sonorance 0.1.0-beta.4.1

package/src/plugins.mjs

@@ -0,0 +1,91 @@
+/**
+ * plugins.mjs — per-vault PLUGIN loading for the Sonorance app.
+ *
+ * Sonorance is the platform; capabilities beyond the plain Markdown editor arrive as **plugins** a
+ * vault opts into. A plugin is declared in the vault's `.sonorance/plugins.json` and can be enabled
+ * or disabled individually:
+ *
+ *   { "plugins": [ { "id": "deliberate", "enabled": true } ] }
+ *
+ * The engine is built ADDITIVELY: the host always constructs the generic default engine, then, for
+ * each enabled plugin, MERGES that plugin's contribution on top (kinds, a record-store overlay,
+ * gitignore) — a plugin never replaces the whole engine, and the app's identity stays Sonorance.
+ *
+ * Plugins ship INSIDE this package and are resolved by `id` from the BUILTIN map below. Vault
+ * configuration never loads executable filesystem paths and no plugin can replace the host engine.
+ */
+import { readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { makeDefaultEngine } from './engine-default.mjs';
+
+export const pluginsPath = (root) => join(resolve(root), '.sonorance', 'plugins.json');
+
+// Built-in plugins bundled in this package, resolved by id (no path in the vault's config).
+const BUILTIN = {
+  deliberate: () => import('./plugins/deliberate/contribute.mjs'),
+};
+
+// The vault's declared plugins (in order). Missing / malformed file → none.
+export function listPlugins(root) {
+  try { const j = JSON.parse(readFileSync(pluginsPath(root), 'utf8')); return Array.isArray(j.plugins) ? j.plugins : []; }
+  catch { return []; }
+}
+
+// Layer a plugin's store (which may be a CLASS instance) on top of the base store. A plain spread
+// drops a class instance's prototype methods, so walk the overlay's prototype chain and bind each
+// method to the instance. The base store supplies the generic project/current-pointer machinery
+// (`_current`/`_setCurrent`/…) the engine's resolvers call; the overlay overrides the record,
+// comment and state methods it defines (exactly the surface it owned in the pre-composition model).
+function overlayStore(base, overlay) {
+  const merged = { ...base };
+  const skip = new Set([...Object.getOwnPropertyNames(Object.prototype), 'constructor']);
+  for (let o = overlay; o && o !== Object.prototype; o = Object.getPrototypeOf(o)) {
+    for (const key of Object.getOwnPropertyNames(o)) {
+      if (skip.has(key)) continue;
+      skip.add(key);
+      const v = overlay[key];
+      merged[key] = typeof v === 'function' ? v.bind(overlay) : v;
+    }
+  }
+  return merged;
+}
+
+// Merge one plugin's contribution onto the current engine. Only the fields a plugin supplies are
+// overlaid; everything else (project resolution, current-vault pointer, logger, identity) stays
+// app-owned from the base engine. The record store is layered on top of the base store so generic
+// vault machinery keeps working for a plugin vault.
+function compose(engine, contrib) {
+  if (!contrib) return engine;
+  return {
+    ...engine,
+    KINDS: contrib.KINDS ?? engine.KINDS,
+    gitignoreEntries: contrib.gitignoreEntries ?? engine.gitignoreEntries,
+    openVault: typeof contrib.openVault === 'function'
+      ? () => overlayStore(engine.openVault(), contrib.openVault())
+      : engine.openVault,
+  };
+}
+
+// Load a bundled plugin by its stable id.
+async function loadPluginModule(p) {
+  if (p.id && BUILTIN[p.id]) return BUILTIN[p.id]();
+  return null;
+}
+
+// Resolve the engine for a vault: build the generic base engine, then compose every enabled
+// bundled plugin's contribution on top. A plugin that fails to load is skipped with a warning.
+export async function resolveEngine(root) {
+  const dir = resolve(root);
+  let engine = makeDefaultEngine(dir);
+  for (const p of listPlugins(dir)) {
+    if (!p || p.enabled === false || !p.id) continue;
+    try {
+      const mod = await loadPluginModule(p);
+      if (!mod) continue;
+      if (typeof mod.contribute === 'function') engine = compose(engine, mod.contribute(dir));
+    } catch (e) {
+      console.error(`sonorance: plugin "${p.id}" failed to load — ${e.message}. Continuing with the base engine.`);
+    }
+  }
+  return engine;
+}

