@great-arrow/cli 0.1.51 → 0.1.53

package/dist/index.js

@@ -9327,6 +9327,7 @@ function mapErrorToExitCode(error) {
   return 2 /* NETWORK_ERROR */;
 }
 var FAILURE_HINTS = {
+  permission: "Review this connection's scopes and workspace permissions at /account/connections.",
   auth: "Run `gad login`, then reconnect the client: /mcp \u2192 great-arrow \u2192 reconnect.",
   network: "Check this machine's connectivity (VPN, proxy, DNS), then try again.",
   timeout: "The request timed out. Check connectivity and retry; if it persists, see https://www.greatarrow.ai/status.",
@@ -9337,9 +9338,11 @@ var FAILURE_HINTS = {
 function classifyRequestFailure(error) {
   const message = error instanceof Error ? error.message : String(error ?? "unknown error");
   let kind = "unknown";
-  if (error instanceof CliError && error.code === 1 /* AUTH_ERROR */) {
+  if (/\b403\b/.test(message)) {
+    kind = "permission";
+  } else if (error instanceof CliError && error.code === 1 /* AUTH_ERROR */) {
     kind = "auth";
-  } else if (/\b(401|403)\b/.test(message)) {
+  } else if (/\b401\b/.test(message)) {
     kind = "auth";
   } else if (/HTTP 5\d\d|Server error/i.test(message)) {
     kind = "server";
@@ -9399,7 +9402,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.51";
+var CLI_VERSION = "0.1.53";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -10675,6 +10678,42 @@ function parseMcpPayload(result) {
   }
 }
 
