@ouro.bot/cli 0.1.0-alpha.286 → 0.1.0-alpha.287

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.287",
+      "changes": [
+        "feat(nerves): add two-layer log redaction to the NDJSON sink. Structured key-based redaction strips sensitive fields (passwords, tokens, API keys, auth headers) from event meta objects before serialization. Regex fallback catches secrets in serialized strings that bypass structured checks (Anthropic keys, OpenAI keys, Bearer tokens, URL token params). Redacted values are replaced with `[REDACTED:key_name]` markers that preserve debugging context without exposing secrets. Redaction happens at the sink level only — in-memory events retain full data for runtime use. `OURO_LOG_VERBOSE=1` env var disables redaction for active debugging sessions. New `src/nerves/redact.ts` module with 38 tests across 3 test files including a 10-case golden corpus covering nested objects, mixed safe/secret fields, and realistic key patterns."
+      ]
+    },
     {
       "version": "0.1.0-alpha.286",
       "changes": [

package/dist/nerves/coverage/file-completeness.js

@@ -69,6 +69,8 @@ const DISPATCH_EXEMPT_PATTERNS = [
     "mind/embedding-provider",
     // Commerce utility module: error classes and pure helpers (no independent side effects).
     "repertoire/commerce-errors",
+    // Log redaction: pure utility consumed by the NDJSON sink (no independent side effects).
+    "nerves/redact",
 ];
 function isDispatchExempt(filePath) {
     return DISPATCH_EXEMPT_PATTERNS.some((pattern) => filePath.includes(pattern));

package/dist/nerves/index.js

@@ -54,6 +54,7 @@ const zlib = __importStar(require("zlib"));
 // lazily inside `getRuntimeLogger()`, and we only call `emitNervesEvent` from
 // inside `rotateIfNeeded` — never at module top level.
 const runtime_1 = require("./runtime");
+const redact_1 = require("./redact");
 const LEVEL_PRIORITY = {
     debug: 10,
     info: 20,
@@ -293,6 +294,7 @@ function createNdjsonFileSink(filePath, optionsOrMaxSize) {
         ? { maxSizeBytes: optionsOrMaxSize }
         : optionsOrMaxSize ?? {};
     const rotationCheckInterval = options.rotationCheckIntervalBytes ?? DEFAULT_ROTATION_CHECK_INTERVAL_BYTES;
+    const verbose = process.env.OURO_LOG_VERBOSE === "1";
     const queue = [];
     let flushing = false;
     let bytesSinceCheck = 0;
@@ -316,7 +318,9 @@ function createNdjsonFileSink(filePath, optionsOrMaxSize) {
         });
     }
     return (entry) => {
-        const line = `${JSON.stringify(entry)}\n`;
+        const line = verbose
+            ? `${JSON.stringify(entry)}\n`
+            : `${(0, redact_1.redactString)(JSON.stringify((0, redact_1.redactLogEntry)(entry)))}\n`;
         bytesSinceCheck += line.length;
         queue.push(line);
         flush();

package/dist/nerves/redact.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_PATTERNS = exports.SENSITIVE_KEYS = void 0;
+exports.redactMeta = redactMeta;
+exports.redactString = redactString;
+exports.redactLogEntry = redactLogEntry;
+/**
+ * Lowercase key names that trigger structured redaction.
+ * Matched case-insensitively against meta object keys.
+ */
+exports.SENSITIVE_KEYS = new Set([
+    "password",
+    "secret",
+    "token",
+    "accesstoken",
+    "refreshtoken",
+    "clientsecret",
+    "apikey",
+    "oauthaccesstoken",
+    "authorization",
+    "cookie",
+    "set-cookie",
+]);
+/**
+ * Regex patterns for string-level fallback redaction.
+ * Applied in order; each match is replaced with `[REDACTED:name]`.
+ */
+exports.SENSITIVE_PATTERNS = [
+    { name: "anthropic_key", pattern: /sk-ant-[A-Za-z0-9_-]+/g },
+    { name: "openai_key", pattern: /sk-proj-[A-Za-z0-9_-]+/g },
+    { name: "bearer_token", pattern: /Bearer [A-Za-z0-9\-_.]+/g },
+    { name: "api_key_assignment", pattern: /api[_-]?key[=:]\s*["']?[A-Za-z0-9\-_.]+/g },
+    { name: "url_token", pattern: /[?&](?:token|key|api_key|access_token)=[A-Za-z0-9\-_.%]+/g },
+];
+/**
+ * Deep-clone meta and replace values at sensitive keys with `[REDACTED:key_name]`.
+ * Recurses into nested objects. Case-insensitive key matching.
+ */
+function redactMeta(meta) {
+    const result = {};
+    for (const key of Object.keys(meta)) {
+        const value = meta[key];
+        if (exports.SENSITIVE_KEYS.has(key.toLowerCase())) {
+            result[key] = `[REDACTED:${key}]`;
+        }
+        else if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+            result[key] = redactMeta(value);
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Apply all regex patterns to a string, replacing matches with `[REDACTED:pattern_name]`.
+ */
+function redactString(text) {
+    let result = text;
+    for (const { name, pattern } of exports.SENSITIVE_PATTERNS) {
+        // Reset lastIndex for global regexes reused across calls
+        pattern.lastIndex = 0;
+        result = result.replace(pattern, `[REDACTED:${name}]`);
+    }
+    return result;
+}
+/**
+ * Full redaction pipeline: redact meta (structured keys), then redact message (regex patterns).
+ * Returns a new LogEvent -- never mutates the input.
+ */
+function redactLogEntry(entry) {
+    const redactedMeta = redactMeta(entry.meta);
+    const redactedMessage = redactString(entry.message);
+    return {
+        ...entry,
+        meta: redactedMeta,
+        message: redactedMessage,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.286",
+  "version": "0.1.0-alpha.287",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",