@indigoai-us/hq-cli 5.201.4 → 5.202.1

package/dist/utils/redact-url.js

@@ -0,0 +1,218 @@
+/** Marker used when a value claims to be a URL but cannot be parsed safely. */
+export const REDACTED_URL = "[REDACTED]";
+const EXACT_SECRET_PARAMETER_NAMES = new Set([
+    "key",
+    "apikey",
+    "api_key",
+    "x-api-key",
+    "xmcpkey",
+    "token",
+    "access_token",
+    "refresh_token",
+    "secret",
+    "client_secret",
+    "password",
+    "pass",
+    "pwd",
+    "auth",
+    "authorization",
+    "sig",
+    "signature",
+    "session",
+    "code",
+    "credential",
+    "credentials",
+    "authcode",
+    "authorizationcode",
+    "oauthcode",
+    "clientcode",
+    "verificationcode",
+    "confirmationcode",
+    "resetcode",
+    "activationcode",
+    "invitecode",
+    "devicecode",
+    "pairingcode",
+    "onetimecode",
+    "otpcode",
+    "auth_code",
+    "authorization_code",
+    "oauth_code",
+    "client_code",
+    "verification_code",
+    "confirmation_code",
+    "reset_code",
+    "activation_code",
+    "invite_code",
+    "device_code",
+    "pairing_code",
+    "one_time_code",
+    "otp_code",
+]);
+const UNAMBIGUOUS_SECRET_PARAMETER_SUFFIXES = [
+    "key",
+    "token",
+    "secret",
+    "password",
+    "signature",
+    "credential",
+    "credentials",
+];
+const AMBIGUOUS_SECRET_PARAMETER_SUFFIXES = ["pass", "pwd", "sig", "auth", "session"];
+const SECRET_PATH_LABEL = /^(?:access[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|x?mcpkey|client[_-]?secret|token|key|secret|password|pass|pwd|auth|authorization|sig|signature|credential|credentials|session)[=_-].+$/i;
+function hasParameterBoundaryBeforeSuffix(name, suffix) {
+    const suffixStart = name.length - suffix.length;
+    if (suffixStart <= 0)
+        return true;
+    return /[-_.]/.test(name[suffixStart - 1]) || /[A-Z]/.test(name[suffixStart]);
+}
+function isSecretParameterName(name) {
+    const normalized = name.toLowerCase();
+    return (EXACT_SECRET_PARAMETER_NAMES.has(normalized) ||
+        UNAMBIGUOUS_SECRET_PARAMETER_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) ||
+        AMBIGUOUS_SECRET_PARAMETER_SUFFIXES.some((suffix) => normalized.endsWith(suffix) && hasParameterBoundaryBeforeSuffix(name, suffix)));
+}
+function isOpaqueCapabilitySegment(segment) {
+    if (SECRET_PATH_LABEL.test(segment))
+        return true;
+    const length = segment.length;
+    const hasLetter = /[A-Za-z]/.test(segment);
+    const hasDigit = /\d/.test(segment);
+    const isLongHex = length >= 24 && /^[A-Fa-f0-9]+$/.test(segment);
+    const isLongBase64Url = length >= 32 &&
+        /^[A-Za-z0-9_-]+$/.test(segment) &&
+        hasLetter &&
+        (hasDigit || /[A-Z_-]/.test(segment));
+    return (length >= 20 && hasLetter && hasDigit) || isLongHex || isLongBase64Url;
+}
+/** Mask opaque credential-like path segments while keeping ordinary routes. */
+function redactPathSegments(pathname) {
+    const segments = pathname.split("/");
+    const redacted = segments.map((segment) => {
+        let decoded;
+        try {
+            decoded = decodeURIComponent(segment);
+        }
+        catch (error) {
+            if (error instanceof URIError)
+                return null;
+            throw error;
+        }
+        return isOpaqueCapabilitySegment(decoded) ? "REDACTED" : segment;
+    });
+    return redacted.some((segment) => segment === null) ? null : redacted.join("/");
+}
+/**
+ * Redact the values of secret-looking URL parameters while retaining URL
+ * structure and safe query values. An invalid URL or malformed encoded
+ * parameter name is replaced in full because its secret boundaries are
+ * unknowable.
+ */
+export function redactSensitiveUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch (error) {
+        if (error instanceof TypeError)
+            return REDACTED_URL;
+        throw error;
+    }
+    const hasUserinfo = url.username !== "" || url.password !== "";
+    url.username = "";
+    url.password = "";
+    const pathname = redactPathSegments(url.pathname);
+    if (pathname === null)
+        return REDACTED_URL;
+    url.pathname = pathname;
+    const query = redactParameterList(url.search.slice(1));
+    if (query === null)
+        return REDACTED_URL;
+    url.search = query === "" ? "" : `?${query}`;
+    const fragment = redactFragment(url.hash.slice(1));
+    if (fragment === null)
+        return REDACTED_URL;
+    url.hash = fragment === "" ? "" : `#${fragment}`;
+    const serialized = url.toString();
+    if (!hasUserinfo)
+        return serialized;
+    const authorityStart = serialized.indexOf("://");
+    if (authorityStart === -1)
+        return serialized;
+    const hostStart = authorityStart + 3;
+    return `${serialized.slice(0, hostStart)}***@${serialized.slice(hostStart)}`;
+}
+/** Redact secret parameters in an ampersand-separated query or fragment. */
+function redactParameterList(raw) {
+    if (raw === "")
+        return "";
+    const parts = raw.split("&");
+    const redacted = [];
+    for (const part of parts) {
+        const equalsAt = part.indexOf("=");
+        const encodedName = equalsAt === -1 ? part : part.slice(0, equalsAt);
+        let name;
+        try {
+            name = decodeURIComponent(encodedName.replace(/\+/g, " "));
+        }
+        catch (error) {
+            if (error instanceof URIError)
+                return null;
+            throw error;
+        }
+        if (isSecretParameterName(name)) {
+            redacted.push(`${encodedName}=REDACTED`);
+        }
+        else {
+            redacted.push(part);
+        }
+    }
+    return redacted.join("&");
+}
+/** Redact query-like fields in both `#access_token=...` and `#/route?...`. */
+function redactFragment(fragment) {
+    if (fragment === "")
+        return "";
+    const queryStart = fragment.indexOf("?");
+    if (queryStart !== -1) {
+        const query = redactParameterList(fragment.slice(queryStart + 1));
+        return query === null ? null : `${fragment.slice(0, queryStart + 1)}${query}`;
+    }
+    if (fragment.includes("="))
+        return redactParameterList(fragment);
+    return fragment;
+}
+const URL_IN_TEXT = /\b[a-z][a-z\d+.-]*:\/\/[^\s<>"'`]+/gi;
+const TRAILING_SENTENCE_PUNCTUATION = /[),.;!?]+$/;
+/** Redact URLs embedded in an error or human-readable sentence. */
+export function redactUrlsInText(text) {
+    return text.replace(URL_IN_TEXT, (candidate) => {
+        const punctuation = TRAILING_SENTENCE_PUNCTUATION.exec(candidate)?.[0] ?? "";
+        const url = punctuation ? candidate.slice(0, -punctuation.length) : candidate;
+        return `${redactSensitiveUrl(url)}${punctuation}`;
+    });
+}
+const URL_PROPERTY = /(?:^|[-_.])(?:url|uri|endpoint)$/i;
+const CAMEL_URL_PROPERTY = /(?:Url|Uri|Endpoint)$/;
+const ABSOLUTE_URL = /^[a-z][a-z\d+.-]*:\/\//i;
+function isUrlProperty(key) {
+    return URL_PROPERTY.test(key) || CAMEL_URL_PROPERTY.test(key);
+}
+/** Clone a JSON-like value with all URL-valued fields and embedded URLs safe. */
+export function redactSensitiveUrls(value) {
+    if (typeof value === "string")
+        return redactUrlsInText(value);
+    if (Array.isArray(value))
+        return value.map((item) => redactSensitiveUrls(item));
+    if (!value || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+        key,
+        typeof item === "string" && isUrlProperty(key)
+            ? ABSOLUTE_URL.test(item)
+                ? redactSensitiveUrl(item)
+                : redactUrlsInText(item)
+            : redactSensitiveUrls(item),
+    ]));
+}
+//# sourceMappingURL=redact-url.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.201.4",
+  "version": "5.202.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {