skillwiki 0.10.110 → 0.10.111

package/dist/chunk-X5GL2FCU.js

@@ -0,0 +1,344 @@
+#!/usr/bin/env node
+import {
+  err,
+  getErrorMessage,
+  ok
+} from "./chunk-UIEQIJXP.js";
+
+// src/parsers/frontmatter.ts
+import yaml from "js-yaml";
+var FM_OPEN = /^---\r?\n/;
+function splitFrontmatter(text) {
+  if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 });
+  const afterOpen = text.replace(FM_OPEN, "");
+  const closeIdx = afterOpen.search(/\r?\n---\r?\n/);
+  if (closeIdx === -1) return err("MISSING_CLOSING_DELIMITER");
+  const rawFrontmatter = afterOpen.slice(0, closeIdx);
+  const closeMatch = afterOpen.slice(closeIdx).match(/\r?\n---\r?\n/);
+  const bodyStart = text.length - (afterOpen.length - closeIdx - closeMatch[0].length);
+  const body = text.slice(bodyStart);
+  return ok({ rawFrontmatter, body, bodyStart });
+}
+function extractFrontmatter(text) {
+  const split = splitFrontmatter(text);
+  if (!split.ok) return split;
+  if (!split.data.rawFrontmatter) return ok({});
+  try {
+    const parsed = yaml.load(split.data.rawFrontmatter, { schema: yaml.JSON_SCHEMA });
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return ok({});
+    return ok(parsed);
+  } catch (e) {
+    return err("INVALID_FRONTMATTER", { message: getErrorMessage(e) });
+  }
+}
+
+// src/utils/sensitive-content.ts
+import { createHash } from "crypto";
+var REDACTED_RE = /\[REDACTED:[^\]]+\]/i;
+var SYNTHETIC_RE = /^(?:<[^>]+>|\$\{[^}]+\}|REPLACE_WITH_[A-Z0-9_]+|YOUR_[A-Z0-9_]+|EXAMPLE_[A-Z0-9_]+)$/i;
+var MATCHERS = [
+  {
+    kind: "private_key",
+    re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g
+  },
+  {
+    kind: "authorization_header",
+    re: /\bAuthorization["']?\s*:\s*["']?(Bearer\s+[A-Za-z0-9._~+/-]{20,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "cookie",
+    re: /\b(?:Cookie|Set-Cookie)\s*:\s*([^\n]{20,})/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "jwt",
+    re: /\b([A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,})\b/g,
+    valueGroup: 1
+  },
+  {
+    kind: "provider_key",
+    re: /\b(sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|gh[pousr]_[A-Za-z0-9_=-]{20,})\b/g,
+    valueGroup: 1
+  },
+  {
+    kind: "access_key",
+    re: /\b((?:AKIA|ASIA)[A-Z0-9]{16})\b/g,
+    valueGroup: 1
+  },
+  {
+    kind: "access_key",
+    re: /\b(?:access[-_ ]?key|credential)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "api_key",
+    re: /\b(?:api[-_ ]?key)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "password",
+    re: /\b(?:password|passwd)["']?\s*[:=]\s*[`"']?([^\s`"']{8,})[`"']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "secret",
+    re: /\b(?:secret|client[-_ ]?secret)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "token",
+    re: /\b(?:token|session)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
+    valueGroup: 1
+  }
+];
+function fingerprint(value) {
+  return createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+function lineFor(text, offset) {
+  return text.slice(0, offset).split(/\r?\n/).length;
+}
+function redactMarker(kind, value) {
+  return `[REDACTED:${kind}:${fingerprint(value)}]`;
+}
+function isSyntheticPlaceholder(value) {
+  return REDACTED_RE.test(value) || SYNTHETIC_RE.test(value.trim());
+}
+function isInsideRedactedMarker(text, start, end) {
+  for (const marker of text.matchAll(new RegExp(REDACTED_RE.source, "gi"))) {
+    const markerStart = marker.index ?? 0;
+    const markerEnd = markerStart + marker[0].length;
+    if (start >= markerStart && end <= markerEnd) return true;
+  }
+  return false;
+}
+function isNonSecretTokenCapture(value) {
+  if (value.startsWith("//")) return true;
+  if (value.includes("/")) return true;
+  if (/^[a-z0-9.]+(?:-[a-z0-9.]+)+$/.test(value) && !/^[0-9a-f]+(?:-[0-9a-f]+)+$/.test(value)) return true;
+  return false;
+}
+var PASSWORD_PROSE_SENTINELS = /* @__PURE__ */ new Set([
+  "generated",
+  "configured",
+  "required",
+  "optional",
+  "provided",
