synabun 2.0.7 → 2.0.10

package/neural-interface/public/shared/assistant/asst-rack-styles.js

@@ -4,7 +4,9 @@
 // Injected once by asst-render.js as <style id="asst-rack-styles">, right
 // after the main assistant styles. One rack per burst of agent work: a stage
 // where the mascot acts out the call it is on (live only), a ledger with one
-// row per tool kind, and a receipt once it settles.
+// row per tool kind, and a receipt once it settles. On a direct route the
+// mascot stands over its task class's scene (asst-scenes.js; the motion is
+// asst-scene-styles.js): one column, as wide as the scene.
 //
 // Rules: gold only means live (the awake row's ring and tick, the caret, the
 // sweep); a rack a card holds (data-state="waiting") drops its gold: "Waiting
@@ -81,10 +83,12 @@ export const RACK_CSS = `
     position: relative;
     display: grid;
     grid-template-columns: auto minmax(0, 1fr);
-    grid-template-areas: "face caption" "face bubble";
+    /* The mascot sits level with its bubble (the caption over the bubble), so the notch, near the bubble's top,
+       points at the mascot however tall the bubble grows. */
+    grid-template-areas: ". caption" "face bubble";
     align-items: center;
     column-gap: 8px;
-    row-gap: 6px;
+    row-gap: 0;
     min-height: 0;
     overflow: hidden;
     padding: 0 14px;
@@ -96,12 +100,24 @@ export const RACK_CSS = `
     visibility: visible;
     transition: padding var(--rk-moderate) var(--rk-ease), visibility 0s;
   }
-  .asst-rack-face { grid-area: face; align-self: center; color: var(--rk-text); line-height: 0; }
+  /* The set: the mascot, and under it the direct route's scene (none: the set is the mascot alone). Never between the
+     mascot and the bubble's notch: under the mascot here (the bubble is beside it), after it ≤400 (the bubble is under it). */
+  .asst-rack-set { grid-area: face; align-self: start; display: flex; flex-direction: column; align-items: center; gap: 4px 6px; min-width: 0; line-height: 0; }
+  .asst-rack-face { color: var(--rk-text); line-height: 0; }
   .asst-rack-face svg { display: block; width: 72px; height: 36px; }
+  .asst-rack-scene { color: var(--rk-text-2); line-height: 0; }
+  .asst-rack-scene:empty { display: none; }
+  /* 96×32 (the 120×40 scene at .8, strokes held near the run stage's weight). */
+  .asst-rack-scene .asst-scene { width: 96px; height: 32px; stroke-width: 1.9; }
+  /* Gold only means live: none while a card holds the rack or once it settled (the scene holds its frame, dimmed). */
+  .asst-rack:not(.is-live) .asst-rack-scene,
+  .asst-rack[data-state="waiting"] .asst-rack-scene { --sc-gold: currentColor; }
+  .asst-rack[data-state="waiting"] .asst-rack-scene { opacity: .55; }
   .asst-rack-caption {
     grid-area: caption;
     align-self: end;
     min-width: 0;
+    margin-bottom: 6px; /* the gap over the bubble: an empty caption takes no room */
     overflow: hidden;
     display: -webkit-box;
     -webkit-box-orient: vertical;
@@ -111,7 +127,6 @@ export const RACK_CSS = `
     line-height: 1.45;
   }
   .asst-rack-caption:empty { display: none; }
-  .asst-rack-caption:empty ~ .asst-bubble { grid-row: 1 / span 2; }
 
   .asst-bubble {
     grid-area: bubble;
@@ -528,15 +543,17 @@ export const RACK_CSS = `
 
   /* ── Narrow containers ─────────────────────────────────────────────
      ≤400: the face (still 72×36) sits over the bubble, whose notch points up
-     at it; the rows keep the last 12 ticks and drop the time (the receipt and
+     at it (a direct route's scene goes after the face, never between the two);
+     the rows keep the last 12 ticks and drop the time (the receipt and
      the Timeline carry it). ≤320: only the bubble's meta goes; its subject
      wraps to two lines, cut from the head so the file name survives, and the
-     error keeps two lines. Under a 300px container the face is 56×28. */
+     error keeps two lines. Under a 300px container the face is 56×28 and a
+     direct route's scene beside it 72×24 (96×32 above). */
   @container asst (max-width: 400px) {
