privateer-agent 0.15.4 → 0.15.6

package/dist-boot/c-FH4NXKHV.mjs

@@ -0,0 +1,177 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  CODE_ONLY_OPTIONS,
+  DEFAULT_ALLOW,
+  DEFAULT_BADGE_SINKS,
+  NEARAI_BASE_URL,
+  PII_COMMAND_WORDS,
+  PRIVACY_PROVIDERS,
+  PROVIDER_BY_ID,
+  SECRET_TYPES,
+  TIERS,
+  TINFOIL_BASE_URL,
+  UNNAMED_HOST,
+  assessDowngrade,
+  assessToolCall,
+  capabilityTier,
+  capturedHosts,
+  clampProjectConfig,
+  classifyTool,
+  compileAllow,
+  createLedger,
+  detectPii,
+  dispatcherTransport,
+  downgradeWarning,
+  effectiveTier,
+  exposureLevel,
+  extension_default,
+  fetchAttestation,
+  fetchTinfoilAttestation,
+  firstRemoteUrl,
+  getCapturedCert,
+  hasPii,
+  hasSecrets,
+  hostOf,
+  httpsTransport,
+  installAttestationDispatcher,
+  interpretReport,
+  interpretTinfoilDoc,
+  isLocalEndpoint,
+  isRepoSupplied,
+  ledgerHosts,
+  ledgerReport,
+  loadConfig,
+  makePiPrivacyExtension,
+  maskPii,
+  mergePiiBaseline,
+  nearApiKey,
+  newPii,
+  observationLine,
+  openRouterZdrPatch,
+  optionsFromEnv,
+  parsePiiCommand,
+  payloadText,
+  pickerEntry,
+  pickerOptionLabel,
+  piiDetail,
+  piiInline,
+  postureBadge,
+  providerConfig,
+  randomNonce,
+  rankModels,
+  rankSurface,
+  recordEgress,
+  redactPayloadPii,
+  redactPii,
+  redactToolResultContent,
+  registerable,
+  renderBadgeTo,
+  runPiiCommand,
+  sanitizeConfig,
+  scanPii,
+  secretHits,
+  sensitiveFileRefs,
+  splitCommands,
+  summarizePii,
+  summarizeSurface,
+  surfaceLine,
+  surfaceReport,
+  teePosture,
+  tierFromTeePosture,
+  tierRank,
+  tinfoilTeePosture,
+  toolProvenance,
+  toolReach,
+  toolResultText,
+  veniceRequestPatch,
+  verifyModelPosture
+} from "./c-76QH4UCP.mjs";
+import "./c-P63T3XL2.mjs";
+import "./c-CN77DCGF.mjs";
+export {
+  CODE_ONLY_OPTIONS,
+  DEFAULT_ALLOW,
+  DEFAULT_BADGE_SINKS,
+  NEARAI_BASE_URL,
+  PII_COMMAND_WORDS,
+  PRIVACY_PROVIDERS,
+  PROVIDER_BY_ID,
+  SECRET_TYPES,
+  TIERS,
+  TINFOIL_BASE_URL,
+  UNNAMED_HOST,
+  assessDowngrade,
+  assessToolCall,
+  capabilityTier,
+  capturedHosts,
+  clampProjectConfig,
+  classifyTool,
+  compileAllow,
+  createLedger,
+  detectPii,
+  dispatcherTransport,
+  downgradeWarning,
+  effectiveTier,
+  exposureLevel,
+  fetchAttestation,
+  fetchTinfoilAttestation,
+  firstRemoteUrl,
+  getCapturedCert,
+  hasPii,
+  hasSecrets,
+  hostOf,
+  httpsTransport,
+  installAttestationDispatcher,
+  interpretReport,
+  interpretTinfoilDoc,
+  isLocalEndpoint,
+  isRepoSupplied,
+  ledgerHosts,
+  ledgerReport,
+  loadConfig,
+  makePiPrivacyExtension,
+  maskPii,
+  mergePiiBaseline,
+  nearApiKey,
+  newPii,
+  observationLine,
+  openRouterZdrPatch,
+  optionsFromEnv,
+  parsePiiCommand,
+  payloadText,
+  extension_default as piPrivacyExtension,
+  pickerEntry,
+  pickerOptionLabel,
+  piiDetail,
+  piiInline,
+  postureBadge,
+  providerConfig,
+  randomNonce,
+  rankModels,
+  rankSurface,
+  recordEgress,
+  redactPayloadPii,
+  redactPii,
+  redactToolResultContent,
+  registerable,
+  renderBadgeTo,
+  runPiiCommand,
+  sanitizeConfig,
+  scanPii,
+  secretHits,
+  sensitiveFileRefs,
+  splitCommands,
+  summarizePii,
+  summarizeSurface,
+  surfaceLine,
+  surfaceReport,
+  teePosture,
+  tierFromTeePosture,
+  tierRank,
+  tinfoilTeePosture,
+  toolProvenance,
+  toolReach,
+  toolResultText,
+  veniceRequestPatch,
+  verifyModelPosture
+};

package/dist-boot/c-FHNUCTEM.mjs

@@ -0,0 +1,140 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  __name
+} from "./c-CN77DCGF.mjs";
+
+// node_modules/tinfoil/dist/user-cache-secret-store.js
+import { closeSync, constants, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var USER_CACHE_SECRET_DIR_NAME = ".tinfoil";
+var USER_CACHE_SECRET_FILE_NAME = "user_cache_secret";
+var HAS_POSIX_PERMISSIONS = process.platform !== "win32";
+function posixReadFlags() {
+  return constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+}
+__name(posixReadFlags, "posixReadFlags");
+function trimPersistenceWhitespace(value) {
+  return value.replace(new RegExp("^\\p{White_Space}+|\\p{White_Space}+$", "gu"), "");
+}
+__name(trimPersistenceWhitespace, "trimPersistenceWhitespace");
+function isExpectedWindowsPath(path, expectedType) {
+  try {
+    const stats = lstatSync(path);
+    if (stats.isSymbolicLink()) {
+      return false;
+    }
+    return expectedType === "directory" ? stats.isDirectory() : stats.isFile();
+  } catch (err) {
+    return err?.code === "ENOENT" ? void 0 : false;
+  }
+}
+__name(isExpectedWindowsPath, "isExpectedWindowsPath");
+function readSecretFile(path) {
+  let fd;
+  try {
+    if (!HAS_POSIX_PERMISSIONS) {
+      const pathState = isExpectedWindowsPath(path, "file");
+      if (pathState !== true) {
+        return pathState === void 0 ? void 0 : null;
+      }
+    }
+    fd = openSync(path, HAS_POSIX_PERMISSIONS ? posixReadFlags() : "r");
+    if (HAS_POSIX_PERMISSIONS) {
+      if (!fstatSync(fd).isFile()) {
+        return null;
+      }
+    }
+    let secret;
+    try {
+      secret = trimPersistenceWhitespace(new TextDecoder("utf-8", { fatal: true }).decode(readFileSync(fd)));
+    } catch {
+      return null;
+    }
+    return secret === "" ? null : secret;
+  } catch (err) {
+    return err?.code === "ENOENT" ? void 0 : null;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+__name(readSecretFile, "readSecretFile");
+function loadOrPersistUserCacheSecret(generateSecret) {
+  let home;
+  try {
+    home = homedir();
+  } catch {
+    return null;
+  }
+  if (!home) {
+    return null;
+  }
+  const dir = join(home, USER_CACHE_SECRET_DIR_NAME);
+  const path = join(dir, USER_CACHE_SECRET_FILE_NAME);
+  try {
+    if (!HAS_POSIX_PERMISSIONS && isExpectedWindowsPath(dir, "directory") === false) {
+      return null;
+    }
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    if (HAS_POSIX_PERMISSIONS) {
+      let dirFd;
+      try {
+        dirFd = openSync(dir, posixReadFlags() | constants.O_DIRECTORY);
+        if (!fstatSync(dirFd).isDirectory()) {
+          return null;
+        }
+      } finally {
+        if (dirFd !== void 0) {
+          closeSync(dirFd);
+        }
+      }
+    } else if (isExpectedWindowsPath(dir, "directory") !== true) {
+      return null;
+    }
+  } catch {
+    return null;
+  }
+  const existing = readSecretFile(path);
+  if (existing === null) {
+    return null;
+  }
+  if (existing !== void 0) {
+    return existing;
+  }
+  const secret = generateSecret();
+  if (secret === "") {
+    return "";
+  }
+  const candidatePath = join(dir, `${USER_CACHE_SECRET_FILE_NAME}.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    writeFileSync(candidatePath, secret, { encoding: "utf8", flag: "wx", mode: 384 });
+    try {
+      linkSync(candidatePath, path);
+    } catch (err) {
+      if (err?.code !== "EEXIST") {
+        return null;
+      }
+    }
+    const persisted = readSecretFile(path);
+    return persisted ?? null;
+  } catch {
+    return null;
+  } finally {
+    try {
+      unlinkSync(candidatePath);
+    } catch {
+    }
+  }
+}
+__name(loadOrPersistUserCacheSecret, "loadOrPersistUserCacheSecret");
+export {
+  USER_CACHE_SECRET_DIR_NAME,
+  USER_CACHE_SECRET_FILE_NAME,
+  loadOrPersistUserCacheSecret
+};