@mrciphersmith/keryx 0.2.88 → 0.2.94

package/dist/core.js

@@ -3467,9 +3467,17 @@ var init_secrets = __esm(() => {
       confidence: 0.9,
       remediation: "Treat the JWT as a live credential; do not persist it."
     },
+    {
+      policyId: "secrets.credential-file-assignment",
+      regex: /\b((?:aws_)?secret_access_key|aws_session_token|aws_secret_key|client_secret)\s*[:=]\s*["']?([^\s"'#]{6,})/gi,
+      severity: "critical",
+      confidence: 0.95,
+      remediation: "Rotate the credential; it was read from a credentials file into agent-visible output.",
+      valueGroup: 2
+    },
     {
       policyId: "secrets.env-assignment",
-      regex: /\b([A-Z0-9_]*(?:DATABASE_URL|JWT_SECRET|SECRET(?:_KEY)?|API_?KEY|ACCESS_?TOKEN|AUTH_?TOKEN|PASSWORD|PRIVATE_?KEY|TOKEN))["']?\s*[:=]\s*["']?([^\s"'#]{6,})/g,
+      regex: /\b([A-Z0-9_]*(?:DATABASE_URL|JWT_SECRET|SECRET(?:_KEY)?|API_?KEY|ACCESS_?KEY|ACCESS_?TOKEN|AUTH_?TOKEN|PASSWORD|PRIVATE_?KEY|TOKEN))["']?\s*[:=]\s*["']?([^\s"'#]{6,})/g,
       severity: "high",
       confidence: 0.85,
       remediation: "Move the secret to an untracked env file or secrets manager.",
@@ -6880,6 +6888,7 @@ __export(exports_service2, {
   analyze: () => analyze,
   createSecurityService: () => createSecurityService,
   memoizeResolved: () => memoizeResolved,
+  redactSensitiveText: () => redactSensitiveText,
   runGate: () => runGate,
   runReport: () => runReport,
   runScan: () => runScan,
@@ -7100,6 +7109,7 @@ var init_service = __esm(() => {
   init_incidents();
   init_self_protect();
   init_path_scan();
+  init_redact();
   RECOGNIZED_GATES = new Set(["pass", "needs-approval", "incomplete", "fail"]);
 });
 
@@ -10479,6 +10489,14 @@ function validateNode(value, schema, docRoot, valuePath, ctx, errors) {
     if (maximum !== undefined && value > maximum) {
       errors.push({ path: valuePath, message: `Expected number <= ${maximum}` });
     }
+    const exclusiveMinimum = asNumber(schema.exclusiveMinimum);
+    if (exclusiveMinimum !== undefined && value <= exclusiveMinimum) {
+      errors.push({ path: valuePath, message: `Expected number > ${exclusiveMinimum}` });
+    }
+    const exclusiveMaximum = asNumber(schema.exclusiveMaximum);
+    if (exclusiveMaximum !== undefined && value >= exclusiveMaximum) {
+      errors.push({ path: valuePath, message: `Expected number < ${exclusiveMaximum}` });
+    }
   }
   if (Array.isArray(value)) {
     if (schema.items !== undefined) {
@@ -10527,6 +10545,11 @@ function validateNode(value, schema, docRoot, valuePath, ctx, errors) {
         }
       }
     }
+    if (isPlainObject(schema.propertyNames)) {
+      for (const key of Object.keys(value)) {
+        validateNode(key, schema.propertyNames, docRoot, `${valuePath}.${key}`, ctx, errors);
+      }
+    }
     const properties = isPlainObject(schema.properties) ? schema.properties : {};
     const additional = schema.additionalProperties;
     for (const [key, nested] of Object.entries(value)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.88",
+  "version": "0.2.94",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {
@@ -49,7 +49,7 @@
     "test:client:terminal": "bun test src/tui/ src/commands/shell",
     "test:client:streaming": "bun test src/harness/provider/",
     "test:client:cancel-resume": "bun test src/harness/run/ src/harness/resume/ src/harness/session/ src/session/ src/commands/sessions",
-    "test:client:runtime": "bun test src/harness/ src/mcp-client/ src/agents/ src/commands/agent src/commands/harness src/commands/providers",
+    "test:client:runtime": "bun test src/harness/ src/mcp-client/ src/mcp-servers/ src/agents/ src/commands/agent src/commands/harness src/commands/providers",
     "test:client": "bun run test:client:terminal && bun run test:client:streaming && bun run test:client:cancel-resume && bun run test:client:runtime",
     "check": "bun run lint && bun run typecheck && bun run typecheck:scripts && bun test",
     "check:core": "bun run lint && bun run typecheck && bun run typecheck:scripts && bun run test:core",