@wayai/cli 0.3.100 → 0.3.101

package/dist/index.js

@@ -44,30 +44,57 @@ function maskCredentialValues(text, keyRe, isValueEnd) {
   }
   return out + text.slice(copied);
 }
+function maskJwts(text) {
+  let out = "";
+  let copied = 0;
+  let cursor = 0;
+  while (cursor < text.length) {
+    while (cursor < text.length && !isBase64UrlChar(text[cursor])) cursor++;
+    const headerStart = cursor;
+    let tokenStart = -1;
+    while (cursor < text.length && isBase64UrlChar(text[cursor])) {
+      if (tokenStart < 0 && text[cursor] === "e" && text[cursor + 1] === "y" && text[cursor + 2] === "J") {
+        tokenStart = cursor;
+      }
+      cursor++;
+    }
+    const headerEnd = cursor;
+    if (headerStart === headerEnd) continue;
+    const hasJwtHeader = tokenStart >= headerStart && tokenStart + 3 < headerEnd;
+    if (!hasJwtHeader || text[headerEnd] !== ".") continue;
+    const payloadStart = headerEnd + 1;
+    cursor = payloadStart;
+    while (cursor < text.length && isBase64UrlChar(text[cursor])) cursor++;
+    const payloadEnd = cursor;
+    if (payloadEnd === payloadStart || text[payloadEnd] !== ".") continue;
+    const signatureStart = payloadEnd + 1;
+    cursor = signatureStart;
+    while (cursor < text.length && isBase64UrlChar(text[cursor])) cursor++;
+    if (cursor === signatureStart) continue;
+    out += text.slice(copied, tokenStart) + "[REDACTED_JWT]";
+    copied = cursor;
+  }
+  return out + text.slice(copied);
+}
 function maskSecretsInMessage(text) {
-  let out = text;
+  let out = maskJwts(text);
   for (const [pattern, replacement] of SHAPE_PATTERNS) out = out.replace(pattern, replacement);
   out = maskCredentialValues(out, JSON_KEY_RE, isJsonValueEnd);
   out = maskCredentialValues(out, QUERY_KEY_RE, isQueryValueEnd);
   return out.replace(BASE64_RE, maskBase64);
 }
-var CREDENTIAL_KEY_RE, FULLY_MASKED_VALUE_RE, isCredentialKey, SHAPE_PATTERNS, JSON_KEY_RE, isJsonValueEnd, QUERY_KEY_RE, isQueryValueEnd, BASE64_RE, maskBase64;
+var CREDENTIAL_KEY_RE, FULLY_MASKED_VALUE_RE, isCredentialKey, isBase64UrlChar, SHAPE_PATTERNS, JSON_KEY_RE, isJsonValueEnd, QUERY_KEY_RE, isQueryValueEnd, BASE64_RE, maskBase64;
 var init_mask_secrets = __esm({
   "src/lib/mask-secrets.ts"() {
     "use strict";
     CREDENTIAL_KEY_RE = /token|secret|credential|password|passwd|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt/i;
     FULLY_MASKED_VALUE_RE = /^(?:Bearer\s+)?(?:way_|wst_)?\[REDACTED(?:_JWT|_BASE64)?\]$/;
     isCredentialKey = (key) => CREDENTIAL_KEY_RE.test(key);
+    isBase64UrlChar = (char) => {
+      const code = char.charCodeAt(0);
+      return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || char === "-" || char === "_";
+    };
     SHAPE_PATTERNS = [
-      // JWTs (header.payload.signature) — WorkOS access/refresh tokens, OAuth JWTs.
-      // Run first so a `Bearer <jwt>` collapses to the JWT placeholder.
-      //
-      // Deliberately NOT anchored with the lookbehind the base64 rule uses. It would
-      // make this linear (this rule is quadratic on a pathological `eyJeyJeyJ…` run),
-      // but it also NARROWS masking: `refresh-<jwt>` and `way_<jwt>` would stop
-      // matching and leak the token whole. Correctness of a redaction rule outranks
-      // its worst case on a body that has to be adversarial to hurt.
-      [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[REDACTED_JWT]"],
       // way_ scoped API tokens (keyring/CI credentials). Leading \b avoids
       // over-redacting benign substrings (e.g. `gateway_config`); the charset is
       // base64url (no `.`) so a trailing sentence period stays outside the match.