voidmachine 5.0.0 → 5.0.2

package/core-assets/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness",
-  "version": "5.0.0",
+  "version": "5.0.2",
   "description": "VoidCorp universal craftsman skills (void-tdd, void-typescript-strict, void-hexagonal-architecture, void-domain-driven-design, void-functional, void-code-review, void-api-and-interface-design, void-source-driven-development, void-context, void-learn, void-decide, void-claude-md, void-observability, void-security-guidance, ...) plus 12 PreToolUse enforcement hooks (tdd-guard, no-any, protect-sensitive-files, block-dangerous-bash, no-ai-design-slop, ...) and PostToolUse/SessionStart lifecycle hooks (incl. trim-large-output token frugality), five read-only critics including doctrine-critic, native architecture/security/QA specialists, and the void-graph, void-doctor and void-audit gestures, which are skills like everything else.",
   "author": {
     "name": "VoidCorp",

package/core-assets/data/certification.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "harnessVersion": "5.0.0",
+  "harnessVersion": "5.0.2",
   "capabilities": [
     {
       "id": "skill:pack-mobile/void-eas-build-profile",

package/core-assets/hooks/_void-hook.mjs

@@ -7914,7 +7914,7 @@ function projectPath(root, path2) {
   const relativePath = relative(resolve2(root), absolute).replaceAll("\\", "/");
   return relativePath === ".." || relativePath.startsWith("../") || isAbsolute(relativePath) ? void 0 : relativePath;
 }
-function protectedReason(path2, root) {
+function protectedReason(path2, root, shellWrite) {
   if (root !== void 0) {
     const relativePath = projectPath(root, path2);
     if (relativePath !== void 0 && !isCoOwned(relativePath) && manifestOwnedPaths(root).has(relativePath)) {
@@ -7930,7 +7930,10 @@ function protectedReason(path2, root) {
     return "private key / certificate";
   }
   if (/(?:\.npmrc|\.netrc|\.pgpass)$/.test(base)) return "credential file";
-  if (!base.endsWith(".md") && /(?:secret|credential)/.test(base)) return "credential file";
+  const sourceModule = /\.(?:[cm]?[jt]s|[jt]sx)$/.test(base);
+  if (!base.endsWith(".md") && (!sourceModule || shellWrite) && /(?:secret|credential)/.test(base)) {
+    return sourceModule && shellWrite ? "credential-named source module with unavailable shell content; use Write/Edit or apply_patch" : "credential file";
+  }
   if ((/* @__PURE__ */ new Set([
     "package-lock.json",
     "pnpm-lock.yaml",
@@ -7948,7 +7951,7 @@ function protectedReason(path2, root) {
 }
 function protectedFile(paths, options = {}) {
   for (const path2 of paths) {
-    const reason = protectedReason(path2, options.root);
+    const reason = protectedReason(path2, options.root, options.shellWritePaths?.includes(path2) ?? false);
     if (reason !== void 0) {
       const learn = reason.includes("void-learn") ? " Use void-learn to capture the missing harness capability." : "";
       return block("PROTECTED_FILE", `refusing to edit ${path2}.${learn}`, [`${path2}: ${reason}`]);
@@ -7969,24 +7972,31 @@ var HIGH_CONFIDENCE = [
   /\bAIza[0-9A-Za-z_-]{35}\b/,
   /-----BEGIN [A-Z ]*PRIVATE KEY-----/
 ];
-var GENERIC_ASSIGNMENT = /(?:_KEY|_SECRET|_TOKEN|_PASSWORD|_PASSWD|_APIKEY)["' ]*[:=]\s*["']([A-Za-z0-9+/=_-]{24,})["']/i;
+var GENERIC_ASSIGNMENT = /(?:_KEY|_SECRET|_TOKEN|_PASSWORD|_PASSWD|_APIKEY)["' ]*[:=]\s*["']([A-Za-z0-9+/=_-]{24,})["']/gi;
+var CAMEL_ASSIGNMENT = /\b[a-z][A-Za-z0-9_$]*(?:Key|Secret|Token|Password|Passwd)["' ]*[:=]\s*["']([A-Za-z0-9+/=_-]{24,})["']/g;
 var PLACEHOLDER = /process\.env|import\.meta\.env|xxx|changeme|example|redacted|your[-_]|<[a-z]|placeholder|todo/i;
 var EXEMPT_PATH = /\.(?:test|spec)\.|\/__tests__\/|\/__fixtures__\/|\/fixtures\/|\/__generated__\//;
+var CREDENTIAL_SOURCE_MODULE = /(?:secret|credential)[^/]*\.(?:[cm]?[jt]s|[jt]sx)$/i;
 function lineHasSecret(line) {
   if (line.includes("allow-secret-pattern:")) return false;
   if (HIGH_CONFIDENCE.some((pattern2) => pattern2.test(line))) return true;
-  const assignment = line.match(GENERIC_ASSIGNMENT);
-  if (assignment === null || PLACEHOLDER.test(line)) return false;
-  const value = assignment[1] ?? "";
-  if (/^[0-9a-f]+$/i.test(value) || /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(value)) {
-    return false;
+  for (const pattern2 of [GENERIC_ASSIGNMENT, CAMEL_ASSIGNMENT]) {
+    for (const assignment of line.matchAll(pattern2)) {
+      const value = assignment[1] ?? "";
+      if (PLACEHOLDER.test(value)) continue;
+      if (/^[0-9a-f]+$/i.test(value) || /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(value)) {
+        continue;
+      }
+      if (/[A-Za-z]/.test(value) && /[0-9]/.test(value)) return true;
+    }
   }
-  return /[A-Za-z]/.test(value) && /[0-9]/.test(value);
+  return false;
 }
 function secretContent(edits) {
   const evidence = [];
   for (const edit of edits) {
-    if (EXEMPT_PATH.test(edit.path.replaceAll("\\", "/"))) continue;
+    const path2 = edit.path.replaceAll("\\", "/");
+    if (EXEMPT_PATH.test(path2) && !CREDENTIAL_SOURCE_MODULE.test(path2)) continue;
     edit.addedContent.split(/\r?\n/).forEach((line, index) => {
       if (lineHasSecret(line)) evidence.push(`${edit.path}:${index + 1}`);
     });
@@ -8876,7 +8886,8 @@ function evaluateRule(rule, rawInput, options) {
   if (rule === "protected-file") {
     if (productSetting(env, "ALLOW_SECRET_EDIT") === "1") return allow("OVERRIDE", "one-shot override");
     const ownership = options.source === "checked-out" ? {} : { root: options.root };
-    return protectedFile(call.edits.map((edit) => edit.path), ownership);
+    const shellWritePaths = call.tool === "Bash" || call.tool === "shell" ? shellWriteTargets(call.command) : [];
+    return protectedFile(call.edits.map((edit) => edit.path), { ...ownership, shellWritePaths });
   }
   if (rule === "secret-content") return secretContent(call.edits);
   if (rule === "control-character") return controlCharacter(call.edits);

