@cofy-x/dsh-console 0.1.0-alpha.0 → 0.1.0-alpha.1

package/README.md

@@ -1,27 +1,23 @@
 # DSH Console
 
-`dsh-console` is a TypeScript and React/Ink terminal frontend for
-[DeepSeek Harness](https://github.com/deepseek-ai/DeepSeek-Harness).
+`dsh-console` is a TypeScript and React/Ink terminal frontend for [DeepSeek Harness](https://github.com/deepseek-ai/DeepSeek-Harness).
 
-> DSH Console is currently a public alpha. Commands and UI details may change
-> before the first stable release.
+> DSH Console is currently a public alpha. Commands and UI details may change before the first stable release.
 
 ## Install
 
-DSH Console requires Node.js 24 or newer and a working DSH provider
-configuration.
+DSH Console requires Node.js 24 or newer and a working DSH provider configuration.
 
 ```sh
-npm install --global @deepseek-ai/dsh @cofy-x/dsh-console@alpha
+npm install --global @deepseek-ai/dsh @cofy-x/dsh-console
 dsh-console --prompt "hello"
 ```
 
-Alpha releases use the `alpha` npm dist-tag and do not update `latest`.
+Public Alpha releases are intentionally available through npm's default `latest` channel for a simple installation path, while the published version keeps its `-alpha.x` prerelease identifier so the maturity level remains explicit.
 
 ## Use
 
-The launcher initializes or locates the `dsh-console` DSH profile and starts an
-interactive terminal session. Useful commands include:
+The launcher initializes or locates the `dsh-console` DSH profile and starts an interactive terminal session. Useful commands include:
 
 ```text
 /model       Select the active DSH model
@@ -34,8 +30,6 @@ interactive terminal session. Useful commands include:
 /settings    Edit Console settings
 ```
 
-DSH owns provider credentials, model routing, session logs, and attachments.
-DSH Console does not maintain a separate authentication or session database.
+DSH owns provider credentials, model routing, session logs, and attachments. DSH Console does not maintain a separate authentication or session database.
 
-See the [GitHub repository](https://github.com/cofy-x/dsh-console) for source
-development, architecture, alpha boundaries, and license attribution details.
+See the [GitHub repository](https://github.com/cofy-x/dsh-console) for source development, architecture, alpha boundaries, and license attribution details.

package/dist/{chunk-YNJGTXFJ.js → chunk-N3EQS35J.js}

@@ -1585,24 +1585,52 @@ var NEVER_ALLOWED_NAME_PATTERNS = [
 var NEVER_ALLOWED_VALUE_PATTERNS = [
   /-----BEGIN (RSA|OPENSSH|EC|PGP) PRIVATE KEY-----/i,
   /-----BEGIN CERTIFICATE-----/i,
-  // Credentials in URL
-  /(https?|ftp|smtp):\/\/[^:]+:[^@]+@/i,
   // GitHub tokens (classic, fine-grained, OAuth, etc.)
   /(ghp|gho|ghu|ghs|ghr|github_pat)_[a-zA-Z0-9_]{36,}/i,
   // Google API keys
   /AIzaSy[a-zA-Z0-9_\\-]{33}/i,
   // Amazon AWS Access Key ID
   /AKIA[A-Z0-9]{16}/i,
-  // Generic OAuth/JWT tokens
-  /eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*/i,
   // Stripe API keys
   /(s|r)k_(live|test)_[0-9a-zA-Z]{24}/i,
   // Slack tokens (bot, user, etc.)
   /xox[abpr]-[a-zA-Z0-9-]+/i
 ];
+var CREDENTIAL_URL_PROTOCOLS = /* @__PURE__ */ new Set([
+  "http:",
+  "https:",
+  "ftp:",
+  "smtp:"
+]);
+function containsUrlCredentials(value) {
+  try {
+    const url = new URL(value);
+    return CREDENTIAL_URL_PROTOCOLS.has(url.protocol) && (url.username.length > 0 || url.password.length > 0);
+  } catch {
+    return false;
+  }
+}
+function isBase64UrlSegment(value) {
+  if (value.length === 0) {
+    return false;
+  }
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    const isDigit = code >= 48 && code <= 57;
+    const isUppercase = code >= 65 && code <= 90;
+    const isLowercase = code >= 97 && code <= 122;
+    if (!isDigit && !isUppercase && !isLowercase && character !== "_" && character !== "-") {
+      return false;
+    }
+  }
+  return true;
+}
+function looksLikeJwt(value) {
+  const segments = value.split(".");
+  return segments.length === 3 && segments[0].startsWith("eyJ") && segments.every(isBase64UrlSegment);
+}
 function shouldRedactEnvironmentVariable(key, value, allowedSet, blockedSet, isStrictSanitization = false) {
   key = key.toUpperCase();
-  value = value?.toUpperCase();
   if (allowedSet?.has(key)) {
     return false;
   }
@@ -1624,6 +1652,9 @@ function shouldRedactEnvironmentVariable(key, value, allowedSet, blockedSet, isS
     }
   }
   if (value) {
+    if (containsUrlCredentials(value) || looksLikeJwt(value)) {
+      return true;
+    }
     for (const pattern of NEVER_ALLOWED_VALUE_PATTERNS) {
       if (pattern.test(value)) {
         return true;