pi-information-protecter 0.2.0 → 0.3.0

package/src/engine.ts

@@ -1,130 +0,0 @@
-import { Worker } from "node:worker_threads";
-import { fileURLToPath } from "node:url";
-import { migrateConfig, type Snapshot } from "./migration.ts";
-import { getMachineHash } from "./machine.ts";
-
-export const REQUEST_ERROR =
-  "protecter: 请求已清空。配置无效、扫描超时或包含不支持的附件；修复后重试。";
-export class Protecter {
-  private readonly tokens = new Map<string, string>();
-  private queue: Promise<unknown> = Promise.resolve();
-  private readonly workers = new Set<Worker>();
-  private closed = false;
-  private snapshot?: Snapshot;
-  constructor(
-    private readonly configDir: string,
-    private readonly timeoutMs = 2000,
-    private readonly machineId: () => string = getMachineHash,
-  ) {}
-
-  async initialize(): Promise<void> {
-    if (this.closed) throw new Error(REQUEST_ERROR);
-    this.snapshot = undefined;
-    const snapshot = await migrateConfig(this.configDir, this.machineId());
-    if (this.closed) throw new Error(REQUEST_ERROR);
-    this.snapshot = snapshot;
-  }
-  get configPath(): string { return this.snapshot?.path ?? ""; }
-  get ruleCount(): number { return this.snapshot?.config.sensitiveWords.length ?? 0; }
-  get ready(): boolean { return !!this.snapshot && !this.closed; }
-  get mappingCount(): number {
-    return this.tokens.size;
-  }
-
-  /**
-   * Serialise scans so two requests cannot assign different tokens to the same value.
-   * 串行扫描，避免两个请求为同一原文分配不同占位符。
-   */
-  redact(payload: unknown): Promise<unknown> {
-    const run = this.queue.then(() => this.scan(payload));
-    this.queue = run.catch(() => undefined);
-    return run;
-  }
-
-  private async scan(payload: unknown): Promise<unknown> {
-    if (!this.ready) throw new Error(REQUEST_ERROR);
-    const { config, sourceRaws } = this.snapshot!;
-    const serialized = JSON.stringify(payload);
-    if (!serialized || Buffer.byteLength(serialized) > 8 * 1024 * 1024)
-      throw new Error(REQUEST_ERROR);
-    let snapshot: unknown;
-    try {
-      snapshot = JSON.parse(serialized);
-    } catch {
-      throw new Error(REQUEST_ERROR);
-    }
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const worker = new Worker(
-        fileURLToPath(new URL("./scan-worker.mjs", import.meta.url)),
-        {
-          workerData: {
-            payload: snapshot,
-            rules: config.sensitiveWords,
-            entries: [...this.tokens],
-            configRaws: sourceRaws,
-          },
-          execArgv: [],
-          resourceLimits: { maxOldGenerationSizeMb: 128 },
-        },
-      );
-      this.workers.add(worker);
-      const finish = (data?: {
-        payload: unknown;
-        additions: [string, string][];
-      }) => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timer);
-        this.workers.delete(worker);
-        void worker.terminate();
-        if (!data || this.closed) {
-          reject(new Error(REQUEST_ERROR));
-          return;
-        }
-        for (const [token, original] of data.additions)
-          this.tokens.set(token, original);
-        resolve(data.payload);
-      };
-      const timer = setTimeout(() => finish(), this.timeoutMs);
-      worker.once("message", (data) => finish(data.failed ? undefined : data));
-      worker.once("error", () => finish());
-      worker.once("exit", () => finish());
-    });
-  }
-
-  restoreText(text: string): string {
-    // One pass, never recursively expand text introduced by a replacement.
-    // 仅替换一遍，不递归展开替换后引入的文本。
-    return text.replace(
-      /__PIP_[a-f0-9]{48}__/g,
-      (token) => this.tokens.get(token) ?? token,
-    );
-  }
-
-  restore<T>(value: T, depth = 0): T {
-    if (depth > 80) throw new Error("protecter: 响应层级过深。");
-    if (typeof value === "string") return this.restoreText(value) as T;
-    if (Array.isArray(value))
-      return value.map((item) => this.restore(item, depth + 1)) as T;
-    if (value && typeof value === "object") {
-      const result: Record<string, unknown> = Object.create(null);
-      for (const [key, item] of Object.entries(value)) {
-        const nextKey = this.restoreText(key);
-        if (Object.hasOwn(result, nextKey))
-          throw new Error("protecter: 响应键冲突。");
-        result[nextKey] = this.restore(item, depth + 1);
-      }
-      return result as T;
-    }
-    return value;
-  }
-
-  close(): void {
-    this.closed = true;
-    this.snapshot = undefined;
-    this.tokens.clear();
-    for (const worker of this.workers) void worker.terminate();
-    this.workers.clear();
-  }
-}

package/src/guard.ts

@@ -1,73 +0,0 @@
-import { realpathSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
-import { CONFIG_NAME } from "./migration.ts";
-import { fileURLToPath } from "node:url";
-
-function normalized(path: string, cwd: string): string {
-  let value = path.replace(/^@/, "");
-  if (value.startsWith("file://")) value = fileURLToPath(value);
-  if (value === "~" || value.startsWith("~/"))
-    value = homedir() + value.slice(1);
-  return resolve(cwd, value);
-}
-function canonical(path: string): string {
-  try {
-    return realpathSync(path);
-  } catch {
-    const parent = dirname(path);
-    return parent === path
-      ? path
-      : resolve(canonical(parent), relative(parent, path));
-  }
-}
-function contains(parent: string, child: string): boolean {
-  const rel = relative(parent, child);
-  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-}
-function sameFile(a: string, b: string): boolean {
-  try {
-    const x = statSync(a),
-      y = statSync(b);
-    return x.dev === y.dev && x.ino === y.ino;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Best-effort access guard. Arbitrary shell/third-party tools are NOT sandboxed.
- * 尽力而为的访问防护，不对任意 shell 或第三方工具提供沙箱隔离。
- */
-export function blocksConfigAccess(
-  tool: string,
-  input: Record<string, unknown>,
-  cwd: string,
-  configPath: string,
-): boolean {
-  if (!configPath) return true;
-  const target = canonical(resolve(configPath));
-  // Inspect executable fields, not document bodies. / 检查可执行字段，不检查文档正文。
-  if (["bash", "powershell"].includes(tool)) {
-    const command = typeof input.command === "string" ? input.command : "";
-    if (/protecter(?:\.[a-f0-9]{32})?\.json|\.protecter-migration/i.test(command) || command.includes(configPath)) return true;
-  }
-  const candidate = input.path ?? input.file_path ?? input.filePath;
-  const recursive = ["grep", "find", "ls"].includes(tool);
-  if (typeof candidate !== "string" && !recursive) return false;
-  try {
-    const path = normalized(
-      typeof candidate === "string" ? candidate : ".",
-      cwd,
-    );
-    const real = canonical(path);
-    return (
-      (dirname(real) === dirname(target) && (CONFIG_NAME.test(basename(real)) || basename(real).startsWith(".protecter-migration"))) ||
-      real === target ||
-      sameFile(path, configPath) ||
-      (recursive && contains(real, target))
-    );
-  } catch {
-    return true;
-  }
-}

package/src/index.ts

@@ -1,151 +0,0 @@
-import {
-  getAgentDir,
-  VERSION,
-  type ExtensionAPI,
-} from "@earendil-works/pi-coding-agent";
-import { Protecter, REQUEST_ERROR } from "./engine.ts";
-import { blocksConfigAccess } from "./guard.ts";
-
-/**
- * Explicitly install this after other extensions that rewrite outgoing payloads.
- * 请将本扩展放在其他改写出站请求体的扩展之后加载。
- */
-export default function informationProtecter(pi: ExtensionAPI): void {
-  const engine = new Protecter(getAgentDir());
-  const compatible =
-    /^0\.85\./.test(VERSION) && Number(VERSION.split(".")[2]) >= 1;
-  let healthy = false;
-
-  pi.on("session_start", async (_event, ctx) => {
-    try {
-      if (!compatible) throw new Error();
-      await engine.initialize();
-      healthy = true;
-      const count = engine.ruleCount;
-      ctx.ui.setStatus("protecter", `SPI Protecter · ${count} rules`);
-      if (count === 0)
-        ctx.ui.notify(
-          "SPI Protecter: empty rules; edit local machine config and /reload / 规则为空，请编辑本地机器配置后重载。",
-          "warning",
-        );
-    } catch {
-      healthy = false;
-      ctx.ui.notify(REQUEST_ERROR, "error");
-    }
-  });
-
-  pi.on("before_provider_request", async (event, ctx) => {
-    try {
-      if (!compatible) throw new Error();
-      const payload = await engine.redact(event.payload);
-      healthy = true;
-      return payload;
-    } catch {
-      healthy = false;
-      // Pi catches hook errors and continues with the ORIGINAL payload.
-      // Pi 会捕获钩子异常并继续使用原始请求体。
-      // Always return an empty replacement; abort/notifications are best-effort.
-      // 必须返回空替代请求体；终止请求和通知仅作尽力处理。
-      try {
-        await ctx.abort();
-      } catch {
-        /* Replacement below remains mandatory. / 仍须返回下方的替代请求体。 */
-      }
-      try {
-        ctx.ui.notify(REQUEST_ERROR, "error");
-      } catch {
-        /* Never fail open. / 不因异常放行原文。 */
-      }
-      // May produce a provider validation error, but contains NO original data.
-      // 可能触发提供商校验错误，但不包含任何原始数据。
-      return {};
-    }
-  });
-
-  pi.on("message_end", (event) => {
-    if (event.message.role !== "assistant") return;
-    // Preserve IDs, signatures, usage and provider metadata; only restore user-facing content.
-    // 保留 ID、签名、用量与提供商元数据，仅还原面向用户的内容。
-    const message = event.message;
-    return {
-      message: {
-        ...message,
-        content: message.content.map((block) => {
-          if (block.type === "text")
-            return { ...block, text: engine.restoreText(block.text) };
-          if (block.type === "thinking")
-            return { ...block, thinking: engine.restoreText(block.thinking) };
-          if (block.type === "toolCall")
-            return { ...block, arguments: engine.restore(block.arguments) };
-          return block;
-        }),
-        ...(message.errorMessage
-          ? { errorMessage: engine.restoreText(message.errorMessage) }
-          : {}),
-      },
-    };
-  });
-
-  pi.registerMarkdownTransformer((text, context) =>
-    context.messageType === "user" ? text : engine.restoreText(text),
-  );
-
-  pi.on("tool_call", (event, ctx) => {
-    if (!healthy) return { block: true, reason: "SPI Protecter 尚未就绪。" };
-    const restored = engine.restore(event.input);
-    for (const key of Object.keys(event.input))
-      delete (event.input as Record<string, unknown>)[key];
-    Object.assign(event.input, restored);
-    if (
-      blocksConfigAccess(
-        event.toolName,
-        event.input,
-        ctx.cwd,
-        engine.configPath,
-      )
-    ) {
-      return {
-        block: true,
-        reason: "SPI Protecter：禁止工具访问保护配置，请由用户在本地编辑。",
-      };
-    }
-  });
-
-  // These auxiliary requests have different lifecycle/response restoration semantics.
-  // 这些辅助请求具有不同的生命周期与响应还原语义。
-  // Until separately verified, cancel instead of silently sending plaintext summaries.
-  // 在单独验证前取消这些请求，避免静默发送明文摘要。
-  pi.on("session_before_compact", (_event, ctx) => {
-    ctx.ui.notify(
-      "SPI Protecter：暂不支持远程上下文压缩，请使用 /new 开始新会话。",
-      "warning",
-    );
-    return { cancel: true };
-  });
-  pi.on("session_before_tree", (event) =>
-    event.preparation.userWantsSummary ? { cancel: true } : undefined,
-  );
-
-  pi.registerCommand("protecter", {
-    description: "SPI Protecter memory status / 内存状态（不显示敏感值）",
-    handler: async (args, ctx) => {
-      if (args.trim() && !["status", "reload"].includes(args.trim())) {
-        ctx.ui.notify(
-          "用法：/protecter [status|reload]。不要在命令参数中填写敏感值。",
-          "info",
-        );
-        return;
-      }
-      if (args.trim() === "reload") {
-        await ctx.waitForIdle();
-        await ctx.reload();
-        return;
-      }
-      ctx.ui.notify(
-        `SPI Protecter: ${engine.ready ? "ready / 就绪" : "not ready / 未就绪"}; ${engine.ruleCount} rules / 规则; ${engine.mappingCount} mappings / 映射. Memory snapshot; /reload to refresh / 内存快照，重载后更新。`,
-        engine.ready ? "info" : "error",
-      );
-    },
-  });
-  pi.on("session_shutdown", () => engine.close());
-}

