@wenrwa/marketplace-cli 0.8.9 → 0.8.10

package/dist/__tests__/bridge-preview-checkout.test.js

@@ -215,6 +215,22 @@ describe('PreviewRunner (tp-05) — real git, real processes', () => {
         expect(await runner.update({ workspaceId: 'ws-1', repoUrl: fx.remote })).toMatchObject({ status: 'running', runningSha: fixed });
         expect(JSON.parse(await get(port)).message).toBe('v3 fixed');
     });
+    it('tp-17: the log reply never carries a .env value, even one printed bare by the app', async () => {
+        // A value no token pattern recognises, logged on its own line by merged app code.
+        fs.appendFileSync(path.join(fx.workingCopy, '.env'), 'PLAIN_SECRET=plainvalue9f3a2b7c41\nSHORT=on\n');
+        pushChange(fx, {
+            'server.js': `console.log(process.env.PLAIN_SECRET); console.log('using ' + process.env.OWNER_SECRET + ' and ' + process.env.SHORT);\n${SERVER_JS}`,
+        }, 'logs a key');
+        const r = await runner.start({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        expect(r.status).toBe('running');
+        await new Promise((res) => setTimeout(res, 300));
+        const { log } = runner.logs({ workspaceId: 'ws-1' });
+        expect(log).toContain('using ');
+        expect(log).not.toContain('plainvalue9f3a2b7c41');
+        expect(log).not.toContain('sk_live_owner_value');
+        // Short values (flags, ports) stay readable: masking them would blank the log.
+        expect(log).toContain(' and on');
+    });
     it('pins to the remote default branch — another branch pushed to the remote never runs', async () => {
         git(fx.author, 'checkout', '-b', 'feature');
         fs.writeFileSync(path.join(fx.author, 'message.txt'), 'feature branch\n');

package/dist/bridge/previewCheckout.d.ts

@@ -61,6 +61,18 @@ export interface PreviewRunnerOpts {
 /** The only address a preview app may listen on. */
 export declare const PREVIEW_BIND_HOST = "127.0.0.1";
 export declare const PREVIEW_PASSTHROUGH_ENV: readonly ["PATH", "HOME", "USER", "LANG", "LC_ALL", "TZ", "TMPDIR", "SHELL"];
+/**
+ * tp-17 — `.env` values this long or longer are masked in the log reply by
+ * VALUE, whatever their shape. Shorter ones (ports, flags, `production`) stay:
+ * masking them would blank half the log and they are not secrets.
+ */
+export declare const LOG_MASK_MIN_VALUE_LENGTH = 8;
+/**
+ * tp-17 — mask every given value in `text`, longest first (so a value that
+ * contains another is masked whole). Pattern redaction (`redact`) misses a key
+ * the app prints bare with no recognisable shape; this never does.
+ */
+export declare function maskEnvValues(text: string, values: Iterable<string>): string;
 /**
  * The preview env: allowlisted process names < the owner's repo `.env`
  * (reserved names already removed by loadRepoEnv) < the fixed PORT.
@@ -85,6 +97,8 @@ export declare function installCommand(files: (name: string) => boolean): [strin
 export declare class PreviewRunner {
     private readonly opts;
     private readonly states;
+    /** tp-17 — the `.env` values each workspace's last deploy ran with (log masking). */
+    private readonly deployedEnvValues;
     /** One port, so one operation at a time across the whole box. */
     private chain;
     private orphanSwept;

