pi-para 0.5.2

package/src/redact.ts

@@ -0,0 +1,159 @@
+/**
+ * Secret redaction — strips API keys, tokens, passwords, and other
+ * sensitive values from wiki page content before writing.
+ *
+ * Runs automatically on every wiki_write to prevent secrets from
+ * being persisted in the knowledge base.
+ */
+
+// -- Patterns ----------------------------------------------------------------
+
+interface SecretPattern {
+  name: string;
+  /** Regex to match the full secret value. */
+  pattern: RegExp;
+  /** Replacement text. */
+  replacement: string;
+}
+
+/**
+ * Secret detection patterns — ordered from most specific to most general.
+ *
+ * Each pattern matches a specific type of secret. The replacement preserves
+ * the key type for documentation purposes while removing the actual value.
+ */
+const SECRET_PATTERNS: SecretPattern[] = [
+  // --- Provider-specific API key formats ---
+  {
+    name: "OpenRouter API key",
+    pattern: /sk-or-v1-[a-f0-9]{64}/g,
+    replacement: "<REDACTED:openrouter-key>",
+  },
+  {
+    name: "OpenAI API key",
+    pattern: /sk-[a-zA-Z0-9]{48,}/g,
+    replacement: "<REDACTED:openai-key>",
+  },
+  {
+    name: "Anthropic API key",
+    pattern: /sk-ant-[a-zA-Z0-9_-]{40,}/g,
+    replacement: "<REDACTED:anthropic-key>",
+  },
+  {
+    name: "MiniMax API key",
+    pattern: /sk-cp-[a-zA-Z0-9_-]{40,}/g,
+    replacement: "<REDACTED:minimax-key>",
+  },
+  {
+    name: "GitHub PAT (fine-grained)",
+    pattern: /github_pat_[a-zA-Z0-9_]{60,}/g,
+    replacement: "<REDACTED:github-pat>",
+  },
+  {
+    name: "GitHub PAT (classic)",
+    pattern: /ghp_[a-zA-Z0-9]{36,}/g,
+    replacement: "<REDACTED:github-pat>",
+  },
+  {
+    name: "GitHub OAuth token",
+    pattern: /gho_[a-zA-Z0-9]{36,}/g,
+    replacement: "<REDACTED:github-oauth>",
+  },
+  {
+    name: "AWS Access Key ID",
+    pattern: /AKIA[0-9A-Z]{16}/g,
+    replacement: "<REDACTED:aws-key-id>",
+  },
+  {
+    name: "AWS Secret Access Key",
+    pattern: /(?<=aws_secret_access_key\s*[=:]\s*)[A-Za-z0-9/+=]{40}/g,
+    replacement: "<REDACTED:aws-secret>",
+  },
+  {
+    name: "Jina API key",
+    pattern: /jina_[a-zA-Z0-9_-]{30,}/g,
+    replacement: "<REDACTED:jina-key>",
+  },
+  {
+    name: "Bearer token",
+    pattern: /Bearer [a-zA-Z0-9._-]{30,}/g,
+    replacement: "Bearer <REDACTED>",
+  },
+
+  // --- Generic key/value patterns in YAML/config context ---
+  // Match: key: <long-alphanumeric-value> (in YAML blocks)
+  {
+    name: "YAML key value",
+    pattern: /(?<=^\s*key:\s*)[a-zA-Z0-9_-]{32,}/gm,
+    replacement: "<REDACTED>",
+  },
+  // Match: token: <long-alphanumeric-value>
+  {
+    name: "YAML token value",
+    pattern: /(?<=^\s*token:\s*)[a-zA-Z0-9_-]{32,}/gm,
+    replacement: "<REDACTED>",
+  },
+  // Match: secret: <long-alphanumeric-value>
+  {
+    name: "YAML secret value",
+    pattern: /(?<=^\s*secret:\s*)[a-zA-Z0-9_-]{32,}/gm,
+    replacement: "<REDACTED>",
+  },
+  // Match: password: <value> (any length, in YAML)
+  {
+    name: "YAML password value",
+    pattern: /(?<=^\s*password:\s*)\S+/gm,
+    replacement: "<REDACTED>",
+  },
+  // Match: api_key: / apiKey: <long-alphanumeric-value>
+  {
+    name: "YAML api_key value",
+    pattern: /(?<=^\s*(?:api_key|apiKey|api-key):\s*)[a-zA-Z0-9_-]{20,}/gm,
+    replacement: "<REDACTED>",
+  },
+
+  // --- Environment variable patterns ---
+  // Match: export SECRET_NAME=value or SECRET_NAME="value"
+  {
+    name: "Env var secret",
+    pattern: /(?<=(?:export\s+)?(?:API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY|ACCESS_KEY)[A-Z_]*\s*=\s*["']?)[^\s"']{16,}/g,
+    replacement: "<REDACTED>",
+  },
+];
+
+// -- Public API --------------------------------------------------------------
+
+/**
+ * Redact secrets from text content.
