@m8t-stack/cli 0.2.147 → 0.2.149

package/dist/cli.js

@@ -1464,7 +1464,7 @@ function installFoundryDnsShim() {
 }
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.147";
+var CLI_VERSION = "0.2.149";
 
 // src/lib/render-error.ts
 init_errors();
@@ -29045,8 +29045,102 @@ var KEYED_VALUE = `("[^"\\n]{8,}"|'[^'\\n]{8,}'|(?=[A-Za-z0-9+/=_.~%-]{0,64}[0-9
 var KEYED_STRONG_SECRET_RE = new RegExp(`(?<![A-Za-z0-9])(shared[_-]?access[_-]?key|account[_-]?key|access[_-]?key|storage[_-]?key|api[_-]?key|apikey|x[_-]?api[_-]?key|client[_-]?secret|sas[_-]?token|access[_-]?token|refresh[_-]?token|auth[_-]?token|id[_-]?token|bot[_-]?token|private[_-]?key|password|passwd|pwd)(["']?\\s*[:=]\\s*)("[^"\\n]{8,}"|'[^'\\n]{8,}'|[A-Za-z0-9+/=_.~%-]{8,})`, "gi");
 var KEYED_WEAK_SECRET_RE = new RegExp(`(?<![A-Za-z0-9])(authorization|secret|token|sig)(["']?\\s*[:=]\\s*)` + KEYED_VALUE, "gi");
 var TELEGRAM_BOT_TOKEN_RE = /(?<!\d)\d{8,10}:AA[A-Za-z0-9_-]{32,34}(?![A-Za-z0-9_-])/g;
-var SPOKEN_SECRET_RE = /\b((?:password|passcode|passphrase|api[ _-]?key|access code|pin(?: code)?)\s+is[ \t:]+)(?=\S{0,32}[0-9])\S{4,64}/gi;
-var SPOKEN_PASSWORD_RE = /\b((?:password|passcode|passphrase)\s+is[ \t:]+)(?!\[)(?!(?:wrong|incorrect|invalid|expired|required|missing|reset|unchanged|correct|secure|weak|strong|blank|empty|not|now|still|too|the|already|also|only|just|being|getting)\b)("[^"\n]{4,64}"|'[^'\n]{4,64}'|\S{4,64})/gi;
+var SPOKEN_SECRET_RE = /\b((?:password|passcode|passphrase|api[ _-]?key|access code|pin(?: code)?)\s+is[ \t:]+)(?!\[)("[^"\n]{4,64}"|'[^'\n]{4,64}'|\S{4,64})/gi;
+var SENTENCE_TAIL_RE = /[.,;:]+$/;
+var PROSE_TRIM_RE = /^[*_~`"']+|[*_~`"'.,;:!?]+$/g;
+var PASSWORD_STATE_WORDS = /* @__PURE__ */ new Set([
+  "wrong",
+  "incorrect",
+  "invalid",
+  "expired",
+  "expiring",
+  "required",
+  "missing",
+  "reset",
+  "unchanged",
+  "correct",
+  "secure",
+  "insecure",
+  "weak",
+  "strong",
+  "blank",
+  "empty",
+  "gone",
+  "lost",
+  "forgotten",
+  "compromised",
+  "leaked",
+  "breached",
+  "outdated",
+  "stale",
+  "old",
+  "new",
+  "different",
+  "same",
+  "shared",
+  "saved",
+  "stored",
+  "cached",
+  "rotated",
+  "rotating",
+  "updated",
+  "changed",
+  "changing",
+  "disabled",
+  "enabled",
+  "locked",
+  "unlocked",
+  "temporary",
+  "permanent",
+  "unrecoverable",
+  "case-sensitive",
+  "sensitive",
+  "hashed",
+  "encrypted",
+  "written",
+  "personal",
+  "everywhere",
+  "fine",
+  "ok",
+  "okay",
+  "good",
+  "bad",
+  "ready",
+  "set",
+  "unset",
+  "pending",
+  "working",
+  "broken",
+  "failing",
+  "failed",
+  "accepted",
+  "rejected",
+  "not",
+  "now",
+  "still",
+  "also",
+  "only",
+  "just",
+  "being",
+  "getting",
+  "always",
+  "never",
+  "already",
+  "again",
+  "here",
+  "there",
+  "this",
+  "that"
+]);
+function readsAsPasswordState(value) {
+  if (/^["']/.test(value))
+    return false;
+  return PASSWORD_STATE_WORDS.has(value.replace(PROSE_TRIM_RE, "").toLowerCase());
+}
+function maskSpokenValue(lead, value) {
+  const tail = SENTENCE_TAIL_RE.exec(value)?.[0] ?? "";
+  return `${lead}${SECRET_PLACEHOLDER}${tail}`;
+}
 var B64ISH_RE = /(?<![A-Za-z0-9+=_-])(?=[A-Za-z0-9+=_-]{0,64}[A-Z])(?=[A-Za-z0-9+=_-]{0,64}[a-z])(?=[A-Za-z0-9+=_-]{0,64}[0-9])[A-Za-z0-9+=_-]{40,}(?![A-Za-z0-9+=_-])/g;
 var EMAIL_RE = new RegExp("[\\p{L}\\p{N}._%+-]+@[\\p{L}\\p{N}](?:[\\p{L}\\p{N}.-]*[\\p{L}\\p{N}])?\\.\\p{L}{2,}(?![\\p{L}\\p{N}-])", "gu");
 var PHONE_INTL_RE = /(?<![\d/.-])\+\d{1,3}(?:[ .-]?\(\d{1,4}\))?(?:[ .-]?\d){6,12}(?!\d)/g;
@@ -29065,7 +29159,7 @@ function failClosedOnCutConstructs(text) {
   return text;
 }
 function maskSecrets(text) {
-  const masked = text.replace(PEM_BLOCK_RE, SECRET_PLACEHOLDER).replace(JWT_RE, SECRET_PLACEHOLDER).replace(HTTP_CREDENTIAL_RE, (_, scheme) => `${scheme} ${SECRET_PLACEHOLDER}`).replace(KNOWN_PREFIX_RE, SECRET_PLACEHOLDER).replace(TELEGRAM_BOT_TOKEN_RE, SECRET_PLACEHOLDER).replace(KEYED_STRONG_SECRET_RE, (_, key2, sep4) => `${key2}${sep4}${SECRET_PLACEHOLDER}`).replace(KEYED_WEAK_SECRET_RE, (_, key2, sep4) => `${key2}${sep4}${SECRET_PLACEHOLDER}`).replace(SPOKEN_SECRET_RE, (_, lead) => `${lead}${SECRET_PLACEHOLDER}`).replace(SPOKEN_PASSWORD_RE, (_, lead) => `${lead}${SECRET_PLACEHOLDER}`).replace(B64ISH_RE, SECRET_PLACEHOLDER);
+  const masked = text.replace(PEM_BLOCK_RE, SECRET_PLACEHOLDER).replace(JWT_RE, SECRET_PLACEHOLDER).replace(HTTP_CREDENTIAL_RE, (_, scheme) => `${scheme} ${SECRET_PLACEHOLDER}`).replace(KNOWN_PREFIX_RE, SECRET_PLACEHOLDER).replace(TELEGRAM_BOT_TOKEN_RE, SECRET_PLACEHOLDER).replace(KEYED_STRONG_SECRET_RE, (_, key2, sep4) => `${key2}${sep4}${SECRET_PLACEHOLDER}`).replace(KEYED_WEAK_SECRET_RE, (_, key2, sep4) => `${key2}${sep4}${SECRET_PLACEHOLDER}`).replace(SPOKEN_SECRET_RE, (whole, lead, value) => readsAsPasswordState(value) ? whole : maskSpokenValue(lead, value)).replace(B64ISH_RE, SECRET_PLACEHOLDER);
   return failClosedOnCutConstructs(masked);
 }
 function maskContact(text) {
@@ -29968,7 +30062,11 @@ async function runPipeline(args) {
       (consumedRowsByPk[pk] ??= []).push(...grpRows);
       const trustedOwner = g.source !== "a2a" && g.user.ref !== "unknown" && !g.user.ref.startsWith("svc:");
       const dreamItems = trustedOwner ? teachingFilteredItems : teachingFilteredItems.map((i) => ({ ...i, text: maskContactStrict(i.text) }));
-      const conv = normalize(ng, dreamItems, enrichment);
+      const dreamEnrichment = trustedOwner || !enrichment ? enrichment : {
+        ...enrichment,
+        tools: enrichment.tools.map((t) => ({ ...t, queries: t.queries.map((q) => maskContactStrict(q)) }))
+      };
+      const conv = normalize(ng, dreamItems, dreamEnrichment);
       conv.provenance = { pk, rows: provRows };
       conversations.push(conv);
       if (outcome === "consumed")
@@ -32343,7 +32441,7 @@ var ConversationsSweepCommand = class extends M8tCommand {
   });
   max = Option54.String("--max", "200", { description: "Maximum deletions per run" });
   graceDays = Option54.String("--grace-days", "14", {
-    description: "Days past the 30-day key life before a conversation is eligible"
+    description: `Days past the ${String(KEY_LIFETIME_DAYS)}-day key life before a conversation is eligible`
   });
   lookbackDays = Option54.String("--lookback-days", "180", {
     description: "How far back to scan ledger activity for candidates"