@tekmidian/pai 1.0.6 → 1.0.7

package/dist/hooks/worker-guard.mjs

@@ -8180,6 +8180,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8774,6 +8775,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8910,6 +8918,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,
@@ -10412,20 +10421,50 @@ function wrapTestCommand(command) {
 var REDACTED = "[REDACTED]";
 var REDACTED_RE = String.raw`\[REDACTED\]`;
 var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+var PROSE = "is|are|was|were|be|to|of|in|on|for|and|or|the|a|an|that|this|it|not|out|here|there|so|as|at|by|with|if|when|which";
 var VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
 var REDACT_RULES = [
   {
     // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
     id: "authorization",
-    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+(\S+)/gi,
+    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+([^\s'"]+)/gi,
     replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
   },
+  {
+    // `Cookie: a=b; c=d` — keep the cookie names, redact every value
+    id: "cookie",
+    re: /((?:Set-)?Cookie\s*:\s*)([^\n]+)/gi,
+    replace: (_m, head, rest) => `${head}${rest.replace(/([^=;\s'"]+=)[^;'"]*/g, `$1${REDACTED}`)}`
+  },
   {
     // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
-    // the word must be a whole key segment, so `monkeys=` stays untouched
+    // the word must be a whole key segment, so `monkeys=` stays untouched.
+    // The separator may start with the key's closing quote (JSON); it is kept.
     id: "key-value",
-    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(${VAL})`, "gi"),
-    replace: (_m, key, sep) => `${key}${sep}${REDACTED}`
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(["']?\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(?!(?:${PROSE})\b)(${VAL})`, "gi"),
+    replace: (m, key, sep, val) => {
+      if (/[_-](?:count|length|len|size|limit|max|min|budget)$/i.test(key) && /^\d+$/.test(val)) return m;
+      const q = sep[0] === '"' || sep[0] === "'" ? val[0] : "";
+      return q && (q === '"' || q === "'") ? `${key}${sep}${q}${REDACTED}${q}` : `${key}${sep}${REDACTED}`;
+    }
+  },
+  {
+    // npmrc `//registry/:_authToken=xxx`
+    id: "npm-auth-token",
+    re: new RegExp(String.raw`(_authToken\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `curl -u user:pass` / `--user user:pass` — keep the user
+    id: "curl-user",
+    re: /(\bcurl\b[^\n]{0,500}?\s(?:-u|--user)[\s=]+['"]?[^\s:'"]+:)([^\s'"]+)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `mysql -phunter2` / `mysqldump -p'hunter2'` — attached password only
+    id: "mysql-p",
+    re: /(\bmysql(?:dump)?\b[^\n]{0,300}?\s-p)('[^']*'|"[^"]*"|[^\s'"-][^\s'"]*)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
   },
   {
     // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
@@ -10449,19 +10488,20 @@ var REDACT_RULES = [
     // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
     // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
     id: "token-prefix",
-    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}|[sr]k_(?:live|test)_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
     replace: REDACTED
   },
   {
     // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
     id: "long-run",
-    re: /\b[A-Za-z0-9+/]{40,}={0,2}(?![\w/])/g,
+    re: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,4096}={0,2}(?![\w/])/g,
     // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
     replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
   }
 ];
 var LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
 var LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+var LONG_RUN_MAX_LINE = 64 * 1024;
 var KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
 
 // src/hooks/ts/lib/build-gate.ts

package/dist/hooks/worker-note.mjs

@@ -8177,6 +8177,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8771,6 +8772,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8907,6 +8915,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,
@@ -9247,20 +9256,50 @@ var PS_MAX_BUFFER = 64 * 1024 * 1024;
 var REDACTED = "[REDACTED]";
 var REDACTED_RE = String.raw`\[REDACTED\]`;
 var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+var PROSE = "is|are|was|were|be|to|of|in|on|for|and|or|the|a|an|that|this|it|not|out|here|there|so|as|at|by|with|if|when|which";
 var VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
 var REDACT_RULES = [
   {
     // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
     id: "authorization",
-    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+(\S+)/gi,
+    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+([^\s'"]+)/gi,
     replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
   },
+  {
+    // `Cookie: a=b; c=d` — keep the cookie names, redact every value
+    id: "cookie",
+    re: /((?:Set-)?Cookie\s*:\s*)([^\n]+)/gi,
+    replace: (_m, head, rest) => `${head}${rest.replace(/([^=;\s'"]+=)[^;'"]*/g, `$1${REDACTED}`)}`
+  },
   {
     // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
-    // the word must be a whole key segment, so `monkeys=` stays untouched
+    // the word must be a whole key segment, so `monkeys=` stays untouched.
+    // The separator may start with the key's closing quote (JSON); it is kept.
     id: "key-value",
-    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(${VAL})`, "gi"),
-    replace: (_m, key, sep) => `${key}${sep}${REDACTED}`
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(["']?\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(?!(?:${PROSE})\b)(${VAL})`, "gi"),
+    replace: (m, key, sep, val) => {
+      if (/[_-](?:count|length|len|size|limit|max|min|budget)$/i.test(key) && /^\d+$/.test(val)) return m;
+      const q = sep[0] === '"' || sep[0] === "'" ? val[0] : "";
+      return q && (q === '"' || q === "'") ? `${key}${sep}${q}${REDACTED}${q}` : `${key}${sep}${REDACTED}`;
+    }
+  },
+  {
+    // npmrc `//registry/:_authToken=xxx`
+    id: "npm-auth-token",
+    re: new RegExp(String.raw`(_authToken\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `curl -u user:pass` / `--user user:pass` — keep the user
+    id: "curl-user",
+    re: /(\bcurl\b[^\n]{0,500}?\s(?:-u|--user)[\s=]+['"]?[^\s:'"]+:)([^\s'"]+)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `mysql -phunter2` / `mysqldump -p'hunter2'` — attached password only
+    id: "mysql-p",
+    re: /(\bmysql(?:dump)?\b[^\n]{0,300}?\s-p)('[^']*'|"[^"]*"|[^\s'"-][^\s'"]*)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
   },
   {
     // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
@@ -9284,13 +9323,13 @@ var REDACT_RULES = [
     // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
     // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
     id: "token-prefix",
-    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}|[sr]k_(?:live|test)_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
     replace: REDACTED
   },
   {
     // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
     id: "long-run",
-    re: /\b[A-Za-z0-9+/]{40,}={0,2}(?![\w/])/g,
+    re: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,4096}={0,2}(?![\w/])/g,
     // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
     replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
   }
@@ -9298,11 +9337,12 @@ var REDACT_RULES = [
 var PEM_BLOCK = /-----BEGIN[^-\n]*PRIVATE KEY-----[\s\S]*?(?:-----END[^-\n]*PRIVATE KEY-----|$)/g;
 var LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
 var LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+var LONG_RUN_MAX_LINE = 64 * 1024;
 var KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
 function redactLine(line) {
   let out = line;
   for (const r of LINE_RULES) out = out.replace(r.re, r.replace);
-  if (KEY_LINE.test(out)) out = out.replace(LONG_RUN.re, LONG_RUN.replace);
+  if (out.length <= LONG_RUN_MAX_LINE && KEY_LINE.test(out)) out = out.replace(LONG_RUN.re, LONG_RUN.replace);
   return out;
 }
 function redactSecrets(text) {