package/dist/main.js

@@ -67817,7 +67817,7 @@ async function recordSpecialistRequests(root, missionId, envelopes, planHash) {
 init_esm_shims();
 
 // package.json
-var version2 = "5.0.0";
+var version2 = "5.0.2";
 
 // src/lib/runs/verify.ts
 var MAX_CAPTURE_BYTES = 64 * 1024;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "voidmachine",
-  "version": "5.0.0",
+  "version": "5.0.2",
   "description": "void-machine CLI — install an opinionated engineering doctrine on any project; render deterministic project health. Run via `npx voidmachine`; command: void-machine (alias vm).",
   "license": "MIT",
   "author": "Folpe @ VoidCorp",
@@ -58,10 +58,10 @@
     "ws": "8.21.0",
     "yaml": "^2.5.0",
     "zod": "^4.6.5",
-    "@voidcorp/harness-graph": "5.0.0",
     "@voidcorp/hook-runner": "0.0.0",
-    "@voidcorp/void-machine": "0.0.0",
-    "@voidcorp/mission-engine": "0.0.0"
+    "@voidcorp/harness-graph": "5.0.2",
+    "@voidcorp/mission-engine": "0.0.0",
+    "@voidcorp/void-machine": "0.0.0"
   },
   "scripts": {
     "build": "tsup",