vigthoria-cli 1.13.18 → 1.13.22

package/dist/utils/release-policy.js

@@ -0,0 +1,293 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createPublicKey, verify as verifySignature } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { CliCommandError } from './command-contract.js';
+import { compareSemanticVersions } from './update-policy.js';
+const SHA256 = /^[a-f0-9]{64}$/;
+const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+const TOP_LEVEL_FIELDS = new Set(['schemaVersion', 'channels']);
+const ENTRY_FIELDS = new Set(['version', 'url', 'sha256', 'size', 'archiveFilename', 'packageName', 'packageVersion', 'publishedAt', 'signature', 'sbom', 'provenance', 'notes']);
+const SIGNATURE_FIELDS = new Set(['algorithm', 'keyId', 'url']);
+const EVIDENCE_FIELDS = new Set(['url', 'sha256']);
+function fail(message, code = 'RELEASE_MANIFEST_INVALID') {
+    throw new CliCommandError(message, { code, category: 'configuration' });
+}
+function policyPath() {
+    const moduleDirectory = path.dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        path.resolve(moduleDirectory, '../../release-policy.json'),
+        path.resolve(moduleDirectory, '../release-policy.json'),
+        path.resolve(process.cwd(), 'release-policy.json'),
+    ];
+    const resolved = candidates.find((candidate) => fs.existsSync(candidate));
+    if (!resolved)
+        return fail('The packaged release-policy.json file is missing.', 'RELEASE_POLICY_MISSING');
+    return resolved;
+}
+let cachedPolicy = null;
+export function getReleasePolicy() {
+    if (cachedPolicy)
+        return cachedPolicy;
+    const raw = JSON.parse(fs.readFileSync(policyPath(), 'utf8'));
+    if (raw.schemaVersion !== 1 || raw.manifest?.schemaVersion !== 1 || raw.signature?.algorithm !== 'Ed25519') {
+        return fail('Unsupported release policy schema.', 'RELEASE_POLICY_UNSUPPORTED');
+    }
+    cachedPolicy = Object.freeze(raw);
+    return cachedPolicy;
+}
+function assertExactFields(value, allowed, label) {
+    for (const field of Object.keys(value)) {
+        if (!allowed.has(field))
+            fail(`${label} contains unknown field: ${field}`);
+    }
+}
+export function assertReleaseUrl(raw, kind = 'artifact') {
+    const policy = getReleasePolicy();
+    if (typeof raw !== 'string' || !raw || /[\\\u0000-\u001f\u007f]/.test(raw))
+        fail(`Invalid ${kind} URL.`);
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return fail(`Invalid ${kind} URL.`);
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || (url.port && Number(url.port) !== policy.origins.port)) {
+        fail(`${kind} URL must use HTTPS without credentials on the policy port.`);
+    }
+    if (!policy.origins.allowedHosts.includes(url.hostname.toLowerCase()))
+        fail(`${kind} URL host is not allowlisted.`);
+    if (kind === 'manifest' && url.toString() !== policy.origins.manifest)
+        fail('Manifest URL does not match the canonical release policy origin.');
+    return url;
+}
+function parseEvidence(raw, label) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return fail(`${label} metadata is required.`);
+    const record = raw;
+    assertExactFields(record, EVIDENCE_FIELDS, label);
+    const url = assertReleaseUrl(record.url, 'evidence').toString();
+    const sha256 = String(record.sha256 || '').toLowerCase();
+    if (!SHA256.test(sha256))
+        fail(`${label} SHA-256 is malformed.`);
+    return { url, sha256 };
+}
+export function parseReleaseManifest(input, channel = 'stable', serializedBytes) {
+    const policy = getReleasePolicy();
+    if (serializedBytes !== undefined && serializedBytes > policy.manifest.maximumBytes)
+        fail('Release manifest exceeds the policy size limit.');
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return fail('Release manifest must be a JSON object.');
+    const manifest = input;
+    assertExactFields(manifest, TOP_LEVEL_FIELDS, 'Release manifest');
+    if (manifest.schemaVersion !== policy.manifest.schemaVersion)
