@groundtrack/hooks 0.1.23 → 0.1.24

package/dist/session-import/canonical.d.ts

@@ -1,7 +1,13 @@
-export declare const CANONICALIZATION_VERSION = 1;
+export declare const CANONICALIZATION_VERSION = 2;
 export declare const CANONICAL_IMPORT_MAX_BYTES: number;
 export declare const CANONICAL_IMPORT_MAX_RECORD_BYTES: number;
 export declare const CANONICAL_IMPORT_MAX_ENTRIES = 25000;
+/**
+ * Versions the server accepts. Version 2 fixed flag-style credential redaction
+ * (`--api-key value` no longer becomes `--api-key $2[REDACTED]`). Version 1 is
+ * retained so already-installed CLIs keep importing during rollout.
+ */
+export type CanonicalSessionVersion = 1 | 2;
 export type SessionRecord = Record<string, unknown>;
 export type CanonicalSessionEntry = Readonly<{
     kind: "user_message" | "assistant_message" | "tool_call" | "tool_result";
@@ -10,7 +16,7 @@ export type CanonicalSessionEntry = Readonly<{
 }>;
 export type CanonicalSessionMetadata = Readonly<{
     type: "session";
-    version: 1;
+    version: CanonicalSessionVersion;
     externalSessionId: string;
     repositoryUrl: string | null;
     repositoryBranch: string | null;

package/dist/session-import/canonical.js

@@ -1,4 +1,4 @@
-export const CANONICALIZATION_VERSION = 1;
+export const CANONICALIZATION_VERSION = 2;
 export const CANONICAL_IMPORT_MAX_BYTES = 50 * 1024 * 1024;
 export const CANONICAL_IMPORT_MAX_RECORD_BYTES = 4 * 1024 * 1024;
 export const CANONICAL_IMPORT_MAX_ENTRIES = 25_000;

package/dist/session-import/claude.js

@@ -1,4 +1,4 @@
-import { isSessionRecord, sessionString, } from "./canonical.js";
+import { CANONICALIZATION_VERSION, isSessionRecord, sessionString, } from "./canonical.js";
 import { sessionImportFormatIdentity, } from "./format.js";
 import { containsInternalInstructionText, redactCredentialText, sanitizeSessionValue, sanitizeWorkingDirectory, } from "./redaction.js";
 const knownSkippedRecordTypes = new Set([
@@ -129,7 +129,7 @@ function normalizeMessage(record, entryBudget = Number.POSITIVE_INFINITY) {
                 payload: {
                     callId: sessionString(block.tool_use_id),
                     output: result.output,
-                    ...(typeof block.is_error === "boolean" ? { isError: block.is_error } : {}),
+                    ...(block.is_error === true ? { isError: true } : {}),
                 },
             });
         }
@@ -210,7 +210,7 @@ export function createClaudeSessionNormalizer() {
                 return null;
             return {
                 type: "session",
-                version: 1,
+                version: CANONICALIZATION_VERSION,
                 externalSessionId: metadata.externalSessionId,
                 repositoryUrl: null,
                 repositoryBranch: metadata.repositoryBranch

package/dist/session-import/codex.js

@@ -1,5 +1,5 @@
 import { containsInternalInstructionText, redactCredentialText, sanitizeRepositoryUrl, sanitizeSessionValue, sanitizeWorkingDirectory, } from "./redaction.js";
-import { isSessionRecord, sessionString, } from "./canonical.js";
+import { CANONICALIZATION_VERSION, isSessionRecord, sessionString, } from "./canonical.js";
 import { sessionImportFormatIdentity, } from "./format.js";
 function messageText(content) {
     if (!Array.isArray(content))
@@ -116,7 +116,7 @@ export function codexSessionMetadata(record) {
     const originator = sessionString(payload.originator);
     return {
         type: "session",
-        version: 1,
+        version: CANONICALIZATION_VERSION,
         externalSessionId,
         repositoryUrl: sanitizeRepositoryUrl(git.repository_url),
         repositoryBranch: sessionString(git.branch),

package/dist/session-import/cursor.js

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { isSessionRecord, sessionString, } from "./canonical.js";
+import { CANONICALIZATION_VERSION, isSessionRecord, sessionString, } from "./canonical.js";
 import { sessionImportFormatIdentity, } from "./format.js";
 import { containsInternalInstructionText, sanitizeSessionValue, sanitizeWorkingDirectory, } from "./redaction.js";
 function timestamp(value) {
@@ -245,7 +245,7 @@ export function createCursorSessionNormalizer(metadata) {
         canonicalMetadata: () => metadata
             ? {
                 type: "session",
-                version: 1,
+                version: CANONICALIZATION_VERSION,
                 externalSessionId: metadata.externalSessionId,
                 repositoryUrl: metadata.repositoryUrl,
                 repositoryBranch: metadata.repositoryBranch,

package/dist/session-import/opencode.js

@@ -1,4 +1,4 @@
-import { isSessionRecord, sessionString, } from "./canonical.js";
+import { CANONICALIZATION_VERSION, isSessionRecord, sessionString, } from "./canonical.js";
 import { containsInternalInstructionText, redactCredentialText, sanitizeSessionValue, sanitizeWorkingDirectory, } from "./redaction.js";
 function unixMillisecondsDate(value) {
     if (!Number.isSafeInteger(value) || value < 0)
@@ -216,7 +216,7 @@ export function createOpenCodeSessionNormalizer(metadata) {
         canonicalMetadata: () => metadata
             ? {
                 type: "session",
-                version: 1,
+                version: CANONICALIZATION_VERSION,
                 externalSessionId: metadata.externalSessionId,
                 repositoryUrl: metadata.repositoryUrl,
                 repositoryBranch: metadata.repositoryBranch,

package/dist/session-import/redaction.js

@@ -21,7 +21,7 @@ export function redactCredentialText(value) {
         .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]")
         .replace(/\b(authorization\s*:\s*(?:bearer|basic)\s+)[^\s,;]+/gi, "$1[REDACTED]")
         .replace(/\b((?:[a-z0-9_-]*(?:api[_-]?key|access[_-]?key(?:[_-]?id)?|token|password|passwd|secret|private[_-]?key|credentials?|database[_-]?url))\s*[=:]\s*)[^\s,;]+/gi, "$1[REDACTED]")
-        .replace(/(?:^|\s)((?:--)?(?:api-key|token|password|secret)\s+)[^\s,;]+/gi, "$1$2[REDACTED]")
+        .replace(/(^|\s)((?:--)?(?:api-key|token|password|secret)\s+)[^\s,;]+/gi, "$1$2[REDACTED]")
         .replace(/\b(?:gti_[A-Za-z]{32,}|sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|glpat-[A-Za-z0-9_-]{12,}|npm_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{12,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{20,})\b/g, "[REDACTED]")
         .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED]")
         .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/:@]+:[^\s/@]+@/gi, "$1[REDACTED]@");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundtrack/hooks",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "Lifecycle hook utilities for Groundtrack MCP clients.",
   "keywords": [
     "claude-code",