package/dist/bridge/previewCheckout.js

@@ -33,7 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PreviewRunner = exports.PREVIEW_PASSTHROUGH_ENV = exports.PREVIEW_BIND_HOST = void 0;
+exports.PreviewRunner = exports.LOG_MASK_MIN_VALUE_LENGTH = exports.PREVIEW_PASSTHROUGH_ENV = exports.PREVIEW_BIND_HOST = void 0;
+exports.maskEnvValues = maskEnvValues;
 exports.buildPreviewEnv = buildPreviewEnv;
 exports.loopbackArgs = loopbackArgs;
 exports.machineExternalAddresses = machineExternalAddresses;
@@ -116,6 +117,24 @@ const redact_1 = require("../secrets/redact");
 /** The only address a preview app may listen on. */
 exports.PREVIEW_BIND_HOST = '127.0.0.1';
 exports.PREVIEW_PASSTHROUGH_ENV = ['PATH', 'HOME', 'USER', 'LANG', 'LC_ALL', 'TZ', 'TMPDIR', 'SHELL'];
+/**
+ * tp-17 — `.env` values this long or longer are masked in the log reply by
+ * VALUE, whatever their shape. Shorter ones (ports, flags, `production`) stay:
+ * masking them would blank half the log and they are not secrets.
+ */
+exports.LOG_MASK_MIN_VALUE_LENGTH = 8;
+/**
+ * tp-17 — mask every given value in `text`, longest first (so a value that
+ * contains another is masked whole). Pattern redaction (`redact`) misses a key
+ * the app prints bare with no recognisable shape; this never does.
+ */
+function maskEnvValues(text, values) {
+    const list = [...new Set([...values].filter((v) => v.length >= exports.LOG_MASK_MIN_VALUE_LENGTH))].sort((a, b) => b.length - a.length);
+    let out = text;
+    for (const v of list)
+        out = out.split(v).join('*'.repeat(v.length));
+    return out;
+}
 const DEFAULT_READY_TIMEOUT = { built: 120_000, dev: 300_000 };
 const DEFAULT_STEP_TIMEOUT_MS = 15 * 60_000;
 const LOG_TAIL_LINES = 200;
@@ -204,6 +223,8 @@ function runnerFor(files) {
 class PreviewRunner {
     opts;
     states = new Map();
+    /** tp-17 — the `.env` values each workspace's last deploy ran with (log masking). */
+    deployedEnvValues = new Map();
     /** One port, so one operation at a time across the whole box. */
     chain = Promise.resolve();
     orphanSwept = false;
@@ -280,7 +301,13 @@ class PreviewRunner {
             out = out.slice(-LOG_TAIL_MAX_CHARS);
             truncated = true;
         }
-        return { log: (0, redact_1.redact)(out), truncated };
+        // Pattern masking, then the owner's own .env values by value — the ones
+        // the last deploy ran with and the ones on disk now (an edited .env).
+        const values = [
+            ...(this.deployedEnvValues.get(req.workspaceId) ?? []),
+            ...Object.values((0, repoEnv_1.loadRepoEnv)(this.opts.workingCopyDir(req.workspaceId))),
+        ];
+        return { log: maskEnvValues((0, redact_1.redact)(out), values), truncated };
     }
     status(workspaceId) {
         return this.snapshot(workspaceId, {});
@@ -424,7 +451,9 @@ class PreviewRunner {
                 message: `No "${runScript}" script in package.json.`,
             });
         }
-        const env = buildPreviewEnv(this.opts.baseEnv, (0, repoEnv_1.loadRepoEnv)(this.opts.workingCopyDir(workspaceId)), this.opts.port);
+        const repoEnv = (0, repoEnv_1.loadRepoEnv)(this.opts.workingCopyDir(workspaceId));
+        this.deployedEnvValues.set(workspaceId, Object.values(repoEnv));
+        const env = buildPreviewEnv(this.opts.baseEnv, repoEnv, this.opts.port);
         // 2. Install, then (built) build — beside whatever is serving.
         const [installCmd, installArgs] = installCommand(has);
         const installed = await this.runStep(installCmd, installArgs, slotDir, env, logFile);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenrwa/marketplace-cli",
-  "version": "0.8.9",
+  "version": "0.8.10",
   "description": "CLI tool for the Wenrwa Agent Marketplace — monitor bounties, agents, workspaces, and treasury from your terminal",
   "author": "Wenrwa <dev@wenrwa.com>",
   "license": "MIT",