@hasna/terminal 3.3.1 → 3.3.2

package/dist/mcp/server.js

@@ -21,9 +21,9 @@ import { shouldBeLazy, toLazy } from "../lazy-executor.js";
 import { getEconomyStats, recordSaving } from "../economy.js";
 import { captureSnapshot } from "../snapshots.js";
 // ── helpers ──────────────────────────────────────────────────────────────────
-function exec(command, cwd, timeout) {
-    // Auto-optimize command before execution
-    const rw = rewriteCommand(command);
+function exec(command, cwd, timeout, allowRewrite = false) {
+    // Only rewrite when explicitly allowed (execute_smart, not raw execute)
+    const rw = allowRewrite ? rewriteCommand(command) : { changed: false, rewritten: command };
     const actualCommand = rw.changed ? rw.rewritten : command;
     return new Promise((resolve) => {
         const start = Date.now();
@@ -135,7 +135,7 @@ export function createServer() {
         cwd: z.string().optional().describe("Working directory"),
         timeout: z.number().optional().describe("Timeout in ms (default: 30000)"),
     }, async ({ command, cwd, timeout }) => {
-        const result = await exec(command, cwd, timeout ?? 30000);
+        const result = await exec(command, cwd, timeout ?? 30000, true); // allow rewrite for smart mode
         const output = (result.stdout + result.stderr).trim();
         const processed = await processOutput(command, output);
         // Progressive disclosure: store full output, return summary + expand key

package/dist/noise-filter.js

@@ -33,15 +33,23 @@ const NOISE_PATTERNS = [
     // Generic download/upload progress
     /^\s*\d+(\.\d+)?\s*[KMG]?B\s*\/\s*\d+(\.\d+)?\s*[KMG]?B\b/,
 ];
-// Sensitive env var patterns — redact values, keep names only if needed
+// Sensitive env var patterns — ONLY match actual env var assignments (export X=val, X=val at line start)
+// NOT code lines like `const API_KEY = process.env.API_KEY` or `this.token = config.token`
 const SENSITIVE_PATTERNS = [
-    /^(.*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH).*?)=(.+)$/i,
-    /^(.*(?:API_KEY|ACCESS_KEY|PRIVATE_KEY|CLIENT_SECRET).*?)=(.+)$/i,
+    // export KEY_NAME="value" or KEY_NAME=value (shell env vars only)
+    /^(export\s+[A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)[A-Z_]*)=(.+)$/,
+    // Plain env assignment at start of line (no leading whitespace = not code)
+    /^([A-Z_]*(?:API_KEY|ACCESS_KEY|PRIVATE_KEY|CLIENT_SECRET|AUTH_TOKEN)[A-Z_]*)=(.+)$/,
 ];
-/** Redact sensitive values in output (env vars, credentials) */
+/** Redact sensitive values in output (env vars only, not code) */
 function redactSensitive(line) {
+    const trimmed = line.trim();
+    // Skip lines that look like code (have leading whitespace, semicolons, const/let/var, etc.)
+    if (/^\s*(const|let|var|this\.|private|public|protected|import|export\s+(default|const|let|function|class)|\/\/|\/\*|\*)/.test(line)) {
+        return line; // Code — never redact
+    }
     for (const pattern of SENSITIVE_PATTERNS) {
-        const match = line.match(pattern);
+        const match = trimmed.match(pattern);
         if (match) {
             return `${match[1]}=[REDACTED]`;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/terminal",
-  "version": "3.3.1",
+  "version": "3.3.2",
   "description": "Smart terminal wrapper for AI agents and humans — structured output, token compression, MCP server, natural language",
   "type": "module",
   "files": [

package/src/mcp/server.ts

@@ -24,9 +24,9 @@ import { captureSnapshot } from "../snapshots.js";
 
 // ── helpers ──────────────────────────────────────────────────────────────────
 
-function exec(command: string, cwd?: string, timeout?: number): Promise<{ exitCode: number; stdout: string; stderr: string; duration: number; rewritten?: string }> {
-  // Auto-optimize command before execution
-  const rw = rewriteCommand(command);
+function exec(command: string, cwd?: string, timeout?: number, allowRewrite: boolean = false): Promise<{ exitCode: number; stdout: string; stderr: string; duration: number; rewritten?: string }> {
+  // Only rewrite when explicitly allowed (execute_smart, not raw execute)
+  const rw = allowRewrite ? rewriteCommand(command) : { changed: false, rewritten: command };
   const actualCommand = rw.changed ? rw.rewritten : command;
   return new Promise((resolve) => {
     const start = Date.now();
@@ -156,7 +156,7 @@ export function createServer(): McpServer {
       timeout: z.number().optional().describe("Timeout in ms (default: 30000)"),
     },
     async ({ command, cwd, timeout }) => {
-      const result = await exec(command, cwd, timeout ?? 30000);
+      const result = await exec(command, cwd, timeout ?? 30000, true); // allow rewrite for smart mode
       const output = (result.stdout + result.stderr).trim();
       const processed = await processOutput(command, output);
 

package/src/noise-filter.ts

@@ -41,16 +41,24 @@ const NOISE_PATTERNS: RegExp[] = [
   /^\s*\d+(\.\d+)?\s*[KMG]?B\s*\/\s*\d+(\.\d+)?\s*[KMG]?B\b/,
 ];
 
-// Sensitive env var patterns — redact values, keep names only if needed
+// Sensitive env var patterns — ONLY match actual env var assignments (export X=val, X=val at line start)
+// NOT code lines like `const API_KEY = process.env.API_KEY` or `this.token = config.token`
 const SENSITIVE_PATTERNS = [
-  /^(.*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH).*?)=(.+)$/i,
-  /^(.*(?:API_KEY|ACCESS_KEY|PRIVATE_KEY|CLIENT_SECRET).*?)=(.+)$/i,
+  // export KEY_NAME="value" or KEY_NAME=value (shell env vars only)
+  /^(export\s+[A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)[A-Z_]*)=(.+)$/,
+  // Plain env assignment at start of line (no leading whitespace = not code)
+  /^([A-Z_]*(?:API_KEY|ACCESS_KEY|PRIVATE_KEY|CLIENT_SECRET|AUTH_TOKEN)[A-Z_]*)=(.+)$/,
 ];
 
-/** Redact sensitive values in output (env vars, credentials) */
+/** Redact sensitive values in output (env vars only, not code) */
 function redactSensitive(line: string): string {
+  const trimmed = line.trim();
+  // Skip lines that look like code (have leading whitespace, semicolons, const/let/var, etc.)
+  if (/^\s*(const|let|var|this\.|private|public|protected|import|export\s+(default|const|let|function|class)|\/\/|\/\*|\*)/.test(line)) {
+    return line; // Code — never redact
+  }
   for (const pattern of SENSITIVE_PATTERNS) {
-    const match = line.match(pattern);
+    const match = trimmed.match(pattern);
     if (match) {
       return `${match[1]}=[REDACTED]`;
     }