(v / 1000) : Math.floor(v);
+        return seconds > 0 ? seconds : undefined;
+    }
+    return undefined;
+}
+//# sourceMappingURL=parse-json.js.map

package/packages/cookie-sanitizer/dist/parse-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-json.js","sourceRoot":"","sources":["../src/parse-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAgBH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE7D,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9D,OAAO,CAAC,IAAI,CAAC,IAA4B,CAAC,CAAC;YAC5C,CAAC;QACF,CAAC;IACF,CAAC;SAAM,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,IAA4B,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,SAAS;QAE9B,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAEvD,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,KAAK;YACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAChC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG;YAC7B,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK;YACjC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK;SACrC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACzB,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,CAAU,EAAE,OAAgB;IAC9C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC"}

package/packages/cookie-sanitizer/dist/parse-netscape.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Netscape-format cookie file parser.
+ *
+ * Format reference: https://curl.haxx.se/rfc/cookie_spec.html
+ *
+ * Each row is tab-separated, 7 columns:
+ *   domain  flag  path  secure  expires  name  value
+ *
+ * - Lines starting with `# ` are comments (skipped).
+ * - Lines starting with `#HttpOnly_` are HTTP-only cookies
+ *   (the leading `#HttpOnly_` is stripped, the rest is parsed normally).
+ * - Empty lines are skipped.
+ * - `expires` is Unix seconds; `0` or unparseable → session cookie.
+ * - Lines with fewer than 7 columns are skipped (malformed).
+ *
+ * SEC-001: Cookie values are returned as strings in-memory. They MUST
+ * never be logged. The scrubber in cookie-sanitizer applies value
+ * redaction before any path-touching log line.
+ */
+import type { CanonicalCookie } from "./types.js";
+/**
+ * Parse a Netscape-format cookie string into canonical records.
+ *
+ * Skips:
+ * - blank lines
+ * - comments (lines starting with `#` but not `#HttpOnly_`)
+ * - malformed rows (< 7 columns)
+ *
+ * Never throws; returns empty array if input is invalid.
+ */
+export declare function parseNetscape(text: string): CanonicalCookie[];
+/**
+ * Serialize a list of canonical cookies back to Netscape format.
+ * Used by atomic-write.ts to produce the canonical cache.
+ *
+ * Output uses the canonical column order:
+ *   domain  flag  path  secure  expires  name  value
+ *
+ * `flag` is FALSE per curl spec (HttpOnly is encoded as `#HttpOnly_`).
+ * Cookie values are NEVER logged during the round-trip.
+ */
+export declare function serializeNetscape(cookies: CanonicalCookie[]): string;
+//# sourceMappingURL=parse-netscape.d.ts.map

package/packages/cookie-sanitizer/dist/parse-netscape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-netscape.d.ts","sourceRoot":"","sources":["../src/parse-netscape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAalD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,EAAE,CA8C7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,CAgBpE"}

package/packages/cookie-sanitizer/dist/parse-netscape.js

@@ -0,0 +1,99 @@
+/**
+ * Netscape-format cookie file parser.
+ *
+ * Format reference: https://curl.haxx.se/rfc/cookie_spec.html
+ *
+ * Each row is tab-separated, 7 columns:
+ *   domain  flag  path  secure  expires  name  value
+ *
+ * - Lines starting with `# ` are comments (skipped).
+ * - Lines starting with `#HttpOnly_` are HTTP-only cookies
+ *   (the leading `#HttpOnly_` is stripped, the rest is parsed normally).
+ * - Empty lines are skipped.
+ * - `expires` is Unix seconds; `0` or unparseable → session cookie.
+ * - Lines with fewer than 7 columns are skipped (malformed).
+ *
+ * SEC-001: Cookie values are returned as strings in-memory. They MUST
+ * never be logged. The scrubber in cookie-sanitizer applies value
+ * redaction before any path-touching log line.
+ */
+/**
+ * Parse a Netscape-format cookie string into canonical records.
+ *
+ * Skips:
+ * - blank lines
+ * - comments (lines starting with `#` but not `#HttpOnly_`)
+ * - malformed rows (< 7 columns)
+ *
+ * Never throws; returns empty array if input is invalid.
+ */
+export function parseNetscape(text) {
+    if (typeof text !== "string" || text.length === 0)
+        return [];
+    const rows = [];
+    const lines = text.split(/\r?\n/);
+    for (const raw of lines) {
+        if (!raw)
+            continue;
+        let line = raw;
+        let httpOnly = false;
+        if (line.startsWith("#HttpOnly_")) {
+            httpOnly = true;
+            line = line.slice("#HttpOnly_".length);
+        }
+        else if (line.startsWith("#")) {
+            // Plain comment line (Netscape / curl spec).
+            continue;
+        }
+        const cols = line.split("\t");
+        if (cols.length < 7)
+            continue;
+        const [domain, _flag, cookiePath, secure, expires, name, value] = cols;
+        if (!name || !value)
+            continue;
+        rows.push({
+            domain: (domain ?? "").trim(),
+            path: (cookiePath ?? "/").trim() || "/",
+            secure: (secure ?? "FALSE").toUpperCase() === "TRUE",
+            httpOnly,
+            expires: parseInt(expires ?? "0", 10) || 0,
+            name: name.trim(),
+            value, // intentional: keep as-is for in-memory pipeline; never log
+        });
+    }
+    // Map to CanonicalCookie shape.
+    return rows.map((r) => ({
+        name: r.name,
+        value: r.value,
+        domain: r.domain,
+        path: r.path,
+        expires: r.expires === 0 ? undefined : r.expires,
+        secure: r.secure,
+        httpOnly: r.httpOnly,
+    }));
+}
+/**
+ * Serialize a list of canonical cookies back to Netscape format.
+ * Used by atomic-write.ts to produce the canonical cache.
+ *
+ * Output uses the canonical column order:
+ *   domain  flag  path  secure  expires  name  value
+ *
+ * `flag` is FALSE per curl spec (HttpOnly is encoded as `#HttpOnly_`).
+ * Cookie values are NEVER logged during the round-trip.
+ */
+export function serializeNetscape(cookies) {
+    const out = ["# Netscape HTTP Cookie File", ""];
+    for (const c of cookies) {
+        if (!c.name || !c.value)
+            continue;
+        const domain = c.domain ?? "";
+        const path = c.path ?? "/";
+        const secure = c.secure ? "TRUE" : "FALSE";
+        const expires = c.expires != null ? String(c.expires) : "0";
+        const line = [domain, "FALSE", path, secure, expires, c.name, c.value].join("\t");
+        out.push(c.httpOnly ? `#HttpOnly_${line}` : line);
+    }
+    return out.join("\n") + "\n";
+}
+//# sourceMappingURL=parse-netscape.js.map

