@proagentstore/cli 0.4.86 → 0.4.87

package/dist/browser-runner/local-browser/contract.js

@@ -148,6 +148,36 @@ export function parseLocalBrowserEvent(raw) {
         event.detail = detail;
     return event;
 }
+/**
+ * A finding, with every free-text part redacted (#947).
+ *
+ * The gap this closes: the result envelope's `summary` and `error` went through {@link redactText}
+ * and its FINDINGS did not. `title`, `evidence` and `detail` were length-capped only, and `fields`
+ * was filtered by KEY ({@link SENSITIVE_KEY}) — so a credential-shaped value under an innocuous key
+ * (`{"note": "sk-ant-api03-…"}`) survived, and a secret environment value quoted into `evidence`
+ * survived verbatim. Both are written by the same CLI, on the same machine, in the same envelope as
+ * the summary that WAS cleaned, and findings are the part that persists furthest: the run's result
+ * row, the console, MCP, and then the owner's own collection record. #947's observability rule —
+ * "do not retain … secret environment values" — was therefore breached on the longest-lived path.
+ *
+ * One definition, used by the runner (which knows the machine's secret env values and passes them)
+ * and again by the API when it parses what arrived (which does not, and catches shapes). Defence in
+ * depth on purpose: the runner is where secrets are knowable, and the cloud is where a runner that
+ * skipped the step is still caught.
+ */
+export function redactFinding(f, secrets = []) {
+    const fields = {};
+    for (const [k, v] of Object.entries(f.fields ?? {})) {
+        if (SENSITIVE_KEY.test(k))
+            continue;
+        fields[k] = typeof v === "string" ? redactText(v, secrets) : v;
+    }
+    return { title: redactText(f.title, secrets), url: f.url, evidence: redactText(f.evidence, secrets), fields };
+}
+/** The same for a source failure's free text; its `reason` is a closed vocabulary and its url is a url. */
+export function redactSourceFailure(f, secrets = []) {
+    return f.detail === undefined ? f : { ...f, detail: redactText(f.detail, secrets) };
+}
 /**
  * A validated result envelope, or the reason it is not one.
  *
@@ -194,7 +224,9 @@ export function parseLocalBrowserResult(raw) {
             else if (typeof v === "number" || typeof v === "boolean" || v === null)
                 fields[k.slice(0, 100)] = v;
         }
-        findings.push({ title, url, evidence, fields });
+        // #947: capped and key-filtered is not redacted. A finding is the longest-lived thing a run
+        // produces, and its free text was the one part of this envelope nothing cleaned.
+        findings.push(redactFinding({ title, url, evidence, fields }));
     }
     const sourceFailures = [];
     for (const [i, f] of o.sourceFailures.entries()) {
@@ -204,7 +236,7 @@ export function parseLocalBrowserResult(raw) {
         if (!url || !reason)
             return { error: `sourceFailures[${i}] needs url and a known reason` };
         const detail = str(r.detail, 1000);
-        sourceFailures.push(detail ? { url, reason, detail } : { url, reason });
+        sourceFailures.push(redactSourceFailure(detail ? { url, reason, detail } : { url, reason }));
     }
     const out = { runId, outcome, findings, sourceFailures, summary: redactText(str(o.summary, LOCAL_BROWSER_CAPS.text) ?? ""), traceId, engineAuth };
     // Redacted again here, whatever the runner did: an error is CLI output, and CLIs print keys.

package/dist/browser-runner/local-browser/runtime.js

@@ -26,7 +26,7 @@ import { fileURLToPath } from "node:url";
 import { RunnerInputError } from "../errors.js";
 import { BrowserBridge, domainWithin } from "./bridge.js";
 import { BRIDGE_ENV } from "./bridge-stdio.js";
-import { LOCAL_BROWSER_AUTH_MODES, LOCAL_BROWSER_ENGINES, LOCAL_BROWSER_TASK_TYPE, redactDetail, redactText, secretEnvValues, } from "./contract.js";
+import { LOCAL_BROWSER_AUTH_MODES, LOCAL_BROWSER_ENGINES, LOCAL_BROWSER_TASK_TYPE, redactDetail, redactFinding, redactSourceFailure, redactText, secretEnvValues, } from "./contract.js";
 import { bridgeUnused, buildEngineSpec, finalText, missingLogin, observedEngineAuth, researchPrompt, signInHelp } from "./engine.js";
 /**
  * Why the run could not be launched, in words the owner can act on (#944).
@@ -434,8 +434,11 @@ export class LocalBrowserRuntime {
         run.result = {
             runId: run.envelope.runId,
             outcome: r.outcome,
-            findings: run.bridge?.findings ?? [],
-            sourceFailures: run.bridge?.sourceFailures ?? [],
+            // #947: the machine's own secret env values are knowable HERE and nowhere later, so the
+            // findings are cleaned with them — the same treatment `summary` and `error` below already
+            // had, and the part of this envelope that previously kept whatever the CLI wrote.
+            findings: (run.bridge?.findings ?? []).map((f) => redactFinding(f, run.secrets)),
+            sourceFailures: (run.bridge?.sourceFailures ?? []).map((f) => redactSourceFailure(f, run.secrets)),
             summary: redactText((r.summary ?? "").slice(0, 4000), run.secrets),
             traceId: run.envelope.runId,
             engineAuth: r.engineAuth ?? run.engineAuth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.86",
+  "version": "0.4.87",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",