+ * Returns the redacted text and count of redactions made.
+ */
+export function redactSecrets(text: string): { text: string; redactions: number } {
+  let result = text;
+  let redactions = 0;
+
+  for (const { pattern, replacement } of SECRET_PATTERNS) {
+    // Reset regex state for global patterns
+    const re = new RegExp(pattern.source, pattern.flags);
+    const before = result;
+    result = result.replace(re, replacement);
+    if (result !== before) {
+      // Count how many replacements were made
+      const matches = before.match(new RegExp(pattern.source, pattern.flags));
+      redactions += matches?.length ?? 1;
+    }
+  }
+
+  return { text: result, redactions };
+}
+
+/**
+ * Check if text contains any detectable secrets.
+ * Faster than redactSecrets() — stops at first match.
+ */
+export function containsSecrets(text: string): boolean {
+  for (const { pattern } of SECRET_PATTERNS) {
+    const re = new RegExp(pattern.source, pattern.flags);
+    if (re.test(text)) return true;
+  }
+  return false;
+}

package/src/scope.ts

@@ -0,0 +1,214 @@
+/**
+ * Project scope detection and filtering.
+ *
+ * Determines which wiki pages are relevant to the current working context
+ * by auto-detecting project name from cwd (git remote, git root, dirname)
+ * or reading explicit config from .pi/wiki-scope.json.
+ */
+
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { basename, join } from "node:path";
+
+// -- Types ------------------------------------------------------------------
+
+export interface ProjectScope {
+  name: string;
+  include: string[]; // scope tags to include (always includes name)
+  exclude: string[]; // scope tags to exclude
+  source: "config" | "git-remote" | "git-root" | "dirname";
+}
+
+/** .pi/wiki-scope.json schema */
+export interface ScopeConfig {
+  name: string;
+  include?: string[];
+  exclude?: string[];
+}
+
+// -- Helpers ----------------------------------------------------------------
+
+/** Run a command and return trimmed stdout, or null on failure. */
+function exec(
+  cmd: string,
+  args: string[],
+  cwd: string,
+): Promise<string | null> {
+  return new Promise((resolve) => {
+    execFile(cmd, args, { cwd }, (err, stdout) => {
+      if (err) {
+        resolve(null);
+        return;
+      }
+      const trimmed = (stdout ?? "").trim();
+      resolve(trimmed || null);
+    });
+  });
+}
+
+/**
+ * Extract a repo name from a git remote URL.
+ *
+ * Handles:
+ *   git@github.com:user/repo.git  -> repo
+ *   https://github.com/user/repo.git -> repo
+ *   https://github.com/user/repo -> repo
+ *   ssh://git@host/user/repo.git -> repo
+ */
+export function extractRepoName(remoteUrl: string): string | null {
+  // Strip trailing slashes
+  let url = remoteUrl.trim().replace(/\/+$/, "");
+  // Strip .git suffix
+  url = url.replace(/\.git$/, "");
+  // Get the last path segment
+  const lastSlash = url.lastIndexOf("/");
+  const lastColon = url.lastIndexOf(":");
+  const sep = Math.max(lastSlash, lastColon);
+  if (sep < 0 || sep === url.length - 1) return null;
+  const name = url.slice(sep + 1);
+  return name || null;
+}
+
+// -- Public API -------------------------------------------------------------
+
+/**
+ * Load .pi/wiki-scope.json from the given directory.
+ * Returns null if the file doesn't exist or is invalid JSON.
