clean up

Author: ava-silver

.gitignore

@@ -8,3 +8,4 @@ cache
 .DS_Store
 p10k-instant-prompt-*.zsh
 **/node_modules
+**/__pycache__/

bin/redact-secrets

@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+SUCCESS_CODES = {0, 200, 205}
+
+
+def scan(path: Path) -> list[dict[str, int]]:
+    result = subprocess.run(
+        [
+            "kingfisher",
+            "scan",
+            str(path),
+            "--git-history",
+            "none",
+            "--only-valid",
+            "--redact",
+            "--no-dedup",
+            "--format",
+            "jsonl",
+            "--no-update-check",
+        ],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode not in SUCCESS_CODES:
+        raise RuntimeError(
+            f"Kingfisher failed for {path} with exit code {result.returncode}"
+        )
+
+    return [
+        record["finding"]
+        for line in result.stdout.splitlines()
+        if line and (record := json.loads(line)).get("finding")
+    ]
+
+
+def redact(path: Path, findings: list[dict[str, int]]) -> None:
+    lines = path.read_text().splitlines(keepends=True)
+    by_line: dict[int, list[dict[str, int]]] = {}
+    for finding in findings:
+        by_line.setdefault(finding["line"], []).append(finding)
+
+    for line_number, matches in by_line.items():
+        line = list(lines[line_number - 1])
+        for finding in sorted(
+            matches, key=lambda item: item["column_start"], reverse=True
+        ):
+            start = finding["column_start"]
+            end = finding["column_end"] + 1
+            if start < 0 or end > len(line) or start >= end:
+                raise RuntimeError(
+                    f"Invalid Kingfisher range in {path} at line {line_number}"
+                )
+            line[start:end] = "*" * (end - start)
+        lines[line_number - 1] = "".join(line)
+
+    mode = path.stat().st_mode
+    fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.redact-", dir=path.parent)
+    try:
+        with os.fdopen(fd, "w") as file:
+            file.writelines(lines)
+        os.chmod(temporary, mode)
+        os.replace(temporary, path)
+    except BaseException:
+        Path(temporary).unlink(missing_ok=True)
+        raise
+
+
+def main() -> int:
+    paths = [
+        Path(argument).expanduser().resolve()
+        for argument in sys.argv[1:]
+        if argument != "--"
+    ]
+    if not paths:
+        print("Usage: redact-secrets -- <file>...", file=sys.stderr)
+        return 2
+
+    for path in paths:
+        print(f"Scanning {path}", flush=True)
+        findings = scan(path)
+        if not findings:
+            print(f"No validated secrets in {path}", flush=True)
+            continue
+        redact(path, findings)
+        remaining = scan(path)
+        if remaining:
+            raise RuntimeError(f"Validated secrets remain in {path}")
+        print(f"Redacted {len(findings)} occurrence(s) from {path}", flush=True)
+
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except (OSError, RuntimeError, UnicodeError, json.JSONDecodeError) as error:
+        print(f"redact-secrets: {error}", file=sys.stderr)
+        raise SystemExit(1)

pi/AGENTS.md

@@ -5,6 +5,7 @@
 ## General Behavior
 
 - Start with the simplest implementation that satisfies the stated requirements and existing tests. Before adding an abstraction, guard, or edge-case handling, name (to yourself) the concrete requirement, failing test, observed failure, or established repository convention it addresses -- with file:line if it's a type or call site. If you cannot, leave it out. When the answer is a lookup question (can this be null? who are the callers? does this already exist in the repo?), go look it up rather than hedging.
+- Treat Jira tickets as work-tracking context, not an exhaustive specification. Do not remove or label diff behavior speculative merely because it is absent from the ticket; use the diff, surrounding code, tests, and user direction to establish intent. Ask before removing behavior when intent remains unclear.
 - In general, opt for existing tools (formatters, linters, etc) for fixing problems where possible instead of manual edits
 - After implementation, reread the complete diff and remove speculative abstractions, checks, and indirection.
 - Avoid meta commentary when writing docs, comments, or PR descriptions. Don't make arguments against previous iterations that used to exist -- keep text artifacts grounded in the present.

pi/extensions/.oxlintrc.json

@@ -9,13 +9,6 @@
 				"typescript/no-floating-promises": "off",
 				"typescript/unbound-method": "off"
 			}
-		},
-		{
-			"files": ["output-compaction.ts"],
-			"rules": {
-				"typescript/no-base-to-string": "off",
-				"typescript/unbound-method": "off"
-			}
 		}
 	]
 }

pi/extensions/AGENTS.md

@@ -11,7 +11,7 @@
 - Respect `ctx.isProjectTrusted()` before loading project-controlled configuration or instructions.
 - Validate persisted, network, subprocess, and session data at module boundaries.
 - Do not use `any` outside a documented compatibility adapter.
-- Keep undocumented Pi internals and prototype patches inside `shared/*-compat.ts` modules with installed-runtime tests.
+- Keep undocumented Pi internals and prototype patches inside extension-owned `compat.ts` modules with installed-runtime tests.
 - Add a regression test for every bug fix.
 - Declare dependencies in the root manifest. Do not add nested manifests or lockfiles.
 - Provision external executables through `Brewfile`; extensions only detect and report missing dependencies.

