@i4ctime/q-ring 0.16.0 → 0.16.2

package/dist/{chunk-5LFKBZ3Q.js → chunk-SQKTDYSO.js}

@@ -335,7 +335,8 @@ function isProcessAlive(pid) {
   }
 }
 function withFileLock(name, fn, opts = {}) {
-  const lockDir = join3(homedir(), ".config", "q-ring", opts.dir ?? "locks");
+  const baseDir = process.env.QRING_LOCK_DIR ?? (process.env.QRING_AUDIT_DIR ? join3(process.env.QRING_AUDIT_DIR, ".locks") : join3(homedir(), ".config", "q-ring"));
+  const lockDir = join3(baseDir, opts.dir ?? "locks");
   mkdirSync(lockDir, { recursive: true, mode: 448 });
   const safe = Buffer.from(name, "utf8").toString("base64url");
   const lockPath = join3(lockDir, `${safe}.lock`);
@@ -577,6 +578,13 @@ function setAuditAgentLabel(label) {
 function getAuditAgentLabel() {
   return auditAgentLabel;
 }
+function sanitizeAuditText(value, max) {
+  const cleaned = Array.from(value).filter((ch) => {
+    const cp = ch.codePointAt(0) ?? 0;
+    return cp >= 32 && cp !== 127;
+  }).join("");
+  return cleaned.length > max ? `${cleaned.slice(0, max)}\u2026` : cleaned;
+}
 function getAuditDir() {
   if (process.env.QRING_AUDIT_DIR) {
     if (!existsSync2(process.env.QRING_AUDIT_DIR)) {
@@ -631,6 +639,10 @@ function logAudit(event) {
         if (full.agent === void 0 && auditAgentLabel) {
           full.agent = auditAgentLabel;
         }
+        if (full.key !== void 0) full.key = sanitizeAuditText(full.key, 256);
+        if (full.detail !== void 0) full.detail = sanitizeAuditText(full.detail, 600);
+        if (full.scope !== void 0) full.scope = sanitizeAuditText(full.scope, 128);
+        if (full.env !== void 0) full.env = sanitizeAuditText(full.env, 128);
         const line = JSON.stringify(full);
         const path = getAuditPath();
         appendFileSync(path, line + "\n", { mode: 384 });
@@ -643,7 +655,12 @@ function logAudit(event) {
       },
       { timeoutMs: 5e3 }
     );
-  } catch {
+  } catch (err) {
+    if (process.env.QRING_DEBUG) {
+      console.error(
+        `q-ring: audit event dropped (${event.action}${event.key ? ` ${event.key}` : ""}): ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
   }
 }
 var MAX_AUDIT_BYTES = 12 * 1024 * 1024;
@@ -762,13 +779,33 @@ function exportAudit(opts = {}) {
     const until = new Date(opts.until).getTime();
     events = events.filter((e) => new Date(e.timestamp).getTime() <= until);
   }
+  if (opts.excludeActions?.length) {
+    const excluded = new Set(opts.excludeActions);
+    events = events.filter((e) => !excluded.has(e.action));
+  }
   if (opts.format === "json") {
     return JSON.stringify(events, null, 2);
   }
   if (opts.format === "csv") {
+    const csvField = (v) => {
+      let s = v === void 0 ? "" : String(v);
+      if (/^[=+\-@\t\r]/.test(s)) s = `'${s}`;
+      return `"${s.replace(/"/g, '""')}"`;
+    };
     const header = "timestamp,action,key,scope,env,source,agent,pid,correlationId,detail";
     const rows = events.map(
-      (e) => `${e.timestamp},${e.action},${e.key ?? ""},${e.scope ?? ""},${e.env ?? ""},${e.source},${(e.agent ?? "").replace(/,/g, ";")},${e.pid},${e.correlationId ?? ""},${(e.detail ?? "").replace(/,/g, ";")}`
+      (e) => [
+        csvField(e.timestamp),
+        csvField(e.action),
+        csvField(e.key),
+        csvField(e.scope),
+        csvField(e.env),
+        csvField(e.source),
+        csvField(e.agent),
+        csvField(e.pid),
+        csvField(e.correlationId),
+        csvField(e.detail)
+      ].join(",")
     );
     return [header, ...rows].join("\n");
