@maudecode/talaria-web 1.20.0 → 1.22.0

package/dist/redact.js

@@ -886,6 +886,10 @@ function redactCredentialParams(text) {
     for (let m = CRED_PARAM_RE.exec(text); m; m = CRED_PARAM_RE.exec(text)) {
         const [head, dash = '', key = '', sep = ''] = m;
         const keyEnd = m.index + head.length;
+        // A masked word may swallow a later flag's name but leave its value outside the mask. Keep scanning heads,
+        // skipping those wholly masked before parsing their values, so overlapping heads still cost one scan.
+        if (keyEnd <= last)
+            continue;
         // A computed piece may supply the separator itself (`--password${SEP}hunter2` with `SEP='='`) or the name
         // (`--${KEY}${SEP}hunter2`): from the key's first computed piece, the rest of the key is masked (and the value after a
         // real `=`/`:`) when the static part before it names a credential, or when a flag's name goes on after it.
@@ -898,9 +902,10 @@ function redactCredentialParams(text) {
             // A flag whose name ends in the computed piece (`--password${X} hunter2`) takes its value from the next word.
             const nextWord = dash && !staticTail && /^\s+$/.test(sep);
             const end = /[=:]/.test(sep) || nextWord ? shellWordEnd(text, keyEnd, quoteAt(keyEnd), closeOf) : m.index + dash.length + key.length;
+            if (end <= last)
+                continue;
             out += `${text.slice(last, m.index + dash.length + computedAt)}***${nextWord ? `${sep}***` : ''}`;
             last = end;
-            CRED_PARAM_RE.lastIndex = Math.max(last, CRED_PARAM_RE.lastIndex);
             continue;
         }
         // A key the shell computes from its first piece (`--$(printf password)=`, `--${KEY}=`, a header `${HEADER}: x`) is one
@@ -961,7 +966,6 @@ function redactCredentialParams(text) {
         // Fully masked: a partial mask would leak part of a password or passphrase.
         out += text.slice(last, valueStart) + (/^[[{(]/.test(value) ? '***' : maskShellWord(value));
         last = valueEnd;
-        CRED_PARAM_RE.lastIndex = Math.max(valueEnd, CRED_PARAM_RE.lastIndex);
     }
     return out + text.slice(last);
 }
@@ -1464,7 +1468,9 @@ function redactComposedWords(text) {
         if (wanted === plain)
             continue;
         const asWritten = shellDequote(redactRules(span)).replaceAll(WORD_SPACE, ' ');
-        if (!revealsMore(plain, asWritten, wanted))
+        // Apply a composed flag's mask with its following value even when this span is safe in isolation: an outer header
+        // rule may swallow the flag name before the full-text pass reaches that value.
+        if (!flag && !revealsMore(plain, asWritten, wanted))
             continue;
         out += text.slice(last, start) + redactRules(unit).replaceAll(WORD_SPACE, ' ');
         last = spanEnd;
@@ -2393,8 +2399,23 @@ function withToolDisplay(raw, redacted, enabled) {
             }
             catch { /* unparseable: the text redaction stands */ }
     }
-    // The target is derived in the live order: the sidecar's snapshot (first four arguments, capped) before redaction.
-    return { ...out, ...toolDisplay(toolName(record), redactArgs(snapshotArgs(toolArgs(record)), enabled)) };
+    // TAL-1458: only a call naming a file carries `focus_path`, so a bare completion never clears its start frame's.
+    const { focus_path: focusPath, ...display } = redactedToolDisplay(record, enabled);
+    return { ...out, ...display, ...(focusPath ? { focus_path: focusPath } : {}) };
+}
+/** The target is derived in the live order: the sidecar's snapshot (first four arguments, capped) before redaction. */
+function redactedToolDisplay(call, enabled) {
+    return toolDisplay(toolName(call), redactArgs(snapshotArgs(toolArgs(call)), enabled));
+}
+/** TAL-1458: the session's `focus_path`, the last non-null one of its persisted calls as each call ships it. */
+export function sessionFocusPath(calls, enabled) {
+    for (let i = calls.length - 1; i >= 0; i--) {
+        const call = calls[i];
+        const path = call && typeof call === 'object' && !Array.isArray(call) ? redactedToolDisplay(call, enabled).focus_path : null;
+        if (path)
+            return path;
+    }
+    return null;
 }
 /** Every non-empty scalar of a credential value masked, keeping its shape (`{ password: ['x'] }` → `['***']`). */
 function maskLeaves(value) {