mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-10-23 03:47:00 +09:00
fix: rebuild codex-mod native bundles and improve Windows compatibility (#4277)
This commit is contained in:
PJY | ProviDER authored and GitHub committed
1 parent
b93144803b
commit
6cfce09a57
4 files changed
+20
-7
No files matched your search
@@ -7,5 +7,5 @@
|
||||
`)}if(reason!==void 0)process.stdout.write(`${JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:reason}})}
|
||||
`)}function hookFailure(plugin){process.stderr.write(`${plugin}: native hook input or adapter failed
|
||||
`);process.exitCode=2}var newStats=()=>({calls:0,blocked:0,startedMs:0});var STATUS_PATH=".claude-flow/adr-mod/status.json";function statusText(stats,mode,nowMs){return`${JSON.stringify({version:1,updatedMs:nowMs,mod:"adr",guard:mode.guard,...stats},null,2)}
|
||||
`}var COMMON_SECRETS=[["private key",/-----BEGIN [A-Z ]*PRIVATE KEY-----/],["aws access key",/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],["github token",/\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,})\b/],["slack token",/\bxox[abprs]-[A-Za-z0-9-]{10,}/],["slack webhook",/\bhooks\.slack\.com\/services\/T[A-Z0-9]{6,}\/B[A-Z0-9]{6,}\/[A-Za-z0-9]{16,}/],["google api key",/\bAIza[0-9A-Za-z_-]{35}\b/],["anthropic or openai key",/\bsk-(?:(?:ant|proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|(?=[A-Za-z]{0,40}\d)[A-Za-z0-9]{32,})/],["stripe key",/\b[rs]k_live_[A-Za-z0-9]{16,}/],["npm token",/\bnpm_[A-Za-z0-9]{36}\b/],["huggingface token",/\bhf_[A-Za-z0-9]{30,}\b/],["sendgrid key",/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/],["twilio key",/\bSK[0-9a-f]{32}\b/],["jwt",/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/],["bearer token",/\bBearer\s+([A-Za-z0-9._~+/=-]{24,})/],["database url with credentials",/\b[a-z][a-z0-9+.-]{1,20}:\/\/[^\s:@/]+:[^\s@/]{3,}@[^\s/]+/i]];var INJECTION=[["override instructions",/\b(?:ignore|disregard|forget|override)\b[^.\n]{0,40}\b(?:previous|prior|above|earlier|all|any|system)\b[^.\n]{0,30}\b(?:instructions?|rules?|prompts?|guidelines?)\b/i],["role reassignment",/\byou are (?:now|no longer)\b|\bact as (?:an? )?(?:unrestricted|jailbroken)\b/i],["new instructions",/\b(?:new|updated|real) (?:system )?instructions?\s*:/i],["fake role tags",/<\/?\s*(?:system|assistant|developer|instructions?)\s*>|^\s*(?:system|assistant)\s*:/im],["concealment",/\bdo not (?:tell|inform|mention|reveal)[^.\n]{0,30}\b(?:user|human|operator)\b/i],["exfiltration",/\b(?:exfiltrate|send|post|upload|e-?mail)\b(?:[^.\n]|\.(?=\S)){0,50}(?:\b(?:secrets?|credentials?|api keys?)\b|(?:(?<!max[_-]?)\btokens\b|(?<!oauth\/)\btoken\b)(?![\s_-]*(?:usage|counts?|limits?|budgets?|window)\b)|\.env(?:rc)?\b)/i],["shell pipe",/\b(?:curl|wget)\b[^|\n]{0,200}\|\s*(?:sudo\s+)?(?:ba|z)?sh\b/i]];var INVISIBLE=new RegExp("[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f\\u00ad\\u034f\\u061c\\u115f\\u1160\\u17b4\\u17b5\\u180b-\\u180e\\u200b-\\u200f\\u2028-\\u202e\\u2060-\\u206f\\u3164\\ufe00-\\ufe0f\\ufeff\\uffa0\\ufff9-\\ufffb]","g");var MAX_SCAN=2e5;var bare=text=>(text.length>MAX_SCAN?text.slice(0,MAX_SCAN/2)+"\n"+text.slice(-MAX_SCAN/2):text).replace(INVISIBLE,"");var PLACEHOLDER=/placeholder|your[-_ ]|example|changeme|change[-_]?me|redacted|dummy|replace[-_]?me|insert[-_]|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var REFERENCE=/^(?:\$(?:\{[^}]*\}|\(|[A-Za-z_]\w*$)|%[^%]*%$|<[^>]*>$|\{\{|process\.env|os\.environ|env[.[]|import\.meta|System\.getenv|secrets?\.|vault:|op:\/\/|ref\+|arn:|projects\/[^/]+\/secrets\/|gcp:|kms:|aws:|file:)/i;var CALL=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(|^[A-Za-z_$][\w$]*\[/;var IDENT_PATH=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/;var UUID=/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;var NAME_LIKE=/^[a-z][a-z0-9]*(?:[-_./][a-z0-9]+){2,}$/;var RELATIVE_FILE=/^(?:\.{1,2}|~)\/[A-Za-z0-9_./-]*\.[A-Za-z0-9]{1,8}$/;var SECRET_REF=/^(?:[A-Za-z][A-Za-z0-9_-]*=)?(?:[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)*:latest|[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)+:\d{1,4})$/;function entropy(v){const counts=new Map;for(const ch of v)counts.set(ch,(counts.get(ch)??0)+1);let h=0;for(const n of counts.values())h-=n/v.length*Math.log2(n/v.length);return h}function isReference(v){if(PLACEHOLDER.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v))return true;return NAME_LIKE.test(v)&&v.replace(/\D/g,"").length/v.length<.15}function plausibleSecret(v){if(v.length<8||v.length>256||/\s/.test(v)||UUID.test(v)||isReference(v))return false;const symbol=/[^A-Za-z0-9]/.test(v);const digit=/\d/.test(v);const classes=[/[a-z]/.test(v),/[A-Z]/.test(v),digit,symbol].filter(Boolean).length;return classes>=2&&(digit||symbol)&&entropy(v)>=2.5}var KEYED_MIN=20;var PLACEHOLDER_WORD=/(?:^|[^a-z])(?:your|placeholder|changeme|change[-_]?me|example|redacted|dummy|replace[-_]?me|insert)(?:[^a-z]|$)|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var URL_NO_CREDS=/^[a-z][a-z0-9+.