token-goat 2.9.28 → 2.9.30

package/dist/token-goat-chunk-4FVIAHSI.mjs

@@ -0,0 +1,211 @@
+import { createRequire as __cjsRequire } from 'node:module';
+const require = __cjsRequire(import.meta.url);
+import {
+  loadConfig
+} from "./token-goat-chunk-7IN2MKDS.mjs";
+import {
+  growsExponentially,
+  hasNestedQuantifier
+} from "./token-goat-chunk-GOLEOXZP.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
+
+// src/secret_redact.ts
+init_define_import_meta_env();
+var SECRET_PATTERNS = [
+  // Anthropic keys share OpenAI's "sk-" prefix but are more specific ("sk-ant-"), so they're matched first — the generic OpenAI pattern's negative lookahead below is defense in depth, not the sole guard.
+  ["anthropic_api_key", /sk-ant-[A-Za-z0-9_-]{20,}/g],
+  // Modern (post-2024, now the default) OpenAI project keys: "sk-proj-" followed by a long base64url-ish body that legitimately contains '-' and '_' -- the generic pattern below deliberately excludes those characters (hyphenated prose would false-fire), so this needs its own entry with the more specific prefix matched first, like sk-ant- above.
+  ["openai_project_key", /sk-proj-[A-Za-z0-9_-]{20,}/g],
+  ["openai_api_key", /sk-(?!ant-|proj-)[A-Za-z0-9]{20,}/g],
+  ["aws_access_key", /AKIA[0-9A-Z]{16}/g],
+  // Fine-grained PATs ("github_pat_...") are matched before the classic gh[oprsu]_ pattern so the full token is always consumed as one match -- a fine-grained token's own body can contain '_' and could otherwise partially match the classic pattern.
+  ["github_token", /github_pat_[A-Za-z0-9_]{22,}/g],
+  ["github_token", /gh[oprsu]_[A-Za-z0-9]{36,}/g],
+  // xapp- is Slack's app-level token (Socket Mode), a bearer credential in its own right that the xox[baprs]- prefix does not cover. It gets its own entry rather than joining the alternation above because it needs the full segmented shape (xapp-<ver>-<app id>-<digits>- <hex>) to be safe: a bare /xapp-[A-Za-z0-9-]+/ redacted ordinary identifiers like "xapp-config" and the css class "xapp-container", mangling normal source. The xox* prefixes are distinctive enough on their own; "xapp-" is not.
+  ["slack_token", /xox[baprs]-[A-Za-z0-9-]+/g],
+  ["slack_token", /xapp-\d-[A-Za-z0-9]{6,}-\d{8,}-[A-Za-z0-9]{16,}/g],
+  // Matches the full block (BEGIN marker through its matching END marker), not just the header -- the actual secret material is the base64 body between them, so redacting only the header line would leave the key bytes themselves fully readable in the cached blob. The body is lazy and additionally refuses to cross a following BEGIN marker. Both halves matter. The laziness bounds a successful match at the very next END marker; the negative lookahead bounds a *failing* one, because a BEGIN with no END of its own would otherwise scan to end-of-input, and a blob full of such markers made the pass quadratic -- 6 ms, 20 ms and 78 ms for 2000, 4000 and 8000 of them, four times the work for twice the input, the same shape as the lookbehind incident described above. Private key blocks do not nest, so refusing to cross a BEGIN costs nothing in correctness. The algorithm and ` BLOCK` groups are backreferenced in the END marker rather than repeated, so a BEGIN only ever pairs with its own END spelling. Written as two independent optional groups, `BEGIN PGP PRIVATE KEY` would happily close on a distant `END RSA PRIVATE KEY BLOCK` and redact everything in between. A non-participating group backreferences as the empty string in JS, which is exactly what the unprefixed `BEGIN PRIVATE KEY` form needs. The algorithm list covers every armored private-key header openssl, ssh-keygen and gpg actually emit, not just the ones a first draft happened to think of. ENCRYPTED is the PKCS#8 passphrase-protected form (`openssl genpkey -aes256`, `ssh-keygen -m PKCS8`) and is the most common shape of all; DSA is legacy but still written verbatim; PGP carries the ` BLOCK` suffix, which is why that suffix is optional here. All three used to fall through to disk in full. An encrypted key is still key material: the passphrase can be attacked offline once the bytes are cached, so it is redacted like any other. PuTTY `.ppk` files are deliberately not matched. They have no END marker -- the private section is a `Private-Lines: N` count followed by exactly N base64 lines -- so bounding a match would take a stateful parse rather than a regex, on a path that runs over every command output. A regex guess at where the body ends is exactly the over-eager match this module's header warns against.
