tribunal-kit 9.2.5 → 9.2.7

package/.agent/scripts/pipeline_engine.js

@@ -52,7 +52,6 @@ try {
   sessionLogger = require('./session_logger');
 } catch (_e) {}
 
-
 // ── Lazy-load sibling scripts (avoid circular deps) ─────────────────────────
 let _contextBroker = null;
 function getContextBroker() {
@@ -528,15 +527,28 @@ function validatePhase(code, spec, opts = {}) {
   const guardrailEngine = _getGuardrailEngine();
   if (guardrailEngine && typeof guardrailEngine.validate === 'function') {
     try {
-      let manifest = { agents: { all: [] }, skills: { names: [] }, cross_references: [], numeric_claims: [], scripts: { files: {} } };
+      let manifest = {
+        agents: { all: [] },
+        skills: { names: [] },
+        cross_references: [],
+        numeric_claims: [],
+        scripts: { files: {} },
+      };
       try {
-        const manifestPath = path.join(process.cwd(), '.agent', 'history', 'integrity_manifest.json');
+        const manifestPath = path.join(
+          process.cwd(),
+          '.agent',
+          'history',
+          'integrity_manifest.json',
+        );
         if (fs.existsSync(manifestPath)) {
           manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
         }
       } catch (_e) {}
 
-      const grResult = guardrailEngine.validate(code, manifest, { context: { projectRoot: process.cwd(), filePath: spec.target_file } });
+      const grResult = guardrailEngine.validate(code, manifest, {
+        context: { projectRoot: process.cwd(), filePath: spec.target_file },
+      });
       if (grResult && grResult.violations) {
         for (const v of grResult.violations) {
           issues.push({
@@ -614,7 +626,6 @@ function detectLang(spec) {
   return map[ext] || 'js';
 }
 
-
 /**
  * Find the first line number matching a regex pattern.
  */
@@ -656,12 +667,16 @@ function fullPipeline(task, files = [], opts = {}) {
   const validate = code => validatePhase(code, spec, { lang: detectLang(spec) });
 
   if (sessionLogger) {
-    sessionLogger.appendEvent('AgentDispatched', {
-      task,
-      files,
-      promptTokens: builderResult.tokenEstimate,
-      skills: builderResult.skillsLoaded,
-    }, 'pipeline_engine');
+    sessionLogger.appendEvent(
+      'AgentDispatched',
+      {
+        task,
+        files,
+        promptTokens: builderResult.tokenEstimate,
+        skills: builderResult.skillsLoaded,
+      },
+      'pipeline_engine',
+    );
   }
 