package/src/machine.ts

@@ -1,28 +0,0 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { execFileSync } from "node:child_process";
-
-export const MACHINE_ERROR = "SPI Protecter: machine ID unavailable / 无法获取机器标识。";
-
-/** Normalize OS identifiers without exposing them. / 规范化系统标识，不向外暴露。 */
-export function machineHash(id: string): string {
-  const normalized = id.trim().toLowerCase().replace(/-/g, "");
-  if (!/^[a-f0-9]{32}$/.test(normalized) || /^0+$/.test(normalized)) throw new Error(MACHINE_ERROR);
-  return createHash("sha256").update(`pi-information-protecter:v1:${normalized}`).digest("hex").slice(0, 32);
-}
-
-/** No random fallback: unavailable IDs must fail closed. / 不随机回退，标识不可用时拒绝初始化。 */
-export function getMachineHash(): string {
-  try {
-    if (process.platform === "linux") return machineHash(readFileSync("/etc/machine-id", "utf8"));
-    if (process.platform === "darwin") {
-      const text = execFileSync("/usr/sbin/ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], { encoding: "utf8", timeout: 5000, maxBuffer: 1024 * 1024, stdio: ["ignore", "pipe", "pipe"] });
-      return machineHash(text.match(/"IOPlatformUUID"\s*=\s*"([a-fA-F0-9-]+)"/)?.[1] ?? "");
-    }
-    if (process.platform === "win32") {
-      const text = execFileSync("reg.exe", ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid", "/reg:64"], { encoding: "utf8", timeout: 5000, maxBuffer: 65536, stdio: ["ignore", "pipe", "pipe"] });
-      return machineHash(text.match(/MachineGuid\s+REG_SZ\s+([a-fA-F0-9-]+)/i)?.[1] ?? "");
-    }
-  } catch { /* Do not expose command output. / 不暴露命令输出。 */ }
-  throw new Error(MACHINE_ERROR);
-}

package/src/migration.ts

@@ -1,127 +0,0 @@
-import * as fs from "node:fs";
-import { join, resolve } from "node:path";
-import { createHash, randomUUID } from "node:crypto";
-import { Worker } from "node:worker_threads";
-import { fileURLToPath } from "node:url";
-import { CONFIG_ERROR, DEFAULT_CONFIG, loadConfig, parseConfig, type Config, type Rule } from "./config.ts";
-
-export const CONFIG_NAME = /^protecter(?:\.[a-f0-9]{32})?\.json$/;
-export interface Snapshot { path: string; config: Config; raw: string; sourceRaws: string[]; migrated: number }
-interface Source { name: string; raw: string; config: Config; identity: string; digest: string }
-export interface MigrationOptions {
-  lockTimeoutMs?: number;
-  // Local fault injection for regression tests only. / 仅供本地回归测试注入故障。
-  checkpoint?: (stage: "beforeCommit" | "afterCommit" | "beforeDelete", path: string) => void;
-}
-
-export function validatePatterns(configs: Config[]): Promise<void> {
-  return new Promise((resolvePromise, reject) => {
-    const worker = new Worker(fileURLToPath(new URL("./validate-worker.mjs", import.meta.url)), { workerData: configs, execArgv: [], resourceLimits: { maxOldGenerationSizeMb: 64 } });
-    let done = false;
-    const finish = (ok: boolean) => {
-      if (done) return;
-      done = true;
-      clearTimeout(timer);
-      void worker.terminate();
-      if (ok) resolvePromise(); else reject(new Error(CONFIG_ERROR));
-    };
-    const timer = setTimeout(() => finish(false), 2000);
-    worker.once("message", value => finish(value === true));
-    worker.once("error", () => finish(false));
-    worker.once("exit", () => finish(false));
-  });
-}
-
-export function mergeConfigs(configs: Config[]): Config {
-  const seen = new Set<string>();
-  const rules: Rule[] = [];
-  for (const config of configs) for (const rule of config.sensitiveWords) {
-    const key = typeof rule === "string" ? JSON.stringify(["literal", rule]) : rule.type === "literal" ? JSON.stringify(["literal", rule.value]) : JSON.stringify(["regex", rule.pattern, [...new Set((rule.flags ?? "") + "g")].sort().join("")]);
-    if (!seen.has(key)) { seen.add(key); rules.push(rule); }
-  }
-  const raw = JSON.stringify({ version: 1, sensitiveWords: rules });
-  if (Buffer.byteLength(raw) > 1024 * 1024) throw new Error(CONFIG_ERROR);
-  return parseConfig(raw);
-}
-
-function identity(path: string): string {
-  const s = fs.lstatSync(path, { bigint: true });
-  if (!s.isFile() || s.nlink !== 1n || (process.getuid && s.uid !== BigInt(process.getuid()))) throw new Error(CONFIG_ERROR);
-  return `${s.dev}:${s.ino}:${s.size}:${s.mtimeNs}`;
-}
-function source(dir: string, name: string): Source {
-  const path = join(dir, name), before = identity(path);
-  const loaded = loadConfig(path);
-  if (identity(path) !== before) throw new Error(CONFIG_ERROR);
-  return { name, ...loaded, identity: before, digest: createHash("sha256").update(loaded.raw).digest("hex") };
-}
-function unchanged(dir: string, previous: Source): void {
-  const now = source(dir, previous.name);
-  if (now.identity !== previous.identity || now.digest !== previous.digest) throw new Error(CONFIG_ERROR);
-}
-function names(dir: string): string[] { return fs.readdirSync(dir).filter(name => CONFIG_NAME.test(name)).sort(); }
-function syncDir(dir: string): void {
-  // Windows does not support POSIX directory fsync. / Windows 不支持 POSIX 目录同步。
-  if (process.platform === "win32") return;