+  ["private_key_block", /-----BEGIN (RSA |DSA |EC |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY( BLOCK)?-----(?:(?!-----BEGIN )[\s\S])*?-----END \1PRIVATE KEY\2-----/g],
+  // Redacts only the token itself, not the "Authorization: Bearer " prefix -- the lookbehind anchors on the header name and scheme so the surrounding request-log line stays readable, matching how AWS_ACCESS_KEY_ID=... above keeps its own prefix intact. The optional quotes on either side of the colon are what let this see a header carried in JSON rather than in raw wire format. Without them the lookbehind demanded the colon sit directly against the header name and the scheme directly against the space, so a body like {"Authorization": "Bearer <token>"} -- the shape any logged fetch or MCP result arrives in -- matched nothing and the token was cached verbatim. `token` is the second scheme spelling in wide use -- it is what curl and gh examples pass for GitHub and many other APIs -- and an opaque value behind it carries exactly the same authority as one behind `Bearer`. The trailing gap is `{1,8}` rather than a single space for the same reason every other gap in this lookbehind already is: a hand-aligned or reformatted header ("Authorization: Bearer <token>") is ordinary, and demanding exactly one space there made this the one position in the pattern that a second space defeated.
+  ["auth_bearer_token", /(?<=Authorization["']?[ \t]{0,8}:[ \t]{0,8}["']?[ \t]{0,8}(?:Bearer|token)[ \t]{1,8})[A-Za-z0-9\-._~+/]{10,}=*/gi],
+  ["auth_basic_token", /(?<=Authorization["']?[ \t]{0,8}:[ \t]{0,8}["']?[ \t]{0,8}Basic[ \t]{1,8})[A-Za-z0-9+/]{6,}=*/gi],
+  // JWTs have no distinctive prefix of their own, but the base64url encoding of the smallest realistic header ('{"alg":' or similar) always starts with "eyJ", so that's the practical anchor here -- each of the three dot-separated segments requires a minimum length to avoid matching a short, coincidentally dotted token. The trailing `={0,2}` on each segment is what makes a padded token match. Base64url as the JWT spec defines it drops the `=` padding, but producers that reach for a plain base64 encoder emit it anyway, and a `=` in the header or payload segment used to defeat the match outright: not a partial redaction, but none at all, so the entire token was printed. `=` cannot appear anywhere except the end of a segment, since it is not one of the characters the segment body allows, so accepting it here cannot widen the match onto anything else.
+  ["jwt", /eyJ[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]{10,}={0,2}/g],
+  ["npm_token", /npm_[A-Za-z0-9]{36}/g],
+  // rk_live_ (restricted keys) share the sk_live_/sk_test_ secret-key shape and risk level, so one pattern covers all three rather than adding a near-duplicate entry.
+  ["stripe_key", /(?:sk_live_|sk_test_|rk_live_)[A-Za-z0-9]{20,}/g],
+  ["google_api_key", /AIza[A-Za-z0-9_-]{35}/g],
+  // Presigned-url signatures: AWS SigV4 (X-Amz-Signature), Google Cloud Storage (X-Goog-Signature), and Azure blob SAS (sig). These are bearer credentials in query-string clothing -- anyone holding the whole url can read or write the object until it expires, and none of the prefix-anchored patterns above match them because the signature is a bare hex or base64 blob with no distinctive prefix of its own. The '[?&]' anchor and the 16-char floor are what make the short, generic 'sig' name safe to key on: a prose or code mention of "sig" never sits directly after a query separator followed by that much opaque token.
+  ["presigned_signature", /(?<=[?&](?:X-Amz-Signature|X-Goog-Signature|sig)=)[A-Za-z0-9%+/=_-]{16,}/gi],
+  // A password inside a connection url. `postgres://user:hunter2@db.internal` carries the credential in the authority section, where there is no `key=value` separator for the generic pattern below to anchor on, so a DATABASE_URL echoed by a failing migration or a psql error went through untouched. The anchors are what keep this narrow: a scheme's `://`, a userinfo segment, the colon, and a following `@`. `http://host:8080/path` has no `@` and is left alone; so is any url without credentials. The password class admits `:` and `@` (RFC 3986 lets userinfo carry the first, and a sloppy producer leaves the second unencoded), so the greedy run backtracks to the LAST `@` before the host; it still stops at whitespace, `/`, quotes and angle brackets, which keeps a quoted JSON neighbour or a following email out of the match. The username may be empty, because redis-py, Celery and most broker clients write a password-only url as `redis://:password@host:6379/0`, and it may hold an unencoded `@`, because a username that is itself an email address arrives that way; it still excludes `:` so the first colon after the scheme is the one that starts the password.
+  ["url_credentials", /(?<=:\/\/[^\s:/]{0,64}:)[^\s/"'`<>]{1,256}(?=@)/g],
+  // Azure storage account connection strings (`DefaultEndpointsProtocol=https;AccountName=...; AccountKey=<base64>==;EndpointSuffix=core.windows.net`) carry a full read/write key to the account in the AccountKey field, and none of the generic patterns above catch it: generic_secret_assignment's keyword list (password|passwd|secret|api[_-]?key| access[_-]?token|refresh[_-]?token|id[_-]?token) has nothing that matches "AccountKey", and an unanchored base64-shape pattern was deliberately rejected -- this module's header already warns that a bare high-entropy-blob heuristic false-fires on ordinary code, JSON and log output, and an 88-char base64 value is exactly the shape a hash, a compiled asset digest or a generated id can also take. Anchoring on the literal `AccountKey=` field name instead keeps the match specific to this one connection-string field. The value class is base64 proper (letters, digits, `+`, `/`, trailing `=` padding) and none of those characters include `;`, so the match terminates on its own at the `;` that starts the next `Name=` field -- unlike generic_secret_assignment's separator characters (`& ; # , :`), which double as ordinary credential characters and need a lookahead to tell the two roles apart, `;` is never valid base64 and needs no such lookahead here. The lookbehind keeps `AccountKey=` itself in the output, matching auth_bearer_token and presigned_signature above, so `;EndpointSuffix=core.windows.net` after it stays fully readable too. `SharedAccessKey` is the same credential one Azure service over: Service Bus, Event Hubs and Relay spell it that way (`Endpoint=sb://ns.servicebus.windows.net/;SharedAccessKeyName=Root; SharedAccessKey=<base64>`) and it carries the same authority over that namespace that AccountKey does over a storage account. `SharedAccessKeyName` is a plain identifier rather than a secret, and never matches: the separator in the lookbehind sits directly against the key name, so the `Name` in between stops it dead. The separator is spelled the way auth_bearer_token above spells its own, for the same reasons that comment records having learned the hard way. Optional quotes on either side of it, so the JSON and YAML forms a logged MCP result or api response actually arrives in are matched rather than stopped dead at the opening quote. A bounded gap rather than exactly one space, so a hand-aligned or reformatted `AccountKey = ...` in an appsettings file is not the single variant that defeats the whole pattern. Case-insensitive for the same reason presigned_signature is. The leading word boundary is what keeps the widened name from reaching into the middle of a longer identifier such as `myaccountkey=`.
+  ["azure_storage_key", /(?<=\b(?:AccountKey|SharedAccessKey)["']?[ \t]{0,8}[:=][ \t]{0,8}["']?)[A-Za-z0-9+/]{40,}=*/gi],
+  // Generic key=value assignments in .env-file and connection-string/query-string shape. The lookbehind again redacts only the value, and the value's character class deliberately excludes whitespace, '&', ';', '#', quote characters, and '[' ']' ':' -- that exclusion is what stops this from swallowing the rest of the line (a trailing comment or the next key=value pair) or the remainder of a query string past the matched parameter, which is exactly the kind of over-eager match this module's own design note above warns broad heuristics produce. The '[' ']' ':' exclusion also matters because this pattern runs last: an earlier pattern's own "OPENAI_API_KEY=[REDACTED:openai_project_key]" replacement text contains "API_KEY=" too, and without excluding those characters this pattern would re-match and double-redact its own placeholder. The length has a lower bound only (no upper bound): capping it at 64 used to leave the tail of any longer secret unredacted in plain text, which is worse than no redaction because it looks handled. A single negated-class quantifier like this cannot backtrack catastrophically -- there is no nested or overlapping quantifier for the engine to explore multiple ways of matching, so removing the upper bound does not introduce a ReDoS risk. Quotes are permitted around the separator, but never inside the value class. A quoted value is the ordinary way secrets are written -- .env files, JSON, YAML, TOML all quote by default -- and the lookbehind used to stop dead at the opening quote, so `API_KEY="..."` passed through in full while the bare `API_KEY=...` was caught. The closing quote of the key name blocked it from the other side too, which is what kept every JSON body unredacted. Keeping quotes out of the value class is still what stops the match running past the closing quote. The keyword may be a prefix of a longer key name rather than the whole of it, so the trailing identifier class below is load-bearing: without it the lookbehind required the keyword to sit immediately before the separator, and AWS_SECRET_ACCESS_KEY=, SECRET_KEY=, and DB_PASSWORD_HASH= all passed through in full. That class matches identifier characters only, so prose that merely mentions a keyword still never reaches a separator and stays unredacted. api[_-]?key covers the apikey and api-key spellings too. `& ; # , :` play two incompatible roles. They separate one field from the next (a query string, a cookie header, an inline env list), and they are also perfectly ordinary credential characters. Rejecting them outright got the first role right and the second badly wrong: the match stopped at the first one and left everything after it in plain text, so `password=corr&horse&battery` redacted four characters and printed the rest, and `DB_PASSWORD=Aa1:xyz` matched nothing at all because the run before the `:` was under the four-character floor. A tail left sitting in the open is the outcome this module's header calls worse than no redaction, because it reads as handled. So the separator role is decided by what follows rather than assumed: one of these characters ends the value only when the next thing along is another `name=` / `name:` pair, which is what an actual field separator is always followed by. `,OTHER=public` and `; other=1` still end it; the `&` in the middle of a passphrase does not. Whitespace, quotes and brackets are unchanged -- they end a value unconditionally, which is also what keeps this pattern from re-matching the `[REDACTED:...]` placeholder it just wrote.