   return {

package/.agent/scripts/secret_redactor.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+/**
+ * secret_redactor.js — Redacts recognizable secrets from evidence and report content.
+ *
+ * Patterns covered:
+ *   - API keys (common prefixes: sk_, pk_, api_, key_)
+ *   - Bearer tokens
+ *   - JWTs (eyJ...)
+ *   - Private keys (-----BEGIN)
+ *   - Database URLs (postgres://, mysql://, mongodb://)
+ *   - .env key=value pairs with sensitive names
+ *   - AWS access keys (AKIA...)
+ *   - Generic long hex/base64 strings in value positions
+ */
+
+'use strict';
+
+const SECRET_PATTERNS = [
+  // API keys with common prefixes
+  {
+    pattern: /\b(sk_live_|sk_test_|pk_live_|pk_test_|api_key_|key_)[A-Za-z0-9_\-]{8,}\b/g,
+    label: '[REDACTED_API_KEY]',
+  },
+  // Bearer tokens
+  { pattern: /Bearer\s+[A-Za-z0-9\-_.~+/]{20,}/gi, label: 'Bearer [REDACTED_TOKEN]' },
+  // JWTs
+  {
+    pattern: /eyJ[A-Za-z0-9_\-]{10,}\.eyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}/g,
+    label: '[REDACTED_JWT]',
+  },
+  // Private keys
+  {
+    pattern:
+      /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----[\s\S]*?-----END\s+(RSA\s+)?PRIVATE\s+KEY-----/g,
+    label: '[REDACTED_PRIVATE_KEY]',
+  },
+  // Database connection strings
+  {
+    pattern: /(postgres|postgresql|mysql|mongodb|redis|amqp):\/\/[^\s"'`]+/gi,
+    label: '[REDACTED_DB_URL]',
+  },
+  // AWS access keys
+  { pattern: /\bAKIA[A-Z0-9]{16}\b/g, label: '[REDACTED_AWS_KEY]' },
+  // Generic password/secret assignments
+  {
+    pattern:
+      /(password|passwd|secret|token|api_key|apikey|auth_token|access_token|private_key)\s*[:=]\s*["']?[^\s"']{8,}["']?/gi,
+    label: '$1=[REDACTED]',
+  },
+  // Hex strings that look like secrets (32+ chars in value-like positions)
+  { pattern: /(?<==["']?)[0-9a-f]{32,}(?=["']?\s|$)/gi, label: '[REDACTED_HEX]' },
+];
+
+/**
+ * Redact secrets from a string.
+ * Returns the redacted string and a count of redactions performed.
+ */
+function redactSecrets(text) {
+  if (!text || typeof text !== 'string') return { text, redactions: 0 };
+  let redactions = 0;
+  let result = text;
+  for (const { pattern, label } of SECRET_PATTERNS) {
+    // Reset regex lastIndex for global patterns
+    pattern.lastIndex = 0;
+    result = result.replace(pattern, (...args) => {
+      redactions++;
+      // Handle capture groups in replacement
+      if (label.includes('$1') && args.length > 2) {
+        return label.replace('$1', args[1]);
+      }
+      return label;
+    });
+    // Reset again after use
+    pattern.lastIndex = 0;
+  }
+  return { text: result, redactions };
+}
+
+/**
+ * Redact secrets from a finding's evidence, impact, remediation, and title.
+ */
+function redactFinding(finding) {
+  const redacted = { ...finding };
+  let totalRedactions = 0;
+
+  if (redacted.title) {
+    const r = redactSecrets(redacted.title);
+    redacted.title = r.text;
+    totalRedactions += r.redactions;
+  }
+
+  if (redacted.impact) {
+    const r = redactSecrets(redacted.impact);
+    redacted.impact = r.text;
+    totalRedactions += r.redactions;
+  }
+
+  if (redacted.remediation) {
+    const r = redactSecrets(redacted.remediation);
+    redacted.remediation = r.text;
+    totalRedactions += r.redactions;
+  }
+
+  if (redacted.evidence && Array.isArray(redacted.evidence)) {
+    redacted.evidence = redacted.evidence.map(e => {
+      const desc = redactSecrets(e.description || '');
+      totalRedactions += desc.redactions;
+      return { ...e, description: desc.text };
+    });
+  }
+
+  if (totalRedactions > 0) {
+    redacted._redactions = totalRedactions;
+  }
+
+  return redacted;
+}
+
+module.exports = { redactSecrets, redactFinding, SECRET_PATTERNS };

package/.agent/scripts/session_logger.js

@@ -36,7 +36,7 @@ function appendEvent(type, payload = {}, source = 'system', sessionId = 'default
     sessionId,
     type,
     source,
-    payload
+    payload,
   };
 
   const line = JSON.stringify(event) + '\n';
@@ -83,10 +83,10 @@ function rehydrateState() {
         startedAt: null,
         endedAt: null,
         events: [],
-        status: 'active'
+        status: 'active',
       };
     }
-    
+
     const sess = state.sessions[evt.sessionId];
     sess.events.push(evt);
 
@@ -111,5 +111,5 @@ module.exports = {
   appendEvent,
   readEvents,
   rehydrateState,
-  SESSION_FILE
+  SESSION_FILE,
 };

package/.agent/scripts/session_manager.js

@@ -68,7 +68,12 @@ function cmdSave(note) {
   saveState(state);
 
   if (sessionLogger) {
-    sessionLogger.appendEvent('SessionStarted', { note, tags: [] }, 'session_manager', entry.session);
+    sessionLogger.appendEvent(
+      'SessionStarted',
+      { note, tags: [] },
+      'session_manager',
+      entry.session,
+    );
   }
 
   console.log(`${GREEN}✅ Session saved:${RESET} ${note}`);