@aspruyt/xfg 3.2.0 → 3.3.2

package/dist/command-executor.js

@@ -1,4 +1,5 @@
 import { execSync } from "node:child_process";
+import { sanitizeCredentials } from "./sanitize-utils.js";
 /**
  * Default implementation that uses Node.js child_process.execSync.
  * Note: Commands are escaped using escapeShellArg before being passed here.
@@ -18,9 +19,17 @@ export class ShellCommandExecutor {
             if (execError.stderr && typeof execError.stderr !== "string") {
                 execError.stderr = execError.stderr.toString();
             }
-            // Include stderr in error message for better debugging
+            // Sanitize credentials from stderr before including in error
+            if (execError.stderr) {
+                execError.stderr = sanitizeCredentials(execError.stderr);
+            }
+            // Include sanitized stderr in error message for better debugging
             if (execError.stderr && execError.message) {
-                execError.message = `${execError.message}\n${execError.stderr}`;
+                execError.message =
+                    sanitizeCredentials(execError.message) + "\n" + execError.stderr;
+            }
+            else if (execError.message) {
+                execError.message = sanitizeCredentials(execError.message);
             }
             throw error;
         }

package/dist/index.js

@@ -208,19 +208,15 @@ export async function runSettings(options, processorFactory = defaultRulesetProc
         return;
     }
     console.log(`Found ${reposWithRulesets.length} repositories with rulesets\n`);
+    logger.setTotal(reposWithRulesets.length);
     const processor = processorFactory();
     const repoProcessor = repoProcessorFactory();
     const results = [];
     let successCount = 0;
     let failCount = 0;
     let skipCount = 0;
-    for (let i = 0; i < config.repos.length; i++) {
-        const repoConfig = config.repos[i];
-        // Skip repos without rulesets
-        if (!repoConfig.settings?.rulesets ||
-            Object.keys(repoConfig.settings.rulesets).length === 0) {
-            continue;
-        }
+    for (let i = 0; i < reposWithRulesets.length; i++) {
+        const repoConfig = reposWithRulesets[i];
         let repoInfo;
         try {
             repoInfo = parseGitUrl(repoConfig.git, {

package/dist/retry-utils.js

@@ -1,5 +1,6 @@
 import pRetry, { AbortError } from "p-retry";
 import { logger } from "./logger.js";
+import { sanitizeCredentials } from "./sanitize-utils.js";
 /**
  * Default patterns indicating permanent errors that should NOT be retried.
  * These typically indicate configuration issues, auth failures, or invalid resources.
@@ -121,7 +122,7 @@ export async function withRetry(fn, options) {
         onFailedAttempt: (context) => {
             // Only log if this isn't the last attempt
             if (context.retriesLeft > 0) {
-                const msg = context.error.message || "Unknown error";
+                const msg = sanitizeCredentials(context.error.message) || "Unknown error";
                 logger.info(`Attempt ${context.attemptNumber}/${retries + 1} failed: ${msg}. Retrying...`);
                 options?.onRetry?.(context.error, context.attemptNumber);
             }

package/dist/sanitize-utils.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Sanitizes credentials from error messages and logs.
+ * Replaces sensitive tokens/passwords with '***' to prevent leakage.
+ *
+ * @param message The message that may contain credentials
+ * @returns The sanitized message with credentials replaced by '***'
+ */
+export declare function sanitizeCredentials(message: string | undefined | null): string;

package/dist/sanitize-utils.js

@@ -0,0 +1,20 @@
+/**
+ * Sanitizes credentials from error messages and logs.
+ * Replaces sensitive tokens/passwords with '***' to prevent leakage.
+ *
+ * @param message The message that may contain credentials
+ * @returns The sanitized message with credentials replaced by '***'
+ */
+export function sanitizeCredentials(message) {
+    if (!message) {
+        return "";
+    }
+    let result = message;
+    // Handle URL credentials (most common case)
+    // Replace password portion in https://user:password@host patterns
+    result = result.replace(/(https:\/\/[^:]+:)([^@]+)(@)/g, "$1***$3");
+    // Handle Authorization headers
+    result = result.replace(/(Authorization:\s*Bearer\s+)(\S+)/gi, "$1***");
+    result = result.replace(/(Authorization:\s*Basic\s+)(\S+)/gi, "$1***");
+    return result;
+}

package/dist/strategies/azure-pr-strategy.js

@@ -5,6 +5,7 @@ import { isAzureDevOpsRepo } from "../repo-detector.js";
 import { BasePRStrategy, } from "./pr-strategy.js";
 import { logger } from "../logger.js";
 import { withRetry, isPermanentError } from "../retry-utils.js";
+import { sanitizeCredentials } from "../sanitize-utils.js";
 export class AzurePRStrategy extends BasePRStrategy {
     constructor(executor) {
         super(executor);
@@ -35,7 +36,7 @@ export class AzurePRStrategy extends BasePRStrategy {
                 }
                 const stderr = error.stderr ?? "";
                 if (stderr && !stderr.includes("does not exist")) {
-                    logger.info(`Debug: Azure PR check failed - ${stderr.trim()}`);
+                    logger.info(`Debug: Azure PR check failed - ${sanitizeCredentials(stderr).trim()}`);
                 }
             }
             return null;

package/dist/strategies/github-pr-strategy.js

@@ -5,6 +5,7 @@ import { isGitHubRepo } from "../repo-detector.js";
 import { BasePRStrategy, } from "./pr-strategy.js";
 import { logger } from "../logger.js";
 import { withRetry, isPermanentError } from "../retry-utils.js";
+import { sanitizeCredentials } from "../sanitize-utils.js";
 /**
  * Get the repo flag value for gh CLI commands.
  * Returns HOST/OWNER/REPO for GHE, OWNER/REPO for github.com.
@@ -66,7 +67,7 @@ export class GitHubPRStrategy extends BasePRStrategy {
                 // Log unexpected errors for debugging (expected: empty result means no PR)
                 const stderr = error.stderr ?? "";
                 if (stderr && !stderr.includes("no pull requests match")) {
-                    logger.info(`Debug: GitHub PR check failed - ${stderr.trim()}`);
+                    logger.info(`Debug: GitHub PR check failed - ${sanitizeCredentials(stderr).trim()}`);
                 }
             }
             return null;

package/dist/strategies/gitlab-pr-strategy.js

@@ -5,6 +5,7 @@ import { isGitLabRepo } from "../repo-detector.js";
 import { BasePRStrategy, } from "./pr-strategy.js";
 import { logger } from "../logger.js";
 import { withRetry, isPermanentError } from "../retry-utils.js";
+import { sanitizeCredentials } from "../sanitize-utils.js";
 export class GitLabPRStrategy extends BasePRStrategy {
     constructor(executor) {
         super(executor);
@@ -89,7 +90,7 @@ export class GitLabPRStrategy extends BasePRStrategy {
                 // Log unexpected errors for debugging
                 const stderr = error.stderr ?? "";
                 if (stderr && !stderr.includes("no merge requests")) {
-                    logger.info(`Debug: GitLab MR check failed - ${stderr.trim()}`);
+                    logger.info(`Debug: GitLab MR check failed - ${sanitizeCredentials(stderr).trim()}`);
                 }
             }
             return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aspruyt/xfg",
-  "version": "3.2.0",
+  "version": "3.3.2",
   "description": "CLI tool for repository-as-code",
   "type": "module",
   "main": "dist/index.js",