@groundtrack/hooks 0.1.10 → 0.1.11

package/dist/session-import/discovery.js

@@ -202,10 +202,15 @@ export function discoverSessions(options) {
         const normalizedRemote = metadata.repositoryUrl
             ? normalizeRepositoryUrl(metadata.repositoryUrl)
             : null;
+        const cwdMatchesCurrentRepository = Boolean(options.repository && metadata.cwd && isInside(metadata.cwd, options.repository.root));
+        const currentRepositoryRemote = cwdMatchesCurrentRepository
+            ? soleRemote(options.repository)
+            : null;
+        const remoteMatchesCurrentRepository = Boolean(options.repository && normalizedRemote && options.repository.remotes.has(normalizedRemote));
         const matchesCurrentRepository = options.repository
-            ? normalizedRemote
-                ? options.repository.remotes.has(normalizedRemote)
-                : Boolean(metadata.cwd && isInside(metadata.cwd, options.repository.root))
+            ? remoteMatchesCurrentRepository ||
+                (!normalizedRemote && cwdMatchesCurrentRepository) ||
+                Boolean(currentRepositoryRemote && cwdMatchesCurrentRepository)
             : false;
         if (!options.allRepositories && !matchesCurrentRepository) {
             skipped.push({ path, reason: "other_repository" });
@@ -218,16 +223,15 @@ export function discoverSessions(options) {
             skipped.push({ path, reason: "unscoped" });
             continue;
         }
-        const inferredRemote = normalizedRemote
-            ? null
-            : options.repository && matchesCurrentRepository
-                ? soleRemote(options.repository)
-                : options.allRepositories
-                    ? soleRemote(repositoryIdentityForCwd(metadata.cwd))
-                    : null;
-        included.push(inferredRemote
-            ? { ...candidate, metadata: { ...metadata, repositoryUrl: inferredRemote } }
-            : candidate);
+        const attributedRemote = remoteMatchesCurrentRepository
+            ? normalizedRemote
+            : (currentRepositoryRemote ??
+                normalizedRemote ??
+                (options.allRepositories ? soleRemote(repositoryIdentityForCwd(metadata.cwd)) : null));
+        included.push({
+            ...candidate,
+            metadata: { ...metadata, repositoryUrl: attributedRemote },
+        });
     }
     if (!options.format.materializeCandidates)
         return { included, skipped, failed: [] };

package/dist/session-import/normalize.js

@@ -1,4 +1,5 @@
 import { CANONICAL_IMPORT_MAX_ENTRIES, isSessionRecord, sessionString, } from "./canonical.js";
+import { sanitizeRepositoryUrl } from "./redaction.js";
 export class SessionNormalizationError extends Error {
     code;
     constructor(code, message) {
@@ -65,6 +66,9 @@ export function createSessionNormalizationAccumulator(normalizer, options = {})
             return {
                 metadata: {
                     ...base,
+                    repositoryUrl: options.discoveryMetadata
+                        ? sanitizeRepositoryUrl(options.discoveryMetadata.repositoryUrl)
+                        : base.repositoryUrl,
                     startedAt: earliestTimestampMs === null
                         ? (options.discoveryMetadata?.startedAt?.toISOString() ?? null)
                         : new Date(earliestTimestampMs).toISOString(),

package/dist/session-import/redaction.js

@@ -1,4 +1,4 @@
-const sensitiveKeyPattern = /(?:^|[_-])(?:api[_-]?key|token|authorization|auth|password|passwd|secret|private[_-]?key|cookie|credentials?)(?:$|[_-])/i;
+const sensitiveKeyPattern = /(?:^|[_-])(?:api[_-]?key|access[_-]?key(?:[_-]?id)?|token|authorization|auth|password|passwd|secret|private[_-]?key|cookie|credentials?|database[_-]?url)(?:$|[_-])/i;
 const internalInstructionMarkers = [
     "<local-command-caveat>",
     "<system-reminder>",
@@ -19,9 +19,11 @@ export function redactCredentialText(value) {
     return value
         .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]")
         .replace(/\b(authorization\s*:\s*(?:bearer|basic)\s+)[^\s,;]+/gi, "$1[REDACTED]")
-        .replace(/\b((?:[a-z0-9_-]*(?:api[_-]?key|token|password|passwd|secret|private[_-]?key|credentials?))\s*[=:]\s*)[^\s,;]+/gi, "$1[REDACTED]")
+        .replace(/\b((?:[a-z0-9_-]*(?:api[_-]?key|access[_-]?key(?:[_-]?id)?|token|password|passwd|secret|private[_-]?key|credentials?|database[_-]?url))\s*[=:]\s*)[^\s,;]+/gi, "$1[REDACTED]")
         .replace(/(?:^|\s)((?:--)?(?:api-key|token|password|secret)\s+)[^\s,;]+/gi, "$1$2[REDACTED]")
-        .replace(/\b(?:sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{12,})\b/g, "[REDACTED]");
+        .replace(/\b(?:sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|glpat-[A-Za-z0-9_-]{12,}|npm_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{12,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{20,})\b/g, "[REDACTED]")
+        .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED]")
+        .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/:@]+:[^\s/@]+@/gi, "$1[REDACTED]@");
 }
 export function sanitizeRepositoryUrl(value) {
     if (typeof value !== "string" || value.length === 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundtrack/hooks",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Lifecycle hook utilities for Groundtrack MCP clients.",
   "keywords": [
     "claude-code",