   }
@@ -1762,7 +1799,8 @@ function notifyUser(title, body) {
     let args;
     if (process.platform === "linux") {
       command = "notify-send";
-      args = ["--app-name=q-ring", "--urgency=critical", title, body];
+      const pango = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+      args = ["--app-name=q-ring", "--urgency=critical", pango(title), pango(body)];
     } else if (process.platform === "darwin") {
       command = "osascript";
       const clean = (s) => s.replace(/["\\]/g, "");
@@ -1802,7 +1840,7 @@ function recordCanaryTrip(trip) {
     scope: trip.scope,
     env: trip.env,
     source: trip.source,
-    detail: `CANARY TRIPPED: honeytoken read via ${trip.source}`
+    detail: `CANARY TRIPPED: ${trip.detail ?? `honeytoken read via ${trip.source}`}`
   });
   if (!notificationsEnabled()) return;
   const now = Date.now();
@@ -2245,8 +2283,12 @@ function deleteSecret(key, opts = {}) {
   for (const { service, scope } of scopes) {
     const entry = new Entry(service, key);
     try {
+      const existing = readEnvelope(service, key);
       if (entry.deleteCredential()) {
         deleted = true;
+        if (existing?.meta.canary) {
+          recordCanaryTrip({ key, scope, source, detail: "canary deleted" });
+        }
         logAudit({ action: "delete", key, scope, source });
         fireHooks({
           action: "delete",
@@ -2262,6 +2304,27 @@ function deleteSecret(key, opts = {}) {
   }
   return deleted;
 }
+function disarmCanary(key, opts = {}) {
+  const scopes = resolveScope(opts);
+  for (const { service, scope } of scopes) {
+    const envelope = readEnvelope(service, key);
+    if (!envelope) continue;
+    if (!envelope.meta.canary) return false;
+    delete envelope.meta.canary;
+    delete envelope.meta.canaryFormat;
+    envelope.meta.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    writeEnvelope(service, key, envelope);
+    logAudit({
+      action: "write",
+      key,
+      scope,
+      source: opts.source ?? "cli",
+      detail: "canary disarmed"
+    });
+    return true;
+  }
+  return false;
+}
 function hasSecret(key, opts = {}) {
   const source = opts.source ?? "cli";
   if (source === "mcp") {
@@ -2365,6 +2428,9 @@ function exportSecrets(opts = {}) {
       const value = collapseValue(entry.envelope, env);
       if (value !== null) {
         rawValues.set(entry.key, value);
+        if (entry.envelope.meta.canary) {
+          recordCanaryTrip({ key: entry.key, scope: entry.scope, env, source });
+        }
       }
     }
   }
@@ -2377,7 +2443,13 @@ function exportSecrets(opts = {}) {
       console.warn(`Warning: skipped exporting ${key} due to template error: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
-  logAudit({ action: "export", source, detail: `format=${format}` });
+  const exportedKeys = [...merged.keys()];
+  const keyList = exportedKeys.length > 20 ? `${exportedKeys.slice(0, 20).join(",")} +${exportedKeys.length - 20} more` : exportedKeys.join(",");
+  logAudit({
+    action: "export",
+    source,
+    detail: `format=${format} keys=${keyList}`
+  });
   if (format === "json") {
     const obj = {};
     for (const [key, value] of merged) {
@@ -2701,6 +2773,7 @@ export {
   getEnvelope,
   setSecret,
   deleteSecret,
+  disarmCanary,
   hasSecret,
   listSecrets,
   exportSecrets,
@@ -2716,4 +2789,4 @@ export {
   forget,
   clearMemory
 };
-//# sourceMappingURL=chunk-5LFKBZ3Q.js.map
+//# sourceMappingURL=chunk-SQKTDYSO.js.map