@nac3/forge-cli 1.0.82 → 1.0.83

package/dist/core/audit_log.d.ts

@@ -30,6 +30,15 @@ export interface LifecycleAudit extends AuditEntryBase {
     details?: Record<string, unknown>;
 }
 export type AuditEntry = ShellExecAudit | VerbInvokeAudit | LifecycleAudit | AuditEntryBase;
+/**
+ * PND-156 -- redact obvious secrets before they land in the audit ledger.
+ * On rpa-osde a DB password leaked into the audit log (and journald) via an
+ * inline `mysql -p'<pass>'`. This masks the common shapes: DB passwords
+ * (-p / --password / MYSQL_PWD / PGPASSWORD), URL credentials, Bearer tokens,
+ * and key=value secrets. Best-effort + conservative -- masks the VALUE, keeps
+ * the surrounding command readable so the ledger stays useful.
+ */
+export declare function redactSecrets(text: string): string;
 /** Append a single entry. Best-effort -- never throws. */
 export declare function recordAudit(entry: Partial<AuditEntry> & {
     kind: string;

package/dist/core/audit_log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log.d.ts","sourceRoot":"","sources":["../../src/core/audit_log.ts"],"names":[],"mappings":"AA8BA,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,eAAe,GACf,eAAe,GACf,oBAAoB,GACpB,gBAAgB,CAAC;AAErB,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAgB,MAAM,CAAC;IACzB,IAAI,EAAc,MAAM,CAAC;IACzB,OAAO,EAAW,MAAM,CAAC;IACzB,aAAa,EAAK,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,IAAI,EAAc,YAAY,CAAC;IAC/B,OAAO,EAAW,MAAM,CAAC;IACzB,GAAG,EAAe,MAAM,CAAC;IACzB,WAAW,EAAO,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IACnE,YAAY,EAAM,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAS,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAO,MAAM,CAAC;IACzB,MAAM,EAAY,OAAO,CAAC;IAC1B,YAAY,EAAM,MAAM,CAAC;IACzB,YAAY,EAAM,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACrD,IAAI,EAAc,aAAa,CAAC;IAChC,OAAO,EAAW,MAAM,CAAC;IACzB,aAAa,EAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAY,IAAI,GAAG,OAAO,CAAC;IACjC,KAAK,CAAC,EAAY,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,IAAI,EAAc,UAAU,GAAG,SAAS,GAAG,cAAc,GAAG,kBAAkB,CAAC;IAC/E,WAAW,EAAO,MAAM,CAAC;IACzB,OAAO,CAAC,EAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,cAAc,GAAG,cAAc,CAAC;AAQ5F,0DAA0D;AAC1D,wBAAsB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhH;AAED;gCACgC;AAChC,wBAAsB,eAAe,CAAC,KAAK,SAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAaxE;AAED,iBAAiB;AACjB,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"audit_log.d.ts","sourceRoot":"","sources":["../../src/core/audit_log.ts"],"names":[],"mappings":"AA8BA,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,eAAe,GACf,eAAe,GACf,oBAAoB,GACpB,gBAAgB,CAAC;AAErB,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAgB,MAAM,CAAC;IACzB,IAAI,EAAc,MAAM,CAAC;IACzB,OAAO,EAAW,MAAM,CAAC;IACzB,aAAa,EAAK,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,IAAI,EAAc,YAAY,CAAC;IAC/B,OAAO,EAAW,MAAM,CAAC;IACzB,GAAG,EAAe,MAAM,CAAC;IACzB,WAAW,EAAO,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IACnE,YAAY,EAAM,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAS,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAO,MAAM,CAAC;IACzB,MAAM,EAAY,OAAO,CAAC;IAC1B,YAAY,EAAM,MAAM,CAAC;IACzB,YAAY,EAAM,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACrD,IAAI,EAAc,aAAa,CAAC;IAChC,OAAO,EAAW,MAAM,CAAC;IACzB,aAAa,EAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAY,IAAI,GAAG,OAAO,CAAC;IACjC,KAAK,CAAC,EAAY,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,IAAI,EAAc,UAAU,GAAG,SAAS,GAAG,cAAc,GAAG,kBAAkB,CAAC;IAC/E,WAAW,EAAO,MAAM,CAAC;IACzB,OAAO,CAAC,EAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,cAAc,GAAG,cAAc,CAAC;AAE5F;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiBlD;AAQD,0DAA0D;AAC1D,wBAAsB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhH;AAED;gCACgC;AAChC,wBAAsB,eAAe,CAAC,KAAK,SAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAaxE;AAED,iBAAiB;AACjB,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/core/audit_log.js