-]{1,20}:\/\/[^\s@]*$/i;function hyphenName(v){const parts=v.split("-");return parts.length>=3&&parts.every(p=>/^[a-z0-9]{2,}$/.test(p)&&!/^[0-9a-f]{8,}$/.test(p))&&v.replace(/\D/g,"").length/v.length<.15}function keyedSecret(v){if(v.length<KEYED_MIN||v.length>256||/\s/.test(v))return false;return!(PLACEHOLDER_WORD.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v)||!UUID.test(v)&&hyphenName(v))}var KEY_NAME=/(?:api[_-]?key|secret|token|passw(?:or)?d|passwd|pwd|credential|private[_-]?key|auth(?!or))s?[A-Za-z0-9_-]{0,40}["']?\s*[:=]\s*/gi;var QUOTED=/(["'\x60])((?:(?!\1)[^\n]){1,256})\1/y;var BARE_VALUE=/[^\s"'\x60,;]{1,256}/y;var QUERY_VALUE=/[^\s"'\x60,;&]{1,256}/y;function assignmentSecret(text){let valueEnd=0;for(const m of text.matchAll(KEY_NAME)){if(m.index<valueEnd)continue;const
Line truncated
|
||||
`}var COMMON_SECRETS=[["private key",/-----BEGIN [A-Z ]*PRIVATE KEY-----/],["aws access key",/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],["github token",/\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,})\b/],["slack token",/\bxox[abprs]-[A-Za-z0-9-]{10,}/],["slack webhook",/\bhooks\.slack\.com\/services\/T[A-Z0-9]{6,}\/B[A-Z0-9]{6,}\/[A-Za-z0-9]{16,}/],["google api key",/\bAIza[0-9A-Za-z_-]{35}\b/],["anthropic or openai key",/\bsk-(?:(?:ant|proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|(?=[A-Za-z]{0,40}\d)[A-Za-z0-9]{32,})/],["stripe key",/\b[rs]k_live_[A-Za-z0-9]{16,}/],["npm token",/\bnpm_[A-Za-z0-9]{36}\b/],["huggingface token",/\bhf_[A-Za-z0-9]{30,}\b/],["sendgrid key",/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/],["twilio key",/\bSK[0-9a-f]{32}\b/],["jwt",/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/],["bearer token",/\bBearer\s+([A-Za-z0-9._~+/=-]{24,})/],["database url with credentials",/\b[a-z][a-z0-9+.-]{1,20}:\/\/[^\s:@/]+:[^\s@/]{3,}@[^\s/]+/i]];var INJECTION=[["override instructions",/\b(?:ignore|disregard|forget|override)\b[^.\n]{0,40}\b(?:previous|prior|above|earlier|all|any|system)\b[^.\n]{0,30}\b(?:instructions?|rules?|prompts?|guidelines?)\b/i],["role reassignment",/\byou are (?:now|no longer)\b|\bact as (?:an? )?(?:unrestricted|jailbroken)\b/i],["new instructions",/\b(?:new|updated|real) (?:system )?instructions?\s*:/i],["fake role tags",/<\/?\s*(?:system|assistant|developer|instructions?)\s*>|^\s*(?:system|assistant)\s*:/im],["concealment",/\bdo not (?:tell|inform|mention|reveal)[^.\n]{0,30}\b(?:user|human|operator)\b/i],["exfiltration",/\b(?:exfiltrate|send|post|upload|e-?mail)\b(?:[^.\n]|\.(?=\S)){0,50}(?:\b(?:secrets?|credentials?|api keys?)\b|(?:(?<!max[_-]?)\btokens\b|(?<!oauth\/)\btoken\b)(?![\s_-]*(?:usage|counts?|limits?|budgets?|window)\b)|\.env(?:rc)?\b)/i],["shell pipe",/\b(?:curl|wget)\b[^|\n]{0,200}\|\s*(?:sudo\s+)?(?:ba|z)?sh\b/i]];var INVISIBLE=new RegExp("[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f\\u00ad\\u034f\\u061c\\u115f\\u1160\\u17b4\\u17b5\\u180b-\\u180e\\u200b-\\u200f\\u2028-\\u202e\\u2060-\\u206f\\u3164\\ufe00-\\ufe0f\\ufeff\\uffa0\\ufff9-\\ufffb]","g");var MAX_SCAN=2e5;var bare=text=>(text.length>MAX_SCAN?text.slice(0,MAX_SCAN/2)+"\n"+text.slice(-MAX_SCAN/2):text).replace(INVISIBLE,"");var PLACEHOLDER=/placeholder|your[-_ ]|example|changeme|change[-_]?me|redacted|dummy|replace[-_]?me|insert[-_]|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var REFERENCE=/^(?:\$(?:\{[^}]*\}|\(|[A-Za-z_]\w*$)|%[^%]*%$|<[^>]*>$|\{\{|process\.env|os\.environ|env[.[]|import\.meta|System\.getenv|secrets?\.|vault:|op:\/\/|ref\+|arn:|projects\/[^/]+\/secrets\/|gcp:|kms:|aws:|file:)/i;var CALL=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(|^[A-Za-z_$][\w$]*\[/;var IDENT_PATH=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/;var UUID=/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;var NAME_LIKE=/^[a-z][a-z0-9]*(?:[-_./][a-z0-9]+){2,}$/;var RELATIVE_FILE=/^(?:\.{1,2}|~)\/[A-Za-z0-9_./-]*\.[A-Za-z0-9]{1,8}$/;var SECRET_REF=/^(?:[A-Za-z][A-Za-z0-9_-]*=)?(?:[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)*:latest|[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)+:\d{1,4})$/;function entropy(v){const counts=new Map;for(const ch of v)counts.set(ch,(counts.get(ch)??0)+1);let h=0;for(const n of counts.values())h-=n/v.length*Math.log2(n/v.length);return h}function isReference(v){if(PLACEHOLDER.