@wayai/cli 0.3.44 → 0.3.45

package/dist/index.js

@@ -15,6 +15,34 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/lib/redact.ts
+function redactSecrets(text) {
+  let out = text;
+  for (const [pattern, replacement] of PATTERNS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+var PATTERNS;
+var init_redact = __esm({
+  "src/lib/redact.ts"() {
+    "use strict";
+    PATTERNS = [
+      // JWTs (header.payload.signature) — WorkOS access/refresh tokens, OAuth JWTs.
+      // Run first so a `Bearer <jwt>` collapses to the JWT placeholder.
+      [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[REDACTED_JWT]"],
+      // way_ scoped API tokens (keyring/CI credentials). Leading \b avoids
+      // over-redacting benign substrings (e.g. `gateway_config`); the charset is
+      // base64url (no `.`) so a trailing sentence period stays outside the match.
+      [/\bway_[A-Za-z0-9_-]{8,}/g, "way_[REDACTED]"],
+      // wst_ single-use WebSocket tickets (same opaque base64url format).
+      [/\bwst_[A-Za-z0-9_-]{8,}/g, "wst_[REDACTED]"],
+      // Authorization: Bearer <opaque token> (anything not already masked above).
+      [/(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, "$1[REDACTED]"]
+    ];
+  }
+});
+
 // src/lib/sentry.ts
 import * as Sentry from "@sentry/node";
 import { readFileSync } from "fs";
@@ -51,15 +79,26 @@ function initSentry(command2) {
     defaultIntegrations: false,
     beforeSend(event) {
       const home = homedir();
-      if (home && event.exception?.values) {
+      if (event.exception?.values) {
         for (const value of event.exception.values) {
-          if (value.stacktrace?.frames) {
+          if (home && value.stacktrace?.frames) {
             for (const frame of value.stacktrace.frames) {
               if (frame.filename && frame.filename.includes(home)) {
                 frame.filename = frame.filename.replace(home, "~");
               }
             }
           }
+          if (value.value) value.value = redactSecrets(value.value);
+        }
+      }
+      if (event.breadcrumbs) {
+        for (const crumb of event.breadcrumbs) {
+          if (crumb.message) crumb.message = redactSecrets(crumb.message);
+        }
+      }
+      if (event.extra) {
+        for (const [key, val] of Object.entries(event.extra)) {
+          if (typeof val === "string") event.extra[key] = redactSecrets(val);
         }
       }
       return event;
@@ -127,6 +166,7 @@ var HARDCODED_DSN, initialized;
 var init_sentry = __esm({
   "src/lib/sentry.ts"() {
     "use strict";
+    init_redact();
     HARDCODED_DSN = "https://ffe500121277babcabf32e5868f00f9e@o4510669417807872.ingest.us.sentry.io/4510960145465344";
     initialized = false;
   }
@@ -138,14 +178,16 @@ var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     "use strict";
     init_sentry();
+    init_redact();
     ApiError = class extends Error {
       status;
       body;
       constructor(method, path19, status, body) {
-        super(`API request failed: ${method} ${path19} (${status}): ${body}`);
+        const safeBody = redactSecrets(body);
+        super(`API request failed: ${method} ${path19} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
-        this.body = body;
+        this.body = safeBody;
       }
       /** True when the status code is a 4xx client error (expected user-facing condition, not a bug). */
       get isExpected() {
@@ -8230,7 +8272,7 @@ async function exchangeCodeForTokens(authkitDomain, clientId, code, codeVerifier
   });
   if (!response.ok) {
     const body = await response.text();
-    throw new Error(`Token exchange failed (${response.status}): ${body}`);
+    throw new Error(`Token exchange failed (${response.status}): ${redactSecrets(body)}`);
   }
   return response.json();
 }
@@ -8256,7 +8298,7 @@ async function refreshAccessToken(authkitDomain, clientId, refreshToken) {
       }
       if (isInvalidGrant) throw new Error("SESSION_EXPIRED");
     }
-    throw new Error(`Token refresh failed (${status}): ${body}`);
+    throw new Error(`Token refresh failed (${status}): ${redactSecrets(body)}`);
   }
   return response.json();
 }
@@ -8388,6 +8430,7 @@ var init_auth = __esm({
     init_config();
     init_token_store();
     init_sentry();
+    init_redact();
     OAUTH_CALLBACK_PORT = 3829;
     AUTHKIT_DOMAIN = "https://sprightly-comic-51.authkit.app";
     AUTHKIT_CLIENT_ID = "client_01KMZHB50KENM5SV90ZA80VXK4";
@@ -16691,6 +16734,7 @@ function friendlyHint(err) {
 }
 
 // src/index.ts
+init_redact();
 init_utils();
 
 // src/lib/version-refresh.ts
@@ -17072,7 +17116,7 @@ async function runForeground() {
       captureException2(err);
     }
     await closeSentry();
-    console.error(err instanceof Error ? err.message : String(err));
+    console.error(redactSecrets(err instanceof Error ? err.message : String(err)));
     const hint = friendlyHint(err);
     if (hint) console.error(hint);
     process.exit(1);