@algolia/wizard 0.79.0 → 0.80.0

package/dist/main.js

@@ -2306,7 +2306,7 @@ async function ensureApplication(resumeAppId) {
 // package.json
 var package_default = {
   name: "@algolia/wizard",
-  version: "0.79.0",
+  version: "0.80.0",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {
@@ -3858,6 +3858,14 @@ function reviewScriptTool(ctx) {
   });
 }
 
+// src/lib/tools/utils/redactSecrets.ts
+function redactSecrets(output, secrets) {
+  return [...new Set(Object.values(secrets).filter(Boolean))].sort((a, b) => b.length - a.length).reduce(
+    (redacted, secret) => redacted.split(secret).join("[REDACTED]"),
+    output
+  );
+}
+
 // src/lib/tools/utils/runShell.ts
 import { spawn as spawn2 } from "node:child_process";
 
@@ -3879,9 +3887,14 @@ var DEFAULT_SHELL_TIMEOUT_MS = 10 * 60 * 1e3;
 async function refuseByDefault() {
   return "reject";
 }
+async function emptyShellEnv() {
+  await Promise.resolve();
+  return {};
+}
 function createShellContext(overrides = {}) {
   return {
-    env: async () => ({}),
+    env: emptyShellEnv,
+    secretEnv: emptyShellEnv,
     timeoutMs: DEFAULT_SHELL_TIMEOUT_MS,
     executions: [],
     approve: refuseByDefault,
@@ -3924,7 +3937,9 @@ function runShell(command, opts) {
       clearTimeout(killTimer);
       resolve6({
         exitCode,
-        output: truncateText(output.trim()),
+        output: truncateText(
+          redactSecrets(output.trim(), opts.secrets ?? {})
+        ),
         timedOut,
         durationMs: Date.now() - startedAt
       });
@@ -4250,13 +4265,22 @@ async function resolveShellEnv(ctx, command) {
     return {};
   });
 }
-async function runAndRecord(ctx, command, cwd, resolvedEnv) {
+async function resolveSecretShellEnv(ctx, command) {
+  return ctx.shell.secretEnv().catch((err) => {
+    logger.warn(
+      { err, command },
+      "runShell: could not resolve secret command env"
+    );
+    return {};
+  });
+}
+async function runAndRecord(ctx, command, environment) {
   useWizard.getState().pushNotice({ messages: [`Running: ${command}`] });
-  const env = resolvedEnv ?? await resolveShellEnv(ctx, command);
   const run2 = await (ctx.shell.run ?? runShell)(command, {
-    cwd,
-    env,
-    timeoutMs: ctx.shell.timeoutMs
+    cwd: environment.cwd,
+    env: environment.values,
+    timeoutMs: ctx.shell.timeoutMs,
+    secrets: environment.secrets
   });
   logger.info(
     {
@@ -4268,29 +4292,40 @@ async function runAndRecord(ctx, command, cwd, resolvedEnv) {
     "runShell finished"
   );
   await markInteraction();
+  const output = redactSecrets(run2.output, environment.secrets);
   ctx.shell.executions.push({
     command,
-    cwd,
+    cwd: environment.cwd,
     approved: true,
     exitCode: run2.exitCode,
-    output: run2.output,
+    output,
     timedOut: run2.timedOut,
     durationMs: run2.durationMs
   });
   return {
     exitCode: run2.exitCode,
     timedOut: run2.timedOut,
-    output: run2.output
+    output
   };
 }
 async function runReviewedCommand(ctx, command, cwd) {
   const approval = getReviewedCommandApproval(ctx, command, cwd);
   if (!approval) return void 0;
-  const env = await resolveShellEnv(ctx, command);
   if (!await reviewedCommandApprovalIsCurrent(approval)) {
     return `Refused: ${relative5(ctx.root, approval.filePath)} changed after review. Call reviewScript again before running it.`;
   }
-  const result = await runAndRecord(ctx, command, cwd, env);
+  const [env, secrets] = await Promise.all([
+    resolveShellEnv(ctx, command),
+    resolveSecretShellEnv(ctx, command)
+  ]);
+  if (!await reviewedCommandApprovalIsCurrent(approval)) {