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v))return true;return NAME_LIKE.test(v)&&v.replace(/\D/g,"").length/v.length<.15}function plausibleSecret(v){if(v.length<8||v.length>256||/\s/.test(v)||UUID.test(v)||isReference(v))return false;const symbol=/[^A-Za-z0-9]/.test(v);const digit=/\d/.test(v);const classes=[/[a-z]/.test(v),/[A-Z]/.test(v),digit,symbol].filter(Boolean).length;return classes>=2&&(digit||symbol)&&entropy(v)>=2.5}var KEYED_MIN=20;var PLACEHOLDER_WORD=/(?:^|[^a-z])(?:your|placeholder|changeme|change[-_]?me|example|redacted|dummy|replace[-_]?me|insert)(?:[^a-z]|$)|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var URL_NO_CREDS=/^[a-z][a-z0-9+.-]{1,20}:\/\/[^\s@]*$/i;function hyphenName(v){const parts=v.split("-");return parts.length>=3&&parts.every(p=>/^[a-z0-9]{2,}$/.test(p)&&!/^[0-9a-f]{8,}$/.test(p))&&v.replace(/\D/g,"").length/v.length<.15}function keyedSecret(v){if(v.length<KEYED_MIN||v.length>256||/\s/.test(v))return false;return!(PLACEHOLDER_WORD.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v)||!UUID.test(v)&&hyphenName(v))}var KEY_NAME=/(?:api[_-]?key|secret|token|passw(?:or)?d|passwd|pwd|credential|private[_-]?key|auth(?!or))s?[A-Za-z0-9_-]{0,40}["']?\s*[:=]\s*/gi;var QUOTED=/(["'\x60])((?:(?!\1)[^\n]){1,256})\1/y;var BARE_VALUE=/[^\s"'\x60,;]{1,256}/y;var QUERY_VALUE=/[^\s"'\x60,;&]{1,256}/y;function assignmentSecret(text){let valueEnd=0;for(const m of text.matchAll(KEY_NAME)){if(m.index<valueEnd)continue;const
Line truncated
|
||||
${HELP}`}function splitName(name){if(!name.startsWith("mcp__"))return void 0;const at=name.lastIndexOf("__");return at>5?{server:name.slice(5,at),tool:name.slice(at+2)}:void 0}var namespaceOf=input=>{const ns=input?.namespace;return typeof ns==="string"?ns:""};var ADR_ID=/^(?:mem:)?ADR-/i;var field=(input,key)=>{const v=input?.[key];return typeof v==="string"?v:""};function owns(tool,input){const parts=splitName(tool);const name=parts?.tool??tool;const adrNamespace=/adr/i.test(namespaceOf(input));if(name==="memory_store")return adrNamespace;if(name==="agentdb_hierarchical-store")return adrNamespace||ADR_ID.test(field(input,"key"));if(name==="agentdb_causal-edge")return adrNamespace||ADR_ID.test(field(input,"sourceId"))||ADR_ID.test(field(input,"targetId"));return false}function verdict(tool,input){if(!owns(tool,input))return void 0;return textsOf(input).some(hasSecret)?"ruflo-adr: this ADR write holds what looks like a secret (a key, token or password). An ADR records a decision; name where the secret lives, not its value.":void 0}runCodexHook({name:"ruflo-adr",writers:["memory_store","agentdb_hierarchical-store","agentdb_causal-edge"],verdict,newStats,statusPath:STATUS_PATH,answer,statusText:(stats,now)=>statusText(stats,{guard:true},now),count:(stats,tool,input,reason)=>{if(owns(tool,input)){stats.calls++;if(reason!==void 0)stats.blocked++}}}).catch(()=>hookFailure("ruflo-adr"));
|
||||
@@ -7,6 +7,6 @@
|
||||
`)}if(reason!==void 0)process.stdout.write(`${JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:reason}})}
|
||||
`)}function hookFailure(plugin){process.stderr.write(`${plugin}: native hook input or adapter failed
|
||||
`);process.exitCode=2}var newStats=()=>({blocked:0});var STATUS_PATH=".claude-flow/ddd-mod/status.json";var statusText=(stats,guard,nowMs)=>`${JSON.stringify({version:1,updatedMs:nowMs,guard,...stats},null,2)}
|
||||
`;var COMMON_SECRETS=[["private key",/-----BEGIN [A-Z ]*PRIVATE KEY-----/],["aws access key",/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],["github token",/\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,})\b/],["slack token",/\bxox[abprs]-[A-Za-z0-9-]{10,}/],["slack webhook",/\bhooks\.slack\.com\/services\/T[A-Z0-9]{6,}\/B[A-Z0-9]{6,}\/[A-Za-z0-9]{16,}/],["google api key",/\bAIza[0-9A-Za-z_-]{35}\b/],["anthropic or openai key",/\bsk-(?:(?:ant|proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|(?=[A-Za-z]{0,40}\d)[A-Za-z0-9]{32,})/],["stripe key",/\b[rs]k_live_[A-Za-z0-9]{16,}/],["npm token",/\bnpm_[A-Za-z0-9]{36}\b/],["huggingface token",/\bhf_[A-Za-z0-9]{30,}\b/],["sendgrid key",/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/],["twilio key",/\bSK[0-9a-f]{32}\b/],["jwt",/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/],["bearer token",/\bBearer\s+([A-Za-z0-9._~+/=-]{24,})/],["database url with credentials",/\b[a-z][a-z0-9+.-]{1,20}:\/\/[^\s:@/]+:[^\s@/]{3,}@[^\s/]+/i]];var INVISIBLE=new RegExp("[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f\\u00ad\\u034f\\u061c\\u115f\\u1160\\u17b4\\u17b5\\u180b-\\u180e\\u200b-\\u200f\\u2028-\\u202e\\u2060-\\u206f\\u3164\\ufe00-\\ufe0f\\ufeff\\uffa0\\ufff9-\\ufffb]","g");var MAX_SCAN=2e5;var bare=text=>(text.length>MAX_SCAN?text.slice(0,MAX_SCAN/2)+"\n"+text.slice(-MAX_SCAN/2):text).replace(INVISIBLE,"");var PLACEHOLDER=/placeholder|your[-_ ]|example|changeme|change[-_]?me|redacted|dummy|replace[-_]?me|insert[-_]|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var REFERENCE=/^(?:\$(?:\{[^}]*\}|\(|[A-Za-z_]\w*$)|%[^%]*%$|<[^>]*>$|\{\{|process\.env|os\.environ|env[.[]|import\.meta|System\.getenv|secrets?\.|vault:|op:\/\/|ref\+|arn:|projects\/[^/]+\/secrets\/|gcp:|kms:|aws:|file:)/i;var CALL=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(|^[A-Za-z_$][\w$]*\[/;var IDENT_PATH=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/;var UUID=/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;var NAME_LIKE=/^[a-z][a-z0-9]*(?:[-_./][a-z0-9]+){2,}$/;var RELATIVE_FILE=/^(?:\.{1,2}|~)\/[A-Za-z0-9_./-]*\.[A-Za-z0-9]{1,8}$/;var SECRET_REF=/^(?:[A-Za-z][A-Za-z0-9_-]*=)?(?:[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)*:latest|[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)+:\d{1,4})$/;function entropy(v){const counts=new Map;for(const ch of v)counts.set(ch,(counts.get(ch)??0)+1);let h=0;for(const n of counts.values())h-=n/v.length*Math.log2(n/v.length);return h}function isReference(v){if(PLACEHOLDER.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v))return true;return NAME_LIKE.test(v)&&v.replace(/\D/g,"").length/v.length<.15}function plausibleSecret(v){if(v.length<8||v.length>256||/\s/.test(v)||UUID.test(v)||isReference(v))return false;const symbol=/[^A-Za-z0-9]/.test(v);const digit=/\d/.test(v);const classes=[/[a-z]/.test(v),/[A-Z]/.test(v),digit,symbol].filter(Boolean).length;return classes>=2&&(digit||symbol)&&entropy(v)>=2.5}var KEYED_MIN=20;var PLACEHOLDER_WORD=/(?:^|[^a-z])(?:your|placeholder|changeme|change[-_]?me|example|redacted|dummy|replace[-_]?me|insert)(?:[^a-z]|$)|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var URL_NO_CREDS=/^[a-z][a-z0-9+.-]{1,20}:\/\/[^\s@]*$/i;function hyphenName(v){const parts=v.split("-");return parts.length>=3&&parts.every(p=>/^[a-z0-9]{2,}$/.test(p)&&!/^[0-9a-f]{8,}$/.test(p))&&v.replace(/\D/g,"").length/v.length<.15}function keyedSecret(v){if(v.length<KEYED_MIN||v.length>256||/\s/.test(v))return false;return!(PLACEHOLDER_WORD.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v)||!UUID.test(v)&&hyphenName(v))}var KEY_NAME=/(?:api[_-]?key|secret|token|passw(?:or)?d|passwd|pwd|credential|private[_-]?key|auth(?!or))s?[A-Za-z0-9_-]{0,40}["']?\s*[:=]\s*/gi;var QUOTED=/(["'\x60])((?:(?!\1)[^\n]){1,256})\1/y;var BARE_VALUE=/[^\s"'\x60,;]{1,256}/y;var QUERY_VALUE=/[^\s"'\x60,;&]{1,256}/y;function assignmentSecret(text){let valueEnd=0;for(const m of text.matchAll(KEY_NAME)){if(m.index<valueEnd)continue;const at=m.index+m[0].length;let back=m.index;while(back>0&&m.index-back<64&&/[A-Za-z0-9_.-]/.test(text.charAt(back-1)))back--;const re=/["'\x60]/.test(text.charAt(at))?QUOTED:/[?&]/.test(text.charAt(back-1))?QUERY_VALUE:BARE_VALUE;re.lastIndex=at;const hit=re.exec(text);const v=hit&&(hit[2]??hit[0]);valueEnd=hit?at+hit[0].length:at;if(v&&(plausibleSecret(v)||keyedSecret(v)))return true}return false}function urlCredential(url){const pass=/^[^:]+:\/\/[^\s:@/]+:([^\s@/]+)@/.exec(url)?.[1];if(!pass||/\$\{|\{\{|%\(|%s/.test(pass))return false;return!/^(?:password|passwd|pass|pwd|secret|changeme|dbpassword|db_password|\$\w*|<.*>|\{.*\}|\*+|x+)$/i.test(pass)&&!PLACEHOLDER.test(pass)}var CHECKS={"bearer token":m=>!isReference(m[1]??""),"database url with credentials":m=>urlCredential(m[0]),"database url with password":m=>urlCredential(m[0])};var globals=new WeakMap;function matches(name,re,text){if(name==="key assignment")ret
Line truncated
|
||||
`;var COMMON_SECRETS=[["private key",/-----BEGIN [A-Z ]*PRIVATE KEY-----/],["aws access key",/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],["github token",/\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,})\b/],["slack token",/\bxox[abprs]-[A-Za-z0-9-]{10,}/],["slack webhook",/\bhooks\.slack\.com\/services\/T[A-Z0-9]{6,}\/B[A-Z0-9]{6,}\/[A-Za-z0-9]{16,}/],["google api key",/\bAIza[0-9A-Za-z_-]{35}\b/],["anthropic or openai key",/\bsk-(?:(?:ant|proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|(?=[A-Za-z]{0,40}\d)[A-Za-z0-9]{32,})/],["stripe key",/\b[rs]k_live_[A-Za-z0-9]{16,}/],["npm token",/\bnpm_[A-Za-z0-9]{36}\b/],["huggingface token",/\bhf_[A-Za-z0-9]{30,}\b/],["sendgrid key",/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/],["twilio key",/\bSK[0-9a-f]{32}\b/],["jwt",/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/],["bearer token",/\bBearer\s+([A-Za-z0-9._~+/=-]{24,})/],["database url with credentials",/\b[a-z][a-z0-9+.