package/src/release-config.mjs

@@ -0,0 +1,2 @@
+// Generated only in the npm release workspace. Do not commit this file.
+export const RELEASE_AZURE_CONNECTION_STRING = "InstrumentationKey=39214618-bcec-469f-8ee4-5476d4f95b81;IngestionEndpoint=https://centralus-2.in.applicationinsights.azure.com/";

package/src/scrubber.mjs

@@ -0,0 +1,64 @@
+/**
+ * scrubber.mjs — the pattern-based privacy scrubber for the ONE place free text is allowed near
+ * the wire: bug-report diagnostics and redacted error stacks (feedback-ux spec §4).
+ *
+ * It is a defence layer, NOT the primary control. It removes the mechanical leaks a pattern can
+ * catch — absolute paths, home dir, emails, URLs with credentials, long tokens/base64/hex,
+ * IP/MAC — so a pasted stack or log never carries a filesystem path or secret. It CANNOT catch a
+ * semantic leak (a sentence that happens to describe private content); for feedback, the user's
+ * own preview/approve step is that control, and telemetry has no free-text field at all.
+ *
+ * Everything here is unit-tested (`test/telemetry.test.mjs`): each pattern has a positive case.
+ */
+import { homedir } from 'node:os';
+
+const REDACTED = '⟨redacted⟩';
+
+// Order matters: redact structured secrets first, then paths, then bare identifiers.
+const PATTERNS = [
+  // emails
+  [/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, REDACTED],
+  // URLs carrying credentials or query strings (scheme://user:pass@host or ?token=…)
+  [/\b[a-z][a-z0-9+.-]*:\/\/[^\s'"]*@[^\s'"]*/gi, REDACTED],
+  [/\b(?:token|key|secret|password|pwd|auth|bearer|api[_-]?key)\b\s*[=:]\s*[^\s'"]+/gi, REDACTED],
+  // long opaque tokens / base64 / hex blobs (>=24 chars) — API keys, JWTs, hashes
+  [/\b[A-Za-z0-9_-]{24,}\b/g, REDACTED],
+  [/\b[0-9a-fA-F]{24,}\b/g, REDACTED],
+  // JWTs (three base64url segments)
+  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, REDACTED],
+  // IPv4 + MAC addresses
+  [/\b(?:\d{1,3}\.){3}\d{1,3}\b/g, REDACTED],
+  [/\b(?:[0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}\b/g, REDACTED],
+  // Windows absolute paths (C:\Users\… )
+  [/\b[A-Za-z]:\\[^\s'"]+/g, REDACTED],
+  // POSIX absolute paths (/Users/…, /home/…, /var/…) — 2+ segments so a bare "/" survives
+  [/(?:^|[\s'"(])(\/[^\s'"/]+){2,}\/?/g, (m) => m.replace(/\/\S+/, ' ' + REDACTED)],
+];
+
+/**
+ * Scrub a free-text blob (a pasted log, repro notes, an error message) to a content-free-ish
+ * form: home dir → `~`, then every pattern above. Non-strings return ''. Capped so a giant paste
+ * can't be used to smuggle content past the length the UI shows.
+ */
+export function scrub(text, { max = 4000 } = {}) {
+  if (typeof text !== 'string' || !text) return '';
+  let s = text.slice(0, max);
+  // Collapse the user's home dir first so a path under it becomes `~/…` before path redaction.
+  try { const h = homedir(); if (h) s = s.split(h).join('~'); } catch { /* best-effort */ }
+  for (const [re, repl] of PATTERNS) s = s.replace(re, repl);
+  return s;
+}
+
+/**
+ * Redact an Error into a content-free diagnostic: the error CLASS (constructor name) plus a
+ * scrubbed, path-stripped, top-few-frames stack. NEVER the message (which may quote user content).
+ * Returns `{ class, stack }` — the shape the `error` telemetry event + bug diagnostics use.
+ */
+export function redactError(err, { frames = 5 } = {}) {
+  const cls = (err && (err.name || err.constructor?.name)) || 'Error';
+  const raw = (err && typeof err.stack === 'string') ? err.stack : '';
+  // Drop the first line (it embeds the message), keep the next `frames` "at …" lines, scrubbed.
+  const lines = raw.split('\n').slice(1).filter(l => /^\s*at\s/.test(l)).slice(0, frames);
+  const stack = scrub(lines.join('\n'), { max: 2000 });
+  return { class: String(cls).slice(0, 60), stack };
+}