-  const fd = fs.openSync(dir, fs.constants.O_RDONLY);
-  try { fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
-}
-
-/** Commit before deleting; repeat safely after partial cleanup. / 先提交再删除，部分清理后可安全重试。 */
-export async function migrateConfig(directory: string, hash: string, options: MigrationOptions = {}): Promise<Snapshot> {
-  if (!/^[a-f0-9]{32}$/.test(hash)) throw new Error(CONFIG_ERROR);
-  const dir = resolve(directory), targetName = `protecter.${hash}.json`, path = join(dir, targetName);
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  const lock = join(dir, ".protecter-migration.lock"), deadline = Date.now() + (options.lockTimeoutMs ?? 5000);
-  for (;;) {
-    try { fs.mkdirSync(lock, { mode: 0o700 }); break; }
-    catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST" || Date.now() >= deadline) throw new Error("SPI Protecter: migration locked; check active processes / 迁移锁被占用，请检查活动进程。");
-      await new Promise(resolvePromise => setTimeout(resolvePromise, 50));
-    }
-  }
-  let temp: string | undefined;
-  try {
-    const discovered = names(dir);
-    if (discovered.length > 64) throw new Error(CONFIG_ERROR);
-    const ordered = [...discovered].sort((a, b) => a === targetName ? -1 : b === targetName ? 1 : a.localeCompare(b));
-    const sources = ordered.map(name => source(dir, name));
-    const config = mergeConfigs(sources.length ? sources.map(s => s.config) : [DEFAULT_CONFIG]);
-    await validatePatterns(sources.length ? sources.map(s => s.config) : [config]);
-    if (sources.length === 1 && sources[0].name === targetName) {
-      unchanged(dir, sources[0]);
-      if (JSON.stringify(names(dir)) !== JSON.stringify(discovered)) throw new Error(CONFIG_ERROR);
-      return { path, config: sources[0].config, raw: sources[0].raw, sourceRaws: [sources[0].raw], migrated: 0 };
-    }
-    const raw = JSON.stringify(config, null, 2) + "\n";
-    if (Buffer.byteLength(raw) > 1024 * 1024) throw new Error(CONFIG_ERROR);
-    temp = join(dir, `.protecter-migration.${randomUUID()}.tmp`);
-    const fd = fs.openSync(temp, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o600);
-    try { fs.writeFileSync(fd, raw); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
-    options.checkpoint?.("beforeCommit", path);
-    if (JSON.stringify(names(dir)) !== JSON.stringify(discovered)) throw new Error(CONFIG_ERROR);
-    for (const s of sources) unchanged(dir, s);
-    fs.renameSync(temp, path);
-    temp = undefined;
-    syncDir(dir);
-    const committed = source(dir, targetName);
-    if (committed.raw !== raw) throw new Error(CONFIG_ERROR);
-    options.checkpoint?.("afterCommit", path);
-    for (const s of sources) {
-      if (s.name === targetName) continue;
-      options.checkpoint?.("beforeDelete", join(dir, s.name));
-      unchanged(dir, committed);
-      unchanged(dir, s);
-      fs.unlinkSync(join(dir, s.name));
-    }
-    syncDir(dir);
-    const expected = [targetName];
-    if (JSON.stringify(names(dir)) !== JSON.stringify(expected)) throw new Error(CONFIG_ERROR);
-    unchanged(dir, committed);
-    return { path, config, raw, sourceRaws: [...new Set([...sources.map(s => s.raw), raw])], migrated: sources.filter(s => s.name !== targetName).length };
-  } catch { throw new Error(CONFIG_ERROR); }
-  finally {
-    if (temp) { try { fs.unlinkSync(temp); } catch { /* Preserve on failure. / 失败时保留待人工检查。 */ } }
-    fs.rmdirSync(lock);
-  }
-}