-]{1,20}:\/\/[^\s:@/]+:[^\s@/]{3,}@[^\s/]+/i]];var INVISIBLE=new RegExp("[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f\\u00ad\\u034f\\u061c\\u115f\\u1160\\u17b4\\u17b5\\u180b-\\u180e\\u200b-\\u200f\\u2028-\\u202e\\u2060-\\u206f\\u3164\\ufe00-\\ufe0f\\ufeff\\uffa0\\ufff9-\\ufffb]","g");var MAX_SCAN=2e5;var bare=text=>(text.length>MAX_SCAN?text.slice(0,MAX_SCAN/2)+"\n"+text.slice(-MAX_SCAN/2):text).replace(INVISIBLE,"");var PLACEHOLDER=/placeholder|your[-_ ]|example|changeme|change[-_]?me|redacted|dummy|replace[-_]?me|insert[-_]|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var REFERENCE=/^(?:\$(?:\{[^}]*\}|\(|[A-Za-z_]\w*$)|%[^%]*%$|<[^>]*>$|\{\{|process\.env|os\.environ|env[.[]|import\.meta|System\.getenv|secrets?\.|vault:|op:\/\/|ref\+|arn:|projects\/[^/]+\/secrets\/|gcp:|kms:|aws:|file:)/i;var CALL=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(|^[A-Za-z_$][\w$]*\[/;var IDENT_PATH=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/;var UUID=/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;var NAME_LIKE=/^[a-z][a-z0-9]*(?:[-_./][a-z0-9]+){2,}$/;var RELATIVE_FILE=/^(?:\.{1,2}|~)\/[A-Za-z0-9_./-]*\.[A-Za-z0-9]{1,8}$/;var SECRET_REF=/^(?:[A-Za-z][A-Za-z0-9_-]*=)?(?:[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)*:latest|[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)+:\d{1,4})$/;function entropy(v){const counts=new Map;for(const ch of v)counts.set(ch,(counts.get(ch)??0)+1);let h=0;for(const n of counts.values())h-=n/v.length*Math.log2(n/v.length);return h}function isReference(v){if(PLACEHOLDER.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v))return true;return NAME_LIKE.test(v)&&v.replace(/\D/g,"").length/v.length<.15}function plausibleSecret(v){if(v.length<8||v.length>256||/\s/.test(v)||UUID.test(v)||isReference(v))return false;const symbol=/[^A-Za-z0-9]/.test(v);const digit=/\d/.test(v);const classes=[/[a-z]/.test(v),/[A-Z]/.test(v),digit,symbol].filter(Boolean).length;return classes>=2&&(digit||symbol)&&entropy(v)>=2.5}var KEYED_MIN=20;var PLACEHOLDER_WORD=/(?:^|[^a-z])(?:your|placeholder|changeme|change[-_]?me|example|redacted|dummy|replace[-_]?me|insert)(?:[^a-z]|$)|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var URL_NO_CREDS=/^[a-z][a-z0-9+.-]{1,20}:\/\/[^\s@]*$/i;function hyphenName(v){const parts=v.split("-");return parts.length>=3&&parts.every(p=>/^[a-z0-9]{2,}$/.test(p)&&!/^[0-9a-f]{8,}$/.test(p))&&v.replace(/\D/g,"").length/v.length<.15}function keyedSecret(v){if(v.length<KEYED_MIN||v.length>256||/\s/.test(v))return false;return!(PLACEHOLDER_WORD.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v)||!UUID.test(v)&&hyphenName(v))}var KEY_NAME=/(?:api[_-]?key|secret|token|passw(?:or)?d|passwd|pwd|credential|private[_-]?key|auth(?!or))s?[A-Za-z0-9_-]{0,40}["']?\s*[:=]\s*/gi;var QUOTED=/(["'\x60])((?:(?!\1)[^\n]){1,256})\1/y;var BARE_VALUE=/[^\s"'\x60,;]{1,256}/y;var QUERY_VALUE=/[^\s"'\x60,;&]{1,256}/y;function assignmentSecret(text){let valueEnd=0;for(const m of text.matchAll(KEY_NAME)){if(m.index<valueEnd)continue;const at=m.index+m[0].length;let back=m.index;while(back>0&&m.index-back<64&&/[A-Za-z0-9_.-]/.test(text.charAt(back-1)))back--;if(hyphenName((text.slice(back,m.index)+m[0]).replace(/["']?\s*[:=]\s*$/,""))){valueEnd=at;continue}const re=/["'\x60]/.test(text.charAt(at))?QUOTED:/[?&]/.test(text.charAt(back-1))?QUERY_VALUE:BARE_VALUE;re.lastIndex=at;const hit=re.exec(text);const v=hit&&(hit[2]??hit[0]);valueEnd=hit?at+hit[0].length:at;if(v&&(plausibleSecret(v)||keyedSecret(v)))return true}return false}function urlCredential(url){const pass=/^[^:]+:\/\/[^\s:@/]+:([^\s@/]+)@/.exec(url)?.[1];if(!pass||/\$\{|\{\{|%\(|%s/.test(pass))return false;return!/^(?:password|passwd|pass|pwd|secret|changeme|dbpassword|db_password|\$\w*|<.*>|\{.*\}|\*+|x+)$/i.test(pass)&&!PLACEHOLDER.test(pass)}var CHECKS={"bearer token":m=>!isReference(m[1]??""),"database url with credentials":m=>urlCredential(m[0]),"database url with password":m=>urlCre
Line truncated
|
||||
${found.map(f=>`- ${f}`).join("\n")}`:"No bounded context found under src/, src/contexts or src/modules."}return`Unknown: ${verb}
|
||||
${HELP}`}var tail=name=>name.startsWith("mcp__")?name.slice(name.lastIndexOf("__")+2):name;var WRITERS=new Set(["memory_store","agentdb_hierarchical-store"]);var DOMAIN=/^(?:ddd|domain)-|^(?:context|aggregate):/;function isDomainWrite(input){const o=typeof input==="object"&&input!==null?input:{};return["key","parent","child"].some(k=>typeof o[k]==="string"&&DOMAIN.test(o[k]))}function verdict(tool,input){if(!WRITERS.has(tail(tool))||!isDomainWrite(input))return void 0;return textsOf(input).some(hasSecret)?"ruflo-ddd: this domain-model entry holds what looks like a secret (a key, token or password). The model records contexts and aggregates, not credentials.":void 0}runCodexHook({name:"ruflo-ddd",writers:["memory_store","agentdb_hierarchical-store"],verdict,newStats,statusPath:STATUS_PATH,answer,statusText:(stats,now)=>statusText(stats,true,now),count:(stats,tool,input,reason)=>{if(reason!==void 0)stats.blocked++}}).catch(()=>hookFailure("ruflo-ddd"));
|
||||
@@ -7,5 +7,5 @@
|
||||
`)}if(reason!==void 0)process.stdout.write(`${JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:reason}})}
|
||||
`)}function hookFailure(plugin){process.stderr.write(`${plugin}: native hook input or adapter failed
|
||||
`);process.exitCode=2}var newStats=()=>({checked:0,blocked:0,seen:{}});var STATUS_PATH=".claude-flow/sparc-mod/status.json";function statusText(stats,mode,nowMs){return`${JSON.stringify({version:1,updatedMs:nowMs,guard:mode.guard,...stats},null,2)}
|
||||
`}var COMMON_SECRETS=[["private key",/-----BEGIN [A-Z ]*PRIVATE KEY-----/],["aws access key",/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],["github token",/\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,})\b/],["slack token",/\bxox[abprs]-[A-Za-z0-9-]{10,}/],["slack webhook",/\bhooks\.slack\.com\/services\/T[A-Z0-9]{6,}\/B[A-Z0-9]{6,}\/[A-Za-z0-9]{16,}/],["google api key",/\bAIza[0-9A-Za-z_-]{35}\b/],["anthropic or openai key",/\bsk-(?:(?:ant|proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|(?=[A-Za-z]{0,40}\d)[A-Za-z0-9]{32,})/],["stripe key",/\b[rs]k_live_[A-Za-z0-9]{16,}/],["npm token",/\bnpm_[A-Za-z0-9]{36}\b/],["huggingface token",/\bhf_[A-Za-z0-9]{30,}\b/],["sendgrid key",/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/],["twilio key",/\bSK[0-9a-f]{32}\b/],["jwt",/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/],["bearer token",/\bBearer\s+([A-Za-z0-9._~+/=-]{24,})/],["database url with credentials",/\b[a-z][a-z0-9+.-]{1,20}:\/\/[^\s:@/]+:[^\s@/]{3,}@[^\s/]+/i]];var INVISIBLE=new RegExp("[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f\\u00ad\\u034f\\u061c\\u115f\\u1160\\u17b4\\u17b5\\u180b-\\u180e\\u200b-\\u200f\\u2028-\\u202e\\u2060-\\u206f\\u3164\\ufe00-\\ufe0f\\ufeff\\uffa0\\ufff9-\\ufffb]","g");var MAX_SCAN=2e5;var bare=text=>(text.length>MAX_SCAN?text.slice(0,MAX_SCAN/2)+"\n"+text.slice(-MAX_SCAN/2):text).replace(INVISIBLE,"");var PLACEHOLDER=/placeholder|your[-_ ]|example|changeme|change[-_]?me|redacted|dummy|replace[-_]?me|insert[-_]|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var REFERENCE=/^(?:\$(?:\{[^}]*\}|\(|[A-Za-z_]\w*$)|%[^%]*%$|<[^>]*>$|\{\{|process\.env|os\.environ|env[.[]|import\.meta|System\.getenv|secrets?\.|vault:|op:\/\/|ref\+|arn:|projects\/[^/]+\/secrets\/|gcp:|kms:|aws:|file:)/i;var CALL=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(|^[A-Za-z_$][\w$]*\[/;var IDENT_PATH=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/;var UUID=/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;var NAME_LIKE=/^[a-z][a-z0-9]*(?:[-_./][a-z0-9]+){2,}$/;var RELATIVE_FILE=/^(?:\.{1,2}|~)\/[A-Za-z0-9_./-]*\.[A-Za-z0-9]{1,8}$/;var SECRET_REF=/^(?:[A-Za-z][A-Za-z0-9_-]*=)?(?:[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)*:latest|[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)+:\d{1,4})$/;function entropy(v){const counts=new Map;for(const ch of v)counts.set(ch,(counts.get(ch)??0)+1);let h=0;for(const n of counts.values())h-=n/v.length*Math.log2(n/v.length);return h}function isReference(v){if(PLACEHOLDER.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v))return true;return NAME_LIKE.test(v)&&v.replace(/\D/g,"").length/v.length<.15}function plausibleSecret(v){if(v.length<8||v.length>256||/\s/.test(v)||UUID.test(v)||isReference(v))return false;const symbol=/[^A-Za-z0-9]/.test(v);const digit=/\d/.test(v);const classes=[/[a-z]/.test(v),/[A-Z]/.test(v),digit,symbol].filter(Boolean).length;return classes>=2&&(digit||symbol)&&entropy(v)>=2.5}var KEYED_MIN=20;var PLACEHOLDER_WORD=/(?:^|[^a-z])(?:your|placeholder|changeme|change[-_]?me|example|redacted|dummy|replace[-_]?me|insert)(?:[^a-z]|$)|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var URL_NO_CREDS=/^[a-z][a-z0-9+.-]{1,20}:\/\/[^\s@]*$/i;function hyphenName(v){const parts=v.split("-");return parts.length>=3&&parts.every(p=>/^[a-z0-9]{2,}$/.test(p)&&!/^[0-9a-f]{8,}$/.test(p))&&v.replace(/\D/g,"").length/v.length<.15}function keyedSecret(v){if(v.length<KEYED_MIN||v.length>256||/\s/.test(v))return false;return!(PLACEHOLDER_WORD.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v)||!UUID.test(v)&&hyphenName(v))}var KEY_NAME=/(?:api[_-]?key|secret|token|passw(?:or)?d|passwd|pwd|credential|private[_-]?key|auth(?!or))s?[A-Za-z0-9_-]{0,40}["']?\s*[:=]\s*/gi;var QUOTED=/(["'\x60])((?:(?!\1)[^\n]){1,256})\1/y;var BARE_VALUE=/[^\s"'\x60,;]{1,256}/y;var QUERY_VALUE=/[^\s"'\x60,;&]{1,256}/y;function assignmentSecret(text){let valueEnd=0;for(const m of text.matchAll(KEY_NAME)){if(m.index<valueEnd)continue;const at=m.index+m[0].length;let back=m.index;while(back>0&&m.index-back<64&&/[A-Za-z0-9_.