@opvs-ai/cli 0.25.2 → 0.25.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.build-stamp.json +3 -3
- package/dist/lib/redact.js +48 -18
- package/dist/lib/redact.js.map +1 -1
- package/package.json +1 -1
package/dist/.build-stamp.json
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
{
|
|
2
2
|
"stamp_version": 1,
|
|
3
3
|
"package": "@opvs-ai/cli",
|
|
4
|
-
"version": "0.25.
|
|
5
|
-
"source_digest": "
|
|
4
|
+
"version": "0.25.3",
|
|
5
|
+
"source_digest": "650619bcd8c234f6dea00016fe1beed7f4c85ef4abb650d2afb08b88c894c18f",
|
|
6
6
|
"source_files": 54,
|
|
7
|
-
"built_at": "2026-10-
|
|
7
|
+
"built_at": "2026-10-04T15:25:04.668Z",
|
|
8
8
|
"node": "v22.23.3"
|
|
9
9
|
}
|
package/dist/lib/redact.js
CHANGED
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
*/
|
|
7
7
|
export const REDACTION_MASK = "[redacted-credential]";
|
|
8
8
|
export const CAPTURE_FIELD_LIMIT = 1_500;
|
|
9
|
-
const
|
|
9
|
+
const SECRET_KEY_WORDS = [
|
|
10
10
|
"password",
|
|
11
11
|
"passwd",
|
|
12
12
|
"secret",
|
|
@@ -19,10 +19,52 @@ const SECRET_KEY_NAMES = [
|
|
|
19
19
|
"cookie",
|
|
20
20
|
"x-admin-key",
|
|
21
21
|
"x-api-key",
|
|
22
|
-
"client_secret",
|
|
23
22
|
];
|
|
24
|
-
const
|
|
25
|
-
|
|
23
|
+
const SECRET_KEY_PREFIXES = ["api", "access", "private", "admin", "secret"];
|
|
24
|
+
// Usage-counter exception: token metrics are capture data, not credentials.
|
|
25
|
+
const HARMLESS_SECRET_KEY_NAMES = new Set([
|
|
26
|
+
"token_count",
|
|
27
|
+
"tokens",
|
|
28
|
+
"max_tokens",
|
|
29
|
+
"input_tokens",
|
|
30
|
+
"output_tokens",
|
|
31
|
+
"cache_read_input_tokens",
|
|
32
|
+
]);
|
|
33
|
+
const normalizeKeyName = (key) => key.toLowerCase().replace(/[-_]+/g, "_");
|
|
34
|
+
function isSecretKeyName(key) {
|
|
35
|
+
const normalized = normalizeKeyName(key);
|
|
36
|
+
if (HARMLESS_SECRET_KEY_NAMES.has(normalized))
|
|
37
|
+
return false;
|
|
38
|
+
const containsSecretWord = SECRET_KEY_WORDS.some((word) => normalized.includes(normalizeKeyName(word)));
|
|
39
|
+
if (containsSecretWord)
|
|
40
|
+
return true;
|
|
41
|
+
return SECRET_KEY_PREFIXES.some((prefix) => normalized.endsWith(`${prefix}_key`) || normalized.endsWith(`${prefix}key`));
|
|
42
|
+
}
|
|
43
|
+
const QUOTED_HEADER_PATTERN = /((?:^|\s)(?:-H|--header)(?:\s+|=)(["']))([^:"']+)(\s*:\s*)(.*?)(\2)/gi;
|
|
44
|
+
const UNQUOTED_HEADER_PATTERN = /((?:^|\s)(?:-H|--header)(?:\s+|=))([^:\s"']+)(\s*:\s*)([^\s]+)/gi;
|
|
45
|
+
const SECRET_KEY_VALUE_PATTERN = /((?<![A-Za-z0-9_-])([A-Za-z0-9_-]*(?:passw(?:or)?d|secret|token|(?:api|access|private|admin|secret)[_-]?key|authorization|cookie|credential)[A-Za-z0-9_-]*)["']?\s*[:=]\s*["']?)(?!\[redacted)([^\s"',;}]{6,})/gi;
|
|
46
|
+
function scrubSecretHeaders(text) {
|
|
47
|
+
const quoted = text.replace(QUOTED_HEADER_PATTERN, (match, prefix, _quote, key, separator, _value, close) => isSecretKeyName(key) ? `${prefix}${key}${separator}${REDACTION_MASK}${close}` : match);
|
|
48
|
+
return quoted.replace(UNQUOTED_HEADER_PATTERN, (match, prefix, key, separator) => isSecretKeyName(key) ? `${prefix}${key}${separator}${REDACTION_MASK}` : match);
|
|
49
|
+
}
|
|
50
|
+
function scrubSecretAssignments(text) {
|
|
51
|
+
let scrubbed = text;
|
|
52
|
+
SECRET_KEY_VALUE_PATTERN.lastIndex = 0;
|
|
53
|
+
for (let match = SECRET_KEY_VALUE_PATTERN.exec(scrubbed); match;) {
|
|
54
|
+
const [whole, prefix, key] = match;
|
|
55
|
+
if (isSecretKeyName(key) || normalizeKeyName(key).includes("credential")) {
|
|
56
|
+
const replacement = `${prefix}${REDACTION_MASK}`;
|
|
57
|
+
scrubbed = `${scrubbed.slice(0, match.index)}${replacement}${scrubbed.slice(match.index + whole.length)}`;
|
|
58
|
+
SECRET_KEY_VALUE_PATTERN.lastIndex = match.index + replacement.length;
|
|
59
|
+
}
|
|
60
|
+
else {
|
|
61
|
+
// Allowlisted usage counters must not hide a later secret inside their value.
|
|
62
|
+
SECRET_KEY_VALUE_PATTERN.lastIndex = match.index + 1;
|
|
63
|
+
}
|
|
64
|
+
match = SECRET_KEY_VALUE_PATTERN.exec(scrubbed);
|
|
65
|
+
}
|
|
66
|
+
return scrubbed;
|
|
67
|
+
}
|
|
26
68
|
const PATTERNS = [
|
|
27
69
|
[
|
|
28
70
|
/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
|
|
@@ -48,18 +90,6 @@ const PATTERNS = [
|
|
|
48
90
|
/\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s@/]+(@)/gi,
|
|
49
91
|
`$1${REDACTION_MASK}$2`,
|
|
50
92
|
],
|
|
51
|
-
[
|
|
52
|
-
new RegExp(`((?:^|\\s)(?:-H|--header)(?:\\s+|=)(["'])(?:${SECRET_HEADER_NAME_PATTERN})\\s*:\\s*)(.*?)(\\2)`, "gi"),
|
|
53
|
-
`$1${REDACTION_MASK}$4`,
|
|
54
|
-
],
|
|
55
|
-
[
|
|
56
|
-
new RegExp(`((?:^|\\s)(?:-H|--header)(?:\\s+|=)(?:${SECRET_HEADER_NAME_PATTERN})\\s*:\\s*)[^\\s]+`, "gi"),
|
|
57
|
-
`$1${REDACTION_MASK}`,
|
|
58
|
-
],
|
|
59
|
-
[
|
|
60
|
-
/(\b[A-Za-z0-9_]*(?:api[_-]?key|secret|token|passw(?:or)?d|credential|private[_-]?key)[A-Za-z0-9_]*["']?\s*[:=]\s*["']?)(?!\[redacted)[^\s"',;}]{6,}/gi,
|
|
61
|
-
`$1${REDACTION_MASK}`,
|
|
62
|
-
],
|
|
63
93
|
];
|
|
64
94
|
export function scrubCredentials(text) {
|
|
65
95
|
if (!text)
|
|
@@ -70,7 +100,7 @@ export function scrubCredentials(text) {
|
|
|
70
100
|
pattern.lastIndex = 0;
|
|
71
101
|
scrubbed = scrubbed.replace(pattern, replacement);
|
|
72
102
|
}
|
|
73
|
-
return scrubbed;
|
|
103
|
+
return scrubSecretAssignments(scrubSecretHeaders(scrubbed));
|
|
74
104
|
}
|
|
75
105
|
catch {
|
|
76
106
|
return REDACTION_MASK;
|
|
@@ -106,7 +136,7 @@ export function sanitizeAllowed(value, redact = true) {
|
|
|
106
136
|
return item.map(visit);
|
|
107
137
|
if (item && typeof item === "object") {
|
|
108
138
|
return Object.fromEntries(Object.entries(item).map(([key, child]) => {
|
|
109
|
-
if (redact &&
|
|
139
|
+
if (redact && isSecretKeyName(key)) {
|
|
110
140
|
state = "redacted";
|
|
111
141
|
return [key, REDACTION_MASK];
|
|
112
142
|
}
|
package/dist/lib/redact.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/lib/redact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAEzC,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,eAAe;IACf,QAAQ;IACR,aAAa;IACb,WAAW;
|
|
1
|
+