@@ -27,6 +27,33 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+/**
+ * PND-156 -- redact obvious secrets before they land in the audit ledger.
+ * On rpa-osde a DB password leaked into the audit log (and journald) via an
+ * inline `mysql -p'<pass>'`. This masks the common shapes: DB passwords
+ * (-p / --password / MYSQL_PWD / PGPASSWORD), URL credentials, Bearer tokens,
+ * and key=value secrets. Best-effort + conservative -- masks the VALUE, keeps
+ * the surrounding command readable so the ledger stays useful.
+ */
+export function redactSecrets(text) {
+    if (!text)
+        return text;
+    let s = String(text);
+    /* mysql/mariadb inline password: -pSECRET or -p'SECRET' (NO space after -p). */
+    s = s.replace(/(^|\s)(-p)(['"]?)[^\s'"]+\3/g, '$1$2$3***$3');
+    /* --password=SECRET / --password SECRET / -password SECRET */
+    s = s.replace(/(--?password[=\s])(['"]?)[^\s'"]+\2/gi, '$1$2***$2');
+    /* env-style secret assignments: MYSQL_PWD=... PGPASSWORD=... PASSWORD=... TOKEN=... SECRET=... API_KEY=... */
+    s = s.replace(/\b(MYSQL_PWD|PGPASSWORD|[A-Z0-9_]*(?:PASSWORD|PASSWD|SECRET|TOKEN|API[_-]?KEY))=(['"]?)[^\s'"]+\2/gi, '$1=$2***$2');
+    /* key=value inside connection strings / query params: password=..., pwd=..., token=..., secret=... */
+    s = s.replace(/\b(password|passwd|pwd|token|secret|api[_-]?key)=([^\s&'";]+)/gi, '$1=***');
+    /* URL credentials: scheme://user:SECRET@host */
+    s = s.replace(/(:\/\/[^\s:/@]+:)[^\s@/]+(@)/g, '$1***$2');
+    /* Bearer / Authorization tokens */
+    s = s.replace(/(authorization\s*:?\s*bearer\s+)[A-Za-z0-9._\-]+/gi, '$1***');
+    s = s.replace(/(bearer\s+)[A-Za-z0-9._\-]{12,}/gi, '$1***');
+    return s;
+}
 function auditLogPath() {
     const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
     const base = process.env.YF_CONFIG_DIR || path.join(home, '.yujin-forge');
@@ -43,6 +70,13 @@ export async function recordAudit(entry) {
             approval_mode: entry.approval_mode ?? 'not_applicable',
             ...entry,
         };
+        /* PND-156 -- scrub secrets from the free-text fields before persisting so
+         * a leaked inline password (mysql -p'...') never lands in the ledger. */
+        if (typeof full.summary === 'string')
+            full.summary = redactSecrets(full.summary);
+        const withCmd = full;
+        if (typeof withCmd.command === 'string')
+            withCmd.command = redactSecrets(withCmd.command);
         await fs.appendFile(p, JSON.stringify(full) + '\n', 'utf-8');
     }
     catch (err) {

package/dist/core/audit_log.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log.js","sourceRoot":"","sources":["../../src/core/audit_log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AA6CzB,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AACrD,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA+D;IAC/F,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,GAAe;YACvB,EAAE,EAAc,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,OAAO,EAAS,KAAK,CAAC,OAAO,IAAI,EAAE;YACnC,aAAa,EAAG,KAAK,CAAC,aAAa,IAAI,gBAAgB;YACvD,GAAG,KAAK;SACK,CAAC;QAChB,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,CAAC;QACjG,MAAM,CAAC,CAAC,mDAAmD,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;gCACgC;AAChC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,GAAG,GAAG;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,oBAAoB;IAClC,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"audit_log.js","sourceRoot":"","sources":["../../src/core/audit_log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AA6CzB;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,gFAAgF;IAChF,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;IAC7D,8DAA8D;IAC9D,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,uCAAuC,EAAE,WAAW,CAAC,CAAC;IACpE,8GAA8G;IAC9G,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,qGAAqG,EAAE,YAAY,CAAC,CAAC;IACnI,sGAAsG;IACtG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,iEAAiE,EAAE,QAAQ,CAAC,CAAC;IAC3F,gDAAgD;IAChD,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;IAC1D,mCAAmC;IACnC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,oDAAoD,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,mCAAmC,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AACrD,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA+D;IAC/F,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,GAAe;YACvB,EAAE,EAAc,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,OAAO,EAAS,KAAK,CAAC,OAAO,IAAI,EAAE;YACnC,aAAa,EAAG,KAAK,CAAC,aAAa,IAAI,gBAAgB;YACvD,GAAG,KAAK;SACK,CAAC;QAChB;iFACyE;QACzE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,IAA6B,CAAC;QAC9C,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1F,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,CAAC;QACjG,MAAM,CAAC,CAAC,mDAAmD,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;gCACgC;AAChC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,GAAG,GAAG;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,oBAAoB;IAClC,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC"}

package/dist/version.d.ts

@@ -2,5 +2,5 @@
  * Yujin Forge CLI version. Kept in sync with package.json by the npm
  * "version" lifecycle (scripts/sync_version.mjs) so the two never drift.
  */
-export declare const VERSION = "1.0.82";
+export declare const VERSION = "1.0.83";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -2,5 +2,5 @@
  * Yujin Forge CLI version. Kept in sync with package.json by the npm
  * "version" lifecycle (scripts/sync_version.mjs) so the two never drift.
  */
-export const VERSION = '1.0.82';
+export const VERSION = '1.0.83';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nac3/forge-cli",
-  "version": "1.0.82",
+  "version": "1.0.83",
   "description": "Yujin Forge -- voice-first NAC-3 React development framework. CLI + chat panel + spec ingest + 10-format document reader + voice loop.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Pablo Kuschnirof <pablo@rpaforce.com>",