@smthrs/journal 1.0.0-rc.6 → 1.0.0-rc.8

package/dist/esm/Redaction.js

@@ -661,7 +661,14 @@ export const defaultRules = [
         // of `aaaaaaaa-` cost 11 seconds, on the path every journal write and every
         // log line takes. A scheme longer than 30 characters is not one this net is
         // for, and the cap makes each start position cost a constant.
-        pattern: /\b([a-z][a-z0-9+.-]{0,30}:\/\/[^\s:@/]+):(?!\[REDACTED\]@)[^\s:@/]+@/gi,
+        //
+        // The username may be empty (`redis://:password@host`), and the password
+        // runs to the LAST `@` before the authority ends, as a URL parser reads
+        // it: RFC 3986 allows `:` in a password and a raw `@` is common in
+        // connection strings. Stopping at the first `:` or `@` left the tail of
+        // such a password in the row. Quotes and backslashes end the scan so a
+        // URL inside JSON text never swallows the next string.
+        pattern: /\b([a-z][a-z0-9+.-]{0,30}:\/\/[^\s:@/]*):(?!\[REDACTED\]@)[^\s/?#"'`\\]*@/gi,
         replace: "$1:[REDACTED]@"
     },
     {
@@ -717,6 +724,23 @@ export const defaultRules = [
         pattern: /\bAIza[0-9A-Za-z_-]{35,}(?![0-9A-Za-z_-])/g,
         replace: "[REDACTED]"
     },
+    {
+        id: "gitlab-token",
+        pattern: /\bglpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+        replace: "[REDACTED]"
+    },
+    {
+        id: "npm-token",
+        pattern: /\bnpm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
+        replace: "[REDACTED]"
+    },
+    {
+        // The webhook path is the whole credential: anyone holding it can post
+        // to the channel. The host stays so a failed delivery is still readable.
+        id: "slack-webhook",
+        pattern: /(\bhooks\.slack\.com\/services\/)T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,
+        replace: "$1[REDACTED]"
+    },
     {
         id: "assignment",
         // A credential name, `:`, `=` or `=>`, and its whole value: quoted at any
@@ -925,12 +949,15 @@ const tokenCounterKeys = new Set([
     "totaltoken"
 ]);
 /**
- * A bare plural `tokens` is a count too: `Envelope.budget.tokens` is the run's
- * token ceiling, and redacting it erased every journaled budget. A singular
- * `token` stays bearer material even when it is numeric.
+ * Any name ending in a plural `tokens` holds a count too, the rule the textual
+ * pass applies in {@link namesCredential}: `Envelope.budget.tokens` is the
+ * run's token ceiling, and `usage.cacheWriteTokens`, `maxTokens`, and
+ * `contextWindowTokens` are accounting; redacting them erased every journaled
+ * budget and cache-write count (#3846). A bare singular `token` stays bearer
+ * material even when it is numeric.
  */
 const isTokenCount = (key, value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 &&
-    (tokenCounterKeys.has(canonicalKey(key)) || key.toLowerCase() === "tokens");
+    (tokenCounterKeys.has(canonicalKey(key)) || /tokens$/i.test(key));
 /**
  * Whether a field name names a credential.
  *