pi/extensions/output-compaction.ts

@@ -1,3 +1,4 @@
+/* oxlint-disable typescript/no-base-to-string, typescript/unbound-method */
 import { readFileSync, realpathSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join, resolve } from "node:path";
@@ -188,7 +189,7 @@ function sameMembers(left: ToolRow[], right: ToolRow[]): boolean {
 	return left.length === right.length && left.every((member, index) => member === right[index]);
 }
 
-function renderCompactBlock(rows: ToolRow[], width: number, state: ToolPatchState): string[] {
+function renderCompactBlock(rows: [ToolRow, ...ToolRow[]], width: number, state: ToolPatchState): string[] {
 	const theme = state.theme;
 	if (!theme) return state.originalRender.call(rows[0], width);
 
@@ -254,7 +255,7 @@ function renderContainer(container: ContainerLike, width: number, state: Contain
 			continue;
 		}
 
-		const group: ToolRow[] = [child];
+		const group: [ToolRow, ...ToolRow[]] = [child];
 		let lastMember = index;
 		for (let candidateIndex = index + 1; candidateIndex < children.length; candidateIndex++) {
 			const candidate = children[candidateIndex];

pi/extensions/package.json

@@ -10,7 +10,7 @@
 		"lint": "oxlint --type-aware --deny-warnings --report-unused-disable-directives .",
 		"prepare": "effect-tsgo patch",
 		"test": "node --test --experimental-strip-types",
-		"typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.strict.json"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"acorn": "8.17.0",

pi/extensions/session-secret-redaction/index.test.ts

@@ -17,17 +17,20 @@ for (const scanExitCode of [200, 205]) {
 		temporaryDirectories.push(directory);
 		const sessionFile = join(directory, "session.jsonl");
 		const secret = "0123456789abcdef0123456789abcdef";
-		const content = `${JSON.stringify({ type: "message", message: { content: `{"api_key": "${secret}"}` } })}\n`;
+		const content = `${JSON.stringify({
+			type: "message",
+			message: { content: `{"api_key": "${secret}", "duplicate": "${secret}"}` },
+		})}\n`;
 		await writeFile(sessionFile, content);
 
-		const start = content.indexOf(secret);
-		const finding = {
+		const starts = [content.indexOf(secret), content.lastIndexOf(secret)];
+		const findings = starts.map((start) => ({
 			finding: {
 				line: 1,
 				column_start: start,
 				column_end: start + secret.length - 1,
 			},
-		};
+		}));
 		let sessionStart: ((event: unknown, ctx: unknown) => Promise<void>) | undefined;
 		const commands: string[] = [];
 		const pi = {
@@ -37,7 +40,12 @@ for (const scanExitCode of [200, 205]) {
 			async exec(command: string, args: string[]) {
 				commands.push([command, ...args].join(" "));
 				if (args[0] === "--version") return { code: 0, stdout: "kingfisher", stderr: "" };
-				return { code: scanExitCode, stdout: `${JSON.stringify(finding)}\n`, stderr: "" };
+				const reportedFindings = args.includes("--no-dedup") ? findings : findings.slice(0, 1);
+				return {
+					code: scanExitCode,
+					stdout: `${reportedFindings.map((finding) => JSON.stringify(finding)).join("\n")}\n`,
+					stderr: "",
+				};
 			},
 		};
 		extension(pi as never);
@@ -55,12 +63,12 @@ for (const scanExitCode of [200, 205]) {
 		const result = await readFile(sessionFile, "utf8");
 		assert.equal(Buffer.byteLength(result), Buffer.byteLength(content));
 		assert.equal(result.includes(secret), false);
-		assert.equal(result.includes("*".repeat(secret.length)), true);
+		assert.equal(result.split("*".repeat(secret.length)).length - 1, 2);
 		assert.doesNotThrow(() => JSON.parse(result));
-		assert.deepEqual(notifications, ["Redacted 1 validated secret from this session."]);
+		assert.deepEqual(notifications, ["Redacted 2 validated secrets from this session."]);
 		assert.deepEqual(commands.slice(0, 2), [
 			"kingfisher --version",
-			`kingfisher scan ${sessionFile} --git-history none --only-valid --redact --format jsonl --no-update-check`,
+			`kingfisher scan ${sessionFile} --git-history none --only-valid --redact --no-dedup --format jsonl --no-update-check`,
 		]);
 	});
 }

pi/extensions/session-secret-redaction/index.ts

@@ -81,6 +81,7 @@ async function redactSession(pi: ExtensionAPI, ctx: ExtensionContext): Promise<n
 			"none",
 			"--only-valid",
 			"--redact",
+			"--no-dedup",
 			"--format",
 			"jsonl",
 			"--no-update-check",

pi/extensions/tsconfig.json

@@ -6,6 +6,10 @@
 		"lib": ["ESNext"],
 		"types": ["node"],
 		"strict": true,
+		"exactOptionalPropertyTypes": true,
+		"noUncheckedIndexedAccess": true,
+		"noUnusedLocals": true,
+		"noUnusedParameters": true,
 		"noEmit": true,
 		"skipLibCheck": true,
 		"allowImportingTsExtensions": true,