+ */
+export async function loadScopeConfig(
+  cwd: string,
+): Promise<ScopeConfig | null> {
+  const configPath = join(cwd, ".pi", "wiki-scope.json");
+  let raw: string;
+  try {
+    raw = await readFile(configPath, "utf-8");
+  } catch {
+    return null;
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+
+  if (
+    typeof parsed !== "object" ||
+    parsed === null ||
+    typeof (parsed as Record<string, unknown>).name !== "string" ||
+    !(parsed as Record<string, unknown>).name
+  ) {
+    return null;
+  }
+
+  const obj = parsed as Record<string, unknown>;
+  const config: ScopeConfig = { name: obj.name as string };
+
+  if (Array.isArray(obj.include)) {
+    config.include = obj.include.filter(
+      (v: unknown) => typeof v === "string",
+    );
+  }
+  if (Array.isArray(obj.exclude)) {
+    config.exclude = obj.exclude.filter(
+      (v: unknown) => typeof v === "string",
+    );
+  }
+
+  return config;
+}
+
+/**
+ * Auto-detect project scope from the working directory.
+ *
+ * Detection priority:
+ *   1. .pi/wiki-scope.json (explicit config)
+ *   2. Git remote origin URL -> repo name
+ *   3. Git repository root directory name
+ *   4. cwd basename (fallback)
+ */
+export async function detectScope(cwd: string): Promise<ProjectScope> {
+  // 1. Explicit config
+  const config = await loadScopeConfig(cwd);
+  if (config) {
+    const include = Array.from(
+      new Set([config.name, ...(config.include ?? [])]),
+    );
+    return {
+      name: config.name,
+      include,
+      exclude: config.exclude ?? [],
+      source: "config",
+    };
+  }
+
+  // 2. Git remote origin
+  const remoteUrl = await exec("git", ["remote", "get-url", "origin"], cwd);
+  if (remoteUrl) {
+    const repoName = extractRepoName(remoteUrl);
+    if (repoName) {
+      return {
+        name: repoName,
+        include: [repoName],
+        exclude: [],
+        source: "git-remote",
+      };
+    }
+  }
+
+  // 3. Git root directory name
+  const gitRoot = await exec(
+    "git",
+    ["rev-parse", "--show-toplevel"],
+    cwd,
+  );
+  if (gitRoot) {
+    const name = basename(gitRoot);
+    if (name) {
+      return {
+        name,
+        include: [name],
+        exclude: [],
+        source: "git-root",
+      };
+    }
+  }
+
+  // 4. Fallback to cwd basename
+  const name = basename(cwd);
+  return {
+    name,
+    include: [name],
+    exclude: [],
+    source: "dirname",
+  };
+}
+
+/**
+ * Check whether a page's scope tags match the project scope.
+ *
+ * Rules:
+ *   - A page matches if its scope contains "global" OR any tag in projectScope.include
+ *   - A page is excluded if its scope contains any tag in projectScope.exclude
+ *   - Exclude takes priority over include
+ */
+export function matchesScope(
+  pageScope: string[],
+  projectScope: ProjectScope,
+): boolean {
+  // Exclude takes priority
+  if (
+    projectScope.exclude.length > 0 &&
+    pageScope.some((tag) => projectScope.exclude.includes(tag))
+  ) {
+    return false;
+  }
+
+  // Match: "global" or any include tag
+  if (pageScope.includes("global")) {
+    return true;
+  }
+
+  return pageScope.some((tag) => projectScope.include.includes(tag));
+}

package/src/scripts/bulk-link-fix.ts

@@ -0,0 +1,126 @@
+#!/usr/bin/env tsx
+/**
+ * One-time bulk fix: auto-link slugs, normalize tags, sync frontmatter.links
+ * across all wiki pages.