package/packages/cookie-sanitizer/dist/parse-netscape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-netscape.js","sourceRoot":"","sources":["../src/parse-netscape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAeH;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE7D,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAElC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,IAAI,GAAG,GAAG,CAAC;QACf,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,6CAA6C;YAC7C,SAAS;QACV,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAE9B,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC;QACvE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,SAAS;QAE9B,IAAI,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC7B,IAAI,EAAE,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG;YACvC,MAAM,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;YACpD,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACjB,KAAK,EAAE,4DAA4D;SACnE,CAAC,CAAC;IACJ,CAAC;IAED,gCAAgC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QAChD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA0B;IAC3D,MAAM,GAAG,GAAa,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;IAE1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,SAAS;QAClC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAC1E,IAAI,CACJ,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC9B,CAAC"}

package/packages/cookie-sanitizer/dist/sync.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Sync orchestrator — the heart of the sanitizer.
+ *
+ * Pipeline (per run):
+ *   1. Enumerate files in the drop folder (one level + one sublevel).
+ *   2. Read each file. Detect format. Parse.
+ *   3. Concatenate cookies from all parsed files.
+ *   4. Infer provider from filename + cookies.
+ *   5. Normalize (dedupe, expire, domain-match).
+ *   6. Serialize to Netscape and write to the canonical cache (atomic).
+ *
+ * Returns a SyncResult. Never throws — returns structured errors in `result.errors`.
+ *
+ * Sec-001: Cookie VALUES never appear in any log line. Diagnostics
+ * use file basenames and 64-char previews with values redacted.
+ */
+import type { SyncOptions, SyncResult } from "./types.js";
+/** Default drop-folder location. */
+export declare const DEFAULT_DROP_DIR: string;
+/**
+ * Enumerate readable files inside `dir`, up to MAX_DEPTH.
+ * Returns absolute paths. Skips dotfiles, editor temp files.
+ *
+ * `excludePath` (optional) — absolute path of a file to skip, e.g.
+ * the canonical cache file (so we never recursively read it).
+ */
+export declare function enumerateDropFiles(dir: string, excludePath?: string): string[];
+/**
+ * Read a single input file as text, capped at MAX_INPUT_BYTES.
+ * Returns null + a `reason` if the file can't be read.
+ */
+export declare function readInputFile(filePath: string): {
+    text: string;
+    reason?: string;
+};
+/**
+ * Run the full sync pipeline.
+ *
+ * Options:
+ *   - dropDir      default: ~/.pi-harness-runtime/cookies/
+ *   - cachePath    default: ~/.config/<provider>-cookies.txt
+ *   - providerHint override inference (skips filename/domain checks)
+ *   - dryRun       skip the actual file write (still returns would-be result)
+ *
+ * Returns a SyncResult. Never throws.
+ */
+export declare function sync(opts?: SyncOptions): SyncResult;
+/**
+ * Has-any-input check: true if the drop folder has anything readable.
+ * Cheap — does a single `readdirSync`; no parsing.
+ */
+export declare function hasAnyCookieSource(dropDir?: string): boolean;
+/**
+ * Convenience: cache path for the dominant provider in the drop folder,
+ * or null if nothing's there. Used by `footer-status.ts` to ask "should
+ * the footer hint point at this provider?"
+ */
+export declare function inferCachePath(dropDir?: string): string | null;
+export { inferProvider, inferProviderFromFilename, inferProviderFromCookies, } from "./infer-provider.js";
+export { defaultCachePathFor } from "./atomic-write.js";
+export type { SyncOptions, SyncResult, CanonicalCookie, ProviderId, DetectedFile, CookieFileFormat, WatcherEvent, } from "./types.js";
+//# sourceMappingURL=sync.d.ts.map

package/packages/cookie-sanitizer/dist/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAmB,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAY3E,oCAAoC;AACpC,eAAO,MAAM,gBAAgB,QAI5B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,GAClB,MAAM,EAAE,CA6CV;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAmBA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,IAAI,CAAC,IAAI,GAAE,WAAgB,GAAG,UAAU,CAiHvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,GAAE,MAAyB,GAChC,OAAO,CAET;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC7B,OAAO,GAAE,MAAyB,GAChC,MAAM,GAAG,IAAI,CAqBf;AAED,OAAO,EACN,aAAa,EACb,yBAAyB,EACzB,wBAAwB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,YAAY,EACX,WAAW,EACX,UAAU,EACV,eAAe,EACf,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACZ,MAAM,YAAY,CAAC"}