+  ["generic_secret_assignment", /(?<=(?:password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token)[a-z0-9_-]{0,64}["']?[ \t]{0,8}[:=][ \t]{0,8}["']?)(?:\\[^\n]|[^\s\\&;#,:'"[\]{}]|[&;#,:](?![ \t]*[A-Za-z_][A-Za-z0-9_.-]*[ \t]*[:=])){4,}/gi]
+];
+function countRedactionPlaceholders(text) {
+  return text.match(/\[REDACTED:[a-z0-9_]+\]/g)?.length ?? 0;
+}
+var MAX_CUSTOM_PATTERNS = 64;
+var MAX_CUSTOM_PATTERN_LENGTH = 512;
+var ZERO_WIDTH_PROBES = ["", "a b"];
+function matchesZeroWidth(compiled) {
+  return ZERO_WIDTH_PROBES.some((probe) => Array.from(probe.matchAll(compiled)).some((m) => m[0].length === 0));
+}
+var customCache = null;
+function compileCustomPatterns(sources) {
+  const key = JSON.stringify(sources);
+  if (customCache !== null && customCache.key === key) {
+    return { patterns: customCache.patterns, problems: customCache.problems };
+  }
+  const patterns = [];
+  const problems = [];
+  const written = sources.map((raw) => raw.trim()).filter((source) => source.length > 0);
+  for (const source of written.slice(0, MAX_CUSTOM_PATTERNS)) {
+    if (source.length > MAX_CUSTOM_PATTERN_LENGTH) {
+      problems.push({ pattern: source.slice(0, 60), reason: `longer than ${MAX_CUSTOM_PATTERN_LENGTH} characters` });
+      continue;
+    }
+    if (hasNestedQuantifier(source)) {
+      problems.push({
+        pattern: source,
+        reason: "repeats a group that already repeats, which can take exponential time to match"
+      });
+      continue;
+    }
+    let compiled;
+    try {
+      compiled = new RegExp(source, "g");
+    } catch (e) {
+      problems.push({ pattern: source, reason: e instanceof Error ? e.message : "is not a valid regular expression" });
+      continue;
+    }
+    if (matchesZeroWidth(compiled)) {
+      problems.push({
+        pattern: source,
+        reason: "matches the empty string, so it would replace every position in the text"
+      });
+      continue;
+    }
+    if (growsExponentially(compiled)) {
+      problems.push({
+        pattern: source,
+        reason: "its running time doubles as the text grows, which can stall the process on a short input"
+      });
+      continue;
+    }
+    patterns.push(compiled);
+  }
+  if (written.length > MAX_CUSTOM_PATTERNS) {
+    problems.push({
+      pattern: `(${written.length} entries)`,
+      reason: `only the first ${MAX_CUSTOM_PATTERNS} custom patterns are used`
+    });
+  }
+  customCache = { key, patterns, problems };
+  return { patterns, problems };
+}
+var STRICT_CANDIDATE = /[A-Za-z0-9+/_-]{24,}={0,2}/g;
+function entropyBitsPerChar(s) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let bits = 0;
+  for (const n of counts.values()) {
+    const p = n / s.length;
+    bits -= p * Math.log2(p);
+  }
+  return bits;
+}
+function characterClasses(s) {
+  let n = 0;
+  if (/[a-z]/.test(s)) n++;
+  if (/[A-Z]/.test(s)) n++;
+  if (/[0-9]/.test(s)) n++;
+  if (/[+/=_-]/.test(s)) n++;
+  return n;
+}
+function looksLikeCredential(s) {
+  return characterClasses(s) >= 3 && entropyBitsPerChar(s) >= 3.5;
+}
+var RECALL_TUNED_KIND = "generic_secret_assignment";
+function matchesAnywhere(pattern, text) {
+  pattern.lastIndex = 0;
+  const hit = pattern.test(text);
+  pattern.lastIndex = 0;
+  return hit;
+}
+function matchesNonEmpty(compiled, text) {
+  compiled.lastIndex = 0;
+  for (const match of text.matchAll(compiled)) {
+    if (match[0].length > 0) return true;
+  }
+  return false;
+}
+function hasPreciseSecret(text, config = loadConfig()) {
+  for (const [kind, pattern] of SECRET_PATTERNS) {
+    if (kind === RECALL_TUNED_KIND) continue;
+    if (matchesAnywhere(pattern, text)) return true;
+  }
+  for (const custom of compileCustomPatterns(config.redaction.custom_patterns).patterns) {
+    if (matchesNonEmpty(custom, text)) return true;
+  }
+  if (config.redaction.strict) {
+    for (const candidate of text.match(STRICT_CANDIDATE) ?? []) {
+      if (looksLikeCredential(candidate)) return true;
+    }
+  }
+  return false;
+}
+function redactSecrets(text, config = loadConfig()) {
+  let count = 0;
+  let out = text;
