@rulvar/cli 1.57.0 → 1.58.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { r as runCli, t as processIo } from "./io-FzfY_HhN.js";
+import { r as runCli, t as processIo } from "./io-DzlCfHd9.js";
 import { sanitizeTerminalText } from "@rulvar/core";
 import { inspect } from "node:util";
 //#region src/cli.ts

package/dist/index.d.ts

@@ -121,6 +121,12 @@ interface AssembledCli {
   workflows: WorkflowRegistry;
   /** The journal-fold price function (table wins over caps). */
   priceUsd: (servedBy: ModelRef, usage: Usage) => number | undefined;
+  /**
+  * The deployment's argsHash salt (engineOptions.security, RV-217),
+  * surfaced so the CLI resume args gate hashes supplied --args the
+  * same way the engine hashed the genesis args.
+  */
+  argsHashSalt?: string;
 }
 declare function assembleEngine(options: {
   config: CliConfig;
@@ -348,6 +354,13 @@ interface ToOtelOptions {
   contextApi?: OtelContextApi;
   /** trace.setSpan(context, span) equivalent; required with contextApi. */
   setSpan?: (context: unknown, span: SpanLike) => unknown;
+  /**
+  * Host redaction patterns applied to every exported string attribute
+  * ON TOP of the default credential set (RV-217). Feed the same list
+  * as `createEngine redaction.patterns` for event/trace parity; an
+  * invalid pattern is a typed ConfigError before anything exports.
+  */
+  patterns?: ReadonlyArray<RegExp | string>;
 }
 /**
 * Exports one settled run's event stream onto a tracer. The run's

package/dist/index.js

@@ -1,5 +1,5 @@
-import { _ as looksLikeFile, a as resumeCommand, c as driveRun, d as attachProgress, f as renderEventLine, g as loadWorkflowModule, h as loadCliConfig, i as inspectCommand, l as reportOutcome, m as assembleEngine, n as HELP, o as runCommand, p as DEFAULT_STORE_DIR, r as runCli, s as runsLsCommand, t as processIo, u as strictExitCode } from "./io-FzfY_HhN.js";
-import { ConfigError, InvalidResolutionError, JournalCompatibilityError, LeaseHeldError, Replayer, RulvarError, buildDeriverRegistry, costReportFromJournal, maskSecrets, normalizeEntry, readRunMeta, scanJournalCompatibility, validateSchemaSpec } from "@rulvar/core";
+import { _ as looksLikeFile, a as resumeCommand, c as driveRun, d as attachProgress, f as renderEventLine, g as loadWorkflowModule, h as loadCliConfig, i as inspectCommand, l as reportOutcome, m as assembleEngine, n as HELP, o as runCommand, p as DEFAULT_STORE_DIR, r as runCli, s as runsLsCommand, t as processIo, u as strictExitCode } from "./io-DzlCfHd9.js";
+import { ConfigError, InvalidResolutionError, JournalCompatibilityError, LeaseHeldError, Replayer, RulvarError, buildDeriverRegistry, compileSecretMasker, costReportFromJournal, maskSecrets, normalizeEntry, readRunMeta, scanJournalCompatibility, validateSchemaSpec } from "@rulvar/core";
 //#region src/server.ts
 /**
 * createServer (M8-T01): the HTTP shell over the public engine API
@@ -827,7 +827,7 @@ function spanName(event) {
 		default: return event.type;
 	}
 }
-function openAttributes(event, runId) {
+function openAttributes(event, runId, maskText) {
 	const attrs = {
 		"rulvar.run_id": runId,
 		"rulvar.entry_seq": event.seq
@@ -847,7 +847,7 @@ function openAttributes(event, runId) {
 		attrs["rulvar.invocation"] = event.invocation;
 	}
 	if (event.type === "tool:start") attrs["rulvar.tool_name"] = event.toolName;
-	for (const [key, value] of Object.entries(attrs)) if (typeof value === "string") attrs[key] = maskSecrets(value);
+	for (const [key, value] of Object.entries(attrs)) if (typeof value === "string") attrs[key] = maskText(value);
 	return attrs;
 }
 /**
@@ -862,6 +862,8 @@ async function toOtel(run, tracer, options = {}) {
 	const stack = [];
 	let created = 0;
 	const { contextApi, setSpan } = options;
+	const masker = options.patterns === void 0 ? void 0 : compileSecretMasker(options.patterns, "toOtel patterns");
+	const maskText = (text) => masker === void 0 ? maskSecrets(text) : masker.maskText(text);
 	const startSpan = (event, key = event.spanId, parentKey) => {
 		const parentId = parentKey ?? event.parentSpanId;
 		if (openBySpanId.has(key)) {
@@ -872,7 +874,7 @@ async function toOtel(run, tracer, options = {}) {
 		const parentContext = parent !== void 0 && contextApi !== void 0 && setSpan !== void 0 ? setSpan(contextApi.active(), parent.span) : void 0;
 		const span = tracer.startSpan(spanName(event), {
 			startTime: msOf(event.ts),
-			attributes: openAttributes(event, run.runId)
+			attributes: openAttributes(event, run.runId, maskText)
 		}, parentContext);
 		created += 1;
 		const open = {
@@ -943,7 +945,7 @@ async function toOtel(run, tracer, options = {}) {
 					"rulvar.entry_seq": event.seq,
 					"rulvar.determinism.category": event.category,
 					"rulvar.determinism.provenance": event.provenance,
-					...event.file === void 0 ? {} : { "code.filepath": maskSecrets(event.file) },
+					...event.file === void 0 ? {} : { "code.filepath": maskText(event.file) },
 					...event.line === void 0 ? {} : { "code.lineno": event.line }
 				});
 				break;

package/dist/{io-FzfY_HhN.js → io-DzlCfHd9.js}

@@ -108,11 +108,13 @@ function assembleEngine(options) {
 		const pricing = resolvePricing(servedBy, engineOptions.pricing, byId.get(adapterId)?.caps(model).pricing);
 		return pricing === void 0 ? void 0 : priceUsdOf(pricing, usage);
 	};
+	const argsHashSalt = engineOptions.security?.argsHashSalt;
 	return {
 		engine,
 		store,
 		workflows,
-		priceUsd
+		priceUsd,
+		...argsHashSalt === void 0 ? {} : { argsHashSalt }
 	};
 }
 /**
@@ -826,7 +828,7 @@ function enforceArgsBinding(input) {
 		}
 		let supplied;
 		try {
-			supplied = hashRunArgs(args);
+			supplied = hashRunArgs(args, input.salt === void 0 ? void 0 : { salt: input.salt });
 		} catch {
 			throw new ConfigError(`--args cannot be canonicalized to compare against run '${meta.runId}' (a numeric value overflows the finite range, or the value is otherwise not canonical JSON); supply finite JSON, or force the resume with --allow-args-change; ${usageOf(GRAMMAR.resume)}`);
 		}
@@ -862,7 +864,8 @@ async function resumeCommand(argv, context) {
 		argsGiven,
 		args,
 		allowChange,
-		io: context.io
+		io: context.io,
+		...assembled.argsHashSalt === void 0 ? {} : { salt: assembled.argsHashSalt }
 	});
 	const name = meta.workflowName;
 	const workflow = name === void 0 ? void 0 : assembled.workflows[name];
@@ -919,7 +922,8 @@ async function replayCommand(argv, context) {
 		argsGiven,
 		args,
 		allowChange: false,
-		io: context.io
+		io: context.io,
+		...assembled.argsHashSalt === void 0 ? {} : { salt: assembled.argsHashSalt }
 	});
 	const name = meta.workflowName;
 	const workflow = name === void 0 ? void 0 : assembled.workflows[name];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/cli",
-  "version": "1.57.0",
+  "version": "1.58.0",
   "description": "Rulvar shell: run/resume/runs/inspect/plan/kb commands, TUI progress, createServer, createWorker, OTel exporter.",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,17 +22,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@rulvar/core": "1.57.0"
+    "@rulvar/core": "1.58.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.0",
     "tsdown": "^0.22.3",
     "typescript": "~6.0.3",
-    "@rulvar/testing": "1.57.0",
-    "@rulvar/store-sqlite": "1.57.0",
-    "@rulvar/plan": "1.57.0",
-    "@rulvar/evals": "1.57.0",
-    "@rulvar/planner": "1.57.0"
+    "@rulvar/testing": "1.58.0",
+    "@rulvar/store-sqlite": "1.58.0",
+    "@rulvar/planner": "1.58.0",
+    "@rulvar/evals": "1.58.0",
+    "@rulvar/plan": "1.58.0"
   },
   "bin": {
     "rulvar": "./dist/cli.js"