@mossbear/eval-core 0.1.0-alpha.27 → 0.1.0-alpha.28
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sanitize-command.d.ts","sourceRoot":"","sources":["../src/sanitize-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;
|
|
1
|
+
{"version":3,"file":"sanitize-command.d.ts","sourceRoot":"","sources":["../src/sanitize-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoEH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASvD"}
|
package/dist/sanitize-command.js
CHANGED
|
@@ -54,18 +54,20 @@ const COMMAND_REDACTIONS = [
|
|
|
54
54
|
],
|
|
55
55
|
// Our own CLI token (`API_KEY_PREFIX`, apps/dashboard/src/features/auth
|
|
56
56
|
// /constants.ts). Listed with the third-party prefixes because the documented
|
|
57
|
-
// setup path — `mossbear sync --token
|
|
58
|
-
// so the `key=value` rule above never sees it: without this, the hook
|
|
59
|
-
// that command and the next sync uploads a live dashboard credential in
|
|
60
|
-
// action summary. The product's own secret shape is the one most likely to
|
|
61
|
-
// appear in a command a user runs.
|
|
62
|
-
//
|
|
63
|
-
//
|
|
64
|
-
|
|
65
|
-
//
|
|
66
|
-
//
|
|
67
|
-
//
|
|
68
|
-
//
|
|
57
|
+
// setup path — `mossbear sync --token mossbear_…` — is a *space-separated*
|
|
58
|
+
// flag, so the `key=value` rule above never sees it: without this, the hook
|
|
59
|
+
// logs that command and the next sync uploads a live dashboard credential in
|
|
60
|
+
// an action summary. The product's own secret shape is the one most likely to
|
|
61
|
+
// appear in a command a user runs. Any future re-mint under a new prefix has
|
|
62
|
+
// to be added here in the same change — a token this rule does not match is
|
|
63
|
+
// one the action log keeps in plaintext.
|
|
64
|
+
[/\bmossbear_[A-Za-z0-9_-]{8,}/g, '[redacted]'],
|
|
65
|
+
// The pre-rename prefix. Every key issued under it is deleted by migration
|
|
66
|
+
// `0056-revoke_legacy_prefix_cli_tokens.ts`, so this matches nothing that can
|
|
67
|
+
// still authenticate — it is kept because a CLI redacting on the user's
|
|
68
|
+
// machine can be older or newer than the dashboard it syncs to, and the
|
|
69
|
+
// window where one of these is still live is exactly the window where
|
|
70
|
+
// dropping the rule would upload it in plaintext.
|
|
69
71
|
[/\bauden_[A-Za-z0-9_-]{8,}/g, '[redacted]'],
|
|
70
72
|
[/\bsk-[A-Za-z0-9_-]{8,}/g, '[redacted]'],
|
|
71
73
|
[/\bgh[pousr]_[A-Za-z0-9]{8,}/g, '[redacted]'],
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sanitize-command.js","sourceRoot":"","sources":["../src/sanitize-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAgC;IACtD,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,iCAAiC;IACjC,CAAC,8DAA8D,EAAE,qBAAqB,CAAC;IACvF;QACE,iFAAiF;QACjF,YAAY;KACb;IACD,CAAC,gDAAgD,EAAE,eAAe,CAAC;IACnE,CAAC,6CAA6C,EAAE,cAAc,CAAC;IAC/D,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,wDAAwD;IACxD;QACE,2KAA2K;QAC3K,gBAAgB;KACjB;IACD,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,
|
|
1
|
+
{"version":3,"file":"sanitize-command.js","sourceRoot":"","sources":["../src/sanitize-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAgC;IACtD,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,iCAAiC;IACjC,CAAC,8DAA8D,EAAE,qBAAqB,CAAC;IACvF;QACE,iFAAiF;QACjF,YAAY;KACb;IACD,CAAC,gDAAgD,EAAE,eAAe,CAAC;IACnE,CAAC,6CAA6C,EAAE,cAAc,CAAC;IAC/D,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,wDAAwD;IACxD;QACE,2KAA2K;QAC3K,gBAAgB;KACjB;IACD,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,yCAAyC;IACzC,CAAC,+BAA+B,EAAE,YAAY,CAAC;IAC/C,2EAA2E;IAC3E,8EAA8E;IAC9E,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,kDAAkD;IAClD,CAAC,4BAA4B,EAAE,YAAY,CAAC;IAC5C,CAAC,yBAAyB,EAAE,YAAY,CAAC;IACzC,CAAC,8BAA8B,EAAE,YAAY,CAAC;IAC9C,CAAC,gCAAgC,EAAE,YAAY,CAAC;IAChD,CAAC,gCAAgC,EAAE,YAAY,CAAC;IAChD,CAAC,uBAAuB,EAAE,YAAY,CAAC;CACxC,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,GAAG,GAAG,OAAO,CAAA;IACjB,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACxD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,oBAAoB,GAAG,CAAC,MAAM,GAAG,iBAAiB,sBAAsB,CAAA;IAClH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
|
|
@@ -10,12 +10,17 @@ describe('sanitizeCommand', () => {
|
|
|
10
10
|
// command line, where PostToolUse logs it and the next sync would upload
|
|
11
11
|
// it in an action summary. The `key=value` rule never sees a
|
|
12
12
|
// space-separated flag, so the token prefix has to be matched directly.
|
|
13
|
-
|
|
14
|
-
|
|
13
|
+
expect(sanitizeCommand('mossbear sync --token mossbear_tPtcsSvXyRxygMSkBjjDpBKz')).toBe('mossbear sync --token [redacted]');
|
|
14
|
+
expect(sanitizeCommand('mossbear init --token=mossbear_abcdefgh12345678')).toBe('mossbear init --token=[redacted]');
|
|
15
|
+
});
|
|
16
|
+
it('still redacts a token issued under the pre-rename prefix', () => {
|
|
17
|
+
// Those keys are deleted by migration 0056, but a CLI can be older or newer
|
|
18
|
+
// than the dashboard it syncs to; while one is still live, dropping the rule
|
|
19
|
+
// would upload it in plaintext.
|
|
15
20
|
expect(sanitizeCommand('mossbear sync --token auden_tPtcsSvXyRxygMSkBjjDpBKz')).toBe('mossbear sync --token [redacted]');
|
|
16
|
-
expect(sanitizeCommand('mossbear init --token=auden_abcdefgh12345678')).toBe('mossbear init --token=[redacted]');
|
|
17
21
|
});
|
|
18
22
|
it('does not redact ordinary words that merely start with the prefix', () => {
|
|
23
|
+
expect(sanitizeCommand('cd mossbear_repo && ls')).toBe('cd mossbear_repo && ls');
|
|
19
24
|
expect(sanitizeCommand('cd auden_repo && ls')).toBe('cd auden_repo && ls');
|
|
20
25
|
});
|
|
21
26
|
it('redacts bearer tokens in Authorization headers', () => {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sanitize-command.test.js","sourceRoot":"","sources":["../src/sanitize-command.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CACxD,4BAA4B,CAC7B,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,6DAA6D;QAC7D,wEAAwE;QACxE,
|
|
1
|
+
{"version":3,"file":"sanitize-command.test.js","sourceRoot":"","sources":["../src/sanitize-command.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CACxD,4BAA4B,CAC7B,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,6DAA6D;QAC7D,wEAAwE;QACxE,MAAM,CACJ,eAAe,CAAC,yDAAyD,CAAC,CAC3E,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;QAC1C,MAAM,CAAC,eAAe,CAAC,iDAAiD,CAAC,CAAC,CAAC,IAAI,CAC7E,kCAAkC,CACnC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,4EAA4E;QAC5E,6EAA6E;QAC7E,gCAAgC;QAChC,MAAM,CAAC,eAAe,CAAC,sDAAsD,CAAC,CAAC,CAAC,IAAI,CAClF,kCAAkC,CACnC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,eAAe,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAChF,MAAM,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,eAAe,CACzB,+EAA+E,CAChF,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,GAAG,GAAG,eAAe,CAAC,yDAAyD,CAAC,CAAA;QACtF,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,sDAAsD,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG,eAAe,CAAC,kDAAkD,CAAC,CAAA;QAC/E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,eAAe,CAAC,gDAAgD,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;QACzD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAE/B,MAAM,MAAM,GAAG,eAAe,CAAC,2BAA2B,CAAC,CAAA;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,eAAe,CACzB,qFAAqF,CACtF,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACvC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,KAAK,MAAM,MAAM,IAAI;YACnB,0CAA0C;YAC1C,iCAAiC;YACjC,6BAA6B;YAC7B,sBAAsB;SACvB,EAAE,CAAC;YACF,MAAM,GAAG,GAAG,eAAe,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAA;YACtD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,eAAe,CACzB,mEAAmE,CACpE,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,QAAQ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACtC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mossbear/eval-core",
|
|
3
|
-
"version": "0.1.0-alpha.
|
|
3
|
+
"version": "0.1.0-alpha.28",
|
|
4
4
|
"private": false,
|
|
5
5
|
"description": "Portable pieces of Mossbear's evaluation path — command redaction, the LLM adapter seam, and guide normalization.",
|
|
6
6
|
"license": "MIT",
|
|
@@ -39,7 +39,7 @@
|
|
|
39
39
|
"test": "vitest run"
|
|
40
40
|
},
|
|
41
41
|
"dependencies": {
|
|
42
|
-
"@mossbear/protocol": "0.1.0-alpha.
|
|
42
|
+
"@mossbear/protocol": "0.1.0-alpha.28"
|
|
43
43
|
},
|
|
44
44
|
"devDependencies": {
|
|
45
45
|
"typescript": "*"
|