+  for (const [kind, pattern] of SECRET_PATTERNS) {
+    out = out.replace(pattern, () => {
+      count++;
+      return `[REDACTED:${kind}]`;
+    });
+  }
+  for (const pattern of compileCustomPatterns(config.redaction.custom_patterns).patterns) {
+    out = out.replace(pattern, (match) => {
+      if (match.length === 0) return match;
+      count++;
+      return "[REDACTED:custom]";
+    });
+  }
+  if (config.redaction.strict) {
+    out = out.replace(STRICT_CANDIDATE, (candidate) => {
+      if (!looksLikeCredential(candidate)) return candidate;
+      count++;
+      return "[REDACTED:high_entropy]";
+    });
+  }
+  return { text: out, count };
+}
+var CONTROL_ESCAPES = new Map(
+  Array.from({ length: 32 }, (_, code) => {
+    const ch = String.fromCharCode(code);
+    return [ch, JSON.stringify(ch).slice(1, -1)];
+  })
+);
+var CONTROL_CHARACTER_OF_ESCAPE = new Map([...CONTROL_ESCAPES].map(([ch, escape]) => [escape, ch]));
+var JSON_ESCAPE = /\\(?:u[0-9a-fA-F]{4}|[^u])/g;
+var SURROGATE_ESCAPE = /^\\u[dD][89a-fA-F][0-9a-fA-F]{2}$/;
+var DECODED_CHARACTER = /[\u0000-\u001f]|[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g;
+function decodeEscape(escape) {
+  return CONTROL_CHARACTER_OF_ESCAPE.get(escape) ?? (SURROGATE_ESCAPE.test(escape) ? String.fromCharCode(Number.parseInt(escape.slice(2), 16)) : escape);
+}
+function redactSerializedJson(json) {
+  const result = redactSecrets(json.replace(JSON_ESCAPE, decodeEscape));
+  return { text: result.text.replace(DECODED_CHARACTER, (ch) => CONTROL_ESCAPES.get(ch) ?? JSON.stringify(ch).slice(1, -1)), count: result.count };
+}
+
+export {
+  countRedactionPlaceholders,
+  compileCustomPatterns,
+  hasPreciseSecret,
+  redactSecrets,
+  redactSerializedJson
+};

package/dist/{token-goat-chunk-66LODAUT.mjs → token-goat-chunk-4JJS54TR.mjs}

@@ -10,13 +10,14 @@ import {
   stripMultilineStringSpan,
   stripNestedBlockCommentSpan,
   stripStringLiterals
-} from "./token-goat-chunk-M56BWPBN.mjs";
+} from "./token-goat-chunk-VL3YIFHZ.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
 
 // src/languages/swift.ts
 init_define_import_meta_env();
+var SWIFT_STRIP = { swiftInterpolation: true };
 var IDENT_START = "A-Za-z_\\u00C0-\\uFFFF";
 var IDENT_CONT = "A-Za-z0-9_\\u00C0-\\uFFFF";
 var IDENT = `(?:\`[^\`]+\`|[${IDENT_START}][${IDENT_CONT}]*)`;
@@ -134,7 +135,7 @@ function extractSwift(content, filePath) {
     const line = stripLineComment(blockStripped).trimEnd();
     const stripped = line.trim();
     if (!stripped) {
-      const braceLine2 = stripRegexLiterals(stripStringLiterals(line));
+      const braceLine2 = stripRegexLiterals(stripStringLiterals(line, SWIFT_STRIP));
       braceDepth += (braceLine2.match(/\{/g) ?? []).length - (braceLine2.match(/\}/g) ?? []).length;
       continue;
     }
@@ -172,7 +173,7 @@ function extractSwift(content, filePath) {
     } else if (frame === null && braceDepth === 0) {
       pushMembers(line, void 0, lineNum, stripped.slice(0, 200));
     }
-    const braceLine = stripRegexLiterals(stripStringLiterals(line));
+    const braceLine = stripRegexLiterals(stripStringLiterals(line, SWIFT_STRIP));
     for (const ch of braceLine) {
       if (ch === "{") {
         braceDepth++;

package/dist/token-goat-chunk-4LCCNRTG.mjs

@@ -0,0 +1,313 @@
+import { createRequire as __cjsRequire } from 'node:module';
+const require = __cjsRequire(import.meta.url);
+import {
+  copyFromSharedCache,
+  downloadPinned
+} from "./token-goat-chunk-PD5VKH46.mjs";
+import "./token-goat-chunk-SMVRN2HU.mjs";
+import {
+  loadConfig
+} from "./token-goat-chunk-7IN2MKDS.mjs";
+import "./token-goat-chunk-U4N3BN2W.mjs";
+import {
+  registerReset
+} from "./token-goat-chunk-YZAAZU2S.mjs";
+import "./token-goat-chunk-IVE6U7KV.mjs";
+import {
+  atomicWriteText,
+  ensureDirSync
+} from "./token-goat-chunk-GOLEOXZP.mjs";
+import "./token-goat-chunk-AM5V6GSX.mjs";
+import "./token-goat-chunk-FNFBKLRD.mjs";
+import {
+  ensureDataDirPrivate
+} from "./token-goat-chunk-VES7EL7O.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
+
+// src/embed_runtime_web.ts
+init_define_import_meta_env();
