@orion-agents/orion-code 0.1.2 → 0.1.4

package/dist/utils/errors.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * Helpers for reading a caught value safely.
+ *
+ * TypeScript types `catch` bindings as `unknown`, and the codebase used to
+ * work around that by writing `catch (err: any)` and reaching for
+ * `err.message`. That silently produces the string `"undefined"` whenever
+ * something other than an `Error` is thrown — a rejected promise carrying a
+ * string, an axios object, a `throw { code }` — which is exactly when a clear
+ * message matters most.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.errorMessage = errorMessage;
+exports.errorCode = errorCode;
+/**
+ * Extract a human-readable message from any thrown value.
+ *
+ * - `Error`            -> `error.message`
+ * - `string`           -> the string itself
+ * - `{ message: '…' }` -> that message (axios/node-fetch style error objects)
+ * - anything else      -> `String(value)`
+ */
+function errorMessage(error) {
+    if (error instanceof Error)
+        return error.message;
+    if (typeof error === 'string')
+        return error;
+    if (typeof error === 'object' && error !== null) {
+        const message = error.message;
+        if (typeof message === 'string' && message)
+            return message;
+    }
+    return String(error);
+}
+/**
+ * Read the `code` property that Node's `ErrnoException` and most HTTP clients
+ * attach (`ENOENT`, `EACCES`, `ECONNREFUSED`, …), without asserting a type.
+ */
+function errorCode(error) {
+    if (typeof error === 'object' && error !== null) {
+        const code = error.code;
+        if (typeof code === 'string')
+            return code;
+    }
+    return undefined;
+}
+//# sourceMappingURL=errors.js.map

package/dist/utils/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/utils/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAUH,oCAQC;AAMD,8BAMC;AA5BD;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;QACzD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/utils/mask.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Secret masking helpers.
+ *
+ * Diagnostics (`/config`, `/doctor`, provider dumps) used to print
+ * `apiKey.slice(0, 7) + '***'`. That leaks the full provider prefix
+ * (`sk-proj-`, `sk-ant-`, org-scoped prefixes, …) and, for short keys,
+ * a meaningful fraction of the secret itself. Terminal output is routinely
+ * pasted into issues and chat logs, so the safe default is to reveal nothing
+ * that identifies the key beyond its shape.
+ */
+/**
+ * Mask a secret for display.
+ *
+ * - empty / undefined  -> `(not set)`
+ * - short secrets      -> fully masked, only the length is shown
+ * - normal secrets     -> `***<last 4> (len=NN)`
+ *
+ * The length is included because it is the single most useful signal when
+ * debugging "wrong key configured" problems, and it does not narrow the
+ * search space in any practical way.
+ */
+export declare function maskSecret(secret: string | undefined | null): string;
+/**
+ * Redact secret-looking substrings from free-form text (log lines, error
+ * messages, HTTP bodies) before it is shown to the user or written to disk.
+ */
+export declare function redactSecrets(text: string): string;
+//# sourceMappingURL=mask.d.ts.map

package/dist/utils/mask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask.d.ts","sourceRoot":"","sources":["../../src/utils/mask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAOpE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAclD"}

package/dist/utils/mask.js

@@ -0,0 +1,54 @@
+"use strict";
+/**
+ * Secret masking helpers.
+ *
+ * Diagnostics (`/config`, `/doctor`, provider dumps) used to print
+ * `apiKey.slice(0, 7) + '***'`. That leaks the full provider prefix
+ * (`sk-proj-`, `sk-ant-`, org-scoped prefixes, …) and, for short keys,
+ * a meaningful fraction of the secret itself. Terminal output is routinely
+ * pasted into issues and chat logs, so the safe default is to reveal nothing
+ * that identifies the key beyond its shape.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.maskSecret = maskSecret;
+exports.redactSecrets = redactSecrets;
+/** Number of trailing characters kept so a user can tell two keys apart. */
+const VISIBLE_SUFFIX = 4;
+/** Minimum length before we are willing to reveal any characters at all. */
+const MIN_LENGTH_FOR_SUFFIX = 12;
+/**
+ * Mask a secret for display.
+ *
+ * - empty / undefined  -> `(not set)`
+ * - short secrets      -> fully masked, only the length is shown
+ * - normal secrets     -> `***<last 4> (len=NN)`
+ *
+ * The length is included because it is the single most useful signal when
+ * debugging "wrong key configured" problems, and it does not narrow the
+ * search space in any practical way.
+ */
+function maskSecret(secret) {
+    if (!secret)
+        return '(not set)';
+    const trimmed = String(secret);
+    if (trimmed.length < MIN_LENGTH_FOR_SUFFIX) {
+        return `*** (len=${trimmed.length})`;
+    }
+    return `***${trimmed.slice(-VISIBLE_SUFFIX)} (len=${trimmed.length})`;
+}
+/**
+ * Redact secret-looking substrings from free-form text (log lines, error
+ * messages, HTTP bodies) before it is shown to the user or written to disk.
+ */
+function redactSecrets(text) {
+    if (!text)
+        return text;
+    return (text
+        // Bearer tokens
+        .replace(/\b(Bearer\s+)[A-Za-z0-9._~+/-]{8,}=*/gi, '$1***')
+        // Common provider key prefixes (sk-, sk-ant-, sk-proj-, gsk_, xai-, ...)
+        .replace(/\b(sk|gsk|xai|pk|rk)[-_][A-Za-z0-9._-]{8,}/g, '$1-***')
+        // api_key=... / apiKey: "..." style assignments
+        .replace(/\b(api[-_]?key\s*[:=]\s*["']?)([A-Za-z0-9._~+/-]{8,})(["']?)/gi, (_m, prefix, _val, suffix) => `${prefix}***${suffix}`));
+}
+//# sourceMappingURL=mask.js.map

package/dist/utils/mask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask.js","sourceRoot":"","sources":["../../src/utils/mask.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAmBH,gCAOC;AAMD,sCAcC;AA5CD,4EAA4E;AAC5E,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,SAAgB,UAAU,CAAC,MAAiC;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC3C,OAAO,YAAY,OAAO,CAAC,MAAM,GAAG,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,SAAS,OAAO,CAAC,MAAM,GAAG,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CACL,IAAI;QACF,gBAAgB;SACf,OAAO,CAAC,wCAAwC,EAAE,OAAO,CAAC;QAC3D,yEAAyE;SACxE,OAAO,CAAC,6CAA6C,EAAE,QAAQ,CAAC;QACjE,gDAAgD;SAC/C,OAAO,CACN,gEAAgE,EAChE,CAAC,EAAE,EAAE,MAAc,EAAE,IAAY,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,MAAM,MAAM,EAAE,CAC9E,CACJ,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-agents/orion-code",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Orion Code - goal-driven coding agent for the terminal.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -25,6 +25,7 @@
     "test:ink-compat": "ORION_RUN_DEPRECATED_INK_PTY=1 jest tests/ink-ui-pty.test.ts --runInBand",
     "lint": "eslint src/",
     "format": "prettier --write src/",
+    "release:check": "node scripts/release-check.js",
     "prepack": "npm run build",
     "prepublishOnly": "npm run lint && npm run build && npm test -- --runInBand"
   },