@sjawhar/pi-legion 9.1.0 → 9.1.2

package/dist/legion.js

@@ -15477,6 +15477,15 @@ var CHECKS = {
 };
 var MAX_DETAIL_BYTES = 1024;
 var HELD = "\uFFFF";
+var C1_INTRODUCER = "\uFFFE";
+var OPENER = "\uFDD0";
+var HELD_READINGS = [
+  [/(?:\uffff\[|\ufffe)[0-?]*[!-)+,/-]*/g, OPENER],
+  [/\ufdd0[@-~]?/g, HELD],
+  [/\uffff/g, " "]
+];
+var HELD_SEQUENCE = String.raw`\ufffe|\ufdd0|\uffff(?:\[[0-?]*[@-~])?`;
+var JWT_FIRST_HELD_SEQUENCE = String.raw`\ufffe|\uffff(?:\[[0-?]*[@-~])?`;
 function isSpace(code) {
   return code >= 9 && code <= 13 || code === 32 || code === 133 || code === 160 || code === 5760 || code >= 8192 && code <= 8202 || code === 8232 || code === 8233 || code === 8239 || code === 8287 || code === 12288;
 }
@@ -15495,33 +15504,83 @@ function truncateUtf8(text, max) {
 var CREDENTIAL_RULES = [
   [/(?<![a-z0-9+.-])([0-9+.-]*[a-z][a-z0-9+.-]*:\/\/)[^ /?#]+@/gi, "$1***@"],
   [
-    /([?&](?:token|key|secret|password|access_token|refresh_token|id_token|api_key|apikey|client_secret|sig|x-amz-security-token|x-amz-signature)=)[^ &#"'<>]+/gi,
+    /([?&](?:token|key|secret|password|access_token|accesstoken|refresh_token|id_token|auth_token|private_token|api_key|apikey|client_secret|sig|signature|x-amz-security-token|x-amz-signature|x-goog-signature)=)[^ &#"'<>]+/gi,
+    "$1***"
+  ],
+  [
+    /\b(password[ \ufffe\uffff]*=[ \ufffe\uffff]*)(?:(')(?:[^'\\]|\\.)*('?)|[^ &#"'<>]+)/gi,
+    "$1$2***$3"
+  ],
+  [
+    /(authorization\\?["']?[ \ufffe\uffff]*[:=][ \ufffe\uffff]*)(?:(\\["'](?:(?:bearer|basic|token|digest)[ \ufffe\uffff]+)?)[^"'\\]+|(["'](?:(?:bearer|basic|token|digest)[ \ufffe\uffff]+)?)(?:[^"'\\]|\\.)+|(\[?(?:(?:bearer|basic|token|digest)[ \ufffe\uffff]+)?)[^)\]}>]+)/gi,
+    "$1$2$3$4***"
+  ],
+  [
+    new RegExp(String.raw`((?:api-key|ocp-apim-subscription-key|x-subscription-token)\\?["']?[ \ufffe\uffff]*[:=][ \ufffe\uffff]*\\?["']?)(?:[A-Za-z0-9._~+/=*-]|${HELD_SEQUENCE})+`, "gi"),
+    "$1***"
+  ],
+  [
+    /(\\?["'](?:api_key|access_token)\\?["'][ \ufffe\uffff]*:[ \ufffe\uffff]*\\?["'])[^"'\\]+/gi,
+    "$1***"
+  ],
+  [
+    new RegExp(String.raw`\b(bearer[ \ufffe\uffff]+)(?:[A-Za-z0-9._~+/=*-]|${HELD_SEQUENCE})+`, "gi"),
     "$1***"
   ],
   [
-    /(authorization["']?[ \uffff]*[:=][ \uffff]*)(?:(["'])((?:bearer|basic|token|digest)[ \uffff]+)?[^"']+|(\[?)((?:bearer|basic|token|digest)[ \uffff]+)?[^)\]}>]+)/gi,
-    "$1$2$3$4$5***"
+    new RegExp(String.raw`\b(gh[pousr]_|github_pat_)(?:[A-Za-z0-9._-]|${HELD_SEQUENCE}){20,}`, "g"),
+    "$1***"
   ],
-  [/(x-api-key["']?[ \uffff]*[:=][ \uffff]*["']?)[A-Za-z0-9._~+/=*\uffff-]+/gi, "$1***"],
-  [/\b(bearer[ \uffff]+)[A-Za-z0-9._~+/=*\uffff-]+/gi, "$1***"],
-  [/\b(gh[pousr]_|github_pat_)[A-Za-z0-9._\uffff-]{20,}/g, "$1***"],
   [
-    /(?<![A-Za-z0-9_\uffff-])eyJ[A-Za-z0-9_\uffff-]{8,}\.[A-Za-z0-9_\uffff-]{8,}\.[A-Za-z0-9_\uffff-]*/g,
+    new RegExp(String.raw`(?:(?=eyJ)(?<!\uffff\[[0-?]*(?:[@-~]?|\\u[0-9A-Fa-f]{4}))(?:(?<![A-Za-z0-9_\ufffe\uffff-])|(?<=%[0-9A-Fa-f]{2}|\\u[0-9A-Fa-f]{4}))eyJ(?:[A-Za-z0-9_-]|${JWT_FIRST_HELD_SEQUENCE}){8,}|(?<=\uffff)eyJ(?:[A-Za-z0-9_-]|\ufffe){8,}|(?=eyJ)(?<=\uffff\[[0-?]*(?:[@-~]|\\u[0-9A-Fa-f]{4})?)eyJ[A-Za-z0-9_-]*\ufffe(?:[A-Za-z0-9_-]|\ufffe)*)\.(?:[A-Za-z0-9_-]|${HELD_SEQUENCE}){8,}\.(?:[A-Za-z0-9_-]|${HELD_SEQUENCE})*`, "g"),
     "***"
   ],
