@aiwg/cli 2026.10.7 → 2026.10.9

package/dist/src/storage/backends/postgrest.js

@@ -1,3 +1,5 @@
+import { resolveSensitiveInput } from '../../auth/sensitive-input.js';
+import { credentialReferenceInput } from '../../mcp/credentials.mjs';
 import { STORAGE_BACKEND_CONTRACT } from '../backend-contract.js';
 import { postgresBatchId, postgresPayloadDigest } from './postgres.js';
 const DEFAULT_TIMEOUT_MS = 15_000;
@@ -18,6 +20,7 @@ export class PostgrestBackendError extends Error {
 /** PostgreSQL accessMode=postgrest; not a separate storage engine. */
 export class PostgrestStorageBackend {
     options;
+    sensitiveInput;
     descriptor = {
         contract: STORAGE_BACKEND_CONTRACT,
         backend: 'postgres-postgrest',
@@ -42,8 +45,9 @@ export class PostgrestStorageBackend {
     maxResponseBytes;
     maxBatchSize;
     maxPageSize;
-    constructor(options) {
+    constructor(options, sensitiveInput = {}) {
         this.options = options;
+        this.sensitiveInput = sensitiveInput;
         this.baseUrl = normalizeBaseUrl(options.baseUrl);
         this.fetchImpl = options.fetch ?? globalThis.fetch;
         if (!this.fetchImpl)
@@ -185,7 +189,7 @@ export class PostgrestStorageBackend {
             headers['Content-Type'] = options.contentType ?? 'application/json';
         if (options.prefer)
             headers.Prefer = options.prefer;
-        const authorization = this.authorization();
+        const authorization = await this.authorization();
         if (authorization)
             headers.Authorization = authorization;
         let response;
@@ -195,8 +199,8 @@ export class PostgrestStorageBackend {
                 signal: AbortSignal.timeout(this.timeoutMs),
             });
         }
-        catch (error) {
-            throw new PostgrestBackendError('AIWG_POSTGREST_TRANSPORT_FAILED', error instanceof Error ? error.message : String(error), true);
+        catch {
+            throw new PostgrestBackendError('AIWG_POSTGREST_TRANSPORT_FAILED', 'PostgREST transport failed; check connectivity and authorization.', true);
         }
         if (response.status === 204)
             return undefined;
@@ -204,15 +208,23 @@ export class PostgrestStorageBackend {
         if (declaredLength > this.maxResponseBytes) {
             throw new PostgrestBackendError('AIWG_POSTGREST_RESPONSE_TOO_LARGE', `response exceeds ${this.maxResponseBytes} byte ceiling`);
         }
-        const responseBody = await response.text();
+        let responseBody;
+        try {
+            responseBody = await response.text();
+        }
+        catch {
+            throw new PostgrestBackendError('AIWG_POSTGREST_TRANSPORT_FAILED', 'PostgREST response could not be read.', true);
+        }
         if (Buffer.byteLength(responseBody) > this.maxResponseBytes) {
             throw new PostgrestBackendError('AIWG_POSTGREST_RESPONSE_TOO_LARGE', `response exceeds ${this.maxResponseBytes} byte ceiling`);
         }
         if (!response.ok) {
-            const databaseError = parseDatabaseError(responseBody);
+            const secrets = authorization
+                ? [authorization, authorization.trim(), authorization.trim().replace(/^\S+\s+/, '')].filter(Boolean) : [];
+            const databaseError = parseDatabaseError(responseBody, secrets);
             const retryable = response.status === 408 || response.status === 425 || response.status === 429 ||
                 response.status >= 500 || isRetryableDatabaseCode(databaseError.databaseCode);
-            const exposedCode = databaseError.message?.startsWith('AIWG_')
+            const exposedCode = /^AIWG_[A-Z0-9_]+$/.test(databaseError.message ?? '')
                 ? databaseError.message
                 : retryable ? 'AIWG_POSTGREST_RETRYABLE' : 'AIWG_POSTGREST_REQUEST_FAILED';
             throw new PostgrestBackendError(exposedCode, `PostgREST request failed with HTTP ${response.status}${databaseError.databaseCode ? ` (database ${databaseError.databaseCode})` : ''}`, retryable, parseRetryAfter(response.headers.get('retry-after')));
@@ -224,12 +236,19 @@ export class PostgrestStorageBackend {
             throw new PostgrestBackendError('AIWG_POSTGREST_RESPONSE_INVALID', 'PostgREST returned invalid JSON');
         }
     }
-    authorization() {
+    async authorization() {
         if (!this.options.authorizationEnv)
             return undefined;
-        const value = process.env[this.options.authorizationEnv];
+        const input = credentialReferenceInput(this.options.authorizationEnv, 'PostgREST authorizationEnv');
+        let value;
+        try {
+            value = input.env ? (this.sensitiveInput.environment ?? process.env)[input.env] : await resolveSensitiveInput(input, this.sensitiveInput);
+        }
+        catch (error) {
+            throw new PostgrestBackendError('AIWG_POSTGREST_CREDENTIAL_UNAVAILABLE', error.message);
+        }
         if (!value)
-            throw new PostgrestBackendError('AIWG_POSTGREST_CREDENTIAL_UNAVAILABLE', `authorization locator ${this.options.authorizationEnv} is not set`);
+            throw new PostgrestBackendError('AIWG_POSTGREST_CREDENTIAL_UNAVAILABLE', 'PostgREST authorizationEnv is not set; use ENV_NAME, file:ABSOLUTE_PATH or store:NAME.');
         return value;
     }
     assertMutationIdentity(mutation) {
@@ -294,12 +313,17 @@ function parseCsv(input) {
     }
     return { header, rows: output };
 }
-function parseDatabaseError(body) {
+function parseDatabaseError(body, secrets) {
     try {
         const parsed = JSON.parse(body);
+        // Decode JSON escapes before redaction: encoded echoes must not become codes.
+        const redact = (value) => typeof value === 'string'
+            ? secrets.reduce((text, secret) => text.split(secret).join('[REDACTED]'), value) : undefined;
+        const databaseCode = redact(parsed.code);
+        const message = redact(parsed.message);
         return {
-            ...(typeof parsed.code === 'string' ? { databaseCode: parsed.code } : {}),
-            ...(typeof parsed.message === 'string' ? { message: parsed.message } : {}),
+            ...(databaseCode && /^[A-Z0-9]{5}$/.test(databaseCode) ? { databaseCode } : {}),
+            ...(message ? { message } : {}),
         };
     }
     catch {

package/dist/src/storage/config.js

@@ -14,6 +14,7 @@
  * @issue #953
  */
 import { existsSync } from 'fs';
+import { credentialReferenceInput } from '../mcp/credentials.mjs';
 import { readFile } from 'fs/promises';
 import { resolve, isAbsolute, join } from 'path';
 import { homedir } from 'os';
@@ -171,8 +172,12 @@ function validateBackendConfig(raw, source) {
             requireString(obj, 'vault', source);
             return obj;
         case 'logseq':
-            rejectUnknownKeys(obj, ['type', 'graph', 'apiUrl', 'useApi'], source, 'backend');
+            rejectUnknownKeys(obj, ['type', 'graph', 'apiUrl', 'apiTokenEnv', 'useApi'], source, 'backend');
             requireString(obj, 'graph', source);
+            if (obj['apiTokenEnv'] !== undefined) {
+                requireString(obj, 'apiTokenEnv', source);
+                credentialReferenceInput(obj['apiTokenEnv'], 'Logseq apiTokenEnv');
+            }
             return obj;
         case 'notion': {
             rejectUnknownKeys(obj, ['type', 'parent', 'externalIdProperty'], source, 'backend');

package/dist/src/uhp/config.js

@@ -100,6 +100,10 @@ export function validateUhpConfig(config) {
         if (!profile.credential || profile.credential.source !== 'env' || !/^[A-Z_][A-Z0-9_]*$/.test(profile.credential.name ?? '')) {
             errors.push(`${where}.credential: must be an env secret reference with an uppercase variable name`);
         }
+        if (profile.credential && typeof profile.credential === 'object'
+            && Object.keys(profile.credential).some(key => key !== 'source' && key !== 'name')) {
+            errors.push(`${where}.credential: must contain only source and name; inline credentials are forbidden`);
+        }
         if (profile.defaultHarness !== undefined && !OBJECT_ID.test(profile.defaultHarness))
             errors.push(`${where}.defaultHarness: malformed UHP harness id`);
         if (profile.defaultModel !== undefined && !MODEL_ID.test(profile.defaultModel))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.10.7",
+  "version": "2026.10.9",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",