@ait-co/devtools 0.1.127 → 0.1.129

package/dist/log-CUik_tHp.js

@@ -0,0 +1,95 @@
+//#region src/mcp/log.ts
+/**
+* Allowed field keys that may pass through to a log line.
+* Unknown keys are dropped. Values are still redact-scanned.
+*/
+const ALLOWED_KEYS = new Set([
+	"ts",
+	"level",
+	"event",
+	"msg",
+	"port",
+	"totpEnabled",
+	"env",
+	"tool",
+	"deploymentId",
+	"errorKind",
+	"reason",
+	"prevTargetId",
+	"mode",
+	"fileCount",
+	"passed",
+	"failed",
+	"skipped"
+]);
+/**
+* Patterns that match secret values.
+* Match order matters — more-specific patterns first.
+*
+* #268 redact script covers: relay=wss://…, at=<TOTP>, _deploymentId=<uuid>.
+* Here we extend to in-process value-level patterns used in server logs.
+*/
+const SECRET_PATTERNS = [
+	/^\d{6}$/,
+	/^(aitcc_|AITCC_)/i,
+	/^[A-Za-z0-9_-]+=.{4,}/,
+	/^wss:\/\//,
+	/(?:^|[?&])at=[A-Z0-9]{6}/i
+];
+/**
+* Returns `true` when the string value matches any known-secret pattern.
+* Only string values are tested — numbers/booleans are always safe.
+*/
+function isSecretValue(value) {
+	return SECRET_PATTERNS.some((re) => re.test(value));
+}
+/**
+* Redacts a single scalar value.
+* - strings: return "***" if the value matches a secret pattern.
+* - other: return as-is.
+*/
+function redactValue(value) {
+	if (typeof value === "string" && isSecretValue(value)) return "***";
+	return value;
+}
+/**
+* Builds a safe log payload from raw fields.
+*
+* - Only keys in `ALLOWED_KEYS` are included.
+* - String values are scanned for secret patterns and replaced with "***".
+* - `ts` and `level` and `event` are always included (they are injected by the
+*   logger functions below, not by callers).
+*/
+function buildPayload(level, event, fields) {
+	const out = {
+		ts: (/* @__PURE__ */ new Date()).toISOString(),
+		level,
+		event
+	};
+	for (const [key, value] of Object.entries(fields)) {
+		if (!ALLOWED_KEYS.has(key)) continue;
+		if (key === "ts" || key === "level" || key === "event") continue;
+		out[key] = redactValue(value);
+	}
+	return out;
+}
+/**
+* Writes a single JSON log line to stderr.
+* MCP stdio transport uses stdout; all diagnostics go to stderr.
+*/
+function writeLog(level, event, fields = {}) {
+	const payload = buildPayload(level, event, fields);
+	process.stderr.write(`${JSON.stringify(payload)}\n`);
+}
+/** Log an informational structured event. */
+function logInfo(event, fields = {}) {
+	writeLog("info", event, fields);
+}
+/** Log an error structured event. */
+function logError(event, fields = {}) {
+	writeLog("error", event, fields);
+}
+//#endregion
+export { logInfo as n, logError as t };
+
+//# sourceMappingURL=log-CUik_tHp.js.map

package/dist/log-CUik_tHp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-CUik_tHp.js","names":[],"sources":["../src/mcp/log.ts"],"sourcesContent":["/**\n * Structured JSON-line server logger + allowlist-based secret redact.\n *\n * Every log line emitted by the debug-mode MCP server is a single JSON object:\n *   { \"ts\": \"<ISO-8601>\", \"level\": \"info\"|\"warn\"|\"error\", \"event\": \"<category>\", ...fields }\n *\n * Allowlist approach — only the keys in ALLOWED_KEYS pass through to the output\n * object unchanged. Any value that matches a known-secret pattern is replaced\n * with \"***\" regardless of key name. This provides two complementary layers:\n *   1. Key allowlist  — unknown keys (e.g. a future field accidentally containing\n *      a credential) are dropped entirely.\n *   2. Value redact   — pattern matching catches secrets that slip through under\n *      an allowed key name (e.g. a message string that includes a TOTP code).\n *\n * SECRET-HANDLING (MUST NOT appear in stdout/stderr/logs):\n *   - TOTP 6-digit codes (pattern: standalone 6-digit run)\n *   - AITCC_API_KEY values (pattern: \"aitcc_\" or \"AITCC_\" prefix — Deploy Key format)\n *   - cookie header values (pattern: \"cookie:\" header content)\n *   - relay WSS URLs (contain the relay host which is semi-sensitive)\n *   - \"at=<TOTP>\" query params\n *\n * Canonical event categories:\n *   server.start    — MCP server started (relay port, TOTP enabled, etc.)\n *   tunnel.up       — cloudflared tunnel assigned a public URL\n *   tunnel.down     — tunnel error / shutdown\n *   page.attached   — first CDP target appeared (deploymentId, env)\n *   page.detached   — target evicted / session replaced\n *   page.crashed    — target crash detected\n *   tool.call       — MCP tool invocation (tool name only — no args/results)\n *   tool.error      — MCP tool error (tool name + safe error category)\n */\n\n/** Structured log levels. */\nexport type LogLevel = 'info' | 'warn' | 'error';\n\n/** Every valid event category. */\nexport type LogEvent =\n  | 'server.start'\n  | 'tunnel.up'\n  | 'tunnel.down'\n  | 'page.attached'\n  | 'page.detached'\n  | 'page.crashed'\n  | 'tool.call'\n  | 'tool.error'\n  // run_tests progress (#646) — operator-visible in the daemon log, never in\n  // the agent response. Carries only counts (secret-free, redact-safe numbers).\n  | 'run_tests.start'\n  | 'run_tests.done';\n\n/**\n * Allowed field keys that may pass through to a log line.\n * Unknown keys are dropped. Values are still redact-scanned.\n */\nconst ALLOWED_KEYS = new Set([\n  'ts',\n  'level',\n  'event',\n  'msg',\n  'port',\n  'totpEnabled',\n  'env',\n  'tool',\n  'deploymentId',\n  'errorKind',\n  'reason',\n  'prevTargetId',\n  'mode',\n  // run_tests progress counts (#646) — numbers, redact-safe.\n  'fileCount',\n  'passed',\n  'failed',\n  'skipped',\n]);\n\n/**\n * Patterns that match secret values.\n * Match order matters — more-specific patterns first.\n *\n * #268 redact script covers: relay=wss://…, at=<TOTP>, _deploymentId=<uuid>.\n * Here we extend to in-process value-level patterns used in server logs.\n */\nconst SECRET_PATTERNS: RegExp[] = [\n  // TOTP 6-digit code as a standalone value (whole string is exactly 6 digits).\n  /^\\d{6}$/,\n  // Deploy Key — AITCC_API_KEY value prefix formats.\n  /^(aitcc_|AITCC_)/i,\n  // Cookie header value (whole string starts with a cookie-like name=value pair).\n  /^[A-Za-z0-9_-]+=.{4,}/,\n  // WSS relay URL value.\n  /^wss:\\/\\//,\n  // TOTP \"at=\" query param embedded in a string.\n  /(?:^|[?&])at=[A-Z0-9]{6}/i,\n];\n\n/**\n * Returns `true` when the string value matches any known-secret pattern.\n * Only string values are tested — numbers/booleans are always safe.\n */\nfunction isSecretValue(value: string): boolean {\n  return SECRET_PATTERNS.some((re) => re.test(value));\n}\n\n/**\n * Redacts a single scalar value.\n * - strings: return \"***\" if the value matches a secret pattern.\n * - other: return as-is.\n */\nfunction redactValue(value: unknown): unknown {\n  if (typeof value === 'string' && isSecretValue(value)) {\n    return '***';\n  }\n  return value;\n}\n\n/**\n * Builds a safe log payload from raw fields.\n *\n * - Only keys in `ALLOWED_KEYS` are included.\n * - String values are scanned for secret patterns and replaced with \"***\".\n * - `ts` and `level` and `event` are always included (they are injected by the\n *   logger functions below, not by callers).\n */\nfunction buildPayload(\n  level: LogLevel,\n  event: LogEvent,\n  fields: Record<string, unknown>,\n): Record<string, unknown> {\n  const out: Record<string, unknown> = {\n    ts: new Date().toISOString(),\n    level,\n    event,\n  };\n\n  for (const [key, value] of Object.entries(fields)) {\n    if (!ALLOWED_KEYS.has(key)) continue;\n    // ts/level/event are controlled above.\n    if (key === 'ts' || key === 'level' || key === 'event') continue;\n    out[key] = redactValue(value);\n  }\n\n  return out;\n}\n\n/**\n * Writes a single JSON log line to stderr.\n * MCP stdio transport uses stdout; all diagnostics go to stderr.\n */\nfunction writeLog(level: LogLevel, event: LogEvent, fields: Record<string, unknown> = {}): void {\n  const payload = buildPayload(level, event, fields);\n  process.stderr.write(`${JSON.stringify(payload)}\\n`);\n}\n\n// ---------------------------------------------------------------------------\n// Public logger functions — one per level.\n// ---------------------------------------------------------------------------\n\n/** Log an informational structured event. */\nexport function logInfo(event: LogEvent, fields: Record<string, unknown> = {}): void {\n  writeLog('info', event, fields);\n}\n\n/** Log a warning structured event. */\nexport function logWarn(event: LogEvent, fields: Record<string, unknown> = {}): void {\n  writeLog('warn', event, fields);\n}\n\n/** Log an error structured event. */\nexport function logError(event: LogEvent, fields: Record<string, unknown> = {}): void {\n  writeLog('error', event, fields);\n}\n\n// ---------------------------------------------------------------------------\n// Exported redact helper for use in tests and callers that need to sanitise\n// before passing to the logger (e.g. error message strings).\n// ---------------------------------------------------------------------------\n\n/**\n * Returns a redacted copy of `value`:\n * - string: \"***\" if it matches a secret pattern, otherwise the original.\n * - other types: returned as-is.\n *\n * Exposed for unit tests and for callers that build dynamic `msg` strings.\n */\nexport function redact(value: unknown): unknown {\n  return redactValue(value);\n}\n"],"mappings":";;;;;AAsDA,MAAM,eAAe,IAAI,IAAI;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CACD,CAAC;;;;;;;;AASF,MAAM,kBAA4B;CAEhC;CAEA;CAEA;CAEA;CAEA;CACD;;;;;AAMD,SAAS,cAAc,OAAwB;AAC7C,QAAO,gBAAgB,MAAM,OAAO,GAAG,KAAK,MAAM,CAAC;;;;;;;AAQrD,SAAS,YAAY,OAAyB;AAC5C,KAAI,OAAO,UAAU,YAAY,cAAc,MAAM,CACnD,QAAO;AAET,QAAO;;;;;;;;;;AAWT,SAAS,aACP,OACA,OACA,QACyB;CACzB,MAAM,MAA+B;EACnC,qBAAI,IAAI,MAAM,EAAC,aAAa;EAC5B;EACA;EACD;AAED,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,EAAE;AACjD,MAAI,CAAC,aAAa,IAAI,IAAI,CAAE;AAE5B,MAAI,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,QAAS;AACxD,MAAI,OAAO,YAAY,MAAM;;AAG/B,QAAO;;;;;;AAOT,SAAS,SAAS,OAAiB,OAAiB,SAAkC,EAAE,EAAQ;CAC9F,MAAM,UAAU,aAAa,OAAO,OAAO,OAAO;AAClD,SAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,QAAQ,CAAC,IAAI;;;AAQtD,SAAgB,QAAQ,OAAiB,SAAkC,EAAE,EAAQ;AACnF,UAAS,QAAQ,OAAO,OAAO;;;AASjC,SAAgB,SAAS,OAAiB,SAAkC,EAAE,EAAQ;AACpF,UAAS,SAAS,OAAO,OAAO"}