-    .asst-rack-stage { grid-template-columns: auto minmax(0, 1fr); grid-template-areas: "face caption" "bubble bubble"; column-gap: 8px; }
+    .asst-rack-stage { grid-template-columns: auto minmax(0, 1fr); grid-template-areas: "face caption" "bubble bubble"; column-gap: 8px; row-gap: 6px; }
+    .asst-rack-set { align-self: center; flex-direction: row; }
     .asst-rack.is-staged > .asst-rack-stage { padding: 10px 10px 10px; }
-    .asst-rack-caption { align-self: center; }
-    .asst-rack-caption:empty ~ .asst-bubble { grid-row: auto; }
+    .asst-rack-caption { align-self: center; margin-bottom: 0; }
     .asst-bubble { justify-self: stretch; max-width: 100%; margin: 4px 0 0; border-radius: 3px 12px 12px 12px; }
     .asst-bubble::before { left: 30px; top: -5.5px; box-shadow: inset 1px 1px 0 var(--rk-line); clip-path: polygon(0 100%, 0 0, 100% 0); }
     .asst-station-hdr { gap: 8px; padding: 0 6px; }
@@ -554,6 +571,7 @@ export const RACK_CSS = `
   }
   @container asst (max-width: 299px) {
     .asst-rack-face svg { width: 56px; height: 28px; }
+    .asst-rack-scene .asst-scene { width: 72px; height: 24px; stroke-width: 2.2; }
     .asst-bubble::before { left: 22px; }
   }
 

package/neural-interface/public/shared/assistant/asst-redact.js

@@ -0,0 +1,186 @@
+// ═══════════════════════════════════════════
+// SynaBun Assistant — what a step line may say of a call
+// ═══════════════════════════════════════════
+// A worker's step line ("Running curl …", "Opening example.com/docs") names
+// the call it is on, never what the call carries: no credential, no file body
+// written inline. One rule for every place a step line is made: the server's
+// OpenCode relay (lib/opencode-worker-activity.js, before anything leaves the
+// process) and the page's stage and tray (asst-scenes.js compactActivity /
+// stepLine, Claude and Codex workers). Credentials are masked before
+// anything is clipped, so a cut never leaves half a key.
+//
+// No imports and no `document`: node:test and the server load it as it is.
+
+/** What a masked value reads as. */
+export const REDACTED = '••••';
+
+// A credential's name: an environment variable, a query parameter, a JSON key, a header, a long flag.
+const SECRET_NAME_RE = /token|secret|passw(?:or)?d|pwd|api[_-]?key|apikey|access[_-]?key|private[_-]?key|signature|credential|authori[sz]ation|(?:^|[_.-])(?:key|sig|pass|auth)$|^(?:key|sig|pass|auth)$/i;
+// Counters and settings that only sound like one ("max_tokens", "token_count", "--tokenizer").
+const NOT_SECRET_NAME_RE = /tokens$|tokens?[_-]?(?:count|usage|limit|budget|max|min)|max[_-]?tokens|tokeniz/i;
+
+const isSecretName = (name) => SECRET_NAME_RE.test(name) && !NOT_SECRET_NAME_RE.test(name);
+
+// Values a provider's own shape gives away, wherever they stand.
+const KEY_SHAPES = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,
+  /\bsk-ant-[A-Za-z0-9_-]{8,}/g, // Anthropic
+  /\bsk-(?:proj-|svcacct-|admin-|or-v1-)?[A-Za-z0-9_-]{16,}/g, // OpenAI, OpenRouter
+  /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{8,}/g, // Stripe
+  /\bgh[pousr]_[A-Za-z0-9]{20,}/g, // GitHub
+  /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+  /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g, // AWS access key id
+  /\bxox[abposr]-[A-Za-z0-9-]{10,}/g, // Slack
+  /\bAIza[0-9A-Za-z_-]{20,}/g, // Google
+  /\b(?:npm|hf|glpat|dop_v1)_[A-Za-z0-9_-]{20,}/g,
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, // a JWT
+];
+
+// `https://user:secret@host`: the password of a URL.
+const USERINFO_RE = /\b([a-z][a-z0-9+.-]{0,30}:\/\/)([^\s/@:'"]{1,256}):([^\s/@'"]{1,512})@/gi;
+// A header that carries a credential, up to the end of its value (a quote or the line's end): `-H "Authorization: Bearer …"`.
+const HEADER_RE = /\b((?:proxy-)?authorization|cookie|set-cookie|x-[a-z0-9-]{0,40}(?:api-?key|token|secret|auth|signature)[a-z0-9-]{0,40}|api-?key)(["']?[ \t]*:[ \t]*["']?)([^\r\n"']+)/gi;
+// An auth scheme and its credential outside a header.
+const SCHEME_RE = /\b([Bb]earer|Token)([ \t]+)[A-Za-z0-9._~+/=-]{4,}|\b(Basic)([ \t]+)[A-Za-z0-9+/]{8,}={0,2}/g;
+// `curl -u user:secret`.
+const USER_FLAG_RE = /(^|\s)(-u|--user)([ \t]+|=)([^\s:'"]+):([^\s'"]+)/g;
+// `name=value`, `name: value`, `"name": "value"`, `?name=value&`: the value of a credential's name. Names, schemes
+// and header names are bounded so that a long token costs a linear scan, never a quadratic one.
+const ASSIGN_RE = /([A-Za-z_][A-Za-z0-9_.-]{0,63})(["']?[ \t]*[:=][ \t]*["']?)/g;
+const ASSIGN_VALUE_RE = /[^\s"'&;,|<>?)}\]]+/y; // read only after a credential's name: a long value is scanned once
+// `--token value`, `--password "two words"`: a flag named like a credential, and the word after it.
+const FLAG_RE = /(^|\s)(--?[A-Za-z][A-Za-z0-9_-]*)([ \t]+)("[^"]*"|'[^']*'|[^\s"'-][^\s"']*)/g;
+
+// Only a credential's name takes its value: any other `name: value` gives up its value to the scan, so
+// `Note: token=abc` still masks abc.
+function redactAssignments(s) {
+  let out = '';
+  let last = 0;
+  ASSIGN_RE.lastIndex = 0;
+  for (let m = ASSIGN_RE.exec(s); m; m = ASSIGN_RE.exec(s)) {
+    const [head, name] = m;
+    const at = m.index + head.length;
+    ASSIGN_VALUE_RE.lastIndex = at;
+    const v = isSecretName(name) ? ASSIGN_VALUE_RE.exec(s)?.[0] : null;
+    if (!v || v === REDACTED) { ASSIGN_RE.lastIndex = m.index + name.length; continue; }
+    out += `${s.slice(last, at)}${REDACTED}`;
+    last = at + v.length;
+    ASSIGN_RE.lastIndex = last;
+  }
+  return out + s.slice(last);
+}
+
+/**
+ * `text` with every credential masked: provider keys, private keys, a URL's password, credential headers, Bearer
+ * and Basic tokens, and the value of anything named like a credential (token=, key=, secret=, password=, sig=,
+ * GITHUB_TOKEN=, "api_key": …, --api-key …). Counters named like one ("max_tokens=10") are kept.
+ */
+export function redactSecrets(value) {
+  let s = value == null ? '' : String(value);
+  if (!s) return s;
+  for (const re of KEY_SHAPES) s = s.replace(re, REDACTED);
+  s = s.replace(USERINFO_RE, (whole, scheme, user) => `${scheme}${user}:${REDACTED}@`);
+  s = s.replace(HEADER_RE, (whole, name, sep, v) => (v.trim() === REDACTED ? whole : `${name}${sep}${REDACTED}`));
+  s = s.replace(SCHEME_RE, (whole, bearer, gap, basic, gap2) => `${bearer || basic}${gap || gap2}${REDACTED}`);
+  s = s.replace(USER_FLAG_RE, (whole, lead, flag, sep, user) => `${lead}${flag}${sep}${user}:${REDACTED}`);
+  s = redactAssignments(s);
+  s = s.replace(FLAG_RE, (whole, lead, flag, gap, v) => {
+    if (!isSecretName(flag.replace(/^-+/, '')) || v === REDACTED) return whole;
+    const quote = /^["']/.test(v) ? v[0] : '';
+    return `${lead}${flag}${gap}${quote}${REDACTED}${quote}`;
+  });
+  return s;
+}
+
+// ── Commands ──
+
+const COMMAND_SCAN_MAX = 16_000; // a step line shows 300 characters: nothing further in is read
+// `<<EOF`, `<<-EOF`, `<< 'EOF'`, `<<"EOF"`, `<<\EOF` (never a here-string's `<<<`).
+const HEREDOC_RE = /(^|[^<])<<(-?)[ \t]*(?:(['"])([A-Za-z_][\w.-]*)\3|\\?([A-Za-z_][\w.-]*))/g;
+const HERESTRING_RE = /<<<[ \t]*(?:"(?:[^"\\]|\\.)*"|'[^']*'|\S+)/g;
+// A shell word: quoted, $'…', or bare.
+const WORD = String.raw`(?:"(?:[^"\\]|\\.)*"|'[^']*'|\$'(?:[^'\\]|\\.)*'|[^\s;&|<>"'])+`;
+// echo / printf whose words go into a file (`> f`, `>> f`, `| tee f`): the words are the file's content.
+const INLINE_WRITE_RE = new RegExp(String.raw`\b(echo|printf)[ \t]+${WORD}(?:[ \t]+${WORD})*(?=[ \t]*(?:\d?>>?|>\||\|[ \t]*(?:sudo[ \t]+)?tee\b))`, 'g');
+// An interpreter's inline script (`python -c "…"`, `node -e '…'`): kept when it is a short one-liner.
