@mnemonik/cli 7.140.3 → 7.141.1

package/dist/scanner-release.json

@@ -1,23 +1,23 @@
 {
-  "version": "7.140.3",
-  "digestsSha256": "79c8821fc247484eb29889ba2b4133be0700110cd6f5b111be24518f4501f08b",
+  "version": "7.141.1",
+  "digestsSha256": "5afd4c94adf5f200d694fcf73f3a4f1bfec72b1f992a987299dcf969459ceb27",
   "platforms": {
     "darwin-arm64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.140.3",
+      "version": "7.141.1",
       "entry": "scanner-darwin-arm64",
       "files": {
         "scanner-darwin-arm64": {
-          "sha256": "9e2c45831aa36a680bc241c5a46a9f6ad600ace31cea930dc71dd38debd78f2d",
-          "size": 154669024,
+          "sha256": "f40a18f3462a9b29307d90897bff29beedf7cff762c38b0b31248c37fccc2f60",
+          "size": 154735072,
           "executable": true
         }
       },
-      "totalSize": 154669024,
+      "totalSize": 154735072,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.140.3/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.141.1/"
       },
       "signer": {
         "platform": "darwin",
@@ -29,24 +29,24 @@
     "linux-arm64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.140.3",
+      "version": "7.141.1",
       "entry": "scanner-linux-arm64",
       "files": {
         "scanner-linux-arm64": {
-          "sha256": "0cba45d9dd229076a41f69a8646d8e012eb317a9e171b080abffaab431a63a6b",
-          "size": 157355136,
+          "sha256": "6c217674cfe3a3e07971889f68a03303c14d0b461f09700e2679e37220b1ff76",
+          "size": 157420672,
           "executable": true
         },
         "scanner-linux-arm64.minisig": {
-          "sha256": "7564fb5fdf2316641dbe3f763a056301aa478b9f2b81e808ff3b47b24be4c14f",
+          "sha256": "92579f40692107ee8590a19516fca61b5f478f66f1176679f296b6974c741d5d",
           "size": 314,
           "executable": false
         }
       },
-      "totalSize": 157355450,
+      "totalSize": 157420986,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.140.3/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.141.1/"
       },
       "signer": {
         "platform": "linux",
@@ -59,24 +59,24 @@
     "linux-x64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.140.3",
+      "version": "7.141.1",
       "entry": "scanner-linux-x64",
       "files": {
         "scanner-linux-x64": {
-          "sha256": "b17b42ce57904fe4da95fc3e5feba42500226f0ec03152e4a786c067d5a73ea5",
-          "size": 155258048,
+          "sha256": "246a108cd432495fa9dfeb12e5d51974afa8bc8c5267ee868cce8d6b34955e91",
+          "size": 155323584,
           "executable": true
         },
         "scanner-linux-x64.minisig": {
-          "sha256": "bc62786220f94fc485863b363ecaed69afa81d94a7ca5cd99d584dfe0410cdf2",
+          "sha256": "a42c8c1b5da0d2e6b5aaa532ac365f51f1a372cdac9228e04d0028aca32f592c",
           "size": 312,
           "executable": false
         }
       },
-      "totalSize": 155258360,
+      "totalSize": 155323896,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.140.3/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.141.1/"
       },
       "signer": {
         "platform": "linux",
@@ -89,19 +89,19 @@
     "win-x64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.140.3",
+      "version": "7.141.1",
       "entry": "scanner-win-x64.exe",
       "files": {
         "scanner-win-x64.exe": {
-          "sha256": "73589bad3e9d25476a454bfd3169f2d38f593c1db4cbfc51a160dc11e0d43467",
-          "size": 128071168,
+          "sha256": "64e6f4890e0b23479574b0d1f908e9f7110c21a78ef8043d1e7b1da77d24dca3",
+          "size": 128130560,
           "executable": true
         }
       },
-      "totalSize": 128071168,
+      "totalSize": 128130560,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.140.3/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.141.1/"
       },
       "signingStatus": "unsigned",
       "disclosureVersion": "2026.09.1"

package/dist/status.js

@@ -886,9 +886,13 @@ var require_ignore = __commonJS({
 });
 
 // packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
 var init_secretPatterns = __esm({
   "packages/shared/dist/secretPatterns.js"() {
     "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
   }
 });
 
@@ -2796,9 +2800,6 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
-init_secretPatterns();
-init_protectedPaths();
-init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -6851,7 +6852,269 @@ var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm")
 // packages/shared/dist/ast/astChunker.js
 var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
 
+// packages/shared/dist/redactCredentials.js
+var REDACTED = "<redacted credential>";
+var MAX_PEM_BODY_LENGTH = 8 * 1024;
+var LETTER_OR_DIGIT = /[A-Za-z0-9]/;
+function hasLetterOrDigit(value) {
+  return LETTER_OR_DIGIT.test(value);
+}
+function redactContextValue(match, head = "", value = "") {
+  return hasLetterOrDigit(value) ? `${head}${REDACTED}` : match;
+}
+var PLACEHOLDER_PASSWORD = /^(?:\[REDACTED(?::[A-Za-z0-9_-]+)?\]|redacted|<[^<>]*>|\{\{[^{}]*\}\}|\$\{[^{}]+\}|%[A-Za-z_][A-Za-z0-9_]*%|\*+|x{3,}|\.\.\.|\u2026|password|passwd|pass|pwd|pw|secret|changeme|change[_-]me|example|test|(?:your|my)[a-z_-]*?(?:password|passwd|pass|pwd|secret|key|token|here))$/i;
+var PLACEHOLDER_ENV_VAR = /^\$[A-Z_][A-Z0-9_]*$/;
+function isPlaceholderPassword(password) {
+  return PLACEHOLDER_PASSWORD.test(password) || PLACEHOLDER_ENV_VAR.test(password);
+}
+function redactUrlPassword(match, head = "", password = "") {
+  return isPlaceholderPassword(password) || !hasLetterOrDigit(password) ? match : `${head}${REDACTED}@`;
+}
+var SHELL_WORD = String.raw`'[^'\n]*'|"[^"\n]*"|(?!${REDACTED})[^\s'"\`;|&()[\]{}\\,/][^\s'"\`;|&]*`;
+var OPENING_QUOTE = String.raw`(["'\`]?)`;
+var TRAILING_PUNCTUATION = /[.,:;!?)\]}]+$/;
+var PROSE_WORDS = /* @__PURE__ */ new Set([
+  "a",
+  "an",
+  "and",
+  "as",
+  "for",
+  "in",
+  "is",
+  "it",
+  "on",
+  "or",
+  "the",
+  "to",
+  "with",
+  "flag",
+  "option",
+  "argument",
+  "instead",
+  "which",
+  "that",
+  "this",
+  "puts",
+  "passes",
+  "leaks",
+  "exposes"
+]);
+var REGEX_DELIMITER = /\/(?:[{}()[\];]|$)/;
+function shellWordSecret(word) {
+  const quote = word[0];
+  if ((quote === "'" || quote === '"') && word.length >= 2 && word.endsWith(quote)) {
+    const inner = word.slice(1, -1);
+    if (!hasLetterOrDigit(inner) || quote === '"' && inner.startsWith("$"))
+      return null;
+    if (inner !== inner.trim())
+      return null;
+    return isPlaceholderPassword(inner) ? null : inner;
+  }
+  if (word.startsWith("$"))
+    return null;
+  const core = word.replace(TRAILING_PUNCTUATION, "");
+  if (!hasLetterOrDigit(core) || isPlaceholderPassword(core))
+    return null;
+  if (REGEX_DELIMITER.test(core))
+    return null;
+  return PROSE_WORDS.has(core.toLowerCase()) ? null : core;
+}
+function redactShellWord(match, head = "", word = "", tail = "") {
+  return shellWordSecret(word) === null ? match : `${head}${REDACTED}${tail}`;
+}
+function redactQuotedShellWord(match, head = "", openingQuote = "", word = "", tail = "") {
+  if (openingQuote !== "" && word.startsWith(openingQuote))
+    return match;
+  return redactShellWord(match, head, word, tail);
+}
+var SSHPASS_COMMAND = String.raw`ssh|scp|sftp|rsync|ssh-copy-id|ansible[\w-]*`;
+function redactSshpassWord(match, head = "", openingQuote = "", word = "", tail = "", command = "") {
+  if (openingQuote !== "" && word.startsWith(openingQuote))
+    return match;
+  const secret = shellWordSecret(word);
+  if (secret === null)
+    return match;
+  const bare = word[0] !== "'" && word[0] !== '"';
+  if (bare && /^[a-z]+$/.test(secret) && command === "")
+    return match;
+  return `${head}${REDACTED}${tail}`;
+}
+var PATTERNS = [
+  {
+    kind: "bearer",
+    pattern: /(\bBearer\s+)([^\s]{40,})/gi,
+    replacement: redactContextValue,
+    secretGroup: 2
+  },
+  {
+    // Before openai, whose sk- shape would otherwise claim these keys.
+    kind: "anthropic",
+    pattern: /(?<![A-Za-z0-9_-])sk-ant-(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "openai",
+    pattern: /(?<![A-Za-z0-9_-])sk-(?:proj-)?(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "shopify",
+    pattern: /(?<![A-Za-z0-9_])shp(?:at|ss|ca)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "aws_access_key",
+    pattern: /(?<![A-Z0-9])AKIA[A-Z0-9]{16}(?![A-Z0-9])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "github",
+    pattern: /(?<![A-Za-z0-9_])gh[opu]_[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "slack",
+    pattern: /(?<![A-Za-z0-9-])xox[abp]-(?=-*[A-Za-z0-9])[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "sentry",
+    pattern: /(?<![A-Za-z0-9_])sntry[us]_(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "fly",
+    pattern: /(?<![A-Za-z0-9_])(?:FlyV1\s+)?fm2_(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "google_api_key",
+    pattern: /(?<![A-Za-z0-9_-])AIza(?=[_-]*[A-Za-z0-9])[0-9A-Za-z_-]{35}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "jwt",
+    // header.payload.signature, both JSON segments starting eyJ. The length
+    // floors keep `eyJ...` prose and signature-less examples out.
+    pattern: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "mnemonik_component_token",
+    // mnc_ / mncr_ + 43 base64url (oauth/components.ts); 32+ also catches a
+    // partial token. The body must contain an upper-case letter or digit, so a
+    // snake_case identifier is not mistaken for one; the 8-character
+    // display prefix (mnc_ + 8) is too short.
+    pattern: /(?<![A-Za-z0-9_])mncr?_(?=[A-Za-z0-9_-]*[A-Z0-9])[A-Za-z0-9_-]{32,}/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "stripe",
+    // Secret and restricted keys (sk_/rk_ live|test) and webhook signing secrets.
+    pattern: /(?<![A-Za-z0-9_])(?:(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}|whsec_[A-Za-z0-9]{20,})(?![A-Za-z0-9])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "mnemonik_proxy_token",
+    // pxt_ + 32 hex (the format server.ts validates). A bare prefix in prose is left.
+    pattern: /(?<![A-Za-z0-9_])pxt_[0-9a-f]{32,}/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "mnemonik_api_key",
+    // mnk_ + 64 hex (AuthManager.generateApiKey); 32+ also catches a half key.
+    // The stored 12-character key_prefix (mnk_ + 8 hex) is not a credential.
+    pattern: /(?<![A-Za-z0-9_])mnk_[0-9a-f]{32,}/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "mnemonik_api_key_legacy",
+    // mnk_ + 43 base64url: keys minted by hand before AuthManager's hex form
+    // (production's only key in 2026-10 has this shape, and one stored memory
+    // held a development key in it). Authentication accepts any mnk_ bearer.
+    // The body needs upper and lower case and a digit, so a snake_case
+    // identifier that starts mnk_ is not taken for one.
+    pattern: /(?<![A-Za-z0-9_])mnk_(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*[a-z])(?=[A-Za-z0-9_-]*[0-9])[A-Za-z0-9_-]{40,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "named_value",
+    pattern: /(\b[A-Za-z_][A-Za-z0-9_]*(?:_TOKEN|_KEY|_SECRET|_PASSWORD|_PASS|APIKEY|API_KEY)\s*(?:=|:)\s*)([^\s]{16,})/gi,