+  "disabled",
+  "enabled",
+  "undefined",
+  "unspecified",
+  "unknown"
+]);
+function isNonSecretPasswordCapture(value) {
+  return PASSWORD_PROSE_SENTINELS.has(value.toLowerCase());
+}
+function collectMatches(text) {
+  const matches = [];
+  for (const matcher of MATCHERS) {
+    matcher.re.lastIndex = 0;
+    for (const m of text.matchAll(matcher.re)) {
+      const whole = m[0];
+      const start = m.index ?? 0;
+      if (REDACTED_RE.test(whole) || isInsideRedactedMarker(text, start, start + whole.length)) continue;
+      const value = matcher.valueGroup ? m[matcher.valueGroup] : whole;
+      if (isSyntheticPlaceholder(value)) continue;
+      if (matcher.kind === "token" && isNonSecretTokenCapture(value)) continue;
+      if (matcher.kind === "password" && isNonSecretPasswordCapture(value)) continue;
+      const valueOffset = whole.lastIndexOf(value);
+      const valueStart = start + Math.max(0, valueOffset);
+      matches.push({
+        start,
+        end: start + whole.length,
+        valueStart,
+        valueEnd: valueStart + value.length,
+        kind: matcher.kind
+      });
+    }
+  }
+  return matches.sort((a, b) => {
+    if (a.valueStart !== b.valueStart) return a.valueStart - b.valueStart;
+    return b.valueEnd - b.valueStart - (a.valueEnd - a.valueStart);
+  });
+}
+function collapseOverlaps(matches) {
+  const kept = [];
+  for (const match of matches) {
+    const overlaps = kept.some((k) => match.valueStart < k.valueEnd && match.valueEnd > k.valueStart);
+    if (!overlaps) kept.push(match);
+  }
+  return kept;
+}
+function scanSensitiveContent(text, opts = {}) {
+  return collapseOverlaps(collectMatches(text)).map((match) => {
+    const value = text.slice(match.valueStart, match.valueEnd);
+    const marker = redactMarker(match.kind, value);
+    const rawPreview = text.slice(Math.max(0, match.start - 24), Math.min(text.length, match.end + 24));
+    const preview = rawPreview.replace(value, marker);
+    return {
+      file: opts.file,
+      line: lineFor(text, match.valueStart),
+      kind: match.kind,
+      preview,
+      fingerprint: fingerprint(value)
+    };
+  });
+}
+function redactSensitiveContent(text, opts = {}) {
+  const matches = collapseOverlaps(collectMatches(text));
+  if (matches.length === 0) return { text, changed: false, findings: [] };
+  let out = "";
+  let cursor = 0;
+  for (const match of matches) {
+    const value = text.slice(match.valueStart, match.valueEnd);
+    out += text.slice(cursor, match.valueStart);
+    out += redactMarker(match.kind, value);
+    cursor = match.valueEnd;
+  }
+  out += text.slice(cursor);
+  return {
+    text: out,
+    changed: out !== text,
+    findings: scanSensitiveContent(text, opts)
+  };
+}
+
+// src/utils/vault.ts
+import { existsSync, readFileSync } from "fs";
+import { readFile, readdir, stat } from "fs/promises";
+import { join, relative, sep } from "path";
+import { execFileSync } from "child_process";
+var TYPED_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
+var DEFAULT_IO_CONCURRENCY = 1;
+function vaultIoConcurrency() {
+  const raw = Number.parseInt(process.env.SKILLWIKI_VAULT_IO_CONCURRENCY ?? "", 10);
+  return Number.isFinite(raw) && raw > 0 ? Math.min(raw, 64) : DEFAULT_IO_CONCURRENCY;
+}
+function decodeProcMountPath(value) {
+  return value.replace(/\\040/g, " ");
+}
+function isRcloneFuseVaultFromMounts(root, mounts) {
+  return mounts.split(/\r?\n/).some((line) => {
+    const parts = line.split(" ");
+    if (parts.length < 3) return false;
+    const mountPoint = decodeProcMountPath(parts[1]);
+    const fsType = parts[2];
+    return fsType === "fuse.rclone" && (root === mountPoint || root.startsWith(`${mountPoint}/`));
+  });
+}
+function resolveReadOnlyVaultRootWithMounts(root, mounts) {
+  if (/^(1|true|yes)$/i.test(process.env.SKILLWIKI_DISABLE_VAULT_READ_MIRROR ?? "")) {
+    return { root, mirrored: false };
+  }
+  const explicitMirror = process.env.SKILLWIKI_VAULT_READ_MIRROR;
