@lanonasis/recall-forge 1.1.1 → 1.1.2

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to `@lanonasis/recall-forge` will be documented in this file.
 
+## [Unreleased]
+
+---
+
+## 1.1.2 — 2026-09-23
+
+### Fixed
+
+- **Repository URL corrected.** `repository.url` no longer points at the private monorepo (`thefixer3x/lan-onasis-monorepo.git`); it is now `git+https://github.com/lanonasis/lanonasis-maas.git` with `directory: packages/recall-forge`, so npm and GitHub Packages link to the public source.
+- **Secret redactor realigned with 1.1.1.** The source copy of `extraction/secret-redactor.ts` had been hidden by a `.gitignore` `*key*` rule, and the restored file dropped rules that shipped in 1.1.1. It now keeps the newer provider rules (GitHub, Stripe, Google, Notion, ElevenLabs, Telegram, `sb_` tokens, PEM private keys, 64+ hex secrets) and restores the 1.1.1 ones: lowercase / `key: value` assignments for `api_key`, `password`, `secret_key`/`private_key` and `aws_secret_access_key`, plus PII (email, credit card, SSN, phone).
+- `redactSecrets(text, { redactPII })` and `containsSecrets(text, { redactPII })` accept options again (PII on by default, as in 1.1.1), and the JSONL, Markdown and SQLite extractors now honour `ExtractionOptions.redactPII`.
+- OpenAI key detection matches 20+ character keys again (was 32+).
+- `containsSecrets()` no longer depends on global-regex `lastIndex` state, so repeated calls give the same answer.
+- The 1.1.1 catch-all `supabase-key` rule (any 40+ character token) is not restored: it redacted git SHAs and ids. Supabase JWTs and `sb_` keys are covered by `jwt-token` and `supabase-token`.
+
 ---
 
 ## 1.1.1 — 2026-04-04

package/dist/extraction/index.d.ts

@@ -2,6 +2,7 @@ export { extractJsonl, formatStats } from "./jsonl-extractor.js";
 export { extractMarkdown, isMarkdownFile } from "./markdown-extractor.js";
 export { extractSqlite, isSqliteFile } from "./sqlite-extractor.js";
 export { redactSecrets, containsSecrets } from "./secret-redactor.js";
+export type { RedactOptions } from "./secret-redactor.js";
 export { detectFormat, FORMAT_ADAPTERS } from "./format-adapters.js";
 export { registerExtractCli } from "./cli-extract.js";
 export type { ExtractionOptions, ExtractionStats, ExtractionRecord, RedactionResult, FormatAdapter, } from "./types.js";

package/dist/extraction/jsonl-extractor.js

@@ -88,7 +88,7 @@ export async function extractJsonl(options, deps) {
             if (roles.length > 0 && !roles.includes(record.role))
                 continue;
             // Step 1: Redact secrets FIRST — before any other processing
-            const redaction = redactSecrets(record.text);
+            const redaction = redactSecrets(record.text, { redactPII: options.redactPII });
             stats.secretsRedacted += redaction.secretsFound;
             const cleanText = redaction.text;
             // Step 2: Capture filter

package/dist/extraction/markdown-extractor.js

@@ -142,7 +142,7 @@ export async function extractMarkdown(options, deps) {
         if (roles.length > 0 && !roles.includes(record.role))
             continue;
         // Step 1: Redact secrets
-        const redaction = redactSecrets(record.text);
+        const redaction = redactSecrets(record.text, { redactPII: options.redactPII });
         stats.secretsRedacted += redaction.secretsFound;
         const cleanText = redaction.text;
         // Step 2: Capture filter

package/dist/extraction/secret-redactor.d.ts

@@ -1,7 +1,7 @@
 import type { RedactionResult } from "./types.js";
-export declare function redactSecrets(text: string, options?: {
+export interface RedactOptions {
+    /** Also redact PII (email, credit card, SSN, phone). Default: true. */
     redactPII?: boolean;
-}): RedactionResult;
-export declare function containsSecrets(text: string, options?: {
-    redactPII?: boolean;
-}): boolean;
+}
+export declare function redactSecrets(input: string, options?: RedactOptions): RedactionResult;
+export declare function containsSecrets(input: string, options?: RedactOptions): boolean;

package/dist/extraction/secret-redactor.js

@@ -1,112 +1,151 @@
-// Secret redaction for JSONL extraction
-// Detects and redacts API keys, tokens, credentials, and PII
 const SECRET_PATTERNS = [
     {
-        name: "lanonasis-api-key",
-        pattern: /\blano_[A-Za-z0-9_-]{20,}\b/g,
+        type: "anthropic-api-key",
+        pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g,
     },
     {
-        name: "openai-api-key",
-        pattern: /\bsk-[A-Za-z0-9]{20,}\b/g,
+        type: "openai-api-key",
+        pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g,
     },
     {
-        name: "anthropic-api-key",
-        pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g,
+        type: "github-token",
+        pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/g,
     },
     {
-        name: "generic-api-key",
-        pattern: /\b(api[_-]?key|apikey)\s*[:=]\s*["']?[A-Za-z0-9_-]{16,}["']?/gi,
+        type: "github-token",
+        pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
     },
     {
-        name: "bearer-token",
-        pattern: /\bBearer\s+[A-Za-z0-9._~+\/=-]{20,}\b/gi,
+        type: "supabase-token",
+        pattern: /\bsb[ap]_[A-Za-z0-9_-]{20,}\b/g,
     },
     {
-        name: "jwt-token",
-        pattern: /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
+        type: "stripe-key",
+        pattern: /\b(?:sk|pk)_(?:live|test)_[A-Za-z0-9]{20,}\b/g,
     },
     {
-        name: "aws-access-key",
-        pattern: /\bAKIA[A-Z0-9]{16}\b/g,
+        type: "stripe-webhook-secret",
+        pattern: /\bwhsec_[A-Za-z0-9]{20,}\b/g,
     },
     {
-        name: "aws-secret-key",
-        pattern: /\baws[_-]?secret[_-]?access[_-]?key\s*[:=]\s*["']?[A-Za-z0-9/+=]{40}["']?/gi,
+        type: "aws-access-key",
+        pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
+    },
+    {
+        type: "google-api-key",
+        pattern: /\bAIza[0-9A-Za-z_-]{30,}\b/g,
     },
     {
-        name: "database-url",
-        pattern: /\b(postgres|postgresql|mongodb|mysql|redis):\/\/[^"'\s)]+/gi,
+        type: "notion-token",
+        pattern: /\b(?:ntn|secret)_[A-Za-z0-9]{20,}\b/g,
     },
     {
-        name: "supabase-key",
-        pattern: /\b(eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|[A-Za-z0-9_-]{40,})\b/g,
+        type: "lanonasis-api-key",
+        pattern: /\b(?:lano|lns)_[A-Za-z0-9_-]{20,}\b/g,
     },
     {
-        name: "secret-key",
-        pattern: /\b(secret[_-]?key|private[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9_-]{16,}["']?/gi,
+        type: "jwt-token",
+        pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
     },
     {
-        name: "password",
-        pattern: /\b(password|passwd|pwd)\s*[:=]\s*["']?[^\s"']{8,}["']?/gi,
+        type: "bearer-token",
+        pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}\b/g,
+    },
+    {
+        type: "database-url",
+        pattern: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/[^\s"'<>]+/gi,
+    },
+    {
+        type: "private-key",
+        pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    },
+    {
+        type: "hex-secret",
+        pattern: /\b[a-f0-9]{64,}\b/gi,
+    },
+    {
+        type: "elevenlabs-api-key",
+        pattern: /\bel_[A-Za-z0-9_-]{20,}\b/g,
+    },
+    {
+        type: "telegram-bot-token",
+        pattern: /\b\d{8,10}:[A-Za-z0-9_-]{30,}\b/g,
     },
 ];
-const PII_PATTERNS = [
+// Lowercase / `key: value` credential assignments that ASSIGNMENT_PATTERN
+// (UPPER_CASE env style only) misses. Carried over from the 1.1.1 redactor.
+const KEYED_SECRET_PATTERNS = [
     {
-        name: "email",
-        pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
+        type: "aws-secret-key",
+        pattern: /\baws[_-]?secret[_-]?access[_-]?key\s*[:=]\s*["']?[A-Za-z0-9/+=]{40}["']?/gi,
     },
     {
-        name: "phone",
-        pattern: /\+?[\d\s()-]{10,}\b/g,
+        type: "generic-api-key",
+        pattern: /\b(?:api[_-]?key|apikey)\s*[:=]\s*["']?[A-Za-z0-9_-]{16,}["']?/gi,
+    },
+    {
+        type: "secret-key",
+        pattern: /\b(?:secret[_-]?key|private[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9_-]{16,}["']?/gi,
+    },
+    {
+        type: "password",
+        pattern: /\b(?:password|passwd|pwd)\s*[:=]\s*["']?[^\s"']{8,}["']?/gi,
+    },
+];