+        fail('Release manifest schemaVersion is missing or unsupported.');
+    if (!policy.manifest.allowedChannels.includes(channel))
+        fail(`Release channel is not allowed: ${channel}`);
+    if (!manifest.channels || typeof manifest.channels !== 'object' || Array.isArray(manifest.channels))
+        fail('Release manifest channels object is required.');
+    const channels = manifest.channels;
+    for (const name of Object.keys(channels))
+        if (!policy.manifest.allowedChannels.includes(name))
+            fail(`Release manifest contains unknown channel: ${name}`);
+    for (const name of policy.manifest.requiredChannels)
+        if (!(name in channels))
+            fail(`Release manifest is missing required channel: ${name}`);
+    const raw = channels[channel];
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return fail(`Release manifest has no entry for channel ${channel}.`);
+    const entry = raw;
+    assertExactFields(entry, ENTRY_FIELDS, `Release channel ${channel}`);
+    const version = String(entry.version || '');
+    const packageVersion = String(entry.packageVersion || '');
+    const archiveFilename = String(entry.archiveFilename || '');
+    const packageName = String(entry.packageName || '');
+    const sha256 = String(entry.sha256 || '').toLowerCase();
+    const size = Number(entry.size);
+    if (!SEMVER.test(version) || compareSemanticVersions(version, version) !== 0)
+        fail('Release version is invalid.');
+    if (version !== packageVersion)
+        fail('Release version conflicts with packageVersion.');
+    if (packageName !== policy.packageName)
+        fail('Release packageName conflicts with policy.');
+    if (!SHA256.test(sha256))
+        fail('Release artifact SHA-256 is malformed.');
+    if (!Number.isSafeInteger(size) || size <= 0 || size > policy.artifact.maximumBytes)
+        fail('Release artifact size is invalid or exceeds policy.');
+    if (!new RegExp(policy.artifact.filenamePattern).test(archiveFilename) || archiveFilename !== `${policy.packageName}-${version}.tgz`)
+        fail('Release archive filename conflicts with version identity.');
+    const artifactUrl = assertReleaseUrl(entry.url, 'artifact');
+    if (path.posix.basename(artifactUrl.pathname) !== archiveFilename)
+        fail('Release URL filename conflicts with archiveFilename.');
+    if (!policy.channels[channel].allowPrerelease && version.includes('-'))
+        fail(`Prerelease versions are forbidden on channel ${channel}.`);
+    const publishedAt = String(entry.publishedAt || '');
+    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(publishedAt) || !Number.isFinite(Date.parse(publishedAt)))
+        fail('Release publishedAt is invalid.');
+    if (!entry.signature || typeof entry.signature !== 'object' || Array.isArray(entry.signature))
+        return fail('Detached signature metadata is required.');
+    const signature = entry.signature;
+    assertExactFields(signature, SIGNATURE_FIELDS, 'Release signature');
+    const algorithm = String(signature.algorithm || '');
+    const keyId = String(signature.keyId || '');
+    if (algorithm !== policy.signature.algorithm)
+        fail('Release signature algorithm conflicts with policy.');
+    if (!Object.hasOwn(policy.signature.trustedKeys, keyId))
+        fail('Release signature key is not trusted.');
+    const signatureUrl = assertReleaseUrl(signature.url, 'signature');
+    if (path.posix.basename(signatureUrl.pathname) !== `${archiveFilename}.sig`)
+        fail('Detached signature filename conflicts with archive identity.');
+    return {
+        version,
+        url: artifactUrl.toString(),
+        sha256,
+        size,
+        archiveFilename,
+        packageName,
+        packageVersion,
+        publishedAt,
+        signature: { algorithm: 'Ed25519', keyId, url: signatureUrl.toString() },
+        sbom: parseEvidence(entry.sbom, 'SBOM'),
+        provenance: parseEvidence(entry.provenance, 'Provenance'),
