@memnexus-ai/cli 1.7.233 → 1.7.234
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"privacy-filter.d.ts","sourceRoot":"","sources":["../../../src/lib/commit-context/privacy-filter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;
|
|
1
|
+
{"version":3,"file":"privacy-filter.d.ts","sourceRoot":"","sources":["../../../src/lib/commit-context/privacy-filter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmEH;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU7C"}
|
|
@@ -22,6 +22,43 @@ const SECRET_PATTERNS = [
|
|
|
22
22
|
/ghp_[a-zA-Z0-9]{36}/g,
|
|
23
23
|
// GitHub OAuth / user / service tokens
|
|
24
24
|
/gh[ous]_[a-zA-Z0-9]{36}/g,
|
|
25
|
+
// MemNexus API keys. This codebase mints TWO shapes and both authenticate,
|
|
26
|
+
// because core-api/src/routes/internal-auth.routes.ts validates only the
|
|
27
|
+
// `cmk_live_` prefix plus exactly one dot:
|
|
28
|
+
// 1. Application path — core-api/src/repositories/apikey.repository.ts:69
|
|
29
|
+
// `cmk_live_<16 hex>.<24 alphanumeric>`
|
|
30
|
+
// 2. Shell/seeding path — database/scripts/generate-api-key-hash.sh:64,
|
|
31
|
+
// database/scripts/seed-system-data.sh:66, core-api/scripts/seed-system-data.sh:74
|
|
32
|
+
// `cmk_live_${ENVIRONMENT}_<16 hex>.<secret>`, ENVIRONMENT in {dev,staging,prod}.
|
|
33
|
+
// This is the shape that seeds production, so missing it is the worse miss.
|
|
34
|
+
// The optional `[a-z]+_` group covers the environment segment; `{8,}` would not,
|
|
35
|
+
// since dev/prod/staging are all shorter than 8 and `_` is not in `[a-zA-Z0-9]`.
|
|
36
|
+
//
|
|
37
|
+
// The keyId is matched as exactly 16 hex characters, case-insensitive. Both
|
|
38
|
+
// generators emit lowercase today, but the class accepts either case so that a
|
|
39
|
+
// generator swapped for one emitting uppercase (`toUpperCase()`, a different
|
|
40
|
+
// uuid implementation) does not silently drop coverage. The environment segment
|
|
41
|
+
// likewise accepts any case. This costs nothing: measured against the full
|
|
42
|
+
// fixture set, widening both classes breaks zero negatives.
|
|
43
|
+
//
|
|
44
|
+
// Anchoring the keyId to 16 hex is deliberate and is what keeps the pattern off
|
|
45
|
+
// prose. `[a-zA-Z0-9]{8,}` would additionally swallow the documented placeholder
|
|
46
|
+
// at api-gateway/.env.example:63 (`cmk_live_dev_placeholder....`) and dotted
|
|
47
|
+
// identifiers such as `cmk_live_handler.processRequest_helper`.
|
|
48
|
+
//
|
|
49
|
+
// The 16-hex shape is a CONTRACT WITH THE GENERATORS, not a guess. It is pinned
|
|
50
|
+
// by an executable coupling test in core-api/tests/unit/utils/privacy-filter.test.ts
|
|
51
|
+
// that builds a keyId through the real generator expressions and asserts this
|
|
52
|
+
// filter redacts it. If a generator changes shape, that test fails loudly rather
|
|
53
|
+
// than this comment quietly becoming false.
|
|
54
|
+
//
|
|
55
|
+
// The dot-plus-body requirement matches a *token*, not a *mention*: prose naming
|
|
56
|
+
// the scheme ("keys look like cmk_live_<id>.<secret>") is left byte-identical,
|
|
57
|
+
// because `<` is outside the character classes.
|
|
58
|
+
//
|
|
59
|
+
// NOT covered: truncated fragments. A partial key with no dot, or a short body,
|
|
60
|
+
// passes through unredacted. See issue #5382.
|
|
61
|
+
/cmk_(?:live|test)_(?:[a-zA-Z]+_)?[0-9a-fA-F]{16}\.[a-zA-Z0-9_-]{8,}/g,
|
|
25
62
|
// Bearer tokens
|
|
26
63
|
/Bearer\s+[a-zA-Z0-9._-]{20,}/g,
|
|
27
64
|
// Generic key=value secrets (password, secret, token, key followed by = or :)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"privacy-filter.js","sourceRoot":"","sources":["../../../src/lib/commit-context/privacy-filter.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;
|
|
1
|
+
{"version":3,"file":"privacy-filter.js","sourceRoot":"","sources":["../../../src/lib/commit-context/privacy-filter.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAyEH,4BAUC;AAjFD,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;GAGG;AACH,MAAM,eAAe,GAAa;IAChC,wDAAwD;IACxD,8BAA8B;IAE9B,8BAA8B;IAC9B,sBAAsB;IAEtB,gCAAgC;IAChC,sBAAsB;IAEtB,uCAAuC;IACvC,0BAA0B;IAE1B,2EAA2E;IAC3E,yEAAyE;IACzE,2CAA2C;IAC3C,4EAA4E;IAC5E,6CAA6C;IAC7C,0EAA0E;IAC1E,wFAAwF;IACxF,uFAAuF;IACvF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,gFAAgF;IAChF,2EAA2E;IAC3E,4DAA4D;IAC5D,EAAE;IACF,gFAAgF;IAChF,iFAAiF;IACjF,6EAA6E;IAC7E,gEAAgE;IAChE,EAAE;IACF,gFAAgF;IAChF,qFAAqF;IACrF,8EAA8E;IAC9E,iFAAiF;IACjF,4CAA4C;IAC5C,EAAE;IACF,iFAAiF;IACjF,+EAA+E;IAC/E,gDAAgD;IAChD,EAAE;IACF,gFAAgF;IAChF,8CAA8C;IAC9C,sEAAsE;IAEtE,gBAAgB;IAChB,+BAA+B;IAE/B,8EAA8E;IAC9E,iEAAiE;IACjE,8DAA8D;CAC/D,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,qCAAqC;QACrC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@memnexus-ai/cli",
|
|
3
|
-
"version": "1.7.
|
|
3
|
+
"version": "1.7.234",
|
|
4
4
|
"description": "Command-line interface for MemNexus Core API",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"bin": {
|
|
@@ -34,7 +34,7 @@
|
|
|
34
34
|
"node": ">=18.0.0"
|
|
35
35
|
},
|
|
36
36
|
"dependencies": {
|
|
37
|
-
"@memnexus-ai/typescript-sdk": "^1.75.
|
|
37
|
+
"@memnexus-ai/typescript-sdk": "^1.75.3",
|
|
38
38
|
"@modelcontextprotocol/sdk": "^1.27.1",
|
|
39
39
|
"axios": "^1.13.6",
|
|
40
40
|
"chalk": "^5.3.0",
|