+// PII, on by default (1.1.1 behaviour). Callers that run their own PII stage
+// can pass { redactPII: false }.
+const PII_PATTERNS = [
+    {
+        type: "email",
+        pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
     },
     {
-        name: "credit-card",
+        type: "credit-card",
         pattern: /\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g,
     },
     {
-        name: "ssn",
+        type: "ssn",
         pattern: /\b\d{3}[\s-]?\d{2}[\s-]?\d{4}\b/g,
     },
+    {
+        type: "phone",
+        pattern: /\+?[\d\s()-]{10,}\b/g,
+    },
 ];
-export function redactSecrets(text, options = {}) {
-    let result = text;
-    const secretsFound = [];
+const ASSIGNMENT_PATTERN = /\b((?:export\s+)?[A-Z][A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY|ACCESS[_-]?TOKEN|REFRESH[_-]?TOKEN)[A-Z0-9_]*\s*=\s*)(["']?)([^\s"'`]+)(\2)/gi;
+export function redactSecrets(input, options = {}) {
     const { redactPII = true } = options;
-    for (const { name, pattern } of SECRET_PATTERNS) {
-        const matches = result.match(pattern);
-        if (matches && matches.length > 0) {
-            secretsFound.push(name);
-            result = result.replace(pattern, `[REDACTED:${name}]`);
-        }
+    let text = input;
+    const types = [];
+    let secretsFound = 0;
+    const mark = (type) => {
+        secretsFound++;
+        if (!types.includes(type))
+            types.push(type);
+        return `[REDACTED:${type}]`;
+    };
+    for (const { type, pattern } of SECRET_PATTERNS) {
+        text = text.replace(pattern, () => mark(type));
+    }
+    text = text.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote, value, closingQuote) => {
+        if (value.startsWith("[REDACTED:"))
+            return `${prefix}${quote}${value}${closingQuote}`;
+        return `${prefix}${quote}${mark("env-secret")}${closingQuote}`;
+    });
+    for (const { type, pattern } of KEYED_SECRET_PATTERNS) {
+        text = text.replace(pattern, (match) => (match.includes("[REDACTED:") ? match : mark(type)));
     }
     if (redactPII) {
-        for (const { name, pattern } of PII_PATTERNS) {
-            const matches = result.match(pattern);
-            if (matches && matches.length > 0) {
-                secretsFound.push(name);
-                result = result.replace(pattern, `[REDACTED:${name}]`);
-            }
+        for (const { type, pattern } of PII_PATTERNS) {
+            text = text.replace(pattern, () => mark(type));
         }
     }
     return {
-        text: result,
-        secretsFound: secretsFound.length,
-        types: secretsFound,
+        text,
+        secretsFound,
+        types,
     };
 }
-export function containsSecrets(text, options = {}) {
-    const { redactPII = true } = options;
-    for (const { pattern } of SECRET_PATTERNS) {
-        if (pattern.test(text)) {
-            return true;
-        }
-    }
-    if (redactPII) {
-        for (const { pattern } of PII_PATTERNS) {
-            if (pattern.test(text)) {
-                return true;
-            }
-        }
-    }
-    return false;
+export function containsSecrets(input, options = {}) {
+    return redactSecrets(input, options).secretsFound > 0;
 }

package/dist/extraction/sqlite-extractor.js

@@ -149,7 +149,7 @@ export async function extractSqlite(options, deps) {
             continue;
         }
         // Step 1: Redact secrets
-        const redaction = redactSecrets(chunk.text);
+        const redaction = redactSecrets(chunk.text, { redactPII: options.redactPII });
         stats.secretsRedacted += redaction.secretsFound;
         const cleanText = redaction.text;
         // Step 2: Capture filter

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/recall-forge",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "RecallForge — secret-safe memory and context engine plugin for OpenClaw. Fills both memory and contextEngine slots with tiered semantic recall, 30+ pattern credential redaction, and prompt injection protection.",
   "type": "module",
   "license": "MIT",
@@ -52,7 +52,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/thefixer3x/lan-onasis-monorepo.git",
+    "url": "git+https://github.com/lanonasis/lanonasis-maas.git",
     "directory": "packages/recall-forge"
   },
   "homepage": "https://github.com/lanonasis/lanonasis-maas/tree/main/packages/recall-forge#readme",