vouchington-tooling 0.45.0 → 0.46.0

package/dist/session-friction/normalize.mjs

@@ -1,81 +0,0 @@
-import { REDACTED_TOKEN, splitCommand, stripAssignments } from "./command-segments.mjs";
-const MAX_COMMAND_TOKEN_LENGTH = 40;
-const MAX_COMMAND_LENGTH = 100_000;
-const MAX_COMMAND_WRAPPERS = 16;
-const CREDENTIAL_OPTION = /^--?(?:api[-_]?key|auth|credential|password|secret|token)=/i;
-const URL_USERINFO = /^[a-z][a-z0-9+.-]*:\/\/[^/@\s]+@/i;
-const PACKAGE_RUNNERS = new Set(['npm', 'npx', 'pnpm', 'pnpx', 'yarn']);
-const GIT_OPTIONS_WITH_ARGS = new Set(['-C', '-c', '--git-dir', '--work-tree']);
-const GIT_OPTIONS_WITHOUT_ARGS = new Set([
-    '-v',
-    '--version',
-    '-h',
-    '--help',
-    '--exec-path',
-    '--html-path',
-    '--man-path',
-    '--info-path',
-    '-p',
-    '--paginate',
-    '-P',
-    '--no-pager',
-    '--no-replace-objects',
-    '--bare',
-]);
-function redact(token) {
-    return token.length > MAX_COMMAND_TOKEN_LENGTH ||
-        CREDENTIAL_OPTION.test(token) ||
-        URL_USERINFO.test(token)
-        ? REDACTED_TOKEN
-        : token;
-}
-function stripGitOptions(tokens) {
-    let index = 0;
-    while (index < tokens.length) {
-        const token = tokens[index];
-        if (token === '--')
-            return tokens.slice(index + 1);
-        if (GIT_OPTIONS_WITH_ARGS.has(token)) {
-            if (index + 1 >= tokens.length)
-                return [REDACTED_TOKEN];
-            index += 2;
-        }
-        else if (GIT_OPTIONS_WITHOUT_ARGS.has(token) || /^--[a-z0-9-]+=/i.test(token))
-            index++;
-        else
-            break;
-    }
-    return tokens.slice(index);
-}
-function packageRunner(token) {
-    return [...PACKAGE_RUNNERS].some((runner) => token === runner || token.endsWith(`/${runner}`));
-}
-function normalizeSegment(tokens) {
-    const [first, ...rest] = tokens;
-    if (!first)
-        return '';
-    if (packageRunner(first) && (rest[0] === 'run' || rest[0] === 'exec') && rest[1])
-        return `${redact(first)} ${rest[0]} ${redact(rest[1])}`;
-    const effective = first === 'git' || first.endsWith('/git') ? stripGitOptions(rest) : rest;
-    return effective[0] ? `${redact(first)} ${redact(effective[0])}` : redact(first);
-}
-export function normalizeCommandPrefix(command, wrappersToStrip = []) {
-    if (command.length > MAX_COMMAND_LENGTH)
-        return '[REDACTED: command too long]';
-    const segments = splitCommand(command);
-    let index = 0;
-    while (index < segments.length - 1 && stripAssignments(segments[index])[0] === 'cd')
-        index++;
-    const tokens = stripAssignments(segments[index] ?? []);
-    const wrapperValues = Array.isArray(wrappersToStrip) ? wrappersToStrip : [];
-    const wrapperNames = new Set(wrapperValues
-        .slice(0, MAX_COMMAND_WRAPPERS)
-        .filter((value) => typeof value === 'string' && value.length > 0 && value.length <= MAX_COMMAND_TOKEN_LENGTH));
-    let wrappers = 0;
-    while (tokens[wrappers] && wrapperNames.has(tokens[wrappers]))
-        wrappers++;
-    if (!wrappers)
-        return normalizeSegment(tokens);
-    const nested = normalizeSegment(stripAssignments(tokens.slice(wrappers)));
-    return nested ? `${redact(tokens[0])} ${nested}` : redact(tokens[0]);
-}

