@mcpjam/inspector 3.5.4 → 3.6.0

package/dist/server/{chunk-O3BEWXAM.js → chunk-2WXL3DNI.js}

@@ -37,7 +37,7 @@ function resolveEnvironment() {
   }
   return "dev";
 }
-var BAKED_VERSION = "3.5.4";
+var BAKED_VERSION = "3.6.0";
 function blankToNull(value) {
   return value === void 0 || value.trim() === "" ? null : value;
 }
@@ -48,6 +48,30 @@ function resolveRelease() {
   return blankToNull(process.env.RAILWAY_GIT_COMMIT_SHA) ?? blankToNull(process.env.GIT_SHA) ?? resolveAppVersion();
 }
 
+// shared/secret-shape-redaction.ts
+var authHeaderLike = () => /\b(authorization["']?\s*:\s*)["']?[^\n\r"'`]+/gi;
+var tokenLike = () => /\bBearer\s+[A-Za-z0-9._~\-+/=]+\b/gi;
+var skKeyLike = () => /\bsk-(?:[A-Za-z0-9]+-)*[A-Za-z0-9]{16,}\b/g;
+var jwtLike = () => /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
+var secretParamLike = () => /\b((?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|client[_-]?secret|authorization|secret|password|passwd|pwd|token|auth|key|sig|signature)\s*[=:]\s*["']?)[^&\s"'`]+/gi;
+var urlBasicAuthLike = () => /(\/\/[^\s/:@]+:)[^\s@/]+@/g;
+function redactSecretShapes(text, replacement = "[redacted]") {
+  if (!text) return text;
+  const parts = text.split(SECRET_PLACEHOLDER);
+  if (parts.length === 1) return redactSegment(text, replacement);
+  return parts.map(
+    (part, index) => (
+      // Odd segments are the captured names.
+      index % 2 === 1 ? `{{secret:${part}}}` : redactSegment(part, replacement)
+    )
+  ).join("");
+}
+var SECRET_PLACEHOLDER = /\{\{secret:([A-Z_][A-Z0-9_]*)\}\}/g;
+function redactSegment(text, replacement) {
+  if (!text) return text;
+  return text.replace(authHeaderLike(), `$1${replacement}`).replace(tokenLike(), `Bearer ${replacement}`).replace(jwtLike(), replacement).replace(urlBasicAuthLike(), `$1${replacement}@`).replace(skKeyLike(), replacement).replace(secretParamLike(), `$1${replacement}`);
+}
+
 // server/utils/log-scrubber.ts
 var FORBIDDEN_KEY_SUBSTRINGS = [
   "authorization",
@@ -69,13 +93,7 @@ var FORBIDDEN_KEY_SUBSTRINGS = [
   "x-mcpjam-harness-lease"
 ];
 var ALLOWLISTED_KEYS = /* @__PURE__ */ new Set(["emaildomain"]);
-var AUTH_HEADER_LIKE = /\b(authorization["']?\s*:\s*)["']?[^\n\r"'`]+/gi;
-var TOKEN_LIKE = /\bBearer\s+[A-Za-z0-9._\-+/=]+\b/gi;
 var EMAIL_LIKE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
-var SK_KEY_LIKE = /\bsk-[A-Za-z0-9]{16,}\b/g;
-var JWT_LIKE = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
-var SECRET_PARAM_LIKE = /\b((?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|client[_-]?secret|authorization|secret|password|passwd|pwd|token|auth|key|sig|signature)\s*[=:]\s*["']?)[^&\s"'`]+/gi;
-var URL_BASIC_AUTH_LIKE = /(\/\/[^\s/:@]+:)[^\s@/]+@/g;
 function isForbiddenKey(key) {
   const lower = key.toLowerCase();
   if (ALLOWLISTED_KEYS.has(lower)) return false;
@@ -83,7 +101,7 @@ function isForbiddenKey(key) {
   return FORBIDDEN_KEY_SUBSTRINGS.some((s) => lower.includes(s));
 }
 function scrubString(s) {
-  return s.replace(AUTH_HEADER_LIKE, "$1[redacted]").replace(TOKEN_LIKE, "Bearer [redacted-token]").replace(JWT_LIKE, "[redacted-jwt]").replace(URL_BASIC_AUTH_LIKE, "$1[redacted]@").replace(EMAIL_LIKE, "[redacted-email]").replace(SK_KEY_LIKE, "[redacted-secret]").replace(SECRET_PARAM_LIKE, "$1[redacted]");
+  return s.replace(authHeaderLike(), "$1[redacted]").replace(tokenLike(), "Bearer [redacted-token]").replace(jwtLike(), "[redacted-jwt]").replace(urlBasicAuthLike(), "$1[redacted]@").replace(EMAIL_LIKE, "[redacted-email]").replace(skKeyLike(), "[redacted-secret]").replace(secretParamLike(), "$1[redacted]");
 }
 function scrubLogPayload(value) {
   return scrubValue(value, /* @__PURE__ */ new WeakSet());
@@ -2821,6 +2839,7 @@ export {
   resolveEnvironment,
   resolveAppVersion,
   resolveRelease,
+  redactSecretShapes,
   markOriginCaptureHandled,
   ensureStampable,
   isOriginCaptureHandled,
@@ -2855,4 +2874,4 @@ export {
   installRuntimePack,
   reportLocalHarnessRuntimeStatusInBackground
 };
-//# sourceMappingURL=chunk-O3BEWXAM.js.map
+//# sourceMappingURL=chunk-2WXL3DNI.js.map