+// ../../src/lib/observability/scrub-pii.ts
+var EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+var SSN_RE = /\b\d{3}[-.\s]?\d{2}[-.\s]?\d{4}\b/g;
+var CREDIT_CARD_RE = /\b\d(?:[ -]?\d){12,18}\b/g;
+var PHONE_RE = /(?:\+?\b1[-.\s]?)?(?:\([2-9]\d{2}\)\s?|\b[2-9]\d{2}[-.\s]?)\d{3}[-.\s]?\d{4}\b/g;
+function luhnValid(candidate) {
+  const digits2 = candidate.replace(/\D/g, "");
+  if (digits2.length < 13 || digits2.length > 19) return false;
+  let sum = 0;
+  let double = false;
+  for (let i = digits2.length - 1; i >= 0; i--) {
+    let n = digits2.charCodeAt(i) - 48;
+    if (double) {
+      n *= 2;
+      if (n > 9) n -= 9;
+    }
+    sum += n;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+var SECRET_TOKEN_RE = /\b(?:gad_[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9-]{20,}|Bearer\s+[A-Za-z0-9._~+/=-]{8,})\b/gi;
+var SENSITIVE_QUERY_VALUE_RE = /((?:^|[?&])(?:code|token|access_token|refresh_token|id_token|api_key|apikey|api_secret|apisecret|key|secret|client_secret|password|state)=)[^&#\s]+/gi;
+function scrubPiiFromText(s) {
+  return s.replace(EMAIL_RE, "[redacted-email]").replace(
+    CREDIT_CARD_RE,
+    (m) => luhnValid(m) ? "[redacted-credit-card]" : m
+  ).replace(SSN_RE, "[redacted-ssn]").replace(PHONE_RE, "[redacted-phone]");
+}
+function scrubTelemetryText(s) {
+  return scrubPiiFromText(s).replace(SENSITIVE_QUERY_VALUE_RE, "$1[redacted]").replace(
+    SECRET_TOKEN_RE,
+    (match) => match.toLowerCase().startsWith("bearer ") ? "Bearer [redacted]" : "[redacted-secret]"
+  );
+}
+
 // src/lib/telemetry.ts
 var MAX_EVENTS_PER_PROCESS = 20;
 var MAX_STRING = 240;
@@ -10682,12 +10721,14 @@ var sent = 0;
 function enabled() {
   if (process.env.GAD_TELEMETRY === "0" || process.env.GAD_TELEMETRY === "false")
     return false;
-  return process.env.GAD_TELEMETRY === "1" || process.env.GAD_TELEMETRY === "true";
+  if (process.env.GAD_TELEMETRY === "1" || process.env.GAD_TELEMETRY === "true")
+    return true;
+  return void 0;
 }
 function redact(value, depth = 0) {
   if (depth > 3) return "[redacted]";
   if (typeof value === "string") {
-    const scrubbed = value.replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(
+    const scrubbed = scrubTelemetryText(value).replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(
       /(token|secret|password|authorization)[=:]\s*[^\s,]+/gi,
       "$1=[redacted]"
     );
@@ -10706,7 +10747,9 @@ function redact(value, depth = 0) {
 }
 async function captureCliEvent(input) {
   if (sent >= MAX_EVENTS_PER_PROCESS) return;
-  if (!enabled()) {
+  const envConsent = enabled();
+  if (envConsent === false) return;
+  if (envConsent === void 0) {
     try {
       const config = await loadConfig();
       if (config.telemetry_enabled !== true) return;
@@ -10714,28 +10757,33 @@ async function captureCliEvent(input) {
       return;
     }
   }
+  if (sent >= MAX_EVENTS_PER_PROCESS) return;
   sent++;
   const error = input.error instanceof Error ? { name: input.error.name, message: input.error.message } : input.error;
   const payload = {
     platform: "cli",
     event: input.name,
     level: input.error ? "error" : "info",
-    message: error && typeof error === "object" && "message" in error ? String(error.message) : input.name,
+    message: error && typeof error === "object" && "message" in error ? redact(String(error.message)) : redact(input.name),
     version: process.env.GAD_CLI_VERSION,
     code: input.context?.code,
     context: redact(input.context ?? {}),
     timestamp: (/* @__PURE__ */ new Date()).toISOString()
   };
   try {
-    await fetch(`${input.apiUrl.replace(/\/$/, "")}/api/telemetry`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...input.token ? { authorization: `Bearer ${input.token}` } : {}
-      },
-      body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(1500)
-    });
+    const response = await fetch(
+      `${input.apiUrl.replace(/\/$/, "")}/api/telemetry`,
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(redact(payload)),
+        signal: AbortSignal.timeout(1500)
+      }
+    );
+    if (!response.ok)
+      debugSwallow("telemetry.send", new Error(`HTTP ${response.status}`));
   } catch (err) {
     debugSwallow("telemetry.send", err);
   }
@@ -10921,7 +10969,14 @@ var GadClient = class {
     }
     const status = response.status;
     const body = await response.text().catch(() => "");
-    if (status === 401 || status === 403) {
+    if (status === 403) {
+      throw new CliError(
+        "Permission denied (HTTP 403).",
+        1 /* AUTH_ERROR */,
+        "Check this connection's scopes and workspace permissions at /account/connections."
+      );
+    }
+    if (status === 401) {
       throw authError(
         `Authentication failed (HTTP ${status}).`,
         "Run 'gad login' to re-authenticate, or check your GAD_TOKEN."
@@ -14210,7 +14265,8 @@ function codexTransportFields(body) {
 
 // src/lib/mcp-doctor.ts
 var MCP_FAILURE_MESSAGE = {
-  auth: "MCP rejected this machine's credential (401/403)",
+  auth: "MCP rejected this machine's credential (401)",
+  permission: "MCP denied this connection's scopes or workspace access (403)",
   network: "Could not reach the MCP endpoint",
   timeout: "The MCP endpoint did not answer in time",
   server: "The MCP endpoint returned a server error",
@@ -14219,6 +14275,7 @@ var MCP_FAILURE_MESSAGE = {
 };
 var MCP_STATUS_WORD = {
   auth: "unauthenticated",
+  permission: "forbidden",
   network: "unreachable",
   timeout: "timeout",
   server: "server error",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.51",
+  "version": "0.1.53",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {