@massa-ai/tools-api 1.18.0 → 1.19.0

package/dist/index.js

@@ -175207,6 +175207,69 @@ function getAttributionResolver() {
   return sharedResolver2;
 }
 
+// ../../packages/core/dist/kernel/sanitize/credential-scrub.js
+function markerFor(id) {
+  return `[REDACTED:${id}]`;
+}
+function fullMatchRule(id, pattern) {
+  const marker26 = markerFor(id);
+  return {
+    id,
+    replace(text3) {
+      let count = 0;
+      const replaced = text3.replace(pattern, () => {
+        count++;
+        return marker26;
+      });
+      return { text: replaced, count };
+    }
+  };
+}
+var PEM_PATTERN = /-----BEGIN [A-Z ]{0,32}PRIVATE KEY-----[\s\S]{0,8192}?-----END [A-Z ]{0,32}PRIVATE KEY-----/g;
+var JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+var AWS_KEY_PATTERN = /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g;
+var SK_KEY_PATTERN = /\bsk-[A-Za-z0-9_-]{20,}\b/g;
+var GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g;
+var SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{18,}\b/g;
+var BEARER_PATTERN = /(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})/g;
+var RULES = [
+  fullMatchRule("pem", PEM_PATTERN),
+  fullMatchRule("jwt", JWT_PATTERN),
+  fullMatchRule("aws-key", AWS_KEY_PATTERN),
+  fullMatchRule("sk-key", SK_KEY_PATTERN),
+  fullMatchRule("github-token", GITHUB_TOKEN_PATTERN),
+  fullMatchRule("slack-token", SLACK_TOKEN_PATTERN),
+  {
+    id: "bearer",
+    replace(text3) {
+      let count = 0;
+      const replaced = text3.replace(BEARER_PATTERN, (_m, prefix) => {
+        count++;
+        return `${prefix}${markerFor("bearer")}`;
+      });
+      return { text: replaced, count };
+    }
+  }
+];
+var RULE_IDS = RULES.map((r2) => r2.id);
+function scrubCredentials(payloadJson) {
+  const redactions = {};
+  for (const id of RULE_IDS)
+    redactions[id] = 0;
+  let text3 = payloadJson;
+  for (const rule of RULES) {
+    const { text: next, count } = rule.replace(text3);
+    text3 = next;
+    redactions[rule.id] += count;
+  }
+  const total = Object.values(redactions).reduce((sum, n2) => sum + n2, 0);
+  return {
+    sanitized: text3,
+    redactions,
+    total
+  };
+}
+
 // ../../packages/core/dist/tools/compact_snapshot.js
 class CompactSnapshotTool {
   name = "compact_snapshot";
@@ -175258,19 +175321,26 @@ class CompactSnapshotTool {
         persistedId = newObservationId();
         try {
           const attribution = await (this.resolverOverride ?? getAttributionResolver()).resolve({ callerProjectId: projectId, sessionId, cwd });
+          const scrub = scrubCredentials(JSON.stringify({
+            snapshot: snapshot.xml,
+            eventCount: snapshot.eventCount,
+            compactCount: snapshot.compactCount,
+            generatedAt: snapshot.generatedAt,
+            sectionCount: snapshot.sections.length
+          }));
+          if (scrub.total > 0) {
+            logger.debug("compact_snapshot payload redacted before persist", {
+              redactions: scrub.redactions,
+              total: scrub.total
+            });
+          }
           store4.insert({
             id: persistedId,
             projectId: attribution.projectId,
             sessionId,
             source: "pre-compact",
             category: "compaction-snapshots",
-            payloadJson: JSON.stringify({
-              snapshot: snapshot.xml,
-              eventCount: snapshot.eventCount,
-              compactCount: snapshot.compactCount,
-              generatedAt: snapshot.generatedAt,
-              sectionCount: snapshot.sections.length
-            }),
+            payloadJson: scrub.sanitized,
             importance: 0.8,
             createdAt: Date.now(),
             attributionSource: attribution.source
@@ -176698,13 +176768,20 @@ class HookService {
     });
     const id = this.idFactory();
     this.queue.enqueue(async () => {
+      const scrub = scrubCredentials(JSON.stringify(ev.payload));
+      if (scrub.total > 0) {
+        logger.debug("hook payload redacted before persist", {
+          redactions: scrub.redactions,
+          total: scrub.total
+        });
+      }
       const obs = {
         id,
         projectId: attribution.projectId,
         sessionId: ev.sessionId,
         source: ev.event,
         category: extractCategory(ev.event, ev.payload),
-        payloadJson: JSON.stringify(ev.payload),
+        payloadJson: scrub.sanitized,
         importance: ev.importance,
         createdAt: ev.ts,
         agentId: ev.agentId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massa-ai/tools-api",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "author": "luizgmassa",
   "description": "massa-ai REST API server - Semantic code search, memory, and context compression",
   "type": "module",
@@ -21,8 +21,8 @@
     "test": "bun scripts/run-tests-isolated.ts"
   },
   "dependencies": {
-    "@massa-ai/core": "^1.18.0",
-    "@massa-ai/shared": "^1.18.0",
+    "@massa-ai/core": "^1.19.0",
+    "@massa-ai/shared": "^1.19.0",
     "elysia": "^1.2.25",
     "@elysiajs/swagger": "^1.2.0",
     "@elysiajs/cors": "^1.2.0",