+  if (explicitMirror && existsSync(join(explicitMirror, "SCHEMA.md"))) {
+    return { root: explicitMirror, mirrored: explicitMirror !== root };
+  }
+  const siblingMirror = `${root}-git`;
+  if (isRcloneFuseVaultFromMounts(root, mounts) && existsSync(join(siblingMirror, "SCHEMA.md"))) {
+    return { root: siblingMirror, mirrored: true };
+  }
+  return { root, mirrored: false };
+}
+function resolveReadOnlyVaultRoot(root) {
+  let mounts = "";
+  try {
+    mounts = readFileSync("/proc/mounts", "utf8");
+  } catch {
+  }
+  return resolveReadOnlyVaultRootWithMounts(root, mounts);
+}
+async function mapWithConcurrency(items, limit, mapper) {
+  const out = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, async () => {
+    for (; ; ) {
+      const index = next++;
+      if (index >= items.length) return;
+      out[index] = await mapper(items[index], index);
+    }
+  });
+  await Promise.all(workers);
+  return out;
+}
+function filterGitIgnoredRelativePaths(root, relPaths) {
+  if (relPaths.length === 0 || !existsSync(join(root, ".git"))) {
+    return /* @__PURE__ */ new Set();
+  }
+  try {
+    const input = relPaths.join("\0") + "\0";
+    const stdout = execFileSync("git", ["check-ignore", "-z", "--stdin"], {
+      cwd: root,
+      input,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const ignored = stdout.split("\0").filter(Boolean);
+    return new Set(ignored);
+  } catch (error) {
+    if (error && typeof error === "object" && error.status === 1) {
+      return /* @__PURE__ */ new Set();
+    }
+    return /* @__PURE__ */ new Set();
+  }
+}
+async function scanVault(root) {
+  try {
+    await stat(join(root, "SCHEMA.md"));
+  } catch {
+    return err("VAULT_PATH_INVALID", { root, reason: "SCHEMA.md missing" });
+  }
+  const all = await walk(root);
+  const rawRels = all.map((p) => ({ absPath: p, relPath: relative(root, p).split(sep).join("/") }));
+  const ignored = filterGitIgnoredRelativePaths(root, rawRels.map((p) => p.relPath));
+  const rels = ignored.size > 0 ? rawRels.filter((p) => !ignored.has(p.relPath)) : rawRels;
+  return ok({
+    root,
+    allMarkdown: rels,
+    typedKnowledge: rels.filter((p) => TYPED_DIRS.some((d) => p.relPath.startsWith(d + "/"))),
+    raw: rels.filter((p) => p.relPath.startsWith("raw/")),
+    workItems: rels.filter((p) => /^projects\/[^/]+\/work\/[^/]+\/(spec|plan|log)\.md$/.test(p.relPath)),
+    compound: rels.filter((p) => /^projects\/[^/]+\/compound\//.test(p.relPath))
+  });
+}
+async function walk(dir) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  const out = [];
+  const subdirs = [];
+  for (const e of entries) {
+    const p = join(dir, e.name);
+    if (e.isDirectory()) {
+      if (SKIP_DIRS.has(e.name)) continue;
+      subdirs.push(p);
+    } else if (e.isFile() && e.name.endsWith(".md")) out.push(p);
+  }
+  const nested = await mapWithConcurrency(subdirs, Math.min(8, vaultIoConcurrency()), walk);
+  for (const files of nested) out.push(...files);
+  return out;
+}
+async function readPage(p) {
+  return readFile(p.absPath, "utf8");
+}
+async function readPageCached(p, cache) {
+  if (!cache) return readPage(p);
+  const existing = cache.get(p.absPath);
+  if (existing) return existing;
+  const pending = readPage(p);
+  cache.set(p.absPath, pending);
+  return pending;
+}
+
+export {
+  splitFrontmatter,
+  extractFrontmatter,
+  scanSensitiveContent,
+  redactSensitiveContent,
+  vaultIoConcurrency,
+  resolveReadOnlyVaultRoot,
+  mapWithConcurrency,
+  filterGitIgnoredRelativePaths,
+  scanVault,
+  readPage,
+  readPageCached
+};

package/dist/chunk-ZRGZBAVS.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import {
+  DELETE_INTENT_DIR,
+  DELETE_INTENT_SCHEMA,
+  pathToIntentFilename
+} from "./chunk-QESNTTVY.js";
+
+// src/clip-outbox/upload.ts
+import { createHash } from "crypto";
+import { PutObjectCommand, GetObjectCommand, S3ServiceException } from "@aws-sdk/client-s3";
+function sha256Hex(body) {
+  return createHash("sha256").update(body).digest("hex");
+}
+function parseDestination(destination) {
+  const colon = destination.indexOf(":");
+  if (colon <= 0) throw new Error("invalid destination");
+  const remote = destination.slice(0, colon);
+  const rest = destination.slice(colon + 1);
+  const slash = rest.indexOf("/");
+  if (slash <= 0) return { remote, bucket: rest, prefix: "" };
+  return { remote, bucket: rest.slice(0, slash), prefix: rest.slice(slash + 1) };
+}
+function createS3CreateOnlyPut(opts) {
+  const prefix = opts.prefix ?? "";
+  const resolveKey = (rel) => [prefix, rel].filter(Boolean).join("/");
+  return async (key, body) => {
+    if (!/^raw\/(articles|assets)\/[A-Za-z0-9._/-]+$/.test(key) || key.split("/").some((s) => s === ".." || s === "." || !s)) throw new Error("unsafe upload key");
+    const objectKey = resolveKey(key);
+    const parts = key.split("/");
+    for (let count = 1; count <= parts.length; count++) {
+      const target = parts.slice(0, count).join("/");
+      let intentBody;
+      try {
+        const intent2 = await opts.client.send(new GetObjectCommand({ Bucket: opts.bucket, Key: resolveKey(`${DELETE_INTENT_DIR}/${pathToIntentFilename(target)}`) }));
+        if (!intent2.Body) throw new Error("DELETE_INTENT_UNAVAILABLE");
+        intentBody = Buffer.from(await intent2.Body.transformToByteArray());
+      } catch (error) {
+        if (error.$metadata?.httpStatusCode === 404 || error.name === "NoSuchKey") continue;
+        throw error;
+      }
+      const intent = JSON.parse(intentBody.toString("utf8"));
+      if (intent.schema !== DELETE_INTENT_SCHEMA || intent.path !== target || !["remove", "archive"].includes(intent.action ?? "")) throw new Error("DELETE_INTENT_UNAVAILABLE");
+      if (!intent.expires || !Number.isFinite(Date.parse(intent.expires)) || Date.parse(intent.expires) > Date.now()) throw new Error("TOMBSTONE_HOLD");
+    }
+    const inspect = async () => {
+      try {
+        const existing = await opts.client.send(new GetObjectCommand({ Bucket: opts.bucket, Key: objectKey }));
+        if (!existing.Body) throw new Error("missing S3 response body");
+        const bytes = Buffer.from(await existing.Body.transformToByteArray());
+        return bytes.length === body.length && sha256Hex(bytes) === sha256Hex(body) ? "idempotent" : "conflict";
+      } catch (error) {
+        if (error.$metadata?.httpStatusCode === 404 || error.name === "NoSuchKey") return "absent";
+        throw error;
+      }
+    };
+    const prior = await inspect();
+    if (prior !== "absent") return { status: prior };
+    try {
+      await opts.client.send(new PutObjectCommand({
+        Bucket: opts.bucket,
+        Key: objectKey,
+        Body: body,
+        IfNoneMatch: "*"
+      }));
+    } catch (error) {
+      const name = error instanceof S3ServiceException ? error.name : error.name;
+      const status = error.$metadata?.httpStatusCode;
+      if (name === "PreconditionFailed" || status === 412) {
+        const outcome = await inspect();
+        if (outcome !== "absent") return { status: outcome };
+      }
+      throw error;
+    }
+    const verified = await inspect();
+    if (verified === "absent") throw new Error("S3 verification pending");
+    return { status: verified === "conflict" ? "conflict" : "created" };
+  };
+}
+async function uploadBundle(opts) {
+  for (const asset of opts.assets) {
+    const result = await opts.put(asset.key, asset.body);
+    if (result.status === "conflict") {
+      return { ok: false, reason: `asset conflict: ${asset.key}`, articlePut: false };
+    }
+  }
+  const article = await opts.put(opts.articleKey, opts.article);
+  if (article.status === "conflict") {
+    return { ok: false, reason: `article conflict: ${opts.articleKey}`, articlePut: false };
+  }
+  return { ok: true };
+}
+
+export {
+  sha256Hex,
+  parseDestination,
+  createS3CreateOnlyPut,
+  uploadBundle
+};