+    replacement: redactContextValue,
+    secretGroup: 2
+  },
+  {
+    kind: "connection_string",
+    // scheme://user:password@host: only the password is replaced; scheme,
+    // user, host and database stay readable. The user may be empty
+    // (redis://:password@host). The password runs to the last `@` before a
+    // path, query, fragment, quote or whitespace, so an unencoded `@` inside
+    // it is still covered. Runs after named_value, which already replaces a
+    // whole URL assigned to a secret-named variable.
+    pattern: /\b((?:postgres(?:ql)?|mysql|mariadb|mongodb|rediss?|amqps?|mssql|sqlserver)(?:\+[a-z0-9]+)?:\/\/[^\s:/?#@'"`<>]{0,256}:)([^\s/?#'"`]{1,512})@/gi,
+    replacement: redactUrlPassword,
+    secretGroup: 2
+  },
+  {
+    kind: "url_basic_auth",
+    // https://user:password@host: same shape and placeholder rules as a
+    // connection string; only the password is replaced.
+    pattern: /\b(https?:\/\/[^\s:/?#@'"`<>]{0,256}:)([^\s/?#'"`]{1,512})@/gi,
+    replacement: redactUrlPassword,
+    secretGroup: 2
+  },
+  // Command-line passwords. Each keeps the command and replaces only the
+  // password word; an expansion or placeholder in that position is left.
+  {
+    // sshpass -p <password> (also -p'<password>' and -p"<password>"), after
+    // any other sshpass flags. 13 memories, 11 scanner chunks, 15 versions and
+    // 6 dated facts in production held one on 2026-10-12.
+    kind: "sshpass_password",
+    pattern: new RegExp(String.raw`(${OPENING_QUOTE}\bsshpass(?:[ \t]+-[a-oq-zA-Z]\S*)*[ \t]+-p[ \t]*)(${SHELL_WORD})()(?=((?:[ \t]+(?:${SSHPASS_COMMAND})(?![\w-]))?))`, "g"),
+    replacement: redactSshpassWord,
+    secretGroup: 3,
+    commandLine: true
+  },
+  {
+    // Environment variables whose only purpose is a password, in shell
+    // assignment form (no space around `=`): libpq's PGPASSWORD (one memory,
+    // version and fact in production), MySQL's MYSQL_PWD, sshpass -e's
+    // SSHPASS. named_value needs an `_PASSWORD`-style suffix and 16
+    // characters, so it misses all three. Not an awk program that matches or
+    // prints the assignment: `/^PGPASSWORD=/ { print "PGPASSWORD=" pw }`.
+    kind: "password_env_var",
+    pattern: new RegExp(String.raw`(${OPENING_QUOTE}\b(?:PGPASSWORD|MYSQL_PWD|SSHPASS)=)(${SHELL_WORD})()`, "g"),
+    replacement: redactQuotedShellWord,
+    secretGroup: 3,
+    commandLine: true
+  },
+  {
+    // --password=<value>, the long option every CLI that takes one spells
+    // this way. The `=` keeps prose about the option ("--password is
+    // required") out; the spaced form is not matched for that reason.
+    kind: "password_option",
+    pattern: new RegExp(String.raw`(${OPENING_QUOTE}(?<![\w-])--password=)(${SHELL_WORD})()`, "g"),
+    replacement: redactQuotedShellWord,
+    secretGroup: 3,
+    commandLine: true
+  },
+  {
+    // echo <password> | sudo -S: sudo reads the password from stdin. One
+    // memory, two versions and two facts in production.
+    kind: "sudo_password",
+    pattern: new RegExp(String.raw`(\becho[ \t]+(?:-[neE]+[ \t]+)?)(${SHELL_WORD})([ \t]*\|[ \t]*sudo\b[^|\n]*?[ \t](?:-[A-Za-z]*S[A-Za-z]*|--stdin)\b)`, "g"),
+    replacement: redactShellWord,
+    secretGroup: 2,
+    commandLine: true
+  }
+];
+
+// packages/shared/dist/sourceRedaction.js
+init_secretPatterns();
+
 // packages/shared/dist/codeScanner.js
+init_protectedPaths();
+init_projectIdentityFile();
 var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web