+        ...(typeof entry.notes === 'string' ? { notes: entry.notes } : {}),
+    };
+}
+export function parseReleaseManifestText(text, channel = 'stable') {
+    const bytes = Buffer.byteLength(text, 'utf8');
+    if (bytes > getReleasePolicy().manifest.maximumBytes)
+        fail('Release manifest exceeds the policy size limit.');
+    let index = 0;
+    const whitespace = () => { while (/\s/.test(text[index] || ''))
+        index += 1; };
+    const parseString = () => {
+        whitespace();
+        if (text[index] !== '"')
+            fail('Release manifest JSON is malformed.');
+        const start = index++;
+        let escaped = false;
+        while (index < text.length) {
+            const character = text[index++];
+            if (escaped) {
+                escaped = false;
+                continue;
+            }
+            if (character === '\\') {
+                escaped = true;
+                continue;
+            }
+            if (character === '"') {
+                try {
+                    return JSON.parse(text.slice(start, index));
+                }
+                catch {
+                    return fail('Release manifest JSON string is malformed.');
+                }
+            }
+            if (character.charCodeAt(0) < 0x20)
+                fail('Release manifest JSON string contains a control character.');
+        }
+        return fail('Release manifest JSON string is unterminated.');
+    };
+    const parseValue = () => {
+        whitespace();
+        if (text[index] === '{') {
+            index += 1;
+            const keys = new Set();
+            whitespace();
+            if (text[index] === '}') {
+                index += 1;
+                return;
+            }
+            while (index < text.length) {
+                const key = parseString();
+                if (keys.has(key))
+                    fail(`Release manifest contains duplicate field: ${key}`);
+                keys.add(key);
+                whitespace();
+                if (text[index++] !== ':')
+                    fail('Release manifest JSON object is malformed.');
+                parseValue();
+                whitespace();
+                const separator = text[index++];
+                if (separator === '}')
+                    return;
+                if (separator !== ',')
+                    fail('Release manifest JSON object is malformed.');
+            }
+            fail('Release manifest JSON object is unterminated.');
+        }
+        if (text[index] === '[') {
+            index += 1;
+            whitespace();
+            if (text[index] === ']') {
+                index += 1;
+                return;
+            }
+            while (index < text.length) {
+                parseValue();
+                whitespace();
+                const separator = text[index++];
+                if (separator === ']')
+                    return;
+                if (separator !== ',')
+                    fail('Release manifest JSON array is malformed.');
+            }
+            fail('Release manifest JSON array is unterminated.');
+        }
+        if (text[index] === '"') {
+            parseString();
+            return;
+        }
+        const remainder = text.slice(index);
+        const primitive = /^(?:true|false|null|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)/.exec(remainder);
+        if (!primitive)
+            fail('Release manifest JSON value is malformed.');
+        index += primitive[0].length;
+    };
+    parseValue();
+    whitespace();
+    if (index !== text.length)
+        fail('Release manifest JSON has trailing content.');
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return fail('Release manifest JSON is malformed.');
+    }
+    return parseReleaseManifest(parsed, channel, bytes);
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalize).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalize(record[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+export function releaseSignaturePayload(channel, entry) {
+    return Buffer.from(canonicalize({ channel, entry }), 'utf8');
+}
+export function verifyReleaseSignature(channel, entry, detachedBase64, trustedKeys) {
+    const keys = trustedKeys || getReleasePolicy().signature.trustedKeys;
+    const publicKey = keys[entry.signature.keyId];
+    if (!publicKey)
+        fail('Detached signature key is not trusted.', 'RELEASE_SIGNATURE_UNTRUSTED');
+    const encoded = String(detachedBase64 || '').trim();
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded))
+        fail('Detached signature encoding is malformed.', 'RELEASE_SIGNATURE_INVALID');
+    const signature = Buffer.from(encoded, 'base64');
+    if (signature.length !== 64 || !verifySignature(null, releaseSignaturePayload(channel, entry), createPublicKey(publicKey), signature)) {
+        fail('Detached release signature verification failed.', 'RELEASE_SIGNATURE_INVALID');
+    }
+}
+export function assertReleaseTransition(currentVersion, entry, channel, allowDowngrade = false) {
+    const channelPolicy = getReleasePolicy().channels[channel];
+    if (!channelPolicy)
+        fail(`Release channel is not allowed: ${channel}`);
+    if (compareSemanticVersions(entry.version, currentVersion) < 0 && !(allowDowngrade && channelPolicy.allowDowngrade)) {
+        fail(`Downgrade from ${currentVersion} to ${entry.version} is prohibited.`, 'RELEASE_DOWNGRADE_PROHIBITED');
+    }
+}

package/dist/utils/requestIntent.js

@@ -4,12 +4,13 @@
  */
 const CLI_SHAPING_BLOCK = /(?:^|\n\n)Platform:\s*(?:Windows|macOS|Linux)\.[\s\S]*?(?=\n\n[A-Z][^\n]{0,40}:|\s*$)/i;
 const READONLY_SHAPING_BLOCK = /(?:^|\n\n)(?:Read-only analysis mode is active\.|Diagnostic mode is active\.)[\s\S]*?(?=\n\n[A-Z][^\n]{0,40}:|\s*$)/i;
-const BUILD_VERBS = /\b(build|create|make|implement|complete|redesign|overhaul|rebuild|transform|polish|art-direct|fix|repair|edit|modify|write|generate|add|finish|scaffold|develop|update|change|refactor|want|need|require|looking for|let's|let us|we need|we should|erstelle|erstellen|schreib|schreibe|bearbeite)\b/i;
+const BUILD_VERBS = /\b(build|create|make|implement|complete|redesign|overhaul|rebuild|transform|polish|refine|art-direct|fix|repair|correct|edit|modify|write|generate|add|finish|scaffold|develop|update|change|refactor|want|need|require|looking for|let's|let us|we need|we should|erstelle|erstellen|schreib|schreibe|bearbeite)\b/i;
 const ARTIFACT_NOUNS = /\b(file|files|project|game|spiel|app|website|html5|frontend|component|feature|code|workspace|repo|clone|replica|remake|page|site|design|showcase|screen|button|popup|modal|alert|canvas|sprite|level|levels|enemy|enemies|character|npc|world|scene|script|module|api|database|config|landing|dashboard|platformer|arcade|playable|collectible|scoreboard|leaderboard|pitfall|pacman|rogue|html|css|javascript|typescript)\b/i;
 /** Canvas/playable games only — bare "html5" or "website" must NOT match. */
 const GAME_INTENT = /\b(game|spiel|playable|babylon(?:\.js|js)?|vge|webgl|3d\s+(?:game|runner|prototype|world|experience)|html5\s+(?:game|canvas)|html5\s+game|canvas\s+game|game\s+canvas|arcade|platformer|side[- ]?scroller|pitfall|pac[- ]?man|tetris|snake|breakout|pong|roguelike|metroidvania|tower\s+defense|clone\s+of\s+(?:a\s+)?(?:game|pitfall|pac|mario|zelda|arcade)|gameplay|collectible|boss\s+fight|level\s+design|sprite\s+sheet|wild\s+(?:boar|pig|forest)|forest\s+pig)\b/i;
 const WEB_PAGE_INTENT = /\b(website|web\s*site|webpage|web\s*page|landing\s+page|home\s*page|index\.html|html\s+page|static\s+page|single\s+page|popup|alert|modal|hello\s+world)\b/i;
 const WEB_SHOWCASE_INTENT = /\b(web[- ]?design\s+showcase|frontend|marketing\s+site|dashboard|saas)\b/i;
+const COMPREHENSIVE_WEB_BUILD = /\b(?:redesign|overhaul|rebuild|transform|art[- ]direct|enterprise[- ]grade|premium\s+(?:website|web|design)|showcase\s+templates?|five\s+(?:distinct\s+)?(?:pages?|templates?))\b/i;