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import { createRequire } from "node:module";
+import * as path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { createGunzip } from "node:zlib";
+var _require = createRequire(import.meta.url);
+var ORT_WEB_TARBALL = {
+  name: "onnxruntime-web-1.30.0.tgz",
+  sha256: "d2228df7e4616bc3348bf504ee888f3bec43789a273f0a63f3e68d203ce3bf71",
+  bytes: 33106585
+};
+var ORT_WEB_GLUE = {
+  name: "ort-wasm-simd-threaded.mjs",
+  sha256: "e13f7f94fc51b4ca72b12faeb1ee95f4ace6dfbc8939bc718aabdc0a27c4299b",
+  bytes: 24381
+};
+var TARBALL_MEMBER = "package/dist/ort-wasm-simd-threaded.wasm";
+var BACKEND_START_FAILED = "no available backend found";
+var _webLoad = null;
+var _inFlightWasm = null;
+var _placeFailures = /* @__PURE__ */ new WeakSet();
+function readVerified(filePath, file) {
+  const info = fs.lstatSync(filePath, { throwIfNoEntry: false });
+  if (!info?.isFile() || info.size !== file.bytes) return null;
+  const bytes = fs.readFileSync(filePath);
+  if (bytes.length !== file.bytes) return null;
+  return createHash("sha256").update(bytes).digest("hex") === file.sha256 ? bytes : null;
+}
+function ensureWasmBinary(host) {
+  if (_inFlightWasm === null) {
+    _inFlightWasm = (async () => {
+      try {
+        return await placeWasmBinary(host);
+      } finally {
+        _inFlightWasm = null;
+      }
+    })();
+  }
+  return _inFlightWasm;
+}
+async function placeWasmBinary(host) {
+  ensureDataDirPrivate();
+  const { dir, version, wasm } = host;
+  const target = path.join(dir, wasm.name);
+  const cached = readVerified(target, wasm);
+  if (cached) return cached;
+  fs.rmSync(target, { force: true });
+  ensureDirSync(dir);
+  const shared = host.sharedDir;
+  if (shared && await copyFromSharedCache(shared, wasm, target)) {
+    const copied = readVerified(target, wasm);
+    if (copied) return copied;
+  }
+  if (loadConfig().network.offline) {
+    throw new Error(
+      `Offline mode is on (network.offline): refusing to download the WebAssembly inference runtime (onnxruntime-web ${version}). Copy ${wasm.name} from that package's dist/ into ${dir} on a connected machine to use semantic search here.`
+    );
+  }
+  console.warn(
+    `Downloading the embedding runtime, once (onnxruntime-web ${version} from registry.npmjs.org, ${Math.round(ORT_WEB_TARBALL.bytes / 1024 / 1024)} MB, keeping its ${Math.round(wasm.bytes / 1024 / 1024)} MB ${wasm.name}) into ${dir}`
+  );
+  const archive = path.join(dir, ORT_WEB_TARBALL.name);
+  try {
+    await downloadPinned(tarballUrl(), ORT_WEB_TARBALL, archive);
+    await extractTarMember(archive, TARBALL_MEMBER, wasm, target);
+  } finally {
+    fs.rmSync(archive, { force: true, maxRetries: 20, retryDelay: 25 });
+  }
+  if (shared) host.publish(shared, wasm, target);
+  const placed = readVerified(target, wasm);
+  if (!placed) throw new Error(`${target} did not verify after extraction`);
+  return placed;
+}
+function tarballUrl() {
+  return `https://registry.npmjs.org/onnxruntime-web/-/${ORT_WEB_TARBALL.name}`;
+}
+var ExactReader = class {
+  constructor(source) {
+    this.source = source;
+  }
+  source;
+  chunks = [];
+  buffered = 0;
+  ended = false;
+  async fill(n) {
+    while (this.buffered < n && !this.ended) {
+      const next = await this.source.next();
+      if (next.done === true) {
+        this.ended = true;
+        break;
+      }
+      this.chunks.push(next.value);
+      this.buffered += next.value.length;
+    }
+  }
+  /** Exactly `n` bytes, or fewer only when the input ends first. */
+  async read(n) {
+    await this.fill(n);
+    const all = this.chunks.length === 1 ? this.chunks[0] : Buffer.concat(this.chunks);
+    const out = all.subarray(0, n);
+    const rest = all.subarray(out.length);
+    this.chunks = rest.length > 0 ? [rest] : [];
+    this.buffered = rest.length;
+    return out;
+  }
+  /** Discard exactly `n` bytes without holding them, or throw if the input ends first. */
+  async skip(n) {
+    let left = n;
+    while (left > 0) {
+      if (this.buffered === 0) await this.fill(1);
+      const head = this.chunks[0];
