@optimuslabs/harness-map-staging 1.5.19 → 1.5.20

package/dist/log_config_files/runtime/remediation_sync.js

@@ -264,16 +264,46 @@ async function fetchManifest(endpointBase, machineUuid, uuids, timeoutMs = 8000)
 // Enforce / remove
 // ---------------------------------------------------------------------------
 function setByPath(obj, path, value) {
-    const parts = path.split('.');
+    const parts = path.split('.').filter((part) => part.length > 0);
+    if (parts.length === 0)
+        return;
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const part = parts[i];
-        if (current[part] == null || typeof current[part] !== 'object' || Array.isArray(current[part])) {
-            current[part] = {};
+        if (Array.isArray(current)) {
+            if (!/^\d+$/.test(part))
+                return;
+            const idx = Number(part);
+            if (idx >= current.length)
+                return;
+            current = current[idx];
+            continue;
         }
-        current = current[part];
+        if (current == null || typeof current !== 'object')
+            return;
+        const rec = current;
+        const next = rec[part];
+        if (Array.isArray(next)) {
+            current = next;
+            continue;
+        }
+        if (next == null || typeof next !== 'object') {
+            rec[part] = {};
+        }
+        current = rec[part];
+    }
+    const leaf = parts[parts.length - 1];
+    if (Array.isArray(current)) {
+        if (!/^\d+$/.test(leaf))
+            return;
+        const idx = Number(leaf);
+        if (idx >= 0 && idx < current.length)
+            current[idx] = value;
+        return;
+    }
+    if (current != null && typeof current === 'object') {
+        current[leaf] = value;
     }
-    current[parts[parts.length - 1]] = value;
 }
 /** Traverse a JSON object using dot-notation path. Returns undefined if any segment is missing. */
 function getByPath(obj, path) {

package/dist/log_config_files/runtime/secret_regex_scan.js

@@ -57,6 +57,9 @@ const KNOWN_SECRET_PATTERNS = [
     { re: /dop_v1_[a-f0-9]{64}/i, label: 'DigitalOcean personal access token' },
     { re: /pat_[a-zA-Z0-9]{22}_[a-fA-F0-9]{59}/i, label: 'Atlassian API token' },
     { re: /Bearer\s+[a-zA-Z0-9\-_.]{20,}/i, label: 'Bearer token' },
+    // Isolated 32-hex (Azure OpenAI). Lookarounds keep a longer hex string from matching.
+    // Same pattern as HardcodedSecretRule — MCP tokens in args (ISO-005) are this shape.
+    { re: /(?<![a-zA-Z0-9])[a-fA-F0-9]{32}(?![a-zA-Z0-9])/, label: 'Azure OpenAI key' },
 ];
 const BASIC_AUTH_IN_URL = /[a-zA-Z0-9._%+-]+:[a-zA-Z0-9._%+-]+@/gi;
 // Hyphens/underscores count as part of one token so hyphenated keys (ctx7sk-..., sk-ant-...)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.19",
+  "version": "1.5.20",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {