sliccy 2.42.0 → 2.43.0

package/dist/node-server/_shared/index.d.ts

@@ -0,0 +1,4 @@
+export * from './secret-masking.js';
+export * from './secrets-pipeline.js';
+export * from './oauth-extra-domains-storage.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/node-server/_shared/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC"}

package/dist/node-server/_shared/index.js

@@ -0,0 +1,5 @@
+// Re-exports added in Task 1.2 (secret-masking) and Task 1.3 (secrets-pipeline).
+export * from './secret-masking.js';
+export * from './secrets-pipeline.js';
+export * from './oauth-extra-domains-storage.js';
+//# sourceMappingURL=index.js.map

package/dist/node-server/_shared/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC"}

package/dist/node-server/_shared/oauth-extra-domains-storage.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Tiny pure-JS layer over the page-localStorage key
+ * `slicc_oauth_extra_domains`. Same shape and key the webapp's
+ * `provider-settings.ts` uses; this module exists so the options page
+ * (`secrets.html` / `secrets-entry.ts`) can share the same backend
+ * without pulling in the full provider-settings module (which would
+ * fan out into a heavy bundle).
+ *
+ * Both pages live at chrome-extension://<id>/* so they hit the same
+ * localStorage. Updates here are visible to the side panel on its next
+ * read (no chrome.runtime round-trip needed).
+ */
+export declare const OAUTH_EXTRA_DOMAINS_KEY = "slicc_oauth_extra_domains";
+export type OAuthExtraDomainsStore = Record<string, string[]>;
+export interface LocalStorageLike {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+}
+export declare function readOAuthExtras(storage: LocalStorageLike): OAuthExtraDomainsStore;
+export declare function writeOAuthExtras(storage: LocalStorageLike, store: OAuthExtraDomainsStore): void;
+export declare function addOAuthExtraDomain(storage: LocalStorageLike, providerId: string, domain: string): {
+    added: boolean;
+    reason?: string;
+};
+export declare function removeOAuthExtraDomain(storage: LocalStorageLike, providerId: string, domain: string): {
+    removed: boolean;
+};
+export declare function clearOAuthExtras(storage: LocalStorageLike, providerId: string): void;
+//# sourceMappingURL=oauth-extra-domains-storage.d.ts.map

package/dist/node-server/_shared/oauth-extra-domains-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-extra-domains-storage.d.ts","sourceRoot":"","sources":["../src/oauth-extra-domains-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,sBAAsB,CAgBjF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAY/F;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAerC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAUtB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAIpF"}

package/dist/node-server/_shared/oauth-extra-domains-storage.js

@@ -0,0 +1,85 @@
+/**
+ * Tiny pure-JS layer over the page-localStorage key
+ * `slicc_oauth_extra_domains`. Same shape and key the webapp's
+ * `provider-settings.ts` uses; this module exists so the options page
+ * (`secrets.html` / `secrets-entry.ts`) can share the same backend
+ * without pulling in the full provider-settings module (which would
+ * fan out into a heavy bundle).
+ *
+ * Both pages live at chrome-extension://<id>/* so they hit the same
+ * localStorage. Updates here are visible to the side panel on its next
+ * read (no chrome.runtime round-trip needed).
+ */
+export const OAUTH_EXTRA_DOMAINS_KEY = 'slicc_oauth_extra_domains';
+export function readOAuthExtras(storage) {
+    try {
+        const raw = storage.getItem(OAUTH_EXTRA_DOMAINS_KEY);
+        if (!raw)
+            return {};
+        const parsed = JSON.parse(raw);
+        if (parsed == null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return {};
+        const out = {};
+        for (const [k, v] of Object.entries(parsed)) {
+            if (typeof k !== 'string' || !Array.isArray(v))
+                continue;
+            const cleaned = v.filter((d) => typeof d === 'string' && d.length > 0);
+            if (cleaned.length > 0)
+                out[k] = cleaned;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+export function writeOAuthExtras(storage, store) {
+    // setItem throws synchronously on QuotaExceededError. The options-page
+    // click handlers call this through addOAuthExtraDomain / remove / clear
+    // and rely on the throw being caught by their toast wiring; without an
+    // explicit message the toast says nothing useful.
+    try {
+        storage.setItem(OAUTH_EXTRA_DOMAINS_KEY, JSON.stringify(store));
+    }
+    catch (err) {
+        throw new Error(`Failed to persist OAuth extras (localStorage quota exceeded?): ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export function addOAuthExtraDomain(storage, providerId, domain) {
+    if (!providerId || !domain)
+        return { added: false, reason: 'provider and domain required' };
+    const store = readOAuthExtras(storage);
+    const current = store[providerId] ?? [];
+    const lower = domain.toLowerCase();
+    if (current.some((d) => d.toLowerCase() === lower)) {
+        return { added: false, reason: 'duplicate' };
+    }
+    store[providerId] = [...current, domain];
+    try {
+        writeOAuthExtras(storage, store);
+    }
+    catch (err) {
+        return { added: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+    return { added: true };
+}
+export function removeOAuthExtraDomain(storage, providerId, domain) {
+    const store = readOAuthExtras(storage);
+    const current = store[providerId] ?? [];
+    const lower = domain.toLowerCase();
+    const next = current.filter((d) => d.toLowerCase() !== lower);
+    if (next.length === current.length)
+        return { removed: false };
+    if (next.length === 0)
+        delete store[providerId];
+    else
+        store[providerId] = next;
+    writeOAuthExtras(storage, store);
+    return { removed: true };
+}
+export function clearOAuthExtras(storage, providerId) {
+    const store = readOAuthExtras(storage);
+    delete store[providerId];
+    writeOAuthExtras(storage, store);
+}
+//# sourceMappingURL=oauth-extra-domains-storage.js.map

package/dist/node-server/_shared/oauth-extra-domains-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-extra-domains-storage.js","sourceRoot":"","sources":["../src/oauth-extra-domains-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AASnE,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACrF,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,SAAS;YACzD,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAyB,EAAE,KAA6B;IACvF,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,kDAAkD;IAClD,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kEAAkE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAyB,EACzB,UAAkB,EAClB,MAAc;IAEd,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC5F,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAyB,EACzB,UAAkB,EAClB,MAAc;IAEd,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC;;QAC3C,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAyB,EAAE,UAAkB;IAC5E,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC;IACzB,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/node-server/_shared/secret-masking.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Secret masking engine — HMAC-SHA256 based, format-preserving.
+ *
+ * Used on both agent side (env population, output scrubbing) and
+ * server side (fetch proxy response scrubbing).
+ */
+/**
+ * Produce a deterministic, format-preserving masked value.
+ *
+ * `masked = prefix + hex(HMAC-SHA256(sessionId+secretName, realValue))`
+ * truncated/repeated to match `realValue.length - prefix.length`.
+ */
+export declare function mask(sessionId: string, secretName: string, realValue: string): Promise<string>;
+export interface SecretPair {
+    realValue: string;
+    maskedValue: string;
+}
+/**
+ * Build a reusable scrubber function that replaces every occurrence
+ * of any `realValue` with its `maskedValue`.
+ *
+ * For a small number of secrets a simple sequential replace is fine.
+ * Secrets are sorted longest-first to avoid partial-match issues.
+ */
+export declare function buildScrubber(secrets: SecretPair[]): (text: string) => string;
+/**
+ * Domain glob matching.
+ *
+ * - `api.github.com` matches exactly `api.github.com`
+ * - `*.github.com`   matches `api.github.com`, `uploads.github.com`,
+ *                     but NOT `github.com` itself
+ */
+export declare function domainMatches(pattern: string, hostname: string): boolean;
+/**
+ * Check if hostname is allowed by any of the domain patterns.
+ */
+export declare function isAllowedDomain(patterns: string[], hostname: string): boolean;
+/**
+ * Compatibility alias for node-server's historical name + arg order.
+ * Prefer `isAllowedDomain(patterns, hostname)` in new code.
+ */
+export declare function matchesDomains(hostname: string, patterns: string[]): boolean;
+//# sourceMappingURL=secret-masking.d.ts.map

package/dist/node-server/_shared/secret-masking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-masking.d.ts","sourceRoot":"","sources":["../src/secret-masking.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA6DH;;;;;GAKG;AACH,wBAAsB,IAAI,CACxB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAe7E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAcxE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAE5E"}

package/dist/node-server/_shared/secret-masking.js

@@ -0,0 +1,125 @@
+/**
+ * Secret masking engine — HMAC-SHA256 based, format-preserving.
+ *
+ * Used on both agent side (env population, output scrubbing) and
+ * server side (fetch proxy response scrubbing).
+ */
+// ---------- Known token prefixes ----------
+const KNOWN_PREFIXES = [
+    'ghp_', // GitHub PAT
+    'gho_', // GitHub OAuth
+    'ghu_', // GitHub user-to-server
+    'ghs_', // GitHub server-to-server
+    'ghr_', // GitHub refresh
+    'github_pat_', // GitHub fine-grained PAT
+    'sk-', // OpenAI / Stripe secret key
+    'pk-', // Stripe publishable key
+    'xoxb-', // Slack bot token
+    'xoxp-', // Slack user token
+    'xoxa-', // Slack app token
+    'xoxs-', // Slack session token
+    'AKIA', // AWS access key ID
+    'ABIA', // AWS STS
+    'ACCA', // AWS alternate
+    'ASIA', // AWS temporary
+    'sk-ant-', // Anthropic
+    'Bearer ', // generic bearer (keep space)
+];
+// Sort longest-first so we match the most specific prefix
+const SORTED_PREFIXES = [...KNOWN_PREFIXES].sort((a, b) => b.length - a.length);
+/**
+ * Detect a known prefix from the value. Returns the prefix string or empty.
+ */
+function detectPrefix(value) {
+    for (const p of SORTED_PREFIXES) {
+        if (value.startsWith(p))
+            return p;
+    }
+    return '';
+}
+// ---------- HMAC-SHA256 ----------
+async function hmacSha256(key, message) {
+    const enc = new TextEncoder();
+    const cryptoKey = await crypto.subtle.importKey('raw', enc.encode(key), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', cryptoKey, enc.encode(message));
+    return new Uint8Array(sig);
+}
+function toHex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+// ---------- Public API ----------
+/**
+ * Produce a deterministic, format-preserving masked value.
+ *
+ * `masked = prefix + hex(HMAC-SHA256(sessionId+secretName, realValue))`
+ * truncated/repeated to match `realValue.length - prefix.length`.
+ */
+export async function mask(sessionId, secretName, realValue) {
+    const prefix = detectPrefix(realValue);
+    const remainder = realValue.slice(prefix.length);
+    const hmac = await hmacSha256(sessionId + secretName, realValue);
+    let hex = toHex(hmac);
+    // Repeat hex if remainder is longer than 64 hex chars
+    while (hex.length < remainder.length)
+        hex += hex;
+    const maskedRemainder = hex.slice(0, remainder.length);
+    return prefix + maskedRemainder;
+}
+/**
+ * Build a reusable scrubber function that replaces every occurrence
+ * of any `realValue` with its `maskedValue`.
+ *
+ * For a small number of secrets a simple sequential replace is fine.
+ * Secrets are sorted longest-first to avoid partial-match issues.
+ */
+export function buildScrubber(secrets) {
+    if (secrets.length === 0)
+        return (t) => t;
+    // Sort longest real values first to avoid sub-string clobbering
+    const sorted = [...secrets].sort((a, b) => b.realValue.length - a.realValue.length);
+    return (text) => {
+        let result = text;
+        for (const { realValue, maskedValue } of sorted) {
+            if (result.includes(realValue)) {
+                result = result.split(realValue).join(maskedValue);
+            }
+        }
+        return result;
+    };
+}
+/**
+ * Domain glob matching.
+ *
+ * - `api.github.com` matches exactly `api.github.com`
+ * - `*.github.com`   matches `api.github.com`, `uploads.github.com`,
+ *                     but NOT `github.com` itself
+ */
+export function domainMatches(pattern, hostname) {
+    const p = pattern.toLowerCase();
+    const h = hostname.toLowerCase();
+    if (p === '*')
+        return true;
+    if (!p.startsWith('*.')) {
+        return p === h;
+    }
+    // Wildcard: `*.example.com`
+    const suffix = p.slice(1); // `.example.com`
+    // hostname must end with `.example.com` AND have at least one char before
+    return h.length > suffix.length && h.endsWith(suffix);
+}
+/**
+ * Check if hostname is allowed by any of the domain patterns.
+ */
+export function isAllowedDomain(patterns, hostname) {
+    return patterns.some((p) => domainMatches(p, hostname));
+}
+/**
+ * Compatibility alias for node-server's historical name + arg order.
+ * Prefer `isAllowedDomain(patterns, hostname)` in new code.
+ */
+export function matchesDomains(hostname, patterns) {
+    return isAllowedDomain(patterns, hostname);
+}
+//# sourceMappingURL=secret-masking.js.map

package/dist/node-server/_shared/secret-masking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-masking.js","sourceRoot":"","sources":["../src/secret-masking.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,6CAA6C;AAE7C,MAAM,cAAc,GAAa;IAC/B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,wBAAwB;IAChC,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,iBAAiB;IACzB,aAAa,EAAE,0BAA0B;IACzC,KAAK,EAAE,6BAA6B;IACpC,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,sBAAsB;IAC/B,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,YAAY;IACvB,SAAS,EAAE,8BAA8B;CAC1C,CAAC;AAEF,0DAA0D;AAC1D,MAAM,eAAe,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF;;GAEG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,oCAAoC;AAEpC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,OAAe;IACpD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EACf,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,mCAAmC;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,SAAiB,EACjB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,SAAS,GAAG,UAAU,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAEtB,sDAAsD;IACtD,OAAO,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;QAAE,GAAG,IAAI,GAAG,CAAC;IACjD,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,GAAG,eAAe,CAAC;AAClC,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAE1C,gEAAgE;IAChE,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEpF,OAAO,CAAC,IAAY,EAAU,EAAE;QAC9B,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,MAAM,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,QAAgB;IAC7D,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEjC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;IAC5C,0EAA0E;IAC1E,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAgB;IAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,QAAkB;IACjE,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC"}

package/dist/node-server/_shared/secrets-pipeline.d.ts

@@ -0,0 +1,103 @@
+export interface FetchProxySecretSource {
+    get(name: string): Promise<string | undefined>;
+    listAll(): Promise<{
+        name: string;
+        value: string;
+        domains: string[];
+    }[]>;
+}
+export interface MaskedSecret {
+    name: string;
+    realValue: string;
+    maskedValue: string;
+    domains: string[];
+}
+export interface ForbiddenInfo {
+    secretName: string;
+    hostname: string;
+}
+export interface UnmaskResult {
+    text: string;
+    forbidden?: ForbiddenInfo;
+}
+export interface UnmaskHeadersResult {
+    forbidden?: ForbiddenInfo;
+}
+export interface BasicResult {
+    value: string;
+    forbidden?: ForbiddenInfo;
+}
+export interface ExtractedUrlCreds {
+    url: string;
+    syntheticAuthorization?: string;
+    forbidden?: ForbiddenInfo;
+}
+export interface SecretsPipelineOpts {
+    sessionId: string;
+    source: FetchProxySecretSource;
+}
+/**
+ * Stateful unmask/scrub pipeline shared between node-server's /api/fetch-proxy
+ * and the chrome-extension SW's fetch-proxy.fetch Port handler.
+ *
+ * Public surface has four method families:
+ *
+ *   ┌────────────┬────────────────────────────────┬─────────────────────────┐
+ *   │            │ Text-safe (string in / out)    │ Byte-safe (Uint8Array)  │
+ *   ├────────────┼────────────────────────────────┼─────────────────────────┤
+ *   │ Unmask     │ unmask, unmaskBody,            │ unmaskBodyBytes         │
+ *   │ (mask→real)│ unmaskHeaders, …Basic, …Url    │                         │
+ *   ├────────────┼────────────────────────────────┼─────────────────────────┤
+ *   │ Scrub      │ scrubResponse, scrubHeaders    │ scrubResponseBytes      │
+ *   │ (real→mask)│                                │                         │
+ *   └────────────┴────────────────────────────────┴─────────────────────────┘
+ *
+ * Use the byte-safe variants for request/response bodies that may be binary
+ * (git packfiles, ZIPs, images, application/octet-stream). The text variants
+ * UTF-8-decode their input, which corrupts non-UTF-8 byte sequences
+ * (`Buffer.toString('utf-8')` replaces invalid bytes with U+FFFD).
+ *
+ * Note: unmaskHeaders MUTATES its input in place (matching SecretProxyManager's
+ * legacy semantics). The other methods return new strings/byte arrays.
+ */
+export declare class SecretsPipeline {
+    readonly sessionId: string;
+    private readonly source;
+    private maskedToSecret;
+    private scrubber;
+    constructor(opts: SecretsPipelineOpts);
+    reload(): Promise<void>;
+    maskOne(name: string, value: string): Promise<string>;
+    hasSecrets(): boolean;
+    getMaskedEntries(): Array<{
+        name: string;
+        maskedValue: string;
+        domains: string[];
+    }>;
+    /**
+     * Unmask a single string. Domain mismatch on a matched secret → forbidden.
+     * Returns { text } on success, { text: original, forbidden } on block.
+     */
+    unmask(text: string, hostname: string): UnmaskResult;
+    /**
+     * Unmask body text. Domain mismatch on a matched secret leaves it untouched
+     * (NO forbidden — masked values in conversation context are harmless).
+     */
+    unmaskBody(text: string, hostname: string): {
+        text: string;
+    };
+    unmaskAuthorizationBasic(headerValue: string, hostname: string): BasicResult;
+    extractAndUnmaskUrlCredentials(rawUrl: string): ExtractedUrlCreds;
+    /**
+     * Unmask headers IN PLACE. Mutates the headers parameter; returns only { forbidden? }.
+     * Match SecretProxyManager's existing semantics so call sites compile unchanged.
+     */
+    unmaskHeaders(headers: Record<string, string>, hostname: string): UnmaskHeadersResult;
+    unmaskBodyBytes(body: Uint8Array, hostname: string): {
+        bytes: Uint8Array;
+    };
+    scrubResponse(text: string): string;
+    scrubResponseBytes(bytes: Uint8Array): Uint8Array;
+    scrubHeaders(headers: Headers): Record<string, string>;
+}
+//# sourceMappingURL=secrets-pipeline.d.ts.map

package/dist/node-server/_shared/secrets-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-pipeline.d.ts","sourceRoot":"","sources":["../src/secrets-pipeline.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,eAAe;IAC1B,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,QAAQ,CAAsC;gBAE1C,IAAI,EAAE,mBAAmB;IAK/B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBvB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3D,UAAU,IAAI,OAAO;IAIrB,gBAAgB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAQnF;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY;IAYpD;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;IAU5D,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW;IA6B5E,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAkCjE;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB;IAerF,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,UAAU,CAAA;KAAE;IAY1E,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAInC,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU;IAWjD,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAOvD"}