package/dist/server/chunk-PZ5AY32C.js

@@ -0,0 +1,10 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};
+//# sourceMappingURL=chunk-PZ5AY32C.js.map

package/dist/server/{chunk-RP4R2FQ5.js → chunk-RRGPQWGQ.js}

@@ -127,7 +127,7 @@ var consent = createDeviceConsent(
 );
 async function grantLocalBrowserConsent() {
   const grant = await consent.grant();
-  const { invalidateBrowserConsentLifetimes: invalidateBrowserConsentLifetimes2 } = await import("./consent-lifetime-YBODZG23.js");
+  const { invalidateBrowserConsentLifetimes: invalidateBrowserConsentLifetimes2 } = await import("./consent-lifetime-RZJBI5QR.js");
   await invalidateBrowserConsentLifetimes2(await consent.fingerprint());
   return grant;
 }
@@ -136,7 +136,7 @@ var getBrowserConsentFingerprint = consent.fingerprint;
 var verifyAndFingerprintBrowserConsent = consent.verifyAndFingerprint;
 async function revokeLocalBrowserConsent(token) {
   await consent.revoke(token);
-  const { invalidateBrowserConsentLifetimes: invalidateBrowserConsentLifetimes2 } = await import("./consent-lifetime-YBODZG23.js");
+  const { invalidateBrowserConsentLifetimes: invalidateBrowserConsentLifetimes2 } = await import("./consent-lifetime-RZJBI5QR.js");
   await invalidateBrowserConsentLifetimes2(await consent.fingerprint());
 }
 function watchBrowserConsentChanges(changed) {
@@ -184,6 +184,12 @@ function webmcpInspectorReachable(env = process.env) {
 function hostedBrowserEnabled(env = process.env) {
   return env.HOSTED_BROWSER_TOOLS_ENABLED === "1";
 }
+function browserShapeRedactionEnabled(env = process.env) {
+  return env.MCPJAM_BROWSER_SHAPE_REDACTION !== "0";
+}
+function browserSecretPlaceholdersEnabled(env = process.env) {
+  return env.MCPJAM_BROWSER_SECRET_PLACEHOLDERS === "1";
+}
 function webmcpPageToolsMode(env = process.env) {
   return env.MCPJAM_WEBMCP_PAGE_TOOLS === "verbs" ? "verbs" : "first_class";
 }
@@ -628,6 +634,8 @@ export {
   webmcpInspectorHostedEnabled,
   webmcpInspectorReachable,
   hostedBrowserEnabled,
+  browserShapeRedactionEnabled,
+  browserSecretPlaceholdersEnabled,
   webmcpPageToolsMode,
   EVAL_WIDGET_MODEL_CONTEXT,
   CORS_ORIGINS,
@@ -670,4 +678,4 @@ export {
   createBrowserConsentLifetime,
   invalidateBrowserConsentLifetimes
 };
-//# sourceMappingURL=chunk-RP4R2FQ5.js.map
+//# sourceMappingURL=chunk-RRGPQWGQ.js.map

package/dist/server/{consent-lifetime-YBODZG23.js → consent-lifetime-RZJBI5QR.js}

@@ -1,9 +1,10 @@
 import {
   createBrowserConsentLifetime,
   invalidateBrowserConsentLifetimes
-} from "./chunk-RP4R2FQ5.js";
+} from "./chunk-RRGPQWGQ.js";
+import "./chunk-PZ5AY32C.js";
 export {
   createBrowserConsentLifetime,
   invalidateBrowserConsentLifetimes
 };
-//# sourceMappingURL=consent-lifetime-YBODZG23.js.map
+//# sourceMappingURL=consent-lifetime-RZJBI5QR.js.map

package/dist/server/harness-install-cli.js

@@ -1,7 +1,8 @@
 import {
   installRuntimePack,
   readRuntimeInstallStatus
-} from "./chunk-O3BEWXAM.js";
+} from "./chunk-2WXL3DNI.js";
+import "./chunk-PZ5AY32C.js";
 
 // server/harness-install-cli.ts
 async function harnessStatus() {