-]/.test(text.charAt(back-1)))back--;const re=/["'\x60]/.test(text.charAt(at))?QUOTED:/[?&]/.test(text.charAt(back-1))?QUERY_VALUE:BARE_VALUE;re.lastIndex=at;const hit=re.exec(text);const v=hit&&(hit[2]??hit[0]);valueEnd=hit?at+hit[0].length:at;if(v&&(plausibleSecret(v)||keyedSecret(v)))return true}return false}function urlCredential(url){const pass=/^[^:]+:\/\/[^\s:@/]+:([^\s@/]+)@/.exec(url)?.[1];if(!pass||/\$\{|\{\{|%\(|%s/.test(pass))return false;return!/^(?:password|passwd|pass|pwd|secret|changeme|dbpassword|db_password|\$\w*|<.*>|\{.*\}|\*+|x+)$/i.test(pass)&&!PLACEHOLDER.test(pass)}var CHECKS={"bearer token":m=>!isReference(m[1]??""),"database url with credentials":m=>urlCredential(m[0]),"database url with password":m=>urlCredential(m[0])};var globals=new WeakMap;function matches(name,re,text){if(name==="key assignment")ret
Line truncated
|
||||
`}var COMMON_SECRETS=[["private key",/-----BEGIN [A-Z ]*PRIVATE KEY-----/],["aws access key",/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],["github token",/\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,})\b/],["slack token",/\bxox[abprs]-[A-Za-z0-9-]{10,}/],["slack webhook",/\bhooks\.slack\.com\/services\/T[A-Z0-9]{6,}\/B[A-Z0-9]{6,}\/[A-Za-z0-9]{16,}/],["google api key",/\bAIza[0-9A-Za-z_-]{35}\b/],["anthropic or openai key",/\bsk-(?:(?:ant|proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|(?=[A-Za-z]{0,40}\d)[A-Za-z0-9]{32,})/],["stripe key",/\b[rs]k_live_[A-Za-z0-9]{16,}/],["npm token",/\bnpm_[A-Za-z0-9]{36}\b/],["huggingface token",/\bhf_[A-Za-z0-9]{30,}\b/],["sendgrid key",/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/],["twilio key",/\bSK[0-9a-f]{32}\b/],["jwt",/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/],["bearer token",/\bBearer\s+([A-Za-z0-9._~+/=-]{24,})/],["database url with credentials",/\b[a-z][a-z0-9+.-]{1,20}:\/\/[^\s:@/]+:[^\s@/]{3,}@[^\s/]+/i]];var INVISIBLE=new RegExp("[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f\\u00ad\\u034f\\u061c\\u115f\\u1160\\u17b4\\u17b5\\u180b-\\u180e\\u200b-\\u200f\\u2028-\\u202e\\u2060-\\u206f\\u3164\\ufe00-\\ufe0f\\ufeff\\uffa0\\ufff9-\\ufffb]","g");var MAX_SCAN=2e5;var bare=text=>(text.length>MAX_SCAN?text.slice(0,MAX_SCAN/2)+"\n"+text.slice(-MAX_SCAN/2):text).replace(INVISIBLE,"");var PLACEHOLDER=/placeholder|your[-_ ]|example|changeme|change[-_]?me|redacted|dummy|replace[-_]?me|insert[-_]|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var REFERENCE=/^(?:\$(?:\{[^}]*\}|\(|[A-Za-z_]\w*$)|%[^%]*%$|<[^>]*>$|\{\{|process\.env|os\.environ|env[.[]|import\.meta|System\.getenv|secrets?\.|vault:|op:\/\/|ref\+|arn:|projects\/[^/]+\/secrets\/|gcp:|kms:|aws:|file:)/i;var CALL=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(|^[A-Za-z_$][\w$]*\[/;var IDENT_PATH=/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/;var UUID=/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;var NAME_LIKE=/^[a-z][a-z0-9]*(?:[-_./][a-z0-9]+){2,}$/;var RELATIVE_FILE=/^(?:\.{1,2}|~)\/[A-Za-z0-9_./-]*\.[A-Za-z0-9]{1,8}$/;var SECRET_REF=/^(?:[A-Za-z][A-Za-z0-9_-]*=)?(?:[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)*:latest|[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)+:\d{1,4})$/;function entropy(v){const counts=new Map;for(const ch of v)counts.set(ch,(counts.get(ch)??0)+1);let h=0;for(const n of counts.values())h-=n/v.length*Math.log2(n/v.length);return h}function isReference(v){if(PLACEHOLDER.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v))return true;return NAME_LIKE.test(v)&&v.replace(/\D/g,"").length/v.length<.15}function plausibleSecret(v){if(v.length<8||v.length>256||/\s/.test(v)||UUID.test(v)||isReference(v))return false;const symbol=/[^A-Za-z0-9]/.test(v);const digit=/\d/.test(v);const classes=[/[a-z]/.test(v),/[A-Z]/.test(v),digit,symbol].filter(Boolean).length;return classes>=2&&(digit||symbol)&&entropy(v)>=2.5}var KEYED_MIN=20;var PLACEHOLDER_WORD=/(?:^|[^a-z])(?:your|placeholder|changeme|change[-_]?me|example|redacted|dummy|replace[-_]?me|insert)(?:[^a-z]|$)|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i;var URL_NO_CREDS=/^[a-z][a-z0-9+.-]{1,20}:\/\/[^\s@]*$/i;function hyphenName(v){const parts=v.split("-");return parts.length>=3&&parts.every(p=>/^[a-z0-9]{2,}$/.test(p)&&!/^[0-9a-f]{8,}$/.test(p))&&v.replace(/\D/g,"").length/v.length<.15}function keyedSecret(v){if(v.length<KEYED_MIN||v.length>256||/\s/.test(v))return false;return!(PLACEHOLDER_WORD.test(v)||REFERENCE.test(v)||CALL.test(v)||IDENT_PATH.test(v)||URL_NO_CREDS.test(v)||RELATIVE_FILE.test(v)||SECRET_REF.test(v)||!UUID.test(v)&&hyphenName(v))}var KEY_NAME=/(?:api[_-]?key|secret|token|passw(?:or)?d|passwd|pwd|credential|private[_-]?key|auth(?!or))s?[A-Za-z0-9_-]{0,40}["']?\s*[:=]\s*/gi;var QUOTED=/(["'\x60])((?:(?!