@netcatty/dsh-guard 0.2.1 → 0.2.3

package/lib/index.js

@@ -133,7 +133,15 @@ const REDACTIONS = [
   [/\bBearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, 'Bearer ***'],
   [/([A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*\s*=\s*)(?:"[^"]{6,}"|'[^']{6,}'|[^\s"']{6,})/g, '$1***'],
   [/([?&](?:token|access_token|api_key|apikey|key|secret|password)=)[^&\s"']+/gi, '$1***'],
-  [/"(token|access_token|api_key|apikey|secret|password|authorization)"\s*:\s*"[^"]{4,}"/gi, '"$1":"***"'],
+  // JSON string values whose key mentions a credential, anywhere in the name
+  // (`OXIDETERM_MCP_TOKEN`, `settings.token`, `x-api-key`). The character class
+  // covers the separators JSON keys actually use, and the keyword list carries
+  // the hyphenated spellings so `x-api-key` does not slip through.
+  [/"([A-Za-z0-9_.-]*(?:token|api_key|apikey|api-key|secret|password|passwd|authorization|private_key|private-key|access_key|access-key)[A-Za-z0-9_.-]*)"\s*:\s*"[^"]{4,}"/gi, '"$1":"***"'],
+  // The same shape after the quotes were escaped, which is how JSON shows up
+  // inside a shell command: `echo "{\"token\":\"secret\"}"`. Escapes are kept so
+  // the surrounding text stays parseable after masking.
+  [/\\"([A-Za-z0-9_.-]*(?:token|api_key|apikey|api-key|secret|password|passwd|authorization|private_key|private-key|access_key|access-key)[A-Za-z0-9_.-]*)\\"\s*:\s*\\"(?![*]{3}\\")[^"\\]{4,}\\"/gi, '\\"$1\\":\\"***\\"'],
   [/^\s*(set-)?cookie\s*:\s*.*$/gim, 'Cookie: ***'],
 ];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@netcatty/dsh-guard",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "allow/ask/deny permission gates for DeepSeek Harness tools: path/params/agents surfaces, argv decomposition, network rules, redaction, grants, dry-run, fail-closed config",
   "type": "module",
   "main": "lib/index.js",
@@ -25,7 +25,8 @@
     "lib/audit-log.js",
     "lib/diff-view.js",
     "locale/*.json",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "README.en.md"
   ],
   "dsh": {
     "bundle": {