@coffeerunhobby/mcp-ha-connect 2.4.3 → 2.4.5

package/dist/utils/redact.js

@@ -8,7 +8,8 @@
  * response is passed through `redactSecrets` (see toToolResult).
  *
  * Only non-empty string values under secret-looking names are replaced, with
- * "<redacted>": an empty value stays empty (so "is a password set?" is still
+ * "<redacted>" (so are a SIM PIN/PUK and, inside dial-up and VPN sections, account
+ * user names): an empty value stays empty (so "is a password set?" is still
  * answerable), and booleans or numbers under similar names (`hidePwd`,
  * `encryptionPsk`) are left alone. `token=` / `access_token=` query values inside
  * URLs are masked as well. The input is never modified.
@@ -21,16 +22,32 @@ export const REDACTED = '<redacted>';
  * Secret-looking field names, matched on the whole name or its ending
  * (case-insensitive), from the Omada Open API and Home Assistant responses.
  */
-const SECRET_NAME = /(^key$|password|passwd|pwd$|secret|token$|passphrase|presharedkey|privatekey|securitykey|communitystring|^psk$|md5key|simplekey|authcode|devicekey)/i;
+const SECRET_NAME = /(^key$|password|passwd|pwd$|secret|token$|passphrase|presharedkey|privatekey|securitykey|communitystring|^psk$|md5key|simplekey|authcode|devicekey|^(sim)?pin(code)?$|^puk\d?(code)?$)/i;
+/**
+ * Account names that identify a subscription (the ISP PPPoE login, the LTE APN
+ * user, VPN users). Redacted only inside dial-up and VPN sections, so ordinary
+ * names (Home Assistant users, device names) stay readable.
+ */
+const ACCOUNT_NAME = /^(user_?name|username|account)$/i;
+const ACCOUNT_SECTION = /(pppoe|l2tp|pptp|lte|manuallyconfig|apn|dialup|vpn)/i;
 /** Credentials inside URLs, e.g. /api/camera_proxy/camera.door?token=abc123 */
 const URL_SECRET = /([?&](?:access_token|token|key|password|secret)=)[^&#\s"]+/gi;
 export function isSecretName(name) {
     return SECRET_NAME.test(name);
 }
-export function redactSecrets(value) {
-    return redact(value, new WeakSet());
+/** Whether a name (an object key, or a resource path such as "/vpn/client-to-site/clients") is a dial-up or VPN section. */
+export function isAccountSection(name) {
+    return ACCOUNT_SECTION.test(name);
+}
+/**
+ * `accountSection`: the value as a whole comes from a dial-up or VPN section (e.g. an
+ * unwrapped list of VPN users), so account names are redacted from the top level on.
+ */
+export function redactSecrets(value, options = {}) {
+    return redact(value, new WeakSet(), options.accountSection === true);
 }
-function redact(value, seen) {
+/** `inAccountSection`: an enclosing key names a dial-up or VPN section. */
+function redact(value, seen, inAccountSection) {
     if (typeof value === 'string') {
         return value.includes('=') ? value.replace(URL_SECRET, `$1${REDACTED}`) : value;
     }
@@ -42,11 +59,12 @@ function redact(value, seen) {
     }
     seen.add(value);
     if (Array.isArray(value)) {
-        return value.map((item) => redact(item, seen));
+        return value.map((item) => redact(item, seen, inAccountSection));
     }
     const out = {};
     for (const [key, field] of Object.entries(value)) {
-        out[key] = typeof field === 'string' && field !== '' && isSecretName(key) ? REDACTED : redact(field, seen);
+        const secret = isSecretName(key) || (inAccountSection && ACCOUNT_NAME.test(key));
+        out[key] = typeof field === 'string' && field !== '' && secret ? REDACTED : redact(field, seen, inAccountSection || ACCOUNT_SECTION.test(key));
     }
     return out;
 }

package/dist/utils/redact.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/utils/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;GAGG;AACH,MAAM,WAAW,GACf,sJAAsJ,CAAC;AAEzJ,+EAA+E;AAC/E,MAAM,UAAU,GAAG,8DAA8D,CAAC;AAElF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,aAAa,CAAI,KAAQ;IACvC,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,OAAO,EAAE,CAAM,CAAC;AAC3C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAqB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/utils/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;GAGG;AACH,MAAM,WAAW,GACf,yLAAyL,CAAC;AAE5L;;;;GAIG;AACH,MAAM,YAAY,GAAG,kCAAkC,CAAC;AACxD,MAAM,eAAe,GAAG,sDAAsD,CAAC;AAE/E,+EAA+E;AAC/E,MAAM,UAAU,GAAG,8DAA8D,CAAC;AAElF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,4HAA4H;AAC5H,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAI,KAAQ,EAAE,UAAwC,EAAE;IACnF,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI,CAAM,CAAC;AAC5E,CAAC;AAED,2EAA2E;AAC3E,SAAS,MAAM,CAAC,KAAc,EAAE,IAAqB,EAAE,gBAAyB;IAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/version.d.ts

@@ -2,4 +2,4 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export declare const VERSION = "2.4.3";
+export declare const VERSION = "2.4.5";

package/dist/version.js

@@ -2,5 +2,5 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export const VERSION = '2.4.3';
+export const VERSION = '2.4.5';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffeerunhobby/mcp-ha-connect",
-  "version": "2.4.3",
+  "version": "2.4.5",
   "description": "Smart home MCP server for Home Assistant plus Local AI integration",
   "type": "module",
   "main": "dist/index.js",