package/src/scan-worker.mjs

@@ -1,160 +0,0 @@
-// A separate worker bounds user-supplied JavaScript regex execution (including ReDoS).
-// 独立 worker 限制用户正则的执行时间，包括正则拒绝服务风险。
-import { parentPort, workerData } from "node:worker_threads";
-import { randomBytes } from "node:crypto";
-
-try {
-  const { payload, rules, entries, configRaws } = workerData;
-  const originalToToken = new Map(
-    entries.map(([token, original]) => [original, token]),
-  );
-  const tokenToOriginal = new Map(entries);
-  const additions = [];
-  const matchers = rules.map((rule) => {
-    if (typeof rule === "string") return { literal: rule };
-    if (rule.type === "literal") return { literal: rule.value };
-    return {
-      regex: new RegExp(
-        rule.pattern,
-        [...new Set((rule.flags ?? "") + "g")].join(""),
-      ),
-    };
-  });
-  // A restored value may lose its original regex context (e.g. a Bearer prefix).
-  // 还原后的值可能失去原始正则上下文，例如 Bearer 前缀。
-  // Keep learned originals protected for the lifetime of this extension instance.
-  // 在当前扩展实例的整个生命周期内继续保护已识别的原文。
-  for (const original of originalToToken.keys())
-    matchers.push({ literal: original });
-  // Defense in depth for an accidentally pasted full configuration (not a sandbox).
-  // 对意外粘贴的完整配置提供纵深防护，但这不是沙箱。
-  const protectedTexts = [...new Set(configRaws.flatMap(raw => [raw, JSON.stringify(JSON.parse(raw))]))];
-  for (const literal of protectedTexts) matchers.push({ literal });
-  const payloadText = JSON.stringify(payload);
-  let matches = 0;
-  let nodes = 0;
-  function tokenFor(original) {
-    let token = originalToToken.get(original);
-    if (token) return token;
-    if (tokenToOriginal.size >= 50000) throw new Error();
-    do {
-      token = `__PIP_${randomBytes(24).toString("hex")}__`;
-    } while (tokenToOriginal.has(token) || payloadText.includes(token));
-    originalToToken.set(original, token);
-    tokenToOriginal.set(token, original);
-    additions.push([token, original]);
-    return token;
-  }
-  function redactPlain(text) {
-    const spans = [];
-    for (const matcher of matchers) {
-      if (matcher.literal === undefined) {
-        matcher.regex.lastIndex = 0;
-        for (const match of text.matchAll(matcher.regex)) {
-          if (!match[0].length) throw new Error();
-          spans.push([match.index, match.index + match[0].length]);
-          if (++matches > 100000) throw new Error();
-        }
-      } else {
-        if (!matcher.literal) continue;
-        let start = 0;
-        while ((start = text.indexOf(matcher.literal, start)) !== -1) {
-          spans.push([start, start + matcher.literal.length]);
-          if (++matches > 100000) throw new Error();
-          start++; // Include overlapping occurrences. / 包含重叠匹配。
-        }
-      }
-    }
-    spans.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
-    const merged = [];
-    for (const span of spans) {
-      const prev = merged.at(-1);
-      if (prev && span[0] < prev[1]) prev[1] = Math.max(prev[1], span[1]);
-      else merged.push([...span]);
-    }
-    let result = "",
-      cursor = 0;
-    for (const [start, end] of merged) {
-      result += text.slice(cursor, start) + tokenFor(text.slice(start, end));
-      cursor = end;
-    }
-    return result + text.slice(cursor);
-  }
-  function redact(text) {
-    // Only OUR tokens are exempt, not arbitrary strings with a similar prefix.
-    // 仅豁免本实例生成的占位符，不豁免具有相似前缀的任意字符串。
-    let result = "",
-      cursor = 0;
-    for (const match of text.matchAll(/__PIP_[a-f0-9]{48}__/g)) {
-      if (!tokenToOriginal.has(match[0])) continue;
-      result += redactPlain(text.slice(cursor, match.index)) + match[0];
-      cursor = match.index + match[0].length;
-    }
-    return result + redactPlain(text.slice(cursor));
-  }
-  function walk(value, depth = 0) {
-    if (++nodes > 200000 || depth > 80) throw new Error();
-    if (typeof value === "string") {
-      if (protectedTexts.some(text => value.includes(text)))
-        return redact(value);
-      // OpenAI serializes tool arguments as JSON strings: decode escapes BEFORE matching.
-      // OpenAI 将工具参数序列化为 JSON 字符串，匹配前必须先解码转义。
-      if (/^\s*[[{]/.test(value)) {
-        let parsed;
-        try {
-          parsed = JSON.parse(value);
-        } catch {
-          /* Ordinary prose. / 普通文本。 */
-        }
-        if (parsed && typeof parsed === "object") {
-          const inner = JSON.stringify(walk(parsed, depth + 1));
-          const outer = redact(inner);
-          if (outer === inner) return inner;
-          // A rule may span JSON syntax or match a whole JSON-shaped secret.
-          // 规则可能跨越 JSON 语法，或匹配整个 JSON 形式的敏感值。
-          // Return altered JSON only if it still parses; otherwise reject the request.
-          // 仅返回仍可解析的修改后 JSON，否则拒绝请求。
-          JSON.parse(outer);
-          return outer;
-        }
-      }
-      return redact(value);
-    }
-    if (typeof value === "number") {
-      const transformed = redact(String(value));
-      return transformed === String(value) ? value : transformed;
-    }
-    if (Array.isArray(value)) return value.map((item) => walk(item, depth + 1));
-    if (value && typeof value === "object") {
-      // No claim to perform OCR or redact opaque attachments. Reject rather than leak.
-      // 不提供 OCR 或不透明附件脱敏，宁可拒绝请求也不放行泄漏。
-      if (
-        typeof value.type === "string" &&
-        /image|audio|video|document|(^|_)file($|_)/i.test(value.type)
-      )
-        throw new Error();
-      if (
-        Object.keys(value).some((key) =>
-          /^(inlineData|inline_data|fileData|file_data|image_url|input_audio)$/.test(
-            key,
-          ),
-        )
-      )
-        throw new Error();
-      const result = Object.create(null);
-      for (const [key, item] of Object.entries(value)) {
-        const nextKey = redact(key);
-        if (Object.hasOwn(result, nextKey)) throw new Error();
-        result[nextKey] = walk(item, depth + 1);
-      }
-      return result;
-    }
-    if (value === null || typeof value === "boolean") return value;
-    throw new Error();
-  }
-  parentPort.postMessage({ payload: walk(payload), additions });
-} catch {
-  // Never serialize an exception, original payload or configuration back into diagnostics.
-  // 不将异常、原始请求体或配置序列化到诊断信息中。
-  parentPort.postMessage({ failed: true });
-}

package/src/validate-worker.mjs

@@ -1,13 +0,0 @@
-import { parentPort, workerData } from "node:worker_threads";
-
-try {
-  for (const config of workerData) {
-    for (const rule of config.sensitiveWords) {
-      if (typeof rule === "object" && rule.type === "regex" && new RegExp(rule.pattern, rule.flags ?? "").test("")) throw new Error();
-    }
-  }
-  parentPort.postMessage(true);
-} catch {
-  // Return no rules or parser errors. / 不返回规则或解析错误。
-  parentPort.postMessage(false);
-}