+      if (head === void 0) throw new Error("archive ended inside an entry");
+      if (head.length <= left) {
+        this.chunks.shift();
+        this.buffered -= head.length;
+        left -= head.length;
+      } else {
+        this.chunks[0] = head.subarray(left);
+        this.buffered -= left;
+        left = 0;
+      }
+    }
+  }
+};
+function tarString(block, start, length) {
+  const field = block.subarray(start, start + length);
+  const end = field.indexOf(0);
+  return field.subarray(0, end === -1 ? field.length : end).toString("utf8");
+}
+function tarOctal(block, start, length) {
+  if ((block[start] & 128) !== 0) throw new Error("tar header uses a base-256 number, which this reader does not support");
+  const text = tarString(block, start, length).trim();
+  const value = text === "" ? 0 : Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error(`tar header holds an invalid number: ${JSON.stringify(text)}`);
+  return value;
+}
+function paxPath(data) {
+  let at = 0;
+  let found = null;
+  while (at < data.length) {
+    const space = data.indexOf(32, at);
+    if (space === -1) break;
+    const length = Number.parseInt(data.subarray(at, space).toString("latin1"), 10);
+    if (!Number.isSafeInteger(length) || length <= 0 || at + length > data.length) break;
+    const record = data.subarray(space + 1, at + length - 1).toString("utf8");
+    const eq = record.indexOf("=");
+    if (eq !== -1 && record.slice(0, eq) === "path") found = record.slice(eq + 1);
+    at += length;
+  }
+  return found;
+}
+async function extractTarMember(archive, member, file, target) {
+  const raw = fs.createReadStream(archive);
+  const gunzip = createGunzip();
+  raw.on("error", (e) => gunzip.destroy(e));
+  raw.pipe(gunzip);
+  const reader = new ExactReader(gunzip[Symbol.asyncIterator]());
+  try {
+    let nextName = null;
+    for (; ; ) {
+      const header = await reader.read(512);
+      if (header.length < 512) throw new Error(`${archive} ended before its end-of-archive marker, without ${member}`);
+      if (header.every((b) => b === 0)) throw new Error(`${archive} has no ${member}`);
+      let sum = 0;
+      for (let i = 0; i < 512; i++) sum += i >= 148 && i < 156 ? 32 : header[i];
+      if (sum !== tarOctal(header, 148, 8)) throw new Error(`${archive} has a tar header with a bad checksum`);
+      const size = tarOctal(header, 124, 12);
+      const padding = (512 - size % 512) % 512;
+      const type = header[156] === 0 ? "0" : String.fromCharCode(header[156]);
+      let name = tarString(header, 0, 100);
+      if (header.subarray(257, 263).toString("latin1") === "ustar\0") {
+        const prefix = tarString(header, 345, 155);
+        if (prefix !== "") name = `${prefix}/${name}`;
+      }
+      if (nextName !== null) {
+        name = nextName;
+        nextName = null;
+      }
+      if (type === "x" || type === "L") {
+        const data = await reader.read(size);
+        if (data.length < size) throw new Error(`${archive} ended inside an extended header`);
+        await reader.skip(padding);
+        nextName = type === "x" ? paxPath(data) : tarString(data, 0, data.length);
+        continue;
+      }
+      if ((type === "0" || type === "7") && name === member) {
+        if (size !== file.bytes) throw new Error(`${member} is ${size} bytes in ${archive}, expected the pinned ${file.bytes}`);
+        const data = await reader.read(size);
+        if (data.length !== file.bytes) throw new Error(`${archive} ended inside ${member}`);
+        const digest = createHash("sha256").update(data).digest("hex");
+        if (digest !== file.sha256) throw new Error(`${member} has sha256 ${digest}, expected the pinned ${file.sha256}`);
+        const temp = `${target}.${process.pid}.partial`;
+        try {
+          fs.writeFileSync(temp, data);
+          fs.renameSync(temp, target);
+        } catch (e) {
+          fs.rmSync(temp, { force: true, maxRetries: 20, retryDelay: 25 });
+          throw e;
+        }
+        return;
+      }
+      await reader.skip(size + padding);
+    }
+  } finally {
+    raw.destroy();
+    gunzip.destroy();
+  }
+}
+function verifiedGlueUrl(version) {
+  const beside = fileURLToPath(new URL(`./${ORT_WEB_GLUE.name}`, import.meta.url));
+  const file = fs.existsSync(beside) ? beside : _require.resolve(`onnxruntime-web/${ORT_WEB_GLUE.name}`);
+  if (readVerified(file, ORT_WEB_GLUE) === null) {
+    throw new Error(`${file} is not the ${ORT_WEB_GLUE.name} onnxruntime-web ${version} ships (pinned sha256 ${ORT_WEB_GLUE.sha256})`);
+  }
+  return pathToFileURL(file).href;
+}
+function loadWebRuntime(threads, host) {
+  if (_webLoad !== null) return _webLoad;
+  const pending = (async () => {
+    const ort = await import("./token-goat-chunk-EXKGNHEG.mjs");
+    if (ort.env.versions.web !== host.version) {
+      throw new Error(`the bundled onnxruntime-web is ${ort.env.versions.web ?? "unknown"}, but its binary is pinned for ${host.version}`);
+    }
+    const glue = verifiedGlueUrl(host.version);
+    const binary = await ensureWasmBinary(host).catch((e) => {
+      if (typeof e === "object" && e !== null) _placeFailures.add(e);
+      throw e;
+    });
+    ort.env.wasm.wasmBinary = binary;
+    ort.env.wasm.wasmPaths = { mjs: glue };
+    ort.env.wasm.numThreads = threads;
+    return ort;
+  })();
+  _webLoad = pending;
+  pending.catch(() => {
+    if (_webLoad === pending) _webLoad = null;
+  });
+  return pending;
+}
+async function createWebSession(modelPath, threads, host) {
+  let ort;
+  try {
+    ort = await loadWebRuntime(threads, host);
+  } catch (e) {
+    if (typeof e === "object" && e !== null && _placeFailures.has(e)) throw host.failed(e, false);
+    throw startFailed(e, host);
+  }
+  let session;
+  try {
+    session = await ort.InferenceSession.create(modelPath, { intraOpNumThreads: threads, interOpNumThreads: 1 });
+  } catch (e) {
+    if (e instanceof Error && e.message.startsWith(BACKEND_START_FAILED)) throw startFailed(e, host);
+    throw e;
+  }
+  try {
+    const recorded = JSON.parse(fs.readFileSync(host.startFailure.path, "utf8"));
+    if (recorded.key === host.startFailure.key) fs.rmSync(host.startFailure.path, { force: true });
+  } catch {
+  }
+  return { session, Tensor: ort.Tensor };
+}
+function startFailed(e, host) {
+  const message = e instanceof Error ? e.message : String(e);
+  try {
+    ensureDirSync(path.dirname(host.startFailure.path));
+    atomicWriteText(host.startFailure.path, JSON.stringify({ key: host.startFailure.key, message, at: Date.now() }));
+  } catch {
+    return host.failed(e, false);
+  }
+  return host.failed(e, true);
+}
+registerReset(() => {
+  _webLoad = null;
+  _inFlightWasm = null;
+});
+export {
+  ORT_WEB_GLUE,
+  ORT_WEB_TARBALL,
+  createWebSession,
+  ensureWasmBinary,
+  extractTarMember
+};

package/dist/token-goat-chunk-54K3EUV3.mjs

@@ -0,0 +1,35 @@
+import { createRequire as __cjsRequire } from 'node:module';
+const require = __cjsRequire(import.meta.url);
+import {
+  detectHarness
+} from "./token-goat-chunk-U4N3BN2W.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
+
+// src/delivery_cap.ts
+init_define_import_meta_env();
+var CLAUDE_CODE_BASH_OUTPUT_CAP_BYTES = 2e4;
+var CLAUDE_CODE_PERSISTED_PREVIEW_BYTES = 2048;
+function bashOutputCapBytes(harness = detectHarness()) {
+  return harness === "claudecode" ? CLAUDE_CODE_BASH_OUTPUT_CAP_BYTES : null;
+}
+function clipToDeliveryCap(text, reserveBytes) {
+  const cap = bashOutputCapBytes();
+  const room = cap === null ? null : cap - reserveBytes;
+  if (room === null || room <= 0 || Buffer.byteLength(text, "utf-8") <= room) return { text, clipped: false };
+  const sliced = Buffer.from(text, "utf-8").subarray(0, room).toString("utf-8");
+  const lastNewline = sliced.lastIndexOf("\n");
+  return { text: lastNewline > 0 ? sliced.slice(0, lastNewline) : sliced, clipped: true };
+}
+function deliveredOutputBytes(originalBytes, harness) {
+  const cap = bashOutputCapBytes(harness);
+  if (cap === null) return Math.max(0, originalBytes);
+  if (originalBytes <= cap) return Math.max(0, originalBytes);
+  return CLAUDE_CODE_PERSISTED_PREVIEW_BYTES;
+}
+
+export {
+  clipToDeliveryCap,
+  deliveredOutputBytes
+};