package/dist/session-friction/report.d.mts

@@ -1,16 +0,0 @@
-import { type JournalScan } from './journal.mts';
-import type { FrictionLogReadResult, SessionFrictionReport, SessionFrictionReportOptions } from './types.mts';
-type FrictionRead = {
-    result: FrictionLogReadResult;
-} | {
-    error: unknown;
-};
-/** Everything a report reads from outside, loaded once so rendering can be repeated for free. */
-export type FrictionReportInputs = {
-    scanned: JournalScan;
-    read: FrictionRead;
-};
-export declare function loadFrictionReportInputs(sessionId: string, options: SessionFrictionReportOptions): Promise<FrictionReportInputs>;
-export declare function renderFrictionReport(sessionId: string, options: SessionFrictionReportOptions, { scanned, read }: FrictionReportInputs): SessionFrictionReport;
-export declare function buildSessionFrictionReport(sessionId: string, options: SessionFrictionReportOptions): Promise<SessionFrictionReport>;
-export {};

package/dist/session-friction/report.mjs

@@ -1,91 +0,0 @@
-import { eventLimit, readFrictionLog, requireDirectory } from "./log.mjs";
-import { buildCiFailuresSection, getConformingGroups, incompleteCiSection } from "./ci-failures.mjs";
-import { errorMessage, scanJournal } from "./journal.mjs";
-import { buildSandboxSection } from "./sandbox.mjs";
-import { validateSessionId } from "./session-id.mjs";
-function sandboxMarkdown(friction, options) {
-    if (friction.status === 'events')
-        return `${friction.truncated ? `## Capture Coverage\nStatus: partial\nDropped records: ${friction.droppedCount}\n\n` : ''}${buildSandboxSection(friction.events, options.redact, options.budgets?.sandboxBytes)}`;
-    if (friction.status === 'empty' && friction.truncated)
-        return `## Sandbox & Permission Audit\nStatus: unavailable (partial capture; dropped ${friction.droppedCount} records)`;
-    const status = friction.status === 'empty' ? 'none observed' : 'unavailable (no friction log)';
-    return `## Sandbox & Permission Audit\nStatus: ${status}`;
-}
-function reportFromLog(sessionId, logOptions, journal, read) {
-    if ('result' in read) {
-        const friction = read.result;
-        const coverage = {
-            journalStatus: journal.status === 'unreachable'
-                ? 'unavailable'
-                : journal.truncated
-                    ? 'partial'
-                    : 'complete',
-            frictionStatus: friction.status,
-            truncated: friction.status !== 'absent' && friction.truncated === true,
-            ...(friction.status === 'absent' ? {} : { droppedCount: friction.droppedCount ?? 0 }),
-        };
-        if (journal.status === 'ok' && journal.truncated)
-            return {
-                coverage,
-                markdown: incompleteCiSection(journal.markdownBlocks) +
-                    '\n\n' +
-                    sandboxMarkdown(friction, logOptions),
-            };
-        const markdown = buildCiFailuresSection(sessionId, journal, friction.status);
-        return { coverage, markdown: `${markdown}\n\n${sandboxMarkdown(friction, logOptions)}` };
-    }
-    else {
-        const ciMarkdown = journal.status === 'ok' && journal.truncated
-            ? incompleteCiSection(journal.markdownBlocks)
-            : journal.status === 'ok' && journal.markdownBlocks.length === 0
-                ? '## CI Failures\nStatus: unavailable (friction log unreadable)'
-                : buildCiFailuresSection(sessionId, journal, 'empty');
-        return {
-            coverage: {
-                journalStatus: journal.status === 'unreachable'
-                    ? 'unavailable'
-                    : journal.truncated
-                        ? 'partial'
-                        : 'complete',
-                frictionStatus: 'unreadable',
-                truncated: true,
-            },
-            markdown: `${ciMarkdown}\n\n## Sandbox & Permission Audit\nStatus: unavailable (friction log unreadable)`,
-            diagnostic: errorMessage(read.error),
-        };
-    }
-}
-export async function loadFrictionReportInputs(sessionId, options) {
-    validateSessionId(sessionId);
-    requireDirectory(options.directory);
-    eventLimit(options.maxEvents);
-    const scanned = await scanJournal(sessionId, options.journalLoader);
-    try {
-        return { scanned, read: { result: readFrictionLog(sessionId, options) } };
-    }
-    catch (error) {
-        return { scanned, read: { error } };
-    }
-}
-export function renderFrictionReport(sessionId, options, { scanned, read }) {
-    const journal = scanned.status === 'unreachable'
-        ? scanned
-        : scanned.status === 'not-found'
-            ? { status: 'ok', markdownBlocks: [], truncated: false }
-            : {
-                status: 'ok',
-                markdownBlocks: getConformingGroups(scanned.entries, options.redact, options.budgets?.ciBytes),
-                truncated: scanned.truncated,
-            };
-    const report = reportFromLog(sessionId, options, journal, read);
-    if (journal.status === 'unreachable') {
-        const diagnostic = report.diagnostic
-            ? `${journal.diagnostic}; ${report.diagnostic}`
-            : journal.diagnostic;
-        return { ...report, diagnostic };
-    }
-    return report;
-}
-export async function buildSessionFrictionReport(sessionId, options) {
-    return renderFrictionReport(sessionId, options, await loadFrictionReportInputs(sessionId, options));
-}

package/dist/session-friction/sandbox.d.mts

@@ -1,3 +0,0 @@
-import type { FrictionEvent } from './types.mts';
-import { type AuditRedactor } from './text.mts';
-export declare function buildSandboxSection(events: FrictionEvent[], redact?: AuditRedactor, maxBytes?: number): string;

package/dist/session-friction/sandbox.mjs

@@ -1,43 +0,0 @@
-import { byteLength, fitFields, selectWithin } from "./audit-fit.mjs";
-import { markdownAuditUnits } from "./text.mjs";
-const SANDBOX_SECTION_HEADER = '## Sandbox & Permission Audit';
-const SANDBOX_SECTION_MAX_BYTES = 3_000;
-// Room for the `- kind (n)` group lines, which are rendered outside the per-event budget.
-const GROUP_LINES_BYTES = 120;
-// Below this an event line would keep little beyond its timestamp, so it is omitted and counted.
-const MIN_EVENT_SHARE_BYTES = 120;
-// Event line fields: command prefix, detail, timestamp. Cut detail first, the timestamp never.
-const SHRINK_ORDER = [1, 0];
-const KIND_ORDER = [
-    'sandbox-escalation',
-    'sandbox-failure',
-    'ambiguous-failure',
-];
-/** Reports dropped events as a group in the same shape as the rest, so omission is never silent. */
-function omissionGroup(count) {
-    return `- omitted (${count})\n  - see journal — ${count} events omitted to fit the size limit — n/a`;
-}
-export function buildSandboxSection(events, redact, maxBytes = SANDBOX_SECTION_MAX_BYTES) {
-    const observations = events.flatMap((event) => event.failure
-        ? [event, { ...event, kind: event.failure.kind, detail: event.failure.detail }]
-        : [event]);
-    const render = (event, budgetBytes) => {
-        const outcome = event.kind === 'sandbox-escalation' ? ` — outcome: ${event.outcome ?? 'unknown'}` : '';
-        const [prefix, detail, timestamp] = fitFields([event.commandPrefix, event.detail, event.timestamp].map((field) => markdownAuditUnits(field, redact)), byteLength(`  -  —  — ${outcome}`), budgetBytes, SHRINK_ORDER);
-        return `  - ${prefix} — ${detail} — ${timestamp}${outcome}`;
-    };
-    const total = Math.max(0, Math.min(maxBytes, SANDBOX_SECTION_MAX_BYTES) - GROUP_LINES_BYTES);
-    const { rendered, omitted } = selectWithin(observations, total, byteLength(omissionGroup(observations.length)) + 1, 1, MIN_EVENT_SHARE_BYTES, render);
-    const kept = observations
-        .slice(0, rendered.length)
-        .map((event, i) => ({ event, line: rendered[i] }));
-    const groups = KIND_ORDER.map((kind) => {
-        const selected = kept.filter(({ event }) => event.kind === kind);
-        return selected.length
-            ? [`- ${kind} (${selected.length})`, ...selected.map(({ line }) => line)].join('\n')
-            : undefined;
-    }).filter((group) => group !== undefined);
-    if (omitted)
-        groups.push(omissionGroup(omitted));
-    return `${SANDBOX_SECTION_HEADER}\nEvents observed: ${observations.length}\n\n${groups.join('\n')}`;
-}

package/dist/session-friction/session-id.d.mts

@@ -1,2 +0,0 @@
-export declare function validateSessionId(sessionId: string): void;
-export declare function sanitizeSessionId(sessionId: string): string;

package/dist/session-friction/types.d.mts

@@ -1,80 +0,0 @@
-export type FrictionEventKind = 'sandbox-escalation' | 'sandbox-failure' | 'ambiguous-failure';
-export type FrictionEvent = {
-    kind: FrictionEventKind;
-    timestamp: string;
-    commandPrefix: string;
-    detail: string;
-    outcome?: 'requested' | 'approved' | 'denied' | 'unknown';
-    failure?: {
-        kind: 'sandbox-failure' | 'ambiguous-failure';
-        detail: string;
-    };
-};
-export type ToolResultObservation = {
-    type: 'tool-result';
-    command: string;
-    commandWrappers?: string[];
-    permissionOutcome?: 'approved' | 'denied';
-    escalationDetail?: string;
-    structuredStderr?: string;
-};
-export type PermissionRequestObservation = {
-    type: 'permission-request';
-    command: string;
-    commandWrappers?: string[];
-};
-export type FrictionObservation = ToolResultObservation | PermissionRequestObservation;
-type FrictionLogCoverage = {
-    truncated: true;
-    droppedCount: number;
-} | {
-    truncated?: false;
-    droppedCount?: never;
-};
-export type FrictionLogReadResult = {
-    status: 'absent';
-} | ({
-    status: 'empty';
-} & FrictionLogCoverage) | ({
-    status: 'events';
-    events: FrictionEvent[];
-} & FrictionLogCoverage);
-export type FrictionLogOptions = {
-    directory: string;
-    maxEvents?: number;
-};
-export type JournalEntry = {
-    data?: {
-        type?: unknown;
-        markdown?: unknown;
-    };
-};
-export type JournalLoadResult = {
-    status: 'ok';
-    entries: Iterable<JournalEntry> | AsyncIterable<JournalEntry>;
-} | {
-    status: 'not-found';
-};
-export type JournalLoader = (sessionId: string) => JournalLoadResult | Promise<JournalLoadResult>;
-export type SessionFrictionCoverage = {
-    journalStatus: 'complete' | 'partial' | 'unavailable';
-    frictionStatus: 'absent' | 'empty' | 'events' | 'unreadable';
-    truncated: boolean;
-    droppedCount?: number;
-};
-export type SessionFrictionReport = {
-    coverage: SessionFrictionCoverage;
-    markdown: string;
-    diagnostic?: string;
-};
-export type SessionFrictionReportOptions = FrictionLogOptions & {
-    journalLoader: JournalLoader;
-    /** Redacts raw field text before Markdown escaping, which would otherwise break matching. */
-    redact?: (value: string) => string;
-    /** Byte allowances for the CI and sandbox sections, as maximums over the built-in budgets. */
-    budgets?: {
-        ciBytes: number;
-        sandboxBytes: number;
-    };
-};
-export {};