@tollbooth-dpyc/web 1.4.0 → 1.4.2

package/dist/client.js

@@ -12,7 +12,7 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { tollboothConfig, toolName } from "./config.js";
-import { debugPush } from "./debugLog.js";
+import { debugPush, redact } from "./debugLog.js";
 import { clearStoredProof, forgetRecentLogin, getStoredNpub, getStoredProof, } from "./identity.js";
 import { signInlineProof } from "./inlineProof.js";
 import { isTransportFailure, NetworkError } from "./networkError.js";
@@ -129,7 +129,7 @@ export async function callToolWithContent(tool, args = {}, opts = {}) {
     // `args` holds only the caller's own parameters — the envelope is added
     // below — so it is safe to log.
     if (!quiet)
-        debugPush("call", `${name}(${JSON.stringify(args).slice(0, 140)})`);
+        debugPush("call", `${name}(${redact(JSON.stringify(args)).slice(0, 140)})`);
     const bootstrap = STANDARD_BOOTSTRAP.includes(tool) || cfg.extraBootstrapTools.includes(tool);
     const merged = bootstrap
         ? { ...args }
@@ -154,14 +154,14 @@ export async function callToolWithContent(tool, args = {}, opts = {}) {
     if (result.isError) {
         const text = errorText(result);
         if (!quiet)
-            debugPush("error", `${name}: ${text.slice(0, 200)}`);
+            debugPush("error", `${name}: ${redact(text).slice(0, 200)}`);
         throw new Error(text);
     }
     const { payload, images } = readToolResult(result);
     if (!quiet) {
         const preview = typeof payload === "string" ? payload : JSON.stringify(payload);
         const tail = images.length ? ` +${images.length} image` : "";
-        debugPush(looksFailed(payload) ? "error" : "result", `${name} → ${String(preview).slice(0, 220)}${tail}`);
+        debugPush(looksFailed(payload) ? "error" : "result", `${name} → ${redact(String(preview)).slice(0, 220)}${tail}`);
     }
     if (!opts.bestEffort) {
         const bounced = proofBounceMessage(payload);

package/dist/debugLog.d.ts

@@ -7,8 +7,10 @@
  * that flips the view can still be read and copied afterward.
  *
  * Every message is scrubbed on the way in: an nsec, a 64-hex key, a bearer
- * token, and the value of any secret-named field (dpop_token, proof, poison,
- * password, api_key, …) never reach the buffer, the clipboard or storage.
+ * token, the value of any secret-named field (dpop_token, proof, poison,
+ * password, api_key, …), and a secret inside a URL (a query token, a
+ * bearer-like path segment, userinfo) never reach the buffer, the clipboard
+ * or storage.
  * That is the one guarantee a panel relies on — it renders what is here.
  *
  * Merged from the fleet's copies (goodearth, beesknees, cypher, excalibur,

