@golden-frijoles/kit 0.5.0 → 0.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/lib/config.mjs +5 -2
- package/package.json +1 -1
package/dist/lib/config.mjs
CHANGED
|
@@ -236,8 +236,11 @@ const ENV_NAME = /^[A-Z][A-Z0-9_]*$/;
|
|
|
236
236
|
* Pure — does this key/value pair look like a credential rather than the NAME of an env var? A token prefix only
|
|
237
237
|
* counts on a value long enough to be a token (`sk-shop` or `npm_utils` is a name, not a key).
|
|
238
238
|
*/
|
|
239
|
-
export function looksLikeSecret(key,
|
|
240
|
-
if (typeof
|
|
239
|
+
export function looksLikeSecret(key, raw) {
|
|
240
|
+
if (typeof raw !== 'string') return false;
|
|
241
|
+
// Trimmed: the patterns are anchored, so ' sk-…' or a pasted token with a trailing newline slipped past them
|
|
242
|
+
// (security lens on golden-beans #164). Whitespace is never what makes a value safe.
|
|
243
|
+
const value = raw.trim();
|
|
241
244
|
if (TOKEN_PREFIXES.test(value) && value.length >= 20) return true;
|
|
242
245
|
if (TELEGRAM_BOT_TOKEN.test(value) || SLACK_WEBHOOK.test(value) || URL_WITH_PASSWORD.test(value)) return true;
|
|
243
246
|
const leaf = key.split('.').pop();
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@golden-frijoles/kit",
|
|
3
|
-
"version": "0.5.
|
|
3
|
+
"version": "0.5.1",
|
|
4
4
|
"description": "The scripts the Golden Frijoles skills run, packaged so they work in any repo: planning, build-order, reporting and verification rails. Zero dependencies.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|