@lazyingart/agintiflow 0.20.138 → 0.20.139

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.138",
+  "version": "0.20.139",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -1038,7 +1038,9 @@ try {
       content: [
         "import os",
         "from openai import OpenAI",
-        'api_key = os.environ.get("DEEPSEEK_API_KEY")',
+        "def load_api_key():",
+        '    return os.environ.get("DEEPSEEK_API_KEY")',
+        "api_key = load_api_key()",
         'client = OpenAI(api_key=api_key, base_url="https://api.deepseek.com")',
         "print(client)",
         "",

package/src/workspace-tools.js

@@ -210,6 +210,8 @@ function secretContentPolicy(content) {
 function stripSafeCredentialReferences(content) {
   let text = String(content ?? "");
   const keyName = String.raw`(?:api[_-]?key|token|secret|password|passwd|npm_token|_authToken|grsai|venice_api_key)`;
+  const codeKeyName = String.raw`(?:api[_-]?key|apiKey|token|secret|password|passwd|npmToken|authToken|grsai|veniceApiKey|venice_api_key)`;
+  const codeExpression = String.raw`[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*|\([^"'\n]*\))?`;
   const envName = String.raw`[A-Z][A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PASSWD|GRSAI|VENICE)[A-Z0-9_]*`;
 
   text = text.replace(
@@ -228,6 +230,10 @@ function stripSafeCredentialReferences(content) {
     new RegExp(String.raw`([,(]\s*)${keyName}\s*=\s*[A-Za-z_$][\w$]*(?=\s*[,)\n])`, "gi"),
     "$1safe_credential_ref=[VAR_REF]"
   );
+  text = text.replace(
+    new RegExp(String.raw`\b${codeKeyName}\s*=\s*${codeExpression}(?=\s*[,;)\n])`, "g"),
+    "safe_credential_ref=[EXPR_REF]"
+  );
   text = text.replace(
     new RegExp(String.raw`([,{]\s*)${keyName}\s*:\s*[A-Za-z_$][\w$]*(?=\s*[,}\n])`, "gi"),
     "$1safe_credential_ref=[VAR_REF]"