-  [/\b(sk-|dsp_)[A-Za-z0-9_\uffff-]{20,}/g, "$1***"],
-  [/\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, "$1***"]
+  [
+    new RegExp(String.raw`\b(sk-|dsp_|ya29\.|xox[a-z]-|glpat-|npm_)(?:[A-Za-z0-9_-]|${HELD_SEQUENCE}){20,}`, "g"),
+    "$1***"
+  ],
+  [new RegExp(String.raw`\b(AIza)(?:[A-Za-z0-9_-]|${HELD_SEQUENCE}){35,}`, "g"), "$1***"],
+  [new RegExp(String.raw`\b(AKIA|ASIA)(?:(?:${HELD_SEQUENCE})*[A-Z0-9]){16}\b`, "g"), "$1***"]
 ];
+var MAX_REDACTION_PASSES = 8;
+function redactCredentials(text) {
+  let line = text;
+  for (let pass = 0;pass < MAX_REDACTION_PASSES; pass++) {
+    const next = CREDENTIAL_RULES.reduce((redacted, [pattern, replacement]) => redacted.replace(pattern, replacement), line);
+    if (next === line)
+      break;
+    line = next;
+  }
+  return line;
+}
+function withoutLastCodePoint(text) {
+  const last = text.charCodeAt(text.length - 1);
+  return text.slice(0, last >= 56320 && last <= 57343 && text.length > 1 ? -2 : -1);
+}
 function cleanDetail(text) {
   let marked = "";
   for (const char of text) {
     const code = char.codePointAt(0) ?? 0;
-    const control = code < 32 || code >= 127 && code < 160;
-    marked += isSpace(code) ? " " : control ? HELD : char;
+    const control = code < 32 || code >= 127 && code < 160 || code === 65534 || code === 64976 || code === 65533;
+    marked += isSpace(code) ? " " : code === 155 ? C1_INTRODUCER : control ? HELD : char;
+  }
+  let redacted = redactCredentials(marked);
+  if (marked.includes(HELD) || marked.includes(C1_INTRODUCER)) {
+    for (const [pattern, replacement] of HELD_READINGS) {
+      const read = redacted.replace(pattern, replacement);
+      if (read !== redacted)
+        redacted = redactCredentials(read);
+    }
+  }
+  const line = redacted.split(" ").filter((field) => field !== "").join(" ");
+  let cut = truncateUtf8(line, MAX_DETAIL_BYTES).replace(/ +$/, "");
+  if (cut.length < line.length) {
+    while (redactCredentials(cut) !== cut) {
+      const space = cut.lastIndexOf(" ");
+      cut = space > 0 ? cut.slice(0, space) : withoutLastCodePoint(cut);
+    }
   }
-  const redacted = CREDENTIAL_RULES.reduce((line2, [pattern, replacement]) => line2.replace(pattern, replacement), marked);
-  const line = redacted.replaceAll(HELD, " ").split(" ").filter((field) => field !== "").join(" ");
-  return truncateUtf8(line, MAX_DETAIL_BYTES);
+  return cut;
 }
 function budgetLabel(ms) {
   return ms % 1000 === 0 ? `${ms / 1000} s` : `${ms} ms`;
@@ -15641,7 +15700,7 @@ function onEnvoyRoleRegained(listener) {
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion",
-  version: "9.1.0",
+  version: "9.1.2",
   license: "Apache-2.0",
   type: "module",
   omp: {
@@ -15956,6 +16015,7 @@ var LegionOperatorClaimResponse = exports_external.strictObject({
   }),
   uncertainStreak: exports_external.number().int().nonnegative(),
   pending: legionDeliveryView.optional(),
+  suspendedBy: exports_external.enum(["unknown", "operator", "daemon", "exit"]).optional(),
   suspensionHeld: exports_external.literal(true).optional()
 });
 var LegionOperatorClaimsResponse = exports_external.strictObject({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion",
-  "version": "9.1.0",
+  "version": "9.1.2",
   "license": "Apache-2.0",
   "type": "module",
   "omp": {