package/dist/debugLog.js

@@ -7,8 +7,10 @@
  * that flips the view can still be read and copied afterward.
  *
  * Every message is scrubbed on the way in: an nsec, a 64-hex key, a bearer
- * token, and the value of any secret-named field (dpop_token, proof, poison,
- * password, api_key, …) never reach the buffer, the clipboard or storage.
+ * token, the value of any secret-named field (dpop_token, proof, poison,
+ * password, api_key, …), and a secret inside a URL (a query token, a
+ * bearer-like path segment, userinfo) never reach the buffer, the clipboard
+ * or storage.
  * That is the one guarantee a panel relies on — it renders what is here.
  *
  * Merged from the fleet's copies (goodearth, beesknees, cypher, excalibur,
@@ -34,7 +36,7 @@ const SECRET_FIELD = "(?:nsec|ncryptsec|dpop_token|proof|poison|password|passphr
 // a bare one up to a delimiter. Stopping at the first quote of either kind let
 // the tail of a secret holding `'` or `\"` through.
 function fieldValue(names) {
-    return new RegExp(`((?:\\\\*["'])?\\b${names}(?:\\\\*["'])?\\s*[:=]\\s*)(?:(\\\\*["'])(?:\\\\.|\\\\$|(?!\\2)[^\\\\])*?(?=\\2|$)|[^"'\\\\,}\\]&\\s]+)`, "gi");
+    return new RegExp(`((?:\\\\*["'])?\\b${names}(?:\\\\*["'])?\\s*[:=]\\s*)(?:(\\\\*["'])(?:\\\\.|\\\\$|(?!\\2)[^\\\\])*?(?=\\2|$)|(?!\\[redacted\\])[^"'\\\\,}\\]&\\s]+)`, "gi");
 }
 const FIELD_VALUE = fieldValue(SECRET_FIELD);
 // update_patron_credential / update_operator_credential carry the secret as
@@ -47,6 +49,54 @@ const BEARER = /\bBearer\s+[A-Za-z0-9._~+/=-]+/g;
 function scrubbed(_match, head, quote) {
     return `${head}${quote ?? ""}${REDACTED}`;
 }
+// ── Secrets inside URLs ────────────────────────────────────────────────────
+//
+// A capability link carries its secret in the URL itself — Good Earth's
+// calendar feed is `https://host/calendar/<32 hex>.ics` — and a link read
+// back in a tool result is logged whole. Three places a URL hides a secret:
+// the userinfo, a query or fragment parameter, and a bearer-like path segment.
+/** Query/fragment parameter names whose value is a secret (matched whole). */
+const URL_SECRET_PARAM = /([?&#;](?:token|access_token|refresh_token|id_token|auth|authorization|key|api_key|apikey|secret|client_secret|password|pass|sig|signature|code|proof|dpop_token|session|sessionid|nsec)=)[^&#;\s"'\\<>]*/gi;
+// A URL up to whitespace, a quote, an escape or an angle bracket — so one
+// inside JSON (or JSON inside JSON) ends at its own closing quote.
+const URL_IN_TEXT = /\b(?:https?|webcal|wss?):\/\/[^\s"'\\<>]+/gi;
+const USERINFO = /^([a-z]+:\/\/)[^/?#@]+@/i;
+/**
+ * A path segment that reads as a bearer secret rather than a name: 32+ hex,
+ * or 24+ base64url characters holding both a letter and a digit and one
+ * unbroken alphanumeric run of 16+ (a slug's words are short; a token's are
+ * not). An npub is public and stays.
+ */
+function isSecretSegment(seg) {
+    if (/^npub1/i.test(seg))
+        return false;
+    if (/^[0-9a-f]{32,}$/i.test(seg))
+        return true;
+    if (!/^[A-Za-z0-9_-]{24,}$/.test(seg))
+        return false;
+    if (!/[0-9]/.test(seg) || !/[A-Za-z]/.test(seg))
+        return false;
+    return /[A-Za-z0-9]{16,}/.test(seg);
+}
+function scrubUrl(url) {
+    const head = url.replace(USERINFO, `$1${REDACTED}@`);
+    const pathStart = head.indexOf("/", head.indexOf("://") + 3);
+    if (pathStart < 0)
+        return head;
+    const tailAt = head.slice(pathStart).search(/[?#]/);
+    const pathEnd = tailAt < 0 ? head.length : pathStart + tailAt;
+    const path = head
+        .slice(pathStart, pathEnd)
+        .split("/")
+        .map((seg) => {
+        // `<token>.ics`: judge the name, keep the extension.
+        const dot = seg.indexOf(".");
+        const name = dot < 0 ? seg : seg.slice(0, dot);
+        return isSecretSegment(name) ? REDACTED + (dot < 0 ? "" : seg.slice(dot)) : seg;
+    })
+        .join("/");
+    return head.slice(0, pathStart) + path + head.slice(pathEnd);
+}
 /**
  * Scrub secrets from a log line. Deliberately over-eager: a 64-hex event id
  * is hidden along with a hex private key, because the two look alike.
@@ -55,7 +105,9 @@ export function redact(message) {
     let out = message
         .replace(NSEC, REDACTED)
         .replace(BEARER, `Bearer ${REDACTED}`)
-        .replace(FIELD_VALUE, scrubbed);
+        .replace(URL_IN_TEXT, scrubUrl)
+        .replace(FIELD_VALUE, scrubbed)
+        .replace(URL_SECRET_PARAM, `$1${REDACTED}`);
     if (HAS_FIELD.test(out))
         out = out.replace(CREDENTIAL_VALUE, scrubbed);
     return out.replace(HEX_KEY, REDACTED);

package/dist/react/SessionKeyClaim.d.ts

@@ -4,13 +4,19 @@
  * Renders ONLY when this browser holds the session nsec for the signed-in
  * npub. NIP-07 and courier-proof sign-ins see nothing: no disabled control,
  * no placeholder, no mention. Painting the key takes two deliberate taps —
- * "Claim your session key", then the Reveal chip — so an account page opened
+ * "Claim your session key", then the Reveal (eye) button — so an account page opened
  * in front of other people does not show it.
  *
  * Destinations: copy, download .env, password-manager prompt, and an
  * encrypted DM to another npub the patron names. The nsec never reaches a
  * log, error text, analytics call, or MCP tool argument.
  */
-export default function SessionKeyClaim({ npub }: {
+export interface SessionKeyClaimClassNames {
+    /** Each round icon action (Reveal, Copy, .env, password manager, DM) when not active. Default: the package's outlined chip. */
+    action?: string;
+}
+export interface SessionKeyClaimProps {
     npub: string;
-}): import("react").JSX.Element | null;
+    classNames?: SessionKeyClaimClassNames;
+}
+export default function SessionKeyClaim({ npub, classNames }: SessionKeyClaimProps): import("react").JSX.Element | null;

package/dist/react/SessionKeyClaim.js

@@ -5,7 +5,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * Renders ONLY when this browser holds the session nsec for the signed-in
  * npub. NIP-07 and courier-proof sign-ins see nothing: no disabled control,
  * no placeholder, no mention. Painting the key takes two deliberate taps —
- * "Claim your session key", then the Reveal chip — so an account page opened
+ * "Claim your session key", then the Reveal (eye) button — so an account page opened
  * in front of other people does not show it.
  *
  * Destinations: copy, download .env, password-manager prompt, and an
@@ -13,13 +13,14 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * log, error text, analytics call, or MCP tool argument.
  */
 import { useRef, useState } from "react";
+import { Check, Copy, Download, Eye, EyeOff, KeyRound, Send } from "lucide-react";
 import { tollboothConfig } from "../config.js";
 import { passwordManagerOutcomeLabel, sessionKeyClaimVisible, sessionKeyEnvContents, sessionKeyEnvFilename, } from "../sessionKeyClaim.js";
 import { sendSessionKeyDm } from "../sessionKeyDm.js";
 import { getSessionNsec, getSessionNsecBytes, hasSessionNsec, sessionNsecNpub, } from "../sessionNsec.js";
 import { shareOrDownload } from "../shareFile.js";
 import { card, input, muted } from "./ui.js";
-export default function SessionKeyClaim({ npub }) {
+export default function SessionKeyClaim({ npub, classNames = {} }) {
     const visible = sessionKeyClaimVisible({
         hasSessionNsec: hasSessionNsec(),
         sessionNsecNpub: sessionNsecNpub(),
@@ -28,9 +29,9 @@ export default function SessionKeyClaim({ npub }) {
     // Hard requirement: silence when the browser does not hold the key.
     if (!visible)
         return null;
-    return _jsx(SessionKeyClaimInner, {});
+    return _jsx(SessionKeyClaimInner, { actionClass: classNames.action });
 }
-function SessionKeyClaimInner() {
+function SessionKeyClaimInner({ actionClass }) {
     const { slug, appName } = tollboothConfig();
     const envFilename = sessionKeyEnvFilename(slug);
     const [revealed, setRevealed] = useState(false);
@@ -162,17 +163,19 @@ function SessionKeyClaimInner() {
                             setDmOpen(false);
                             setFlash(null);
                             setRecipient("");
-                        }, className: `text-[12px] ${muted} hover:text-[var(--tb-ink)]`, children: "Hide" })] }), _jsxs("p", { className: `mb-3 text-[12.5px] leading-relaxed ${muted}`, children: ["Anyone who holds this key is you. It leaves this page only when you choose a destination below \u2014 never logged, never sent to ", appName, "."] }), _jsxs("div", { className: "flex flex-wrap gap-2", children: [_jsx(DestButton, { onClick: () => setShowKey((v) => !v), active: showKey, children: showKey ? "Conceal" : "Reveal" }), _jsx(DestButton, { onClick: () => void copyKey(), disabled: busy, children: copied ? "Copied" : "Copy" }), _jsx(DestButton, { onClick: () => void downloadEnv(), disabled: busy, children: "Download .env" }), _jsx(DestButton, { onClick: () => void passwordManagerSave(), disabled: busy, children: "Password manager" }), _jsx(DestButton, { onClick: () => {
+                        }, className: `text-[12px] ${muted} hover:text-[var(--tb-ink)]`, children: "Hide" })] }), _jsxs("p", { className: `mb-3 text-[12.5px] leading-relaxed ${muted}`, children: ["Anyone who holds this key is you. It leaves this page only when you choose a destination below \u2014 never logged, never sent to ", appName, "."] }), _jsxs("div", { className: "flex flex-wrap gap-2", children: [_jsx(DestButton, { label: showKey ? "Conceal the key" : "Reveal the key", onClick: () => setShowKey((v) => !v), active: showKey, className: actionClass, children: showKey ? _jsx(EyeOff, { size: 20, "aria-hidden": "true" }) : _jsx(Eye, { size: 20, "aria-hidden": "true" }) }), _jsx(DestButton, { label: copied ? "Copied" : "Copy the key", onClick: () => void copyKey(), disabled: busy, className: actionClass, children: copied ? _jsx(Check, { size: 20, "aria-hidden": "true" }) : _jsx(Copy, { size: 20, "aria-hidden": "true" }) }), _jsx(DestButton, { label: "Download a .env file", onClick: () => void downloadEnv(), disabled: busy, className: actionClass, children: _jsx(Download, { size: 20, "aria-hidden": "true" }) }), _jsx(DestButton, { label: "Save to your password manager", onClick: () => void passwordManagerSave(), disabled: busy, className: actionClass, children: _jsx(KeyRound, { size: 20, "aria-hidden": "true" }) }), _jsx(DestButton, { label: "Send by encrypted DM", onClick: () => {
                             setDmOpen((v) => !v);
                             setFlash(null);
-                        }, disabled: busy, active: dmOpen, children: "Send by DM" })] }), showKey && (_jsx("div", { className: "mt-3 break-all rounded-lg border border-[var(--tb-line)] bg-[var(--tb-surface-2)] px-3 py-2 font-mono text-[12px] text-[var(--tb-ink)]", children: getSessionNsec() })), dmOpen && (_jsxs("div", { className: "mt-3 space-y-2 rounded-lg border border-[var(--tb-line)] bg-[var(--tb-surface-2)] p-3", children: [_jsx("p", { className: `text-[12px] leading-relaxed ${muted}`, children: "Encrypts the key to an npub you own and publishes the sealed message to public relays. Only that npub can open it." }), _jsxs("div", { className: "flex flex-wrap items-end gap-2", children: [_jsxs("label", { className: `block min-w-[16rem] flex-1 text-[12px] ${muted}`, children: ["Recipient npub", _jsx("input", { value: recipient, onChange: (e) => setRecipient(e.target.value), spellCheck: false, autoCapitalize: "off", autoCorrect: "off", placeholder: "npub1\u2026", className: `mt-1 h-11 ${input}` })] }), _jsx("button", { type: "button", onClick: () => void sendDm(), disabled: busy || recipient.trim().length < 60, className: "min-h-11 shrink-0 rounded-full border border-[var(--tb-accent)] bg-[var(--tb-accent)] px-4 text-[13px] font-semibold text-[var(--tb-on-accent)] disabled:opacity-40", children: busy ? "Sending…" : "Send encrypted DM" })] })] })), _jsxs("form", { ref: formRef, className: "absolute h-px w-px overflow-hidden opacity-0", "aria-hidden": "true", autoComplete: "on", onSubmit: (e) => {
+                        }, disabled: busy, active: dmOpen, className: actionClass, children: _jsx(Send, { size: 20, "aria-hidden": "true" }) })] }), showKey && (_jsx("div", { className: "mt-3 break-all rounded-lg border border-[var(--tb-line)] bg-[var(--tb-surface-2)] px-3 py-2 font-mono text-[12px] text-[var(--tb-ink)]", children: getSessionNsec() })), dmOpen && (_jsxs("div", { className: "mt-3 space-y-2 rounded-lg border border-[var(--tb-line)] bg-[var(--tb-surface-2)] p-3", children: [_jsx("p", { className: `text-[12px] leading-relaxed ${muted}`, children: "Encrypts the key to an npub you own and publishes the sealed message to public relays. Only that npub can open it." }), _jsxs("div", { className: "flex flex-wrap items-end gap-2", children: [_jsxs("label", { className: `block min-w-[16rem] flex-1 text-[12px] ${muted}`, children: ["Recipient npub", _jsx("input", { value: recipient, onChange: (e) => setRecipient(e.target.value), spellCheck: false, autoCapitalize: "off", autoCorrect: "off", placeholder: "npub1\u2026", className: `mt-1 h-11 ${input}` })] }), _jsx("button", { type: "button", onClick: () => void sendDm(), disabled: busy || recipient.trim().length < 60, className: "min-h-11 shrink-0 rounded-full border border-[var(--tb-accent)] bg-[var(--tb-accent)] px-4 text-[13px] font-semibold text-[var(--tb-on-accent)] disabled:opacity-40", children: busy ? "Sending…" : "Send encrypted DM" })] })] })), _jsxs("form", { ref: formRef, className: "absolute h-px w-px overflow-hidden opacity-0", "aria-hidden": "true", autoComplete: "on", onSubmit: (e) => {
                     e.preventDefault();
                 }, children: [_jsx("input", { ref: userRef, name: "username", autoComplete: "username", defaultValue: "", readOnly: true, tabIndex: -1 }), _jsx("input", { ref: passRef, name: "password", type: "password", autoComplete: "new-password", defaultValue: "", readOnly: true, tabIndex: -1 })] }), flash && (_jsx("p", { className: `mt-3 text-[12.5px] leading-relaxed ${flash.tone === "ok" ? "text-[var(--tb-ink)]" : "text-[var(--tb-err-ink)]"}`, role: "status", children: flash.text }))] }));
 }
-function DestButton({ onClick, disabled, active, children, }) {
-    return (_jsx("button", { type: "button", onClick: onClick, disabled: disabled, className: `min-h-11 shrink-0 rounded-full border px-3.5 text-[12.5px] font-medium disabled:opacity-40 ${active
+/** An icon-only round action. `label` is its aria-label and tooltip. */
+function DestButton({ label, onClick, disabled, active, className, children, }) {
+    const idle = className ?? `border-[var(--tb-line)] ${muted} active:bg-[var(--tb-surface-2)]`;
+    return (_jsx("button", { type: "button", onClick: onClick, disabled: disabled, "aria-label": label, title: label, className: `inline-flex h-11 w-11 shrink-0 items-center justify-center rounded-full border focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--tb-accent)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--tb-surface)] disabled:opacity-40 ${active
             ? "border-[var(--tb-accent)] bg-[var(--tb-accent)] text-[var(--tb-on-accent)]"
-            : `border-[var(--tb-line)] ${muted} active:bg-[var(--tb-surface-2)]`}`, children: children }));
+            : idle}`, children: children }));
 }
 /**
  * Offer the key to a browser password manager. Never claims an OS keychain.