 const CLONE_BUILD = /\bclone\s+of\b|\b(build|create|make)\s+(?:a|an|the|us|me)?\s*(?:clone|replica|remake|port)\b/i;
 const READ_ONLY_INTENT = /\b(analy[sz]e|analyse|analysis|audit|review|inspect|proof|understand|summari[sz]e|scan|read[\s-]?only|where we left|what is|how does|show me|tell me|identify\s+gaps?|gap\s+analysis|production\s+blockers?)\b/i;
 const EXPLICIT_WRITE_VERBS = /\b(implement|write|edit|modify|update|redesign|overhaul|rebuild|transform|polish|art-direct|fix|repair|create|build|generate|scaffold|deploy|refactor|develop|integrate|correct|apply|patch)\b/i;
@@ -17,7 +18,7 @@ const TRIVIAL_HTML_PAGE = /\b(hello\s*world|simple\s+(?:html|web|page|site)|html
 /** User explicitly grants write permission after an analysis or confirmation gate. */
 const WRITE_PERMISSION_GRANT = /\b(?:hereby\s+confirm|i\s+confirm|confirm(?:ed)?\s+that|give\s+(?:you|permission)|granting\s+permission|allow\s+(?:you|me\s+to)|you\s+(?:may|can|have\s+permission\s+to)|permission\s+to|authorized?\s+to|approve(?:d)?\s+(?:the\s+)?(?:changes?|writes?|edits?)|go\s+ahead\s+and(?:\s+write|\s+apply|\s+make|\s+do)?|do\s+all\s+the\s+changes|apply\s+(?:the\s+)?(?:changes?|fixes?|fix)|proceed\s+with\s+(?:the\s+)?(?:changes?|fixes?|implementation|writes?)|make\s+(?:the\s+)?changes|please\s+write)\b/i;
 /** Fix/correct/repair syntax or errors — write path without requiring artifact nouns. */
-const FIX_CORRECT_INTENT = /\b(correct|fix|repair|resolve|patch|address|remedy)\b[\s\S]{0,48}\b(syntax|errors?|bugs?|issues?|mistakes?|typos?)\b|\b(syntax|errors?|bugs?|issues?)\b[\s\S]{0,48}\b(correct|fix|repair|resolve|patch)\b/i;
+const FIX_CORRECT_INTENT = /\b(correct|fix|repair|resolve|patch|address|remedy)\b[\s\S]{0,48}\b(syntax|errors?|bugs?|issues?|defects?|mistakes?|typos?)\b|\b(syntax|errors?|bugs?|issues?|defects?)\b[\s\S]{0,48}\b(correct|fix|repair|resolve|patch)\b/i;
 /** Read-only audit: check/review/find issues without an paired fix/implement verb nearby. */
 const READ_ONLY_CHECK = /\b(check|verify|audit|inspect|review|investigate|look\s+for|find|scan|validate|examine)\b[\s\S]{0,60}\b(syntax|errors?|bugs?|issues?|missing|gaps?|functionality)\b/i;
 /** Strip CLI-appended platform / mode shaping so it cannot flip quality profiles. */
@@ -77,6 +78,14 @@ export function isAgentContinuePrompt(prompt) {
     if (isBuiltContinuePrompt(text) || isBuiltRetryPrompt(text)) {
         return false;
     }
+    const concreteFileScope = /(?<![A-Za-z0-9_.-])[A-Za-z0-9_./\\-]+\.[A-Za-z0-9]{1,16}(?![A-Za-z0-9_.-])/.test(text);
+    const detailedMutationFollowUp = EXPLICIT_WRITE_VERBS.test(text) && (concreteFileScope || text.split(/\s+/).length > 20);
+    if (detailedMutationFollowUp) {
+        // A user may naturally say "continue" while also supplying new defect
+        // evidence, exact file ownership, or revised acceptance criteria.  That is
+        // a new scoped follow-up, not shorthand for replaying the stored prompt.
+        return false;
+    }
     if (/^\/(?:continue|contiune|contiunue)$/i.test(text)) {
         return true;
     }
@@ -128,7 +137,7 @@ export function isTrivialHtmlPageRequest(prompt) {
     if (text.length > 420) {
         return false;
     }
-    if (/\b(multi[- ]?page|full\s+saas|dashboard|e[\s-]?commerce|auth|database|backend|api|microservice)\b/i.test(text)) {
+    if (/\b(multi[- ]?page|five\s+pages?|showcase|enterprise(?:[- ]grade)?|animated?|motion|redesign|overhaul|existing\s+(?:site|website|project)|full\s+saas|dashboard|e[\s-]?commerce|auth|database|backend|api|microservice)\b/i.test(text)) {
         return false;
     }
     return TRIVIAL_HTML_PAGE.test(text)
@@ -247,6 +256,16 @@ export function inferAgentTaskType(prompt) {
         }
         return 'implementation';
     }
+    // A comprehensive website redesign remains a web-build even when the brief
+    // also says to fix/repair defects found during the audit. Treating the repair
+    // verb as globally dominant collapses the required markup/style/interaction
+    // decomposition into a narrow three-step bug-fix workflow.
+    if (hasWebPageIntent(prompt)
+        && hasBuildVerb(prompt)
+        && COMPREHENSIVE_WEB_BUILD.test(text)
+        && !hasGameIntent(prompt)) {
+        return 'web-build';
+    }
     if (hasFixOrCorrectIntent(prompt)) {
         if (hasGameIntent(prompt)) {
             return 'game-build';

package/dist/utils/runtime-capability.d.ts

@@ -0,0 +1,8 @@
+export type RuntimeCapabilities = {
+    loopbackServices: boolean;
+    localV3Agent: boolean;
+};
+/** Explicit operator grants only; never infer trust from hostname, cwd, OS, or container state. */
+export declare function resolveRuntimeCapabilities(environment?: NodeJS.ProcessEnv): RuntimeCapabilities;
+export declare function hasLoopbackServiceCapability(environment?: NodeJS.ProcessEnv): boolean;
+export declare function hasLocalV3AgentCapability(environment?: NodeJS.ProcessEnv): boolean;

package/dist/utils/runtime-capability.js

@@ -0,0 +1,16 @@
+/** Explicit operator grants only; never infer trust from hostname, cwd, OS, or container state. */
+export function resolveRuntimeCapabilities(environment = process.env) {
+    const loopbackServices = environment.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1'
+        || environment.VIGTHORIA_ALLOW_LOOPBACK === '1'
+        || environment.VIGTHORIA_LOCAL_TEST_MODE === '1';
+    return {
+        loopbackServices,
+        localV3Agent: loopbackServices && environment.VIGTHORIA_ALLOW_LOCAL_V3_AGENT === '1',
+    };
+}
+export function hasLoopbackServiceCapability(environment = process.env) {
+    return resolveRuntimeCapabilities(environment).loopbackServices;
+}
+export function hasLocalV3AgentCapability(environment = process.env) {
+    return resolveRuntimeCapabilities(environment).localV3Agent;
+}

package/dist/utils/secret-policy.d.ts

@@ -0,0 +1,20 @@
+export interface OutboundScanResult<T> {
+    value: T;
+    findings: string[];
+}
+export declare class OutboundContextError extends Error {
+    readonly findings: string[];
+    constructor(findings: string[]);
+}
+export declare function isSensitivePath(pathValue: string): boolean;
+export declare function containsHighConfidenceSecret(input: string): boolean;
+export declare function redactSensitiveText(input: string): string;
+export declare function redactSensitiveValue(value: unknown, seen?: WeakSet<object>): unknown;
+/**
+ * Final production-output guard. Commands should still redact at their own
+ * boundaries, but this prevents an overlooked remote error or JSON object
+ * from writing credentials directly to stdout/stderr.
+ */
+export declare function installConsoleRedaction(): void;
+export declare function scanOutboundContext<T>(input: T): OutboundScanResult<T>;
+export declare function safeChildProcessEnv(source?: NodeJS.ProcessEnv, additions?: Record<string, string>): NodeJS.ProcessEnv;

package/dist/utils/secret-policy.js

@@ -0,0 +1,160 @@
+const REDACTED = '[REDACTED]';
+const SENSITIVE_SEGMENTS = new Set([
+    '.git', '.ssh', '.aws', '.azure', '.kube', '.gnupg', '.vigthoria',
+    'credentials', 'credential', 'secrets', 'secret',
+]);
+const SENSITIVE_BASENAMES = new Set([
+    '.env', '.npmrc', '.pypirc', '.netrc', '.git-credentials',
+    'credentials.json', 'credential.json', 'secrets.json', 'secret.json',
+    'auth.json', 'session.json', 'tokens.json', 'token.json',
+    'id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519',
+]);
+const SENSITIVE_EXTENSIONS = new Set([
+    '.pem', '.key', '.p12', '.pfx', '.jks', '.keystore', '.crtkey', '.ovpn',
+]);
+const SECRET_PATTERNS = [
+    /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/i,
+    /\bAKIA[0-9A-Z]{16}\b/,
+    /\b(?:ghp|gho|ghu|ghs|github_pat)_[A-Za-z0-9_]{20,}\b/,
+    /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+    /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/,
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/,
+    /\b(?:password|passwd|pwd|client_secret|private_key|api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token)\s*[:=]\s*["']?[A-Za-z0-9_./+=:-]{8,}/i,
+];
+const SENSITIVE_KEY = /(?:^|[_-])(?:authorization|cookie|password|passwd|pwd|secret|private[_-]?key|api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|session)(?:$|[_-])/i;
+const SENSITIVE_ENV_KEY = /(?:TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|COOKIE|SESSION|PRIVATE_KEY|API_KEY|AUTH|AWS_|AZURE_|GITHUB_|GITLAB_|NPM_|SSH_)/i;
+export class OutboundContextError extends Error {
+    findings;
+    constructor(findings) {
+        super(`Outbound context contains prohibited secret material (${findings.join(', ')})`);
+        this.name = 'OutboundContextError';
+        this.findings = findings;
+    }
+}
+export function isSensitivePath(pathValue) {
+    const normalized = String(pathValue || '').replace(/\\/g, '/').replace(/^\.\//, '').toLowerCase();
+    if (!normalized)
+        return false;
+    const segments = normalized.split('/').filter(Boolean);
+    const basename = segments.at(-1) || '';
+    if (segments.some((segment) => SENSITIVE_SEGMENTS.has(segment)))
+        return true;
+    if (SENSITIVE_BASENAMES.has(basename))
+        return true;
+    if (basename.startsWith('.env.') || basename.endsWith('.env'))
+        return true;
+    if (/^(?:credentials?|secrets?)[._-]/.test(basename))
+        return true;
+    if (/^(?:tokens?|auth|sessions?)\.(?:json|db|sqlite|sqlite3|yaml|yml)$/i.test(basename))
+        return true;
+    return SENSITIVE_EXTENSIONS.has(basename.slice(basename.lastIndexOf('.')));
+}
+export function containsHighConfidenceSecret(input) {
+    const value = String(input || '').replace(/\[REDACTED\]/g, '');
+    return SECRET_PATTERNS.some((pattern) => pattern.test(value));
+}
+export function redactSensitiveText(input) {
+    return String(input || '')
+        .replace(/-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/gi, REDACTED)
+        .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, `Bearer ${REDACTED}`)
+        .replace(/\bAKIA[0-9A-Z]{16}\b/g, REDACTED)
+        .replace(/\b(?:ghp|gho|ghu|ghs|github_pat)_[A-Za-z0-9_]{20,}\b/g, REDACTED)
+        .replace(/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, REDACTED)
+        .replace(/\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g, REDACTED)
+        .replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, REDACTED)
+        .replace(/([?&](?:token|access_token|refresh_token|api_key|apikey|key|secret|signature)=)[^&#\s]+/gi, `$1${REDACTED}`)
+        .replace(/\b((?:password|passwd|pwd|token|access_token|refresh_token|api_key|apikey|client_secret|private_key|secret|signature)\s*[:=]\s*)["']?[^,;\s"']+["']?/gi, `$1${REDACTED}`)
+        .replace(/((?:authorization|cookie|x-api-key|x-service-key)\s*[:=]\s*)[^,;\s]+/gi, `$1${REDACTED}`)
+        .replace(/(vigthoria-auth-token=)[^;\s]+/gi, `$1${REDACTED}`);
+}
+export function redactSensitiveValue(value, seen = new WeakSet()) {
+    if (typeof value === 'string')
+        return redactSensitiveText(value);
+    if (value instanceof Error)
+        return `${value.name}: ${redactSensitiveText(value.message)}`;
+    if (!value || typeof value !== 'object')
+        return value;
+    if (seen.has(value))
+        return '[Circular]';
+    seen.add(value);
+    if (Array.isArray(value))
+        return value.map((entry) => redactSensitiveValue(entry, seen));
+    const output = {};
+    for (const [key, entry] of Object.entries(value)) {
+        output[key] = SENSITIVE_KEY.test(key) ? REDACTED : redactSensitiveValue(entry, seen);
+    }
+    return output;
+}
+let consoleRedactionInstalled = false;
+/**
+ * Final production-output guard. Commands should still redact at their own
+ * boundaries, but this prevents an overlooked remote error or JSON object
+ * from writing credentials directly to stdout/stderr.
+ */
+export function installConsoleRedaction() {
+    if (consoleRedactionInstalled)
+        return;
+    consoleRedactionInstalled = true;
+    for (const method of ['log', 'info', 'warn', 'error', 'debug']) {
+        const original = console[method].bind(console);
+        console[method] = ((...args) => {
+            original(...args.map((value) => redactSensitiveValue(value)));
+        });
+    }
+}
+export function scanOutboundContext(input) {
+    const findings = new Set();
+    const seen = new WeakSet();
+    const visit = (value, location, depth) => {
+        if (depth > 24)
+            throw new OutboundContextError([`${location}: depth limit exceeded`]);
+        if (typeof value === 'string') {
+            if (!/\s/.test(value) && isSensitivePath(value)) {
+                findings.add(`${location}: sensitive path value excluded`);
+                return REDACTED;
+            }
+            if (containsHighConfidenceSecret(value))
+                findings.add(`${location}: secret value redacted`);
+            return redactSensitiveText(value);
+        }
+        if (!value || typeof value !== 'object')
+            return value;
+        if (seen.has(value))
+            throw new OutboundContextError([`${location}: cyclic value`]);
+        seen.add(value);
+        if (Array.isArray(value))
+            return value.map((entry, index) => visit(entry, `${location}[${index}]`, depth + 1));
+        const output = {};
+        for (const [key, entry] of Object.entries(value)) {
+            const child = `${location}.${key}`;
+            if (isSensitivePath(key)) {
+                findings.add(`${child}: sensitive path excluded`);
+                continue;
+            }
+            if (SENSITIVE_KEY.test(key)) {
+                findings.add(`${child}: credential field redacted`);
+                output[key] = REDACTED;
+                continue;
+            }
+            output[key] = visit(entry, child, depth + 1);
+        }
+        return output;
+    };
+    const value = visit(input, '$', 0);
+    if (containsHighConfidenceSecret(JSON.stringify(value))) {
+        throw new OutboundContextError(['residual secret after redaction']);
+    }
+    return { value, findings: [...findings].sort() };
+}
+export function safeChildProcessEnv(source = process.env, additions = {}) {
+    const output = {};
+    for (const [key, value] of Object.entries(source)) {
+        if (value !== undefined && !SENSITIVE_ENV_KEY.test(key))
+            output[key] = value;
+    }
+    for (const [key, value] of Object.entries(additions)) {
+        if (!SENSITIVE_ENV_KEY.test(key))
+            output[key] = value;
+    }
+    return output;
+}

package/dist/utils/session.d.ts

@@ -2,7 +2,7 @@
  * Session Manager - Persist and resume conversations
  * Similar to Vigthoria's session persistence
  */
-import { ChatMessage } from './api.js';
+import type { ChatMessage } from './api.js';
 export type AuthState = {
     token: string | null;
     expiresAt: number | null;
@@ -40,16 +40,40 @@ export interface Session {
     project: string;
     model: string;
     messages: ChatMessage[];
+    /** Stable event identities aligned one-to-one with messages. */
+    messageIds?: string[];
     memorySummary?: string;
     compactedAt?: string | null;
     createdAt: string;
     updatedAt: string;
     agentMode: boolean;
     operatorMode?: boolean;
+    projectId?: string;
     lastAgentRunOutcome?: Record<string, unknown> | null;
+    activeAgentRun?: AgentExecutionCheckpoint | null;
 }
+export type AgentExecutionStatus = 'submitted' | 'retry' | 'continue' | 'running' | 'completed' | 'failed' | 'cancelled';
+export interface AgentExecutionCheckpoint {
+    executionId: string;
+    parentExecutionId?: string | null;
+    contextId: string;
+    prompt: string;
+    originalPrompt: string;
+    workspacePath: string;
+    userTier: string | null;
+    taskType: string;
+    workflowType: string;
+    status: AgentExecutionStatus;
+    submittedAt: string;
+    updatedAt: string;
+    failedTaskIds: string[];
+    unfinishedTaskIds: string[];
+    error?: string | null;
+}
+export declare function assertAgentStatusTransition(from: AgentExecutionStatus, to: AgentExecutionStatus): void;
 export declare class SessionManager {
     private sessionsDir;
+    private indexStore;
     private readonly compactThreshold;
     private readonly retainRecentMessages;
     /** Keep at most this many session files on disk per CLI install. */
@@ -58,7 +82,12 @@ export declare class SessionManager {
     private readonly retentionWindowMs;
     /** Avoid running prune on every save — at most once per CLI process. */
     private prunedThisProcess;
-    constructor();
+    constructor(stateRoot?: string);
+    private workspaceSessionsDir;
+    private sessionStore;
+    private ensureMessageIds;
+    private readSessionFile;
+    private readSessionsFromDir;
     private ensureDir;
     /**
      * Prune sessions older than the retention window AND cap the number of
@@ -70,6 +99,7 @@ export declare class SessionManager {
      * Generate unique session ID
      */
     private generateId;
+    private getProjectId;
     /**
      * Create a new session
      */
@@ -79,6 +109,7 @@ export declare class SessionManager {
      * read by other local users on a shared POSIX host.
      */
     save(session: Session): void;
+    private mergeConcurrentSession;
     /**
      * Load session by ID
      */
@@ -101,6 +132,7 @@ export declare class SessionManager {
      * Clear all sessions
      */
     clearAll(): number;
+    markCancelledByContext(contextId: string): number;
     /**
      * Add message to session
      */