+const INLINE_SCRIPT_RE = /\b((?:python[0-9.]*|node|deno|bun|perl|ruby|php|osascript)(?:[ \t]+-[A-Za-z]+)*[ \t]+(?:-c|-e|--eval|-p|--print))[ \t]+("(?:[^"\\]|\\.)*"|'[^']*')/g;
+const INLINE_SCRIPT_MAX = 60;
+
+/** A heredoc's body omitted: the line that opens it says `…`, the lines up to its terminator go. */
+function dropHeredocs(text) {
+  const out = [];
+  const pending = []; // terminators still to come, in order
+  for (const line of text.split(/\r?\n/)) {
+    if (pending.length) {
+      const want = pending[0];
+      if ((want.dash ? line.replace(/^\t+/, '') : line).trim() === want.word) pending.shift();
+      continue;
+    }
+    HEREDOC_RE.lastIndex = 0;
+    let found = false;
+    for (let m = HEREDOC_RE.exec(line); m; m = HEREDOC_RE.exec(line)) { pending.push({ word: m[4] || m[5], dash: m[2] === '-' }); found = true; }
+    out.push(found ? `${line} …` : line);
+  }
+  return out.join('\n');
+}
+
+/**
+ * A shell command as a step line may say it: heredoc and here-string bodies, the words echo / printf write into a
+ * file and long inline scripts omitted (`…`), then every credential masked (redactSecrets). Not clipped.
+ */
+export function safeCommand(value) {
+  let s = Array.isArray(value) ? value.map((v) => (v == null ? '' : String(v))).join(' ') : (value == null ? '' : String(value));
+  if (!s) return '';
+  if (s.length > COMMAND_SCAN_MAX) s = s.slice(0, COMMAND_SCAN_MAX);
+  s = dropHeredocs(s);
+  s = s.replace(HERESTRING_RE, '<<< …');
+  s = s.replace(INLINE_WRITE_RE, '$1 …');
+  s = s.replace(INLINE_SCRIPT_RE, (whole, head, body) => (body.length > INLINE_SCRIPT_MAX || /[\r\n]/.test(body) ? `${head} …` : whole));
+  return redactSecrets(s);
+}
+
+// ── Addresses ──
+
+const OPAQUE_SCHEMES = new Set(['mailto:', 'tel:', 'sms:', 'data:', 'blob:', 'javascript:', 'vbscript:', 'about:']);
+
+/** An address as a step line may say it: scheme://host/path, with no user, password, query or fragment. */
+export function safeUrl(value) {
+  const s = value == null ? '' : String(value).trim();
+  if (!s) return '';
+  let url = null;
+  try { url = new URL(s); } catch { url = null; }
+  if (url && url.host) return redactSecrets(`${url.protocol}//${url.host}${url.pathname}`);
+  if (url && url.protocol === 'file:') return redactSecrets(`file://${url.pathname}`);
+  if (url && OPAQUE_SCHEMES.has(url.protocol)) return url.protocol; // what follows is no place: an address, a page's content
+  // No scheme ("example.com/docs?token=…", "/api/x?key=…"): everything before the query.
+  return redactSecrets(s.split(/[?#]/)[0]);
+}
+
+/** Input keys a step line reads as a command, and as an address. */
+export const COMMAND_KEYS = Object.freeze(['command', 'cmd']);
+export const URL_KEYS = Object.freeze(['url', 'href']);
+
+/**
+ * A call's input as a step line may read it (a copy): a command through safeCommand, an address through safeUrl,
+ * every other string through redactSecrets, nested lists and objects too (a plan's items). Nothing is clipped.
+ */
+export function safeStepInput(input, depth = 0) {
+  if (Array.isArray(input)) return depth > 4 ? [] : input.map((v) => safeStepValue('', v, depth + 1));
+  if (!input || typeof input !== 'object') return {};
+  const out = {};
+  for (const [key, v] of Object.entries(input)) out[key] = safeStepValue(key, v, depth + 1);
+  return out;
+}
+
+const STRING_SCAN_MAX = 4_000; // no step line reads further into a field (an edit's text, a file written whole)
+
+function safeStepValue(key, v, depth) {
+  if (typeof v === 'string') {
+    if (COMMAND_KEYS.includes(key)) return safeCommand(v);
+    if (URL_KEYS.includes(key)) return safeUrl(v);
+    return redactSecrets(v.length > STRING_SCAN_MAX ? v.slice(0, STRING_SCAN_MAX) : v);
+  }
+  if (Array.isArray(v) && COMMAND_KEYS.includes(key) && v.every((x) => typeof x === 'string')) return v.map((x) => safeCommand(x));
+  if (v && typeof v === 'object') return depth > 4 ? {} : safeStepInput(v, depth);
+  return v;
+}