+ *
+ * Usage: npx tsx src/scripts/bulk-link-fix.ts [--dry-run]
+ */
+
+import { join } from "node:path";
+import { homedir } from "node:os";
+import {
+  listPages,
+  readPage,
+  writePage,
+} from "../wiki.js";
+import type { WikiPage } from "../wiki.js";
+import { autoLinkSlugs, syncFrontmatterLinks } from "../link-utils.js";
+import { normalizeTags, normalizeScopes } from "../tag-registry.js";
+
+const WIKI_DIR = join(homedir(), ".pi", "wiki");
+const dryRun = process.argv.includes("--dry-run");
+
+async function main() {
+  console.log(`\n📚 Bulk Wiki Fix — ${dryRun ? "DRY RUN" : "LIVE"}`);
+  console.log(`   Wiki: ${WIKI_DIR}\n`);
+
+  // Load all pages
+  const refs = await listPages(WIKI_DIR);
+  const pages: WikiPage[] = [];
+  for (const ref of refs) {
+    const page = await readPage(WIKI_DIR, ref.category, ref.slug);
+    if (page) pages.push(page);
+  }
+
+  const allSlugs = new Set(pages.map(p => p.slug));
+  console.log(`   Found ${pages.length} pages, ${allSlugs.size} unique slugs\n`);
+
+  let linksAdded = 0;
+  let tagsNormalized = 0;
+  let frontmatterSynced = 0;
+  let pagesChanged = 0;
+
+  for (const page of pages) {
+    const originalBody = page.body;
+    const originalTags = [...page.frontmatter.tags];
+    const originalLinks = [...page.frontmatter.links];
+
+    const originalScope = [...page.frontmatter.scope];
+
+    // 1. Normalize scopes first (tags depend on scope)
+    const newScope = normalizeScopes(page.frontmatter.scope);
+
+    // 2. Auto-link slug mentions in body
+    let newBody = autoLinkSlugs(originalBody, allSlugs, page.slug);
+
+    // 3. Sync frontmatter.links from body [[wikilinks]]
+    const newLinks = syncFrontmatterLinks(newBody);
+
+    // 4. Normalize tags (using normalized scope for dedup)
+    const newTags = normalizeTags(page.frontmatter.tags, newScope);
+
+    // Check what changed
+    const bodyChanged = newBody !== originalBody;
+    const linksChanged = JSON.stringify(newLinks.sort()) !== JSON.stringify(originalLinks.sort());
+    const tagsChanged = JSON.stringify(newTags) !== JSON.stringify(originalTags.sort());
+    const scopeChanged = JSON.stringify(newScope) !== JSON.stringify(originalScope.sort());
+
+    if (!bodyChanged && !linksChanged && !tagsChanged && !scopeChanged) continue;
+
+    pagesChanged++;
+
+    const addedLinksCount = newLinks.filter(l => !originalLinks.includes(l)).length;
+    linksAdded += addedLinksCount;
+    if (tagsChanged) tagsNormalized++;
+    if (linksChanged) frontmatterSynced++;
+
+    // Report
+    const changes: string[] = [];
+    if (scopeChanged) {
+      changes.push(`scope: [${originalScope.join(", ")}] → [${newScope.join(", ")}]`);
+    }
+    if (bodyChanged) {
+      const addedLinks = newLinks.filter(l => !originalLinks.includes(l));
+      changes.push(`+${addedLinks.length} wikilinks: ${addedLinks.join(", ")}`);
+    }
+    if (tagsChanged) {
+      changes.push(`tags: [${originalTags.join(", ")}] → [${newTags.join(", ")}]`);
+    }
+    if (linksChanged && !bodyChanged) {
+      changes.push(`frontmatter.links synced`);
+    }
+
+    console.log(`  ${dryRun ? "WOULD FIX" : "FIXED"} ${page.category}/${page.slug}`);
+    for (const c of changes) {
+      console.log(`    → ${c}`);
+    }
+
+    if (!dryRun) {
+      const updatedPage: WikiPage = {
+        ...page,
+        body: newBody,
+        frontmatter: {
+          ...page.frontmatter,
+          scope: newScope,
+          tags: newTags,
+          links: newLinks,
+          updated: new Date().toISOString(),
+        },
+      };
+      await writePage(WIKI_DIR, updatedPage);
+    }
+  }
+
+  console.log(`\n━━━ Summary ━━━`);
+  console.log(`  Pages changed:      ${pagesChanged} / ${pages.length}`);
+  console.log(`  Wikilinks added:    ${linksAdded}`);
+  console.log(`  Tags normalized:    ${tagsNormalized}`);
+  console.log(`  Frontmatter synced: ${frontmatterSynced}`);
+  if (dryRun) console.log(`\n  (dry run — no files modified, re-run without --dry-run to apply)`);
+  console.log();
+}
+
+main().catch(err => {
+  console.error("Error:", err);
+  process.exit(1);
+});