package/dist/react/index.d.ts

@@ -9,7 +9,7 @@ export { default as NpubGate } from "./NpubGate.tsx";
 export { default as NostrProfilePanel } from "./NostrProfilePanel.tsx";
 export { PageControls, SortHeader, TableShell, type PageControlsProps, type PageControlsClassNames, type SortHeaderProps, type SortHeaderClassNames, type TableShellClassNames, } from "./PagedTable.tsx";
 export { default as QuoteScroller, type QuoteScrollerProps, type QuoteScrollerClassNames } from "./QuoteScroller.tsx";
-export { default as SessionKeyClaim } from "./SessionKeyClaim.tsx";
+export { default as SessionKeyClaim, type SessionKeyClaimProps, type SessionKeyClaimClassNames, } from "./SessionKeyClaim.tsx";
 export { default as TableFilter, type DateFieldOption, type FilterQuestion, type TableFilterProps, type TableFilterClassNames, type TableFilterDates, type TableFilterQuestions, type TableFilterSearch, } from "./TableFilter.tsx";
 export { default as ThemeToggle, type ThemeToggleProps, type ThemeToggleClassNames } from "./ThemeToggle.tsx";
 export { default as TimezonePicker, type TimezoneOption, type TimezonePickerClassNames, type TimezonePickerProps, } from "./TimezonePicker.tsx";

package/dist/react/index.js

@@ -9,7 +9,7 @@ export { default as NpubGate } from "./NpubGate.js";
 export { default as NostrProfilePanel } from "./NostrProfilePanel.js";
 export { PageControls, SortHeader, TableShell, } from "./PagedTable.js";
 export { default as QuoteScroller } from "./QuoteScroller.js";
-export { default as SessionKeyClaim } from "./SessionKeyClaim.js";
+export { default as SessionKeyClaim, } from "./SessionKeyClaim.js";
 export { default as TableFilter, } from "./TableFilter.js";
 export { default as ThemeToggle } from "./ThemeToggle.js";
 export { default as TimezonePicker, } from "./TimezonePicker.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tollbooth-dpyc/web",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Shared browser SDK for Tollbooth DPYC operator front ends: npub sign-in, proofs, MCP client, profile and wallet",
   "license": "Apache-2.0",
   "author": "Lonnie VanZandt",