@caddis/cli 0.4.58 → 0.4.60

package/bundles/antigravity-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis",
-  "version": "1.3.144",
+  "version": "1.3.146",
   "description": "caddis — agent-agnostic dev harness as an Antigravity (agy) plugin: TDD skills + commands, single-sourced with the Claude Code plugin."
 }

package/bundles/antigravity-plugin/scripts/caddis_roadmap.py

@@ -103,6 +103,9 @@ except ModuleNotFoundError as exc:
 _NO_WINDOW = 0x08000000 if os.name == "nt" else 0
 
 SCRIPTS_DIR = Path(__file__).resolve().parent
+# This module object, taken while it loads. `render` hands it to the page builder. A lookup by name at call time
+# (`sys.modules[__name__]`) can return a different copy when the file was loaded twice in one process.
+_THIS_MODULE = sys.modules[__name__]
 STATUSES = ("todo", "in-progress", "code-done/data-pending", "done", "not-needed")
 FINISHED = ("done", "not-needed")
 OPEN = ("todo", "in-progress")
@@ -148,12 +151,19 @@ OUTPUT_MASKS: list[tuple[re.Pattern, str]] = [
     (re.compile(r"\bgh[pousr]_[A-Za-z0-9]{36,}\b"), "***"),  # secret_filter github-token
     (re.compile(r"\bxox[abprs]-[A-Za-z0-9-]{10,}\b"), "***"),  # secret_filter slack-token
     (re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"), "***"),  # secret_filter jwt
-    # secret_filter assignment, widened: a quoted value may hold spaces (a passphrase of several words).
-    (re.compile(r"(?i)([A-Za-z0-9_]*(?:password|passwd|secret|api[_-]?key|token)[A-Za-z0-9_]*\s*[:=]\s*)"
+    # secret_filter assignment, widened: a quoted value may hold spaces (a passphrase of several words). A match
+    # starts only at the start of a word: a match inside a word always has one from the word start too, and without
+    # the lookbehind each character of a long word started a new scan (quadratic: 50 KB of one word took 64 s).
+    (re.compile(r"(?i)(?<![A-Za-z0-9_])"
+                r"([A-Za-z0-9_]*(?:password|passwd|secret|api[_-]?key|token)[A-Za-z0-9_]*\s*[:=]\s*)"
                 r"(['\"])[^'\"\n]{8,}\2"), r"\1\2***\2"),
     (re.compile(r"(?im)^(\s*(?:export\s+)?[A-Za-z0-9_]*(?:PASSWORD|PASSWD|SECRET|API_KEY|APIKEY|TOKEN|PRIVATE_KEY)"
                 r"[A-Za-z0-9_]*\s*=\s*)[^\s'\"#]{8,}"), r"\1***"),  # secret_filter env-assignment
-    (re.compile(r"\b([A-Za-z][A-Za-z0-9+.-]*://)[^/\s:@]+:[^/\s@]+@"), r"\1***@"),  # URL credentials
+    # URL credentials. The scheme starts at a letter after a word boundary. Every such letter in one run of scheme
+    # characters reaches the same `://`, so only the first one is tried: group 1 skips, possessively, the run's
+    # digits, `+.-` and letters that follow a word character. Without that, `a.a.a.a...` was quadratic.
+    (re.compile(r"(?<![A-Za-z0-9+.-])((?:[0-9+.-]|(?<=\w)[A-Za-z])*+)([A-Za-z][A-Za-z0-9+.-]*://)"
+                r"[^/\s:@]+:[^/\s@]+@"), r"\1\2***@"),
     # Absolute paths, which can name a user or a host. A path may hold spaces, so each one runs to the end of the
     # line or a quote; a Windows drive or UNC path also stops at `<`, `>` or `|` (never part of a Windows path).
     (re.compile(r"(?<![A-Za-z0-9])[A-Za-z]:[\\/][^\r\n'\"<>|]*"), "<path>"),  # a Windows drive path
@@ -2285,7 +2295,7 @@ def _render(root: Path, args: argparse.Namespace) -> int:
     for slug in slugs:  # --all: one bad roadmap must not stop the others
         try:
             path = caddis_roadmap_page.write_page(root, slug, Path(args.out) if args.out else None,
-                                                  sys.modules[__name__])
+                                                  _THIS_MODULE)
             if path is None:  # a newer caddis owns this page: kept, and neither written nor failed
                 continue
             written += 1