@volter/teams 0.2.19 → 0.2.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.19",
+  "version": "0.2.20",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/redact.mjs

@@ -3,7 +3,8 @@
 //   - the values this machine keeps in its custody files (KEY=value lines), which no detector knows; the files are named
 //     in `<supercode home>/custody.json` ({ "files": [...] }) and in SUPERCODE_CUSTODY_FILES (path-separated);
 //   - gitleaks' default rule set, vendored unchanged as redact/gitleaks-rules.json (its source and sha256 inside): each
-//     rule's keywords gate it, its secret group is what is replaced, and its entropy floor is kept.
+//     rule's keywords gate it, its secret group is what is replaced, and its entropy floor is kept;
+//   - the tokens a Teams server mints itself (TEAM_TOKENS), which no gitleaks rule knows.
 // Local files are never touched; only what is sent is redacted.
 import { readFileSync, existsSync, statSync } from 'node:fs';
 import { createHash } from 'node:crypto';
@@ -103,6 +104,13 @@ function longestMatch(source) {
 const RULES = vendored.rules.map((rule) => { const regex = jsPattern(rule.regex); return { id: rule.id, regex, longest: regex ? longestMatch(regex.source) : Infinity, group: rule.secretGroup ?? null, keywords: (rule.keywords ?? []).map((k) => k.toLowerCase()), entropy: rule.entropy ?? null }; }).filter((rule) => rule.regex);
 export const RULESET = { source: vendored.source, sha256: vendored.sha256, rules: RULES.length };
 
+// The tokens a Teams server mints (sdk/volter-teams/server, sdk/teams/server): a credential `sct_<id>.<32 bytes>`
+// (`sct_cred_<hex>.…`, the one three Codex session copies uploaded on 2026-09-30/10-01 carried, purged under D126), an
+// invitation or install code `sci_[<id>.]<32 bytes>`, an app secret `sca_<32 bytes>`, an attachment token
+// `sat_<id>.<32 bytes>`, each base64url, and a webhook signing secret `whsec_<32 bytes, base64>`. Each is replaced
+// whole, by a marker naming its kind.
+const TEAM_TOKENS = /\b(sct|sci|sca|sat)_(?:[A-Za-z]+_[0-9a-f]{32}\.)?[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])|\b(whsec)_[A-Za-z0-9+/]{43}=/g;
+
 // Where each of many literals occurs, in one pass over the text (gitleaks finds its keywords the same way, with one
 // automaton): a lookahead finds every position some literal starts at, and only those are compared literal by literal.
 // Hundreds of separate includes() read a 5 MB tool result hundreds of times.
@@ -182,6 +190,7 @@ export function redactText(text, env = process.env) {
   // Custody values are random, so one alternation of them gives the regex engine nothing to skip on: each is looked
   // for on its own, which reads a 5 MB text in a few dozen milliseconds.
   for (const { value, name } of custodyValues(env)) if (out.includes(value)) out = out.split(value).join(`[redacted:${name}]`);
+  if (/(?:sct|sci|sca|sat|whsec)_/.test(out)) out = out.replace(TEAM_TOKENS, (_, kind, hook) => `[redacted:teams-${kind ?? hook}-token]`);
   // Every rule has keywords, so a text holding none of them is done (the one test is cheap; finding where each keyword
   // occurs is not, and most texts are short and hold none).
   let lower = out.toLowerCase();