portable-agent-layer 0.66.1 → 0.68.0

package/src/hooks/lib/sensitive-path.ts

@@ -0,0 +1,117 @@
+/**
+ * Paths whose contents the ledger notes the change of but never keeps.
+ *
+ * The floor below is fixed in code rather than configured: a denylist a user can
+ * shrink is a suggestion, and settings may only add to this one. That direction
+ * also makes a malformed user pattern harmless — the worst it can do is redact
+ * something it did not need to.
+ */
+
+import { raw } from "./settings";
+
+const ENV_TEMPLATE_SUFFIXES = [".sample", ".example", ".template", ".dist", ".defaults"];
+
+/** Matched whole: `id_*` would catch `id_generator.ts`, `credentials*` a test file. */
+const SECRET_FILENAMES = new Set([
+  ".npmrc",
+  ".netrc",
+  "_netrc",
+  ".pgpass",
+  ".htpasswd",
+  ".envrc",
+  "credentials",
+  "id_rsa",
+  "id_dsa",
+  "id_ecdsa",
+  "id_ecdsa_sk",
+  "id_ed25519",
+  "id_ed25519_sk",
+]);
+
+const SECRET_EXTENSIONS = [
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".keystore",
+  ".jks",
+  ".asc",
+  ".gpg",
+  ".kdbx",
+];
+
+const SECRET_DIRECTORIES = new Set([
+  ".ssh",
+  ".gnupg",
+  ".aws",
+  ".docker",
+  ".kube",
+  ".gcloud",
+  ".azure",
+]);
+
+const SECRET_DIRECTORY_PAIRS = [
+  [".config", "gh"],
+  [".config", "gcloud"],
+  [".local", "share/keyrings"],
+];
+
+function segmentsOf(path: string): string[] {
+  return path.split(/[/\\]/).filter(Boolean);
+}
+
+function isLiveDotenv(name: string): boolean {
+  if (name !== ".env" && !name.startsWith(".env.")) return false;
+  return !ENV_TEMPLATE_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+
+function isSecretFilename(name: string): boolean {
+  return SECRET_FILENAMES.has(name);
+}
+
+function hasSecretExtension(name: string): boolean {
+  return SECRET_EXTENSIONS.some((ext) => name.toLowerCase().endsWith(ext));
+}
+
+function inSecretDirectory(dirs: string[]): boolean {
+  if (dirs.some((dir) => SECRET_DIRECTORIES.has(dir))) return true;
+  return SECRET_DIRECTORY_PAIRS.some(([parent, child]) =>
+    dirs.some(
+      (dir, i) =>
+        dir === parent &&
+        dirs
+          .slice(i + 1)
+          .join("/")
+          .startsWith(child)
+    )
+  );
+}
+
+function userPatterns(): string[] {
+  const configured = raw().ledger?.redactPaths;
+  if (!Array.isArray(configured)) return [];
+  return configured.filter(
+    (pattern) => typeof pattern === "string" && pattern.length > 0
+  );
+}
+
+function matchesUserPattern(path: string, name: string): boolean {
+  return userPatterns().some((pattern) => {
+    const glob = new Bun.Glob(pattern);
+    return glob.match(path) || glob.match(name);
+  });
+}
+
+/** Should this file's contents be withheld from the ledger? */
+export function isSensitivePath(path: string): boolean {
+  const segments = segmentsOf(path);
+  const name = segments.at(-1) ?? "";
+  const dirs = segments.slice(0, -1);
+  return (
+    inSecretDirectory(dirs) ||
+    isLiveDotenv(name) ||
+    isSecretFilename(name) ||
+    hasSecretExtension(name) ||
+    matchesUserPattern(path, name)
+  );
+}

package/src/hooks/lib/settings.ts

@@ -25,6 +25,11 @@ export interface PalSettingsData {
   dynamicContext?: Record<string, boolean>;
   /** Git co-author attribution opt-in. `decided` gates the one-time prompt. */
   attribution?: { enabled?: boolean; decided?: boolean };
+  /**
+   * Action-ledger user extension. `redactPaths` adds to the built-in set of
+   * paths whose contents are never stored; it cannot shrink it.
+   */
+  ledger?: { redactPaths?: string[] };
   /** Contextual-steering user extension: personal rules + shipped rules to suppress by tag. */
   steering?: {
     disable?: string[];

package/src/targets/lib.ts

@@ -23,11 +23,27 @@ import { declaredTriggers } from "../hooks/lib/skill-triggers";
 
 // --- Colored logging ---
 
+function runningUnderTest(): boolean {
+  return process.env.PAL_TEST_SANDBOX === "1";
+}
+
 export const log = {
   info: (msg: string) => console.log(`\x1b[34m[pal]\x1b[0m ${msg}`),
   success: (msg: string) => console.log(`\x1b[32m[pal]\x1b[0m ${msg}`),
   warn: (msg: string) => console.log(`\x1b[33m[pal]\x1b[0m ${msg}`),
   error: (msg: string) => console.error(`\x1b[31m[pal]\x1b[0m ${msg}`),
+
+  /**
+   * Per-item narration from inside a loop, where the caller already reports the
+   * total. Silent under the test runner: the suite drives these installers by
+   * the hundred against temp directories, so the lines name files that were
+   * never on this machine — and they are the only output no caller asserts on,
+   * precisely because the summary is what carries the result.
+   */
+  detail: (msg: string) => {
+    if (runningUnderTest()) return;
+    console.log(`\x1b[34m[pal]\x1b[0m ${msg}`);
+  },
 };
 
 // --- JSON helpers ---
@@ -456,7 +472,21 @@ export function unmergeCursorHooks(
 
 type CodexHookCommand = { type: string; command: string; timeout?: number };
 type CodexHookGroup = { matcher?: string; hooks: CodexHookCommand[] };
-type CodexHooks = { hooks?: Record<string, CodexHookGroup[]> };
+type CodexHooks = {
+  hooks?: Record<string, CodexHookGroup[]>;
+  description?: string;
+  version?: unknown;
+};
+
+/**
+ * Codex parses hooks.json strictly and accepts only `description` and `hooks`.
+ * A stale `version` makes it reject the whole file — every PAL hook silently
+ * stops — and merging preserves what it finds, so it must be dropped by name.
+ */
+function withoutRejectedFields(config: CodexHooks): CodexHooks {
+  const { version: _version, ...accepted } = config;
+  return accepted;
+}
 
 /**
  * Normalize a PAL hook command for cross-path deduplication.
@@ -526,7 +556,7 @@ function stripPalHooks(
 
 /** Merge PAL hooks into an existing Codex hooks.json. Deduplicates by canonical command path. */
 export function mergeCodexHooks(existing: CodexHooks, template: CodexHooks): CodexHooks {
-  const result: CodexHooks = { ...existing };
+  const result: CodexHooks = withoutRejectedFields(existing);
   if (!template.hooks) return result;
   result.hooks ??= {};
 
@@ -545,7 +575,7 @@ export function unmergeCodexHooks(
   existing: CodexHooks,
   template: CodexHooks
 ): CodexHooks {
-  const result: CodexHooks = { ...existing };
+  const result: CodexHooks = withoutRejectedFields(existing);
   if (!template.hooks || !result.hooks) return result;
 
   stripPalHooks(result.hooks, collectPalCanonical(template));
@@ -784,7 +814,7 @@ export function copySkills(claudeSkillsDir: string): number {
   let count = 0;
 
   for (const name of pruneStaleSkillLinks(claudeSkillsDir)) {
-    log.info(`Removed stale skill link: ${name}`);
+    log.detail(`Removed stale skill link: ${name}`);
   }
 
   for (const name of readdirSync(skillsDir)) {
@@ -994,7 +1024,7 @@ export function removeSkills(claudeSkillsDir: string): string[] {
       }
     }
     removed.push(name);
-    log.info(`Removed skill: ${name}`);
+    log.detail(`Removed skill: ${name}`);
   }
 
   // Remove ~/.agents/skills/ → ~/.pal/skills/ symlink
@@ -1031,7 +1061,7 @@ export function removeAgents(): string[] {
       unlinkSync(dst);
       const name = file.replace(/\.md$/, "");
       removed.push(name);
-      log.info(`Removed agent: ${name}`);
+      log.detail(`Removed agent: ${name}`);
     }
   }
   return removed;
@@ -1141,7 +1171,7 @@ function uninstallAgents(targetDir: string, label: string): string[] {
     if (existsSync(dst)) {
       unlinkSync(dst);
       removed.push(file.replace(/\.md$/, ""));
-      log.info(`Removed ${label} agent: ${file.replace(/\.md$/, "")}`);
+      log.detail(`Removed ${label} agent: ${file.replace(/\.md$/, "")}`);
     }
   }
   return removed;

package/src/targets/opencode/plugin.ts

@@ -106,6 +106,14 @@ const PALPlugin: Plugin = async ({ directory, client }: PluginInput) => {
   const { isPalSpawnedInference } =
     await lib<typeof import("../../hooks/lib/spawn-guard")>("spawn-guard.ts");
 
+  const { commitApplied, ledgeredTarget, snapshotCall } =
+    await lib<typeof import("../../hooks/lib/ledger-hook")>("ledger-hook.ts");
+
+  const ledgeredOpencodeCall = (tool: string, callID: string, args: unknown) => {
+    const target = ledgeredTarget(tool, (args ?? {}) as Record<string, unknown>);
+    return target ? { toolUseId: callID, tool, target } : null;
+  };
+
   return {
     // --- Per-message: Inject dynamic system reminder ---
     "experimental.chat.system.transform": async (_input, output) => {
@@ -213,6 +221,20 @@ const PALPlugin: Plugin = async ({ directory, client }: PluginInput) => {
           throw new Error(`PAL Security: ${fileReason}`);
         }
       }
+
+      const call = ledgeredOpencodeCall(toolName, _input.callID, output.args);
+      if (call) snapshotCall(call);
+    },
+
+    "tool.execute.after": async (
+      input: { tool: string; sessionID: string; callID: string; args: unknown },
+      _output: { title: string; output: string; metadata: unknown }
+    ) => {
+      const call = ledgeredOpencodeCall(input.tool, input.callID, input.args);
+      if (!call) return;
+
+      const entry = commitApplied(call);
+      if (entry) logDebug("opencode:ledger", `recorded ${entry.id} ${entry.target}`);
     },
 
     // --- Inject PAL_DIR into shell environment ---