+    return `Refused: ${relative5(ctx.root, approval.filePath)} changed after review. Call reviewScript again before running it.`;
+  }
+  const result = await runAndRecord(
+    ctx,
+    command,
+    { cwd, values: { ...env, ...secrets }, secrets }
+  );
   if (result.exitCode === SUCCESS_EXIT_CODE && !result.timedOut) {
     clearReviewedCommandApproval(ctx);
   }
@@ -4303,7 +4338,14 @@ async function approveAndRun(ctx, command, cwd, explanation) {
     logger.info({ command }, "runShell: user rejected the command");
     return "The user rejected this command. Do not retry it. Propose a different command, or report the limitation via reportStatus.";
   }
-  return runAndRecord(ctx, command, cwd);
+  return runUnreviewedCommand(ctx, command, cwd);
+}
+async function runUnreviewedCommand(ctx, command, cwd) {
+  const [env, secrets] = await Promise.all([
+    resolveShellEnv(ctx, command),
+    resolveSecretShellEnv(ctx, command)
+  ]);
+  return runAndRecord(ctx, command, { cwd, values: env, secrets });
 }
 function runShellTool(ctx, createModel = defaultCreateModel) {
   return tool9({
@@ -4362,7 +4404,7 @@ function runShellTool(ctx, createModel = defaultCreateModel) {
         if (lateReview !== void 0) return lateReview;
         const storedApprovalIsCurrent = !usedStoredApproval || useWizard.getState().isCommandApproved(command, resolved2.target);
         if (isSafe && storedApprovalIsCurrent) {
-          return runAndRecord(ctx, command, resolved2.target);
+          return runUnreviewedCommand(ctx, command, resolved2.target);
         }
         return approveAndRun(ctx, command, resolved2.target, explanation);
       });
@@ -5867,12 +5909,12 @@ function ingestFailure(attempt, executions) {
   }
   return { reason: `it failed (exit ${attempt.exitCode ?? "unknown"})`, detail };
 }
-function makeToolContext(root, appId, env = async () => ({})) {
+function makeToolContext(root, appId, env = async () => ({}), secretEnv = async () => ({})) {
   return {
     ...createToolContext(
       DEFAULT_TOOL_LIMITS,
       root,
-      createShellContext({ env, approve: storeApproval(root) })
+      createShellContext({ env, secretEnv, approve: storeApproval(root) })
     ),
     appId
   };
@@ -6096,11 +6138,17 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES) {
   let ingestDurationMs;
   let ingestOutcomeMessage;
   const ingestKeyAppId = ingestAppId;
-  const ingestionTools = ingestKeyAppId && ingestWriteKey ? makeToolContext(repoRoot, ctx.appId, async () => ({
-    [APP_ID_VAR]: ingestKeyAppId,
-    [API_KEY_VAR]: ingestWriteKey,
-    [INDEX_NAME_VAR]: targetIndex
-  })) : makeToolContext(repoRoot, ctx.appId);
+  const ingestionTools = ingestKeyAppId && ingestWriteKey ? makeToolContext(
+    repoRoot,
+    ctx.appId,
+    async () => ({
+      [APP_ID_VAR]: ingestKeyAppId,
+      [INDEX_NAME_VAR]: targetIndex
+    }),
+    async () => ({
+      [API_KEY_VAR]: ingestWriteKey
+    })
+  ) : makeToolContext(repoRoot, ctx.appId);
   async function runImplementationUseCase(currentUseCase, extraInstructions = [], isRetry = false) {
     if (agentRuns > 0) ctx.recordStepExecution();
     agentRuns += 1;
@@ -8515,7 +8563,7 @@ async function resetProjectState() {
 // package.json with { type: 'json' }
 var package_default2 = {
   name: "@algolia/wizard",
-  version: "0.79.0",
+  version: "0.80.0",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algolia/wizard",
-  "version": "0.79.0",
+  "version": "0.80.0",
   "description": "Magically implement Algolia functionality in your codebase",
   "type": "module",
   "engines": {