@staff0rd/assist 0.495.0 → 0.496.1

package/dist/index.js

@@ -6,7 +6,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@staff0rd/assist",
-  version: "0.495.0",
+  version: "0.496.1",
   type: "module",
   main: "dist/index.js",
   bin: {
@@ -10848,6 +10848,46 @@ function toSegment(part) {
   return typeof part === "number" ? { kind: "index", index: part } : { kind: "key", name: String(part) };
 }
 
+// src/shared/maskConfigSecrets.ts
+var SECRET_MASK = "<hidden>";
+function maskConfigSecrets(value, node) {
+  return mapConfigSecrets(value, node, () => SECRET_MASK);
+}
+
+// src/shared/scrubConfigSecrets.ts
+function secretStrings(value, node) {
+  const secrets = [];
+  mapConfigSecrets(value, node, (secret) => {
+    if (typeof secret === "string" && secret !== "") secrets.push(secret);
+    return secret;
+  });
+  return secrets;
+}
+function literalAndJsonEncoded(secret) {
+  const encoded = JSON.stringify(secret).slice(1, -1);
+  return encoded === secret ? [secret] : [secret, encoded];
+}
+function scrubConfigSecrets(messages, value, node) {
+  const needles = secretStrings(value, node).flatMap(literalAndJsonEncoded).sort((a, b) => b.length - a.length);
+  if (needles.length === 0) return messages;
+  return messages.map(
+    (message3) => needles.reduce(
+      (text17, needle) => text17.split(needle).join(SECRET_MASK),
+      message3
+    )
+  );
+}
+
+// src/commands/config/configKeyNode.ts
+function configKeyNode(key) {
+  return configEntryNode(describeConfigNode(assistConfigSchema), key);
+}
+
+// src/commands/config/scrubConfigKeyError.ts
+function scrubConfigKeyError(error, key, value) {
+  return scrubConfigSecrets([error], value, configKeyNode(key))[0];
+}
+
 // src/commands/config/coerceConfigValue.ts
 var EDITABLE_TYPES = /* @__PURE__ */ new Set([
   "string",
@@ -10857,6 +10897,11 @@ var EDITABLE_TYPES = /* @__PURE__ */ new Set([
   "union"
 ]);
 function coerceConfigValue(key, raw) {
+  const result = coerceValue(key, raw);
+  if (result.ok) return result;
+  return { ok: false, error: scrubConfigKeyError(result.error, key, raw) };
+}
+function coerceValue(key, raw) {
   const leaf = describeConfigLeaves(assistConfigSchema).find(
     (candidate) => candidate.key === key
   );
@@ -10917,7 +10962,7 @@ function restoreConfigSecrets(value, stored, node) {
 
 // src/commands/config/restoreConfigWriteSecrets.ts
 function restoreConfigWriteSecrets(key, value, cwd) {
-  const node = configEntryNode(describeConfigNode(assistConfigSchema), key);
+  const node = configKeyNode(key);
   if (!node) return value;
   const stored = loadConfigFrom(cwd);
   return restoreConfigSecrets(value, getNestedValue(stored, key), node);
@@ -10975,9 +11020,10 @@ function setNestedValue(obj, path71, value) {
 function validateConfig(updated, key, schema2 = assistConfigSchema) {
   const result = schema2.safeParse(updated);
   if (result.success) return { ok: true };
+  const errors = result.error.issues.map((issue) => formatIssue2(issue, key));
   return {
     ok: false,
-    errors: result.error.issues.map((issue) => formatIssue2(issue, key))
+    errors: scrubConfigSecrets(errors, updated, describeConfigNode(schema2))
   };
 }
 function formatIssue2(issue, key) {
@@ -15121,10 +15167,17 @@ function parsePerms(entries) {
   return map;
 }
 
+// src/shared/revealsConfigSecret.ts
+var REVEAL_RE = /^assist\s+config\s+get\b.*\s--reveal\b/;
+function revealsConfigSecret(command) {
+  return REVEAL_RE.test(command);
+}
+
 // src/shared/isApprovedRead.ts
 var READ_RE = /^Read\((.+)\)$/;
 var SAFE_BUILTINS = /* @__PURE__ */ new Set(["true", "false"]);
 function isApprovedRead(command, toolName = "Bash") {
+  if (revealsConfigSecret(command)) return void 0;
   if (SAFE_BUILTINS.has(command)) return `safe shell builtin: ${command}`;
   if (isCdToCwd(command)) return "cd to current directory";
   const cdRead = isCdToReadAllowedDir(command);
@@ -16671,14 +16724,6 @@ function registerComplexity(program2) {
 
 // src/commands/config/index.ts
 import { stringify as stringifyYaml2 } from "yaml";
-
-// src/shared/maskConfigSecrets.ts
-var SECRET_MASK = "<hidden>";
-function maskConfigSecrets(value, node) {
-  return mapConfigSecrets(value, node, () => SECRET_MASK);
-}
-
-// src/commands/config/index.ts
 function configList() {
   const config = maskConfigSecrets(
     loadConfig(),
@@ -16689,16 +16734,21 @@ function configList() {
 
 // src/commands/config/configGet.ts
 import chalk131 from "chalk";
+
+// src/commands/config/maskConfigKeySecrets.ts
+function maskConfigKeySecrets(key, value) {
+  return maskConfigSecrets(value, configKeyNode(key));
+}
+
+// src/commands/config/configGet.ts
 function configGet(key, options2 = {}) {
   const value = requireNestedValue(
     loadConfig(),
     key
   );
-  console.log(formatOutput(options2.reveal ? value : maskSecretsAt(value, key)));
-}
-function maskSecretsAt(value, key) {
-  const node = configEntryNode(describeConfigNode(assistConfigSchema), key);
-  return maskConfigSecrets(value, node);
+  console.log(
+    formatOutput(options2.reveal ? value : maskConfigKeySecrets(key, value))
+  );
 }
 function formatOutput(value) {
   return typeof value === "object" && value !== null ? JSON.stringify(value, null, 2) : String(value);
@@ -16769,9 +16819,8 @@ function configSet(key, value, options2 = {}) {
   if (!coercion.ok) exitWithConfigErrors([coercion.error]);
   const coerced = coercion.value;
   const target = resolved.useRepo ? `repo: ${applyRepoOrExit(resolved.key, coerced, resolved.repoName)}` : applyOrExit(resolved.key, coerced, options2.global ?? false);
-  console.log(
-    chalk133.green(`Set ${resolved.key} = ${JSON.stringify(coerced)} (${target})`)
-  );
+  const shown = JSON.stringify(maskConfigKeySecrets(resolved.key, coerced));
+  console.log(chalk133.green(`Set ${resolved.key} = ${shown} (${target})`));
 }
 function applyOrExit(key, coerced, global) {
   const result = applyConfigSet(key, coerced, global);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@staff0rd/assist",
-	"version": "0.495.0",
+	"version": "0.496.1",
 	"type": "module",
 	"main": "dist/index.js",
 	"bin": {