@farmslot/recipe-runner 0.39.0 → 0.39.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +4 -0
- package/cdp-broker/cdp-broker.cjs +12 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -6,6 +6,10 @@ All notable changes to `@farmslot/recipe-runner` (published as `@farmslot/recipe
|
|
|
6
6
|
|
|
7
7
|
- Active-development baseline; add user-facing changes here before release or package publication.
|
|
8
8
|
|
|
9
|
+
## 0.39.1 - 2026-10-17
|
|
10
|
+
|
|
11
|
+
- Network capture summaries redact credential-like path segments: 20 or more base64url characters mixing letters and digits, such as an API or write key in the path (`/v1/projects/<key>/settings`, `/v3/<project id>`). Before, only 0x addresses, 64+ hex, JWTs and segments over 64 characters were redacted, so a client write key reached `network/run-summary.json`. Long resource ids such as UUIDs and hashes in a path are now redacted as well.
|
|
12
|
+
|
|
9
13
|
## 0.39.0 - 2026-10-17
|
|
10
14
|
|
|
11
15
|
- Run a gateway-authorised repair through `RecipeRunRequest.repairScope`: retain the original packages, write the engine claim-source selection and project each claim from its selected execution; retained captures stay bound to the revision they were recorded at, across repeated repairs.
|
|
@@ -63,11 +63,22 @@ function safePrimitive(value) {
|
|
|
63
63
|
return value;
|
|
64
64
|
}
|
|
65
65
|
|
|
66
|
+
// A path segment that reads as an opaque token: 20+ base64url characters that
|
|
67
|
+
// mix letters and digits, such as an API or write key carried in the path
|
|
68
|
+
// (`/v1/projects/<key>/settings`, `/v3/<project id>`). Long ids such as UUIDs
|
|
69
|
+
// and hashes match too, which only costs diagnostics. Segments shorter than 20
|
|
70
|
+
// characters, without a digit, or with a dot (asset names) are kept.
|
|
71
|
+
function opaquePathToken(segment) {
|
|
72
|
+
return /^[A-Za-z0-9_-]{20,}$/u.test(segment) && /[A-Za-z]/u.test(segment) && /\d/u.test(segment);
|
|
73
|
+
}
|
|
74
|
+
|
|
66
75
|
function sanitizePathname(pathname) {
|
|
67
76
|
const segments = String(pathname)
|
|
68
77
|
.split('/')
|
|
69
78
|
.map((segment) =>
|
|
70
|
-
segment.length > 64 || SENSITIVE_VALUE.test(segment)
|
|
79
|
+
segment.length > 64 || SENSITIVE_VALUE.test(segment) || opaquePathToken(segment)
|
|
80
|
+
? '<redacted>'
|
|
81
|
+
: segment,
|
|
71
82
|
);
|
|
72
83
|
return segments.join('/').slice(0, 1024);
|
|
73
84
|
}
|