@synkro-sh/cli 1.6.90 → 1.6.91

package/dist/bootstrap.js

@@ -2218,6 +2218,44 @@ function isPlaceholderSecret(v: string): boolean {
   const tail = v.replace(/^(sk-ant-|[rs]k_(?:live|test)_|sk-|AKIA|gh[posru]_|AIza|xox[baprs]-|Bearer[ ]+)/, '');
   return /^(x+|0+|a+|placeholder|example|changeme|your[-_a-z0-9]*|dummy|test|fake|redacted|sample)$/i.test(tail);
 }
+// \u2500\u2500 Opaque-secret heuristic (catches the FORMAT-LESS tail the regex can't) \u2500\u2500
+// A high-entropy value sitting in a SECRET CONTEXT \u2014 assigned to a secret-named
+// variable, in an auth header, or as a connection-string password. Local +
+// deterministic, no model. Char-class regexes only (template-literal backslash safe).
+function shannonEntropy(s: string): number {
+  const m: Record<string, number> = {};
+  for (const ch of s) m[ch] = (m[ch] || 0) + 1;
+  let h = 0;
+  for (const k in m) { const p = m[k] / s.length; h -= p * Math.log2(p); }
+  return h;
+}
+function looksOpaqueSecret(v: string): boolean {
+  if (v.length < 16) return false;
+  if (/[$<>{}]/.test(v)) return false;                                                            // env ref / placeholder
+  if (/^[0-9a-f]{32,}$/i.test(v)) return false;                                                    // hex hash / sha
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v)) return false;     // uuid
+  if (!(/[a-zA-Z]/.test(v) && /[0-9]/.test(v))) return false;                                      // real tokens mix letters+digits
+  return shannonEntropy(v) >= 3.2;
+}
+const OPAQUE_CTX_PATTERNS: RegExp[] = [
+  /[A-Za-z_][A-Za-z0-9_-]*(?:secret|token|key|password|passwd|api[_-]?key|auth|credential)[A-Za-z0-9_-]*[ ]*[=:][ ]*["']?([^ "'&|;]+)/gi,
+  /(?:authorization|x-api-key|x-auth-token|api-key)[ ]*:[ ]*(?:bearer[ ]+)?([^ "']+)/gi,
+  /[a-z][a-z0-9+.-]*:[/][/][^:/@ ]+:([^@/ ]+)@/gi,
+];
+export function detectOpaqueSecrets(text: string): SecretHit[] {
+  if (!text) return [];
+  const hits: SecretHit[] = [];
+  const seen = new Set<string>();
+  for (const re of OPAQUE_CTX_PATTERNS) {
+    re.lastIndex = 0;
+    let m: RegExpExecArray | null;
+    while ((m = re.exec(text)) !== null) {
+      const v = m[1];
+      if (v && !seen.has(v) && looksOpaqueSecret(v)) { seen.add(v); hits.push({ type: 'opaque-secret', value: v }); }
+    }
+  }
+  return hits;
+}
 export function detectHardSecrets(text: string): SecretHit[] {
   if (!text) return [];
   const hits: SecretHit[] = [];
@@ -2232,6 +2270,10 @@ export function detectHardSecrets(text: string): SecretHit[] {
       hits.push({ type, value: v });
     }
   }
+  // Union the format-less opaque-secret tail (entropy + secret context).
+  for (const h of detectOpaqueSecrets(text)) {
+    if (!seen.has(h.value)) { seen.add(h.value); hits.push(h); }
+  }
   return hits;
 }
 // Shape-preserving redaction for persist/log/grade boundaries: the reader still
@@ -2247,6 +2289,8 @@ export function scrubSecrets(text: string): string {
     if (/[$<>{}]/.test(val)) return full;
     return pfx + '<redacted:credential>';
   });
+  // Format-less opaque secrets (entropy + secret context) the patterns above miss.
+  for (const h of detectOpaqueSecrets(out)) out = out.split(h.value).join('<redacted:opaque-secret>');
   return out;
 }
 function guessEnvName(type: string, i: number): string {
@@ -11164,7 +11208,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.90")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.91")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -15207,7 +15251,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.90");
+  console.log("1.6.91");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents