artifact-shelf

1import { atom, read, update } from 'claude-code'
2import type { EngineInterface, Register } from 'claude-code'
3
4import type { ShelfItem, ShelfKind } from '../types'
5import { absolute, ago, commandOutputs, KIND_ICON, KIND_LABEL, kindOf, search, shelve, size, textOutputs } from './shelf'
6import { maskedOf } from './mask'
7
8const PANE = 'artifact-shelf'
9const TITLE = '成果物の棚'
10const KEEP = 300
11const SHOWN = 40
12// A file counts as made by a call when it changed from shortly before the call on.
13const SLACK_MS = 2_000
14
15const items = atom({ plugin: 'artifact-shelf', key: 'items' } as const, [] as ShelfItem[])
16const purpose = atom({ plugin: 'artifact-shelf', key: 'purpose' } as const, '')
17const filter = atom({ plugin: 'artifact-shelf', key: 'filter' } as const, { kind: 'all', query: '' } as { kind: ShelfKind | 'all'; query: string })
18
19const SKIP_TOOLS = new Set(['Read', 'Edit', 'MultiEdit', 'NotebookEdit', 'Glob', 'Grep', 'LS', 'TodoWrite', 'WebSearch', 'WebFetch'])
20const KIND_FILTERS: (ShelfKind | 'all')[] = ['all', 'data', 'document', 'image', 'video', 'audio', 'patch', 'archive']
21
22let queue: Promise<unknown> = Promise.resolve()
23function serial<T>(work: () => Promise<T>): Promise<T> {
24  const run = queue.then(work)
25  queue = run.catch(() => undefined)
26  return run
27}
28
29// The request an item answered is kept across sessions and shown: credentials in it are masked,
30// also in items kept before this was done, as they are read.
31const masked = (list: readonly ShelfItem[]): ShelfItem[] =>
32  list.map(one => ({ ...one, purpose: maskedOf(String(one.purpose ?? '')), event: maskedOf(String(one.event ?? '')) }))
33
34// The store holds 4 MiB of JSON in all, every repository's shelf together: past this many shelves
35// (300 items each run to about 180 KB) the one least recently added to leaves.
36const MAX_SHELVES = 16
37
38/** Drops the shelves least recently added to, past MAX_SHELVES; never the one in hand. */
39async function keepShelves($: EngineInterface, current: string): Promise<void> {
40  const keys = ((await $.store.keys()) as string[]).filter(key => key.startsWith('shelf:') && key !== current)
41  if (keys.length < MAX_SHELVES) return
42  const newest = await Promise.all(
43    keys.map(async key => ({ key, at: Math.max(0, ...((((await $.store.get(key)) as ShelfItem[] | undefined) ?? []).map(one => one.at))) })),
44  )
45  for (const { key } of newest.sort((a, b) => a.at - b.at).slice(0, keys.length - (MAX_SHELVES - 1))) await $.store.delete(key)
46}
47
48const storeKey = async ($: EngineInterface) => `shelf:${(await $.session.repo())?.root ?? (await $.session.cwd())}`
49
50/** Strings in a tool's input that name a file it may have written (`path`, `output_path`, …). */
51function inputPaths(input: Record<string, unknown>): string[] {
52  return Object.entries(input).flatMap(([key, value]) =>
53    typeof value === 'string' && /(?:path|file|filename|output|out|dest|target)$/i.test(key) && value.length < 1024 && kindOf(value) !== undefined ? [value] : [],
54  )
55}
56
57async function shelveNew($: EngineInterface, candidates: string[], meta: { tool: string; event: string; since: number }): Promise<ShelfItem[]> {
58  const cwd = await $.session.cwd()
59  const home = await $.env.get('HOME')
60  const sessionId = await $.session.id()
61  const why = await read($, purpose)
62  const found: ShelfItem[] = []
63  for (const path of [...new Set(candidates.map(one => absolute(one, cwd, home)))].slice(0, 20)) {
64    const kind = kindOf(path)
65    if (kind === undefined) continue
66    const stat = await $.fs.stat(path).catch(() => undefined)
67    if (stat?.kind !== 'file' || stat.mtimeMs < meta.since - SLACK_MS) continue
68    found.push({ path, kind, size: stat.size, at: stat.mtimeMs, tool: meta.tool, event: meta.event, purpose: why, sessionId })
69  }
70  if (found.length === 0) return found
71  const key = await storeKey($)
72  const get = async () => masked(((await $.store.get(key)) as ShelfItem[] | undefined) ?? [])
73  await serial(async () => {
74    await keepShelves($, key)
75    let merged = shelve(await get(), found, KEEP)
76    await $.store.set(key, merged)
77    // Another session may have written in between: read back, and shelve again on top of theirs.
78    const stored = await get()
79    const again = shelve(stored, found, KEEP)
80    if (JSON.stringify(again) !== JSON.stringify(stored)) {
81      merged = again
82      await $.store.set(key, merged)
83    }
84    await update($, items, () => merged)
85  })
86  return found
87}
88
89export const register: Register = on => {
90  on('session.start', async ($, e, next) => {
91    await $.command.register({
92      name: 'shelf',
93      description: '成果物の棚: セッションが作った CSV・PDF・HTML・動画・パッチなどを種類・語・時刻で探す（/shelf [csv|動画|今日|語…]）',
94      argumentHint: '[種類 | 拡張子 | 今日 | 7d | 語…]',
95    })
96    const started = await next(e)
97    const key = await storeKey($)
98    const raw = ((await $.store.get(key)) as ShelfItem[] | undefined) ?? []
99    const stored = masked(raw)
100    // A shelf kept before masking is written back masked now, not at its next new item.
101    if (JSON.stringify(stored) !== JSON.stringify(raw)) await serial(() => $.store.set(key, stored)).catch(() => undefined)
102    await update($, items, () => stored)
103    return started
104  })
105
106  on('prompt.submit', async ($, e, next) => {
107    if (e.origin.kind === 'composer' && e.command === undefined && !e.isMeta) {
108      const text = maskedOf(e.text.slice(0, 65_536)).replace(/\s+/g, ' ').trim()
109      // Masked again once cut: a cut can leave what masks further (`Bearer ab…`), and kept as read back it stays the same.
110      await update($, purpose, () => maskedOf(text.length > 80 ? `${[...text].slice(0, 79).join('')}…` : text))
111    }
112    return next(e)
113  }).catch(($, e, next) => next(e))
114
115  on('tool.call', async ($, e, next) => {
116    const tool = String(e.tool)
117    if (SKIP_TOOLS.has(tool)) return next(e)
118    const since = await $.clock.now()
119    const ran = await next(e)
120    if (ran.deny !== undefined || ran.isError === true) return ran
121
122    const input = e as unknown as Record<string, unknown>
123    const text = ran.text ?? ''
124    let candidates: string[]
125    let event: string
126    if (tool === 'Write') {
127      candidates = typeof input.file_path === 'string' ? [input.file_path] : []
128      event = 'Write'
129    } else if (tool === 'Bash') {
130      const command = String(input.command ?? '')
131      candidates = [...commandOutputs(command), ...textOutputs(text)]
132      // Only the head is shown: a heredoc of a megabyte is not masked whole on every call.
133      event = `Bash: ${maskedOf(command.slice(0, 4_096)).replace(/\s+/g, ' ').slice(0, 120)}`
134    } else {
135      candidates = [...inputPaths(input), ...textOutputs(text)]
136      event = tool
137    }
138    if (candidates.length === 0) return ran
139    const found = await shelveNew($, candidates, { tool, event, since })
140    if (found.length > 0) $.ui.toast(`🗄 棚に追加: ${found.map(one => one.path.slice(one.path.lastIndexOf('/') + 1)).join(', ')}`)
141    return ran
142  }).catch(($, e, next) => next(e)) // an observer: a failure here never changes the call
143
144  on('command.run', { command: 'shelf' }, async ($, e) => {
145    const query = e.args.trim()
146    await update($, filter, () => ({ kind: 'all', query }))
147    // Files gone since they were made are marked, not dropped: the record of the call stays.
148    const all = await read($, items)
149    const checked = await Promise.all(all.map(async one => ({ ...one, isMissing: (await $.fs.stat(one.path).catch(() => undefined)) === undefined })))
150    await update($, items, () => checked)
151    await $.ui.open({ id: PANE, title: TITLE })
152    const hits = search(checked, query, await $.clock.now())
153    if (hits.length === 0) return { text: query === '' ? '🗄 棚はまだ空です。' : `🗄 「${query}」に合う成果物はありません。` }
154    return { text: [`🗄 ${hits.length}件${query === '' ? '' : `（${query}）`}`, ...hits.slice(0, 15).map(one => `- ${one.path}${one.isMissing ? '（削除済み）' : ''} — ${one.event}`)].join('\n') }
155  })
156
157  on('ui.render', { component: 'Pane', requestId: PANE }, async ($, e) => {
158    const { Box, Button, Text } = $.ui.resolve(e)
159    const shown = await read($, filter)
160    const now = await $.clock.now()
161    const matched = search(await read($, items), shown.query, now).filter(one => shown.kind === 'all' || one.kind === shown.kind)
162    const room = Math.max(2, Math.floor(((e.props.scroll.bodyRows ?? 24) - 3) / 2))
163    return (
164      <Box flexDirection="column">
165        <Box flexWrap="wrap">
166          {KIND_FILTERS.map(kind => (
167            <Button
168              key={`k-${kind}`}
169              plain
170              label={`${shown.kind === kind ? '●' : '○'}${kind === 'all' ? 'すべて' : KIND_LABEL[kind]} `}
171              onPress={() => update($, filter, old => ({ ...old, kind }))}
172            />
173          ))}
174        </Box>
175        <Text dimColor>{`${matched.length}件${shown.query === '' ? '' : ` · 「${shown.query}」`}`}</Text>
176        {matched.length === 0 && <Text dimColor>該当する成果物はありません。</Text>}
177        {matched.slice(0, Math.min(room, SHOWN)).map(one => (
178          <Box key={one.path} flexDirection="column">
179            <Box>
180              <Button key={`copy:${one.path}`} plain onPress={press => $.ui.copy({ text: one.path, surface: press.surface })}>
181                {`${KIND_ICON[one.kind]} ${one.path.slice(one.path.lastIndexOf('/') + 1)}`}
182                <Text dimColor>{`  ${size(one.size)} · ${ago(now - one.at)}${one.isMissing ? ' · 削除済み' : ''}`}</Text>
183              </Button>
184            </Box>
185            <Text dimColor wrap="truncate-end">{`   ${one.purpose === '' ? '' : `「${one.purpose}」 · `}${one.event} · ${one.path.slice(0, one.path.lastIndexOf('/'))}`}</Text>
186          </Box>
187        ))}
188        {matched.length > room && <Text dimColor>{`…ほか ${matched.length - room} 件（/shelf <語> で絞り込み）`}</Text>}
189        <Text dimColor>名前を押すとパスをコピー</Text>
190      </Box>
191    )
192  })
193}
194

1// The shelf, pure: which files count as made things, where a call says it wrote one, and
2// how a search over the shelf reads.
3
4import type { ShelfItem, ShelfKind } from '../types'
5
6const KINDS: Record<ShelfKind, string[]> = {
7  data: ['csv', 'tsv', 'xlsx', 'xls', 'ods', 'parquet', 'sqlite', 'db', 'ndjson', 'jsonl', 'har'],
8  document: ['pdf', 'html', 'htm', 'docx', 'pptx', 'odt', 'epub', 'rtf'],
9  image: ['png', 'jpg', 'jpeg', 'gif', 'webp', 'svg', 'avif', 'heic', 'tiff', 'bmp', 'ico'],
10  video: ['mp4', 'mov', 'webm', 'mkv', 'avi', 'm4v'],
11  audio: ['mp3', 'wav', 'm4a', 'aac', 'flac', 'ogg', 'opus'],
12  patch: ['patch', 'diff'],
13  archive: ['zip', 'tar', 'gz', 'tgz', 'bz2', 'xz', '7z', 'dmg', 'whl', 'jar'],
14}
15
16export const KIND_LABEL: Record<ShelfKind, string> = { data: 'データ', document: '文書', image: '画像', video: '動画', audio: '音声', patch: 'パッチ', archive: 'アーカイブ' }
17export const KIND_ICON: Record<ShelfKind, string> = { data: '▦', document: '▤', image: '▣', video: '▶', audio: '♪', patch: '±', archive: '▧' }
18
19const BY_EXT = new Map<string, ShelfKind>(Object.entries(KINDS).flatMap(([kind, exts]) => exts.map(ext => [ext, kind as ShelfKind] as const)))
20
21export function kindOf(path: string): ShelfKind | undefined {
22  const name = path.slice(path.lastIndexOf('/') + 1).toLowerCase()
23  const dot = name.lastIndexOf('.')
24  return dot <= 0 ? undefined : BY_EXT.get(name.slice(dot + 1))
25}
26
27const unquote = (word: string) => word.replace(/^['"]|['"]$/g, '')
28const words = (part: string) => (part.match(/'[^']*'|"[^"]*"|\S+/g) ?? []).map(unquote)
29
30/**
31 * Paths a Bash command may have written: `-o x`, `--output x`, `> x`, `tee x`, the last word
32 * of a converter (`ffmpeg … out.mp4`), an archive's name (`zip x.zip`, `tar -czf x.tgz`).
33 * Candidates only: each is checked on disk before it goes on the shelf.
34 */
35export function commandOutputs(command: string): string[] {
36  const out = new Set<string>()
37  for (const part of command.split(/&&|\|\||\||;|\n/)) {
38    for (const m of part.matchAll(/(?:^|\s)(?:>>?|&>)\s*('[^']*'|"[^"]*"|[^\s|;&<>]+)/g)) out.add(unquote(m[1] as string))
39    const list = words(part.replace(/(?:>>?|&>)\s*\S+/g, ''))
40    list.forEach((word, i) => {
41      const next = list[i + 1]
42      if (next !== undefined && /^(?:-o|--output|--out|-O|--outfile|--out-file|--output-file|--save|-f)$/.test(word)) out.add(next)
43      const eq = word.match(/^--(?:output|out|outfile|out-file|output-file|save)=(.+)$/)
44      if (eq?.[1] !== undefined) out.add(eq[1])
45    })
46    const program = (list[0] ?? '').replace(/^.*\//, '')
47    // `tar -czf x.tgz`, `tar cf x.tar`: the archive follows the bundled flags that end in f.
48    if (program === 'tar') {
49      const at = list.findIndex((word, i) => i > 0 && /^-?[A-Za-z]*c[A-Za-z]*f$/.test(word))
50      if (at > 0 && list[at + 1] !== undefined) out.add(list[at + 1] as string)
51    }
52    if (program === 'tee') list.slice(1).filter(word => !word.startsWith('-')).forEach(word => out.add(word))
53    if (['ffmpeg', 'convert', 'magick', 'zip', 'pandoc', 'wkhtmltopdf', 'cp', 'sips', 'qpdf', 'gs'].includes(program)) {
54      const last = list.at(-1)
55      if (last !== undefined && !last.startsWith('-')) out.add(last)
56      if (program === 'zip' && list[1] !== undefined) out.add(list.find((w, i) => i > 0 && !w.startsWith('-')) ?? '')
57    }
58  }
59  return [...out].filter(path => path !== '' && !path.includes('$') && !path.startsWith('/dev/') && kindOf(path) !== undefined)
60}
61
62/** Paths a tool's answer names that look like made things (`Saved to /tmp/out.pdf`). */
63export function textOutputs(text: string): string[] {
64  const out = new Set<string>()
65  for (const m of text.slice(0, 20_000).matchAll(/(?:^|[\s'"(`:=])((?:\/|~\/|\.{1,2}\/)[^\s'"()`<>|]+\.[A-Za-z0-9]{2,7})(?=$|[\s'"()`.,;:!?<>])/gm)) {
66    const path = m[1] as string
67    if (kindOf(path) !== undefined) out.add(path)
68  }
69  return [...out]
70}
71
72/** A path as an absolute one, against the folder the command ran in. */
73export function absolute(path: string, cwd: string, home: string | undefined): string {
74  const full = path.startsWith('/') ? path : path.startsWith('~/') && home !== undefined ? `${home}${path.slice(1)}` : `${cwd.replace(/\/+$/, '')}/${path}`
75  const parts: string[] = []
76  for (const part of full.split('/')) {
77    if (part === '' || part === '.') continue
78    if (part === '..') parts.pop()
79    else parts.push(part)
80  }
81  return `/${parts.join('/')}`
82}
83
84const KIND_WORDS = new Map<string, ShelfKind>([
85  ...Object.entries(KIND_LABEL).map(([kind, label]) => [label, kind as ShelfKind] as const),
86  ...Object.keys(KIND_LABEL).map(kind => [kind, kind as ShelfKind] as const),
87])
88
89const DAY = 24 * 60 * 60 * 1000
90
91/**
92 * The items a search matches: each word must match. A kind word (`動画`, `video`), an
93 * extension (`csv`), a time word (`今日`/`today`, `昨日`/`yesterday`, `7d`), or text found in
94 * the path, the purpose or the event.
95 */
96export function search(items: readonly ShelfItem[], query: string, now: number): ShelfItem[] {
97  const terms = query.toLowerCase().split(/\s+/).filter(Boolean)
98  // Days as the person's clock counts them: local midnight, not UTC's, and a DST day as long as it is.
99  const midnight = new Date(now)
100  midnight.setHours(0, 0, 0, 0)
101  const startOfToday = midnight.getTime()
102  midnight.setDate(midnight.getDate() - 1)
103  const startOfYesterday = midnight.getTime()
104  return items.filter(item =>
105    terms.every(term => {
106      if (term === 'today' || term === '今日') return item.at >= startOfToday
107      if (term === 'yesterday' || term === '昨日') return item.at >= startOfYesterday && item.at < startOfToday
108      const days = term.match(/^(\d+)d$/)
109      if (days?.[1] !== undefined) return item.at >= now - Number(days[1]) * DAY
110      const kind = KIND_WORDS.get(term)
111      if (kind !== undefined) return item.kind === kind
112      const text = `${item.path}\n${item.purpose}\n${item.event}`.toLowerCase()
113      if (BY_EXT.has(term)) return item.path.toLowerCase().endsWith(`.${term}`) || text.includes(term)
114      return text.includes(term)
115    }),
116  )
117}
118
119export const size = (bytes: number): string =>
120  bytes >= 1024 * 1024 * 1024 ? `${(bytes / 1024 ** 3).toFixed(1)}GB` : bytes >= 1024 * 1024 ? `${(bytes / 1024 ** 2).toFixed(1)}MB` : bytes >= 1024 ? `${Math.round(bytes / 1024)}KB` : `${bytes}B`
121
122export function ago(ms: number): string {
123  const minutes = Math.floor(ms / 60_000)
124  if (minutes < 1) return 'たった今'
125  if (minutes < 60) return `${minutes}分前`
126  const hours = Math.floor(minutes / 60)
127  return hours < 24 ? `${hours}時間前` : `${Math.floor(hours / 24)}日前`
128}
129
130/** Adds made things to a shelf: a path made again replaces its older entry. */
131export function shelve(shelf: readonly ShelfItem[], fresh: readonly ShelfItem[], max: number): ShelfItem[] {
132  const paths = new Set(fresh.map(one => one.path))
133  return [...fresh, ...shelf.filter(one => !paths.has(one.path))].slice(0, max)
134}
135

1// Masking credentials in a command before it is kept, as sandbox-lens does (copied from its
2// parse.ts: mods share no code).
3
4const EXAMPLE_CHARS = 120
5
6// Name segments that mark a value as a credential (`ANTHROPIC_API_KEY`, `x-access-token`, `db_pass`).
7const SECRET_WORDS = new Set([
8  'key', 'apikey', 'token', 'secret', 'password', 'passwd', 'pass', 'pwd',
9  'auth', 'cookie', 'session', 'credential', 'credentials',
10])
11// Words that mark a credential even inside a camelCase name (`accessToken`, `clientSecret`, `APIKey`),
12// and endings that mark one run together (`PGPASSWORD`). `key` and `session` are left out here:
13// `primaryKey` and `sessionId` are ids, not credentials.
14const STRONG_WORDS = new Set(['apikey', 'token', 'secret', 'password', 'passwd', 'credential', 'credentials'])
15const SECRET_ENDINGS = ['password', 'passwd', 'token', 'secret', 'apikey']
16const isStrongName = (name: string) =>
17  name.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase().split(/[_-]/).some(part => STRONG_WORDS.has(part)) ||
18  SECRET_ENDINGS.some(end => name.toLowerCase().replace(/[_-]/g, '').endsWith(end))
19const isSecretName = (name: string) => name.toLowerCase().split(/[_-]/).some(part => SECRET_WORDS.has(part)) || isStrongName(name)
20
21// A value: quoted whole, or up to whitespace or a shell separator.
22const VALUE = String.raw`(?:"[^"]*"|'[^']*'|[^\s&;|'"]+)`
23
24type Replacer = (substring: string, ...groups: string[]) => string
25type Mask = [RegExp, string | Replacer]
26
27// NAME=value. The name is bounded so a long run such as `a-a-a-…` is scanned in linear time, not once per hyphen.
28const NAME_VALUE = new RegExp(String.raw`\b([A-Za-z][\w-]{0,127})=(${VALUE})`, 'g')
29const maskName: Replacer = (whole, name = '') => (isSecretName(name) ? `${name}=***` : whole)
30// One level into the value, not recursively: `a=a=a=…` must not grow the stack.
31const maskNameValue: Replacer = (whole, name = '', value = '') =>
32  isSecretName(name) ? `${name}=***` : value.includes('=') ? `${name}=${value.replace(NAME_VALUE, maskName)}` : whole
33
34// Credentials a command line may carry, each kept to its name.
35const SECRETS: Mask[] = [
36  // URL userinfo: user:password@ keeps the user, a token alone@ goes whole; host and path stay.
37  // The scheme is bounded, as the NAME=value name below is, to keep a long hyphenated run linear.
38  [/(\b[a-z][\w+.-]{0,31}:\/\/)([^/\s:@'"]+):([^/\s@'"]+)@/gi, '$1$2:***@'],
39  [/(\b[a-z][\w+.-]{0,31}:\/\/)([^/\s:@'"*]+)@/gi, '$1***@'],
40  // Headers: Authorization keeps its scheme, Cookie loses every pair.
41  [/(authorization:\s*)(?:(bearer|basic|token)\s+)?[^\s'"]+/gi, (_, head = '', scheme = '') => `${head}${scheme ? `${scheme} ` : ''}***`],
42  [/(\bcookie:\s*)[^\s'";]+(?:;\s*[^\s'";]+)*;?/gi, '$1***'],
43  [/\b(bearer)\s+(?!\*\*\*)[\w.~+/=-]+/gi, '$1 ***'],
44  // Any other header a request sends whose name reads as a credential (-H "X-API-Key: x"); only
45  // as -H/--header, so an error line such as `Unexpected token: '<'` is left as it is. A quoted
46  // value goes whole up to its closing quote (`X-Auth: Token abc`); an unquoted header is one shell
47  // word with no space after the colon, so `grep -H password: config.yml` keeps its file name.
48  [
49    /((?:^|\s)(?:-H|--header)(?:=|\s*))(?:(["'])([\w-]+)(:\s*)(?:(?!\2)[^\n])+|([\w-]+)(:)[^\s'"]+)/g,
50    (whole, head = '', quote = '', quotedName = '', quotedColon = '', name = '', colon = '') => {
51      if (quote !== '') return isSecretName(quotedName) ? `${head}${quote}${quotedName}${quotedColon}***` : whole
52      return isSecretName(name) ? `${head}${name}${colon}***` : whole
53    },
54  ],
55  // -u user:pass, -uuser:pass, --user=user:pass, -u "user:pass"
56  [/(\s(?:-u|--user)(?:=|\s+)?)(["']?)([^\s:'"]+):([^\s'"]+)/g, '$1$2$3:***'],
57  // --password x, --token=x, --client-secret "x"
58  [
59    new RegExp(String.raw`(--(?:client-secret|api-?key|secret|token|auth-token|access-token|password|passwd)(?:=|\s+))${VALUE}`, 'gi'),
60    '$1***',
61  ],
62  // NAME=value where the name reads as a credential, quoted values too (env assignments, query strings).
63  // A value that is itself NAME=value (kubectl --from-literal=password=x) is looked into.
64  [NAME_VALUE, maskNameValue],
65  // "name": "value" (JSON in an output line) where the name reads as a credential.
66  // A bare "key" or "session" is an id there (a path, an S3 key), not a credential.
67  [/("([\w-]+)"\s*:\s*)"[^"]*"/g, (whole, head = '', name = '') => (isSecretName(name) && !/^(?:key|session)$/i.test(name) ? `${head}"***"` : whole)],
68  // Bare tokens with a known shape.
69  [/\b(sk-(?:ant-)?)[\w-]{16,}/g, '$1***'],
70  [/\b(gh[pousr]_)[A-Za-z0-9]{10,}/g, '$1***'],
71  [/\b(github_pat_)\w{10,}/g, '$1***'],
72  [/\b(xox[abprs]-)[\w-]{8,}/g, '$1***'],
73  [/\bAKIA[0-9A-Z]{16}\b/g, 'AKIA***'],
74  [/\b(glpat-)[\w-]{20,}/g, '$1***'],
75  [/\b(npm_)[A-Za-z0-9]{36}\b/g, '$1***'],
76  [/\b((?:sk|rk)_(?:live|test)_)[A-Za-z0-9]{10,}/g, '$1***'],
77  [/\bAIza[\w-]{35}\b/g, 'AIza***'],
78  // Started only where no word or hyphen comes before, so `eyJ-eyJ-…` is not rescanned from each one.
79  [/(?<![\w-])eyJ[\w-]{8,}\.eyJ[\w-]{8,}\.[\w-]*/g, 'eyJ***'],
80]
81
82// Programs whose -p takes a password: attached (mysql -pX) or as the next word (sshpass -p X, docker login -p X).
83const ATTACHED_P = /\b(?:mysql|mariadb|mysqldump|mysqladmin)\b/
84// The words before `login` are bounded, so a long run of `docker docker …` stays linear.
85const SPACED_P = /\bsshpass\b|\b(?:docker|podman|nerdctl|helm)\b(?:\s+\S+){0,8}?\s+login\b/
86
87/** The text with the credentials it carries masked: a command, or a line of its output. */
88export function maskedOf(text: string): string {
89  let masked = SECRETS.reduce((all, [pattern, mask]) => all.replace(pattern, mask as Replacer), text)
90  if (ATTACHED_P.test(masked)) masked = masked.replace(/(\s-p)(?!\s)\S+/g, '$1***')
91  if (SPACED_P.test(masked)) masked = masked.replace(/(\s-p\s+)\S+/g, '$1***')
92  return masked
93}
94
95/** The command as an example: credentials masked, cut to a line. */
96export function exampleOf(command: string): string {
97  const masked = maskedOf(command).replace(/ {2,}/g, ' ')
98  return masked.length > EXAMPLE_CHARS ? `${masked.slice(0, EXAMPLE_CHARS)}…` : masked
99}
100
101

1export type ShelfKind = 'data' | 'document' | 'image' | 'video' | 'audio' | 'patch' | 'archive'
2
3/** A file a session made, and how it came to be. */
4export type ShelfItem = {
5  path: string
6  kind: ShelfKind
7  size: number
8  at: number
9  /** The tool that made it, and what it ran (`Bash: pandoc -o out.pdf …`, `Write`). */
10  tool: string
11  event: string
12  /** The request it answered: the person's latest prompt then, clipped. */
13  purpose: string
14  sessionId: string
15  /** Set by /shelf when the file is no longer there. */
16  isMissing?: boolean
17}
18
19declare module 'claude-code' {
20  interface PluginState {
21    'artifact-shelf': {
22      /** The shelf of the repository the session is in, newest first, as the store keeps it. */
23      items: ShelfItem[]
24      /** The person's latest prompt: what a file made now is for. */
25      purpose: string
26      /** What the pane shows: a kind, or a word to match. */
27      filter: { kind: ShelfKind | 'all'; query: string }
28    }
29  }
30}
31