{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/lib/redact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAEzC,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,eAAe;IACf,QAAQ;IACR,aAAa;IACb,WAAW;CACH,CAAC;AAEX,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAErF,4EAA4E;AAC5E,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,eAAe;IACf,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAE3F,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5D,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACxD,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAC5C,CAAC;IACF,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO,mBAAmB,CAAC,IAAI,CAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,MAAM,KAAK,CAAC,CACxF,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GACzB,uEAAuE,CAAC;AAC1E,MAAM,uBAAuB,GAC3B,kEAAkE,CAAC;AACrE,MAAM,wBAAwB,GAC5B,kNAAkN,CAAC;AAErN,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CACzB,qBAAqB,EACrB,CACE,KAAK,EACL,MAAc,EACd,MAAc,EACd,GAAW,EACX,SAAiB,EACjB,MAAc,EACd,KAAa,EACb,EAAE,CACF,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,GAAG,GAAG,SAAS,GAAG,cAAc,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CACxF,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CACnB,uBAAuB,EACvB,CAAC,KAAK,EAAE,MAAc,EAAE,GAAW,EAAE,SAAiB,EAAE,EAAE,CACxD,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,GAAG,GAAG,SAAS,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC,KAAK,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,wBAAwB,CAAC,SAAS,GAAG,CAAC,CAAC;IAEvC,KAAK,IAAI,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC;QACjE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;QACnC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACzE,MAAM,WAAW,GAAG,GAAG,MAAM,GAAG,cAAc,EAAE,CAAC;YACjD,QAAQ,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,WAAW,GAAG,QAAQ,CAAC,KAAK,CACzE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAC3B,EAAE,CAAC;YACJ,wBAAwB,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,8EAA8E;YAC9E,wBAAwB,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,QAAQ,GAA6C;IACzD;QACE,6EAA6E;QAC7E,cAAc;KACf;IACD;QACE,uEAAuE;QACvE,KAAK,cAAc,EAAE;KACtB;IACD,CAAC,wCAAwC,EAAE,KAAK,cAAc,EAAE,CAAC;IACjE,CAAC,+BAA+B,EAAE,cAAc,CAAC;IACjD,CAAC,yCAAyC,EAAE,cAAc,CAAC;IAC3D,CAAC,iCAAiC,EAAE,cAAc,CAAC;IACnD,CAAC,+BAA+B,EAAE,cAAc,CAAC;IACjD,CAAC,iCAAiC,EAAE,cAAc,CAAC;IACnD,CAAC,gCAAgC,EAAE,cAAc,CAAC;IAClD,CAAC,4BAA4B,EAAE,cAAc,CAAC;IAC9C;QACE,kFAAkF;QAClF,cAAc;KACf;IACD;QACE,mDAAmD;QACnD,KAAK,cAAc,IAAI;KACxB;CACF,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,sBAAsB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AASD,SAAS,WAAW,CAClB,IAAY,EACZ,MAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,MAAM,WAAW,GAAG,QAAQ,KAAK,IAAI,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,mBAAmB,GAAG,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,GAAG,EAAE,CAAC,KAAK,OAAO,iBAAiB,CAAC;QAC1F,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;KACpD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAI,KAAQ,EAAE,MAAM,GAAG,IAAI;IACxD,IAAI,KAAK,GAAiB,UAAU,CAAC;IAErC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAW,EAAE;QACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,YAAY,KAAK,UAAU;gBAAE,KAAK,GAAG,UAAU,CAAC;iBACvD,IAAI,OAAO,CAAC,YAAY,KAAK,WAAW,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;gBACtE,KAAK,GAAG,WAAW,CAAC;YACtB,CAAC;YACD,OAAO,OAAO,CAAC,KAAK,CAAC;QACvB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACnE,IAAI,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,KAAK,GAAG,UAAU,CAAC;oBACnB,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;gBAC/B,CAAC;gBACD,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7B,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC3D,CAAC"}
|