\1)[^\n]){1,256})\1/y;var BARE_VALUE=/[^\s"'\x60,;]{1,256}/y;var QUERY_VALUE=/[^\s"'\x60,;&]{1,256}/y;function assignmentSecret(text){let valueEnd=0;for(const m of text.matchAll(KEY_NAME)){if(m.index<valueEnd)continue;const at=m.index+m[0].length;let back=m.index;while(back>0&&m.index-back<64&&/[A-Za-z0-9_.-]/.test(text.charAt(back-1)))back--;if(hyphenName((text.slice(back,m.index)+m[0]).replace(/["']?\s*[:=]\s*$/,""))){valueEnd=at;continue}const re=/["'\x60]/.test(text.charAt(at))?QUOTED:/[?&]/.test(text.charAt(back-1))?QUERY_VALUE:BARE_VALUE;re.lastIndex=at;const hit=re.exec(text);const v=hit&&(hit[2]??hit[0]);valueEnd=hit?at+hit[0].length:at;if(v&&(plausibleSecret(v)||keyedSecret(v)))return true}return false}function urlCredential(url){const pass=/^[^:]+:\/\/[^\s:@/]+:([^\s@/]+)@/.exec(url)?.[1];if(!pass||/\$\{|\{\{|%\(|%s/.test(pass))return false;return!/^(?:password|passwd|pass|pwd|secret|changeme|dbpassword|db_password|\$\w*|<.*>|\{.*\}|\*+|x+)$/i.test(pass)&&!PLACEHOLDER.test(pass)}var CHECKS={"bearer token":m=>!isReference(m[1]??""),"database url with credentials":m=>urlCredential(m[0]),"database url with password":m=>urlCre
Line truncated
|
||||
${HELP}`}var shortName=name=>name.startsWith("mcp__")&&name.lastIndexOf("__")>5?name.slice(name.lastIndexOf("__")+2):name;var field=(input,key)=>{const v=typeof input==="object"&&input!==null?input[key]:void 0;return typeof v==="string"?v:""};var NS=/^sparc/i;var WRITERS=new Set(["memory_store","agentdb_hierarchical-store","agentdb_pattern-store"]);function watched(tool,input){if(!WRITERS.has(shortName(tool)))return void 0;return NS.test(field(input,"namespace"))?"sparc artifact write":void 0}function verdict(tool,input){if(watched(tool,input)===void 0)return void 0;return textsOf(input).some(hasSecret)?"ruflo-sparc: this spec or artifact holds what looks like a secret (a key, token or password). Write a placeholder and name where the real value lives.":void 0}runCodexHook({name:"ruflo-sparc",writers:["memory_store","agentdb_hierarchical-store","agentdb_pattern-store"],verdict,newStats,statusPath:STATUS_PATH,answer,statusText:(stats,now)=>statusText(stats,{guard:true},now),count:(stats,tool,input,reason)=>{const label=watched(tool,input);if(label!==void 0){stats.checked++;stats.seen[label]=(stats.seen[label]??0)+1;if(reason!==void 0){stats.blocked++;stats.lastReason=reason.slice(0,160)}}}}).catch(()=>hookFailure("ruflo-sparc"));
|
||||
@@ -5,18 +5,31 @@ import path from 'node:path';
|
||||
import os from 'node:os';
|
||||
import { execFileSync } from 'node:child_process';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
|
||||
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
|
||||
const esbuild = process.env.ESBUILD ?? path.join(root, 'node_modules', '.bin', 'esbuild');
|
||||
const isWin = process.platform === 'win32';
|
||||
const esbuildCmd = isWin ? 'npx' : (process.env.ESBUILD ?? path.join(root, 'node_modules', '.bin', 'esbuild'));
|
||||
const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruflo-codex-mod-build-'));
|
||||
|
||||
try {
|
||||
for (const name of ['adr', 'ddd', 'sparc']) {
|
||||
const target = path.join(root, `plugins/ruflo-${name}/hooks/codex-hook.cjs`);
|
||||
const output = path.join(temp, `${name}.cjs`);
|
||||
execFileSync(esbuild, [path.join(root, `plugins/ruflo-${name}/hooks/codex.ts`), '--bundle', '--platform=node', '--target=node20', '--format=cjs', '--minify-whitespace', `--outfile=${output}`], { stdio: 'pipe' });
|
||||
|
||||
const args = isWin
|
||||
? ['esbuild', path.join(root, `plugins/ruflo-${name}/hooks/codex.ts`), '--bundle', '--platform=node', '--target=node20', '--format=cjs', '--minify-whitespace', `--outfile=${output}`]
|
||||
: [path.join(root, `plugins/ruflo-${name}/hooks/codex.ts`), '--bundle', '--platform=node', '--target=node20', '--format=cjs', '--minify-whitespace', `--outfile=${output}`];
|
||||
|
||||
execFileSync(esbuildCmd, args, { stdio: 'pipe', shell: isWin });
|
||||
|
||||
const bytes = `// Generated by scripts/build-codex-mod-hooks.mjs; edit codex.ts or shared runtime, not this bundle.\n${fs.readFileSync(output, 'utf8')}`;
|
||||
if (process.argv.includes('--check')) {
|
||||
if (!fs.existsSync(target) || fs.readFileSync(target, 'utf8') !== bytes) throw new Error(`${name}: native bundle drift; rebuild before release`);
|
||||
} else fs.writeFileSync(target, bytes);
|
||||
} else {
|
||||
fs.writeFileSync(target, bytes);
|
||||
}
|
||||
}
|
||||
console.log('codex-mod-hooks: three bundles match their shared sources');
|
||||
} finally { fs.rmSync(temp, { recursive: true, force: true }); }
|
||||
} finally {
|
||||
fs.rmSync(temp, { recursive: true, force: true });
|
||||
}
|
||||
Reference in new issue
Block a user