@wirecat/cli-core 0.443.0 → 0.444.0

package/CHANGELOG.md

@@ -7,6 +7,20 @@ shape of this file.
 
 ## Unreleased
 
+## 0.444.0 — 26.10.2026
+
+### Security
+
+- **Run records hide more secrets: hex keys, and a password written after its name with a space.** A run of 20 or
+  more lower-case hex characters (`0-9a-f`) is hidden when it looks random (3 bits per character or more, the limit
+  Yelp's detect-secrets uses). This hides hex keys and also full commit hashes; a short hash (7–12 characters), a
+  UUID and an upper-case WhatsApp message id stay. The list of secret names grows by detect-secrets' keyword list
+  (`passwd`, `pwd`, `auth_key`, `private_key`, `db_pass`, `contraseña` and others) and by `pass`, `passcode`, `pin`,
+  `otp`, `2fa`, `clave`, `пароль`, `пин`, `код`, in any letter case. The value after such a name is hidden when it
+  follows `=`, `:`, `=>` or a space (`password hunter2`, `pin 1234`, `код 123456`); after a space only a value that
+  is not a plain word, so `pin this message` stays. A flag or argument with such a name (`--pin <chat>`) now has its
+  value hidden in a run record that keeps what was typed.
+
 ## 0.443.0 — 26.10.2026
 
 ### Added

package/dist/runs/secrets.d.ts

@@ -6,7 +6,8 @@ export declare const secretNamed: (name: string) => boolean;
 export declare const looksRandom: (run: string) => boolean;
 /**
  * Text with each secret inside it replaced by `mark` and the words around it kept: a token of a known vendor format,
- * a private key, a `Bearer`/`Basic` credential, the value of a secret-named `name=value` or `name: value`, and a
- * random-looking string of 20 or more printable characters (`looksRandom`).
+ * a private key, a `Bearer`/`Basic` credential, the value of a secret-named `name=value`, `name: value`, `name => value`
+ * or `name value`, a random-looking string of 20 or more printable characters (`looksRandom`), and a run of 20 or more
+ * lower-case hex characters with a Shannon entropy of 3 bits per character or more.
  */
 export declare const withoutSecrets: (text: string, mark?: string) => string;

package/dist/runs/secrets.js

@@ -1,3 +1,4 @@
+// Single words, and pairs written together (`apikey`) or apart (`api_key`); after Yelp detect-secrets' keyword list.
 const SECRET_WORDS = new Set([
     "authorization",
     "cookie",
@@ -5,9 +6,23 @@ const SECRET_WORDS = new Set([
     "credentials",
     "passphrase",
     "password",
+    "passwd",
+    "pwd",
+    "pass",
+    "passcode",
+    "pin",
+    "otp",
+    "2fa",
     "secret",
     "token",
-    "apikey",
+    "contraseña",
+    "contrasena",
+    "clave",
+    "пароль",
+    "пин",
+    "код",
+    ...["api", "auth", "service", "account", "db", "database", "priv", "private", "client"].map((word) => `${word}key`),
+    ...["db", "database", "key"].map((word) => `${word}pass`),
 ]);
 // Undeclared flags carry no mark, so the name is the only signal; CLIs take secrets at a prompt (WC-SECR-5) and this
 // catches the one typed anyway.
@@ -16,7 +31,7 @@ export const secretNamed = (name) => {
         .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
         .split(/[\s_.-]+/)
         .map((word) => word.toLowerCase());
-    return words.some((word, at) => SECRET_WORDS.has(word) || (word === "api" && words[at + 1] === "key"));
+    return words.some((word, at) => SECRET_WORDS.has(word) || SECRET_WORDS.has(word + (words[at + 1] ?? "")));
 };
 const START = "(?<![A-Za-z0-9_-])";
 const END = "(?![A-Za-z0-9_-])";
@@ -37,7 +52,8 @@ const KNOWN_TOKENS = new RegExp(`${[
 const PRIVATE_KEY = /-----BEGIN[A-Z ]* PRIVATE KEY-----[\s\S]*?(?:-----END[A-Z ]* PRIVATE KEY-----|$)/g;
 // Capitalised, as in a header, and not followed by a plain word: "the Basic plan" is somebody's words.
 const SCHEME = /(?<![A-Za-z])(Bearer|Basic)(\s+)(?![A-Z]?[a-z]+(?![A-Za-z0-9]))[A-Za-z0-9._~+/=-]{8,}/g;
-const NAMED_PAIR = /(?<![A-Za-z0-9])([A-Za-z0-9_.-]*(?:token|password|passphrase|secret|credential|cookie|authorization|api[_-]?key)[A-Za-z0-9_.-]*)(["']?\s*[:=]\s*["']?)((?:Bearer\s+|Basic\s+)?)([^\s"'&,;]+)/gi;
+// After a bare space only a value that is not a plain word: `pin 1234` is a secret, `pin this message` is not.
+const NAMED_PAIR = /(?<![\p{L}\p{N}])([\p{L}\p{N}_.-]*(?:token|pass|pwd|pin|otp|2fa|secret|credential|cookie|authorization|key|contrase|clave|пароль|пин|код)[\p{L}\p{N}_.-]*)(["']?\s*(?:=>|[:=])\s*["']?|\s+(?![\p{L}]+(?![\p{L}\p{N}])))((?:Bearer\s+|Basic\s+)?)([^\s"'&,;]+)/giu;
 /**
  * Whether a run of token characters is a random string rather than words: long, mixed case, high Shannon entropy,
  * cut into short pieces (`Kz9vQ2mX`) where a name is cut into words (`InlineQueryResultMpeg4Gif`).
@@ -72,8 +88,9 @@ const entropy = (text) => {
 };
 /**
  * Text with each secret inside it replaced by `mark` and the words around it kept: a token of a known vendor format,
- * a private key, a `Bearer`/`Basic` credential, the value of a secret-named `name=value` or `name: value`, and a
- * random-looking string of 20 or more printable characters (`looksRandom`).
+ * a private key, a `Bearer`/`Basic` credential, the value of a secret-named `name=value`, `name: value`, `name => value`
+ * or `name value`, a random-looking string of 20 or more printable characters (`looksRandom`), and a run of 20 or more
+ * lower-case hex characters with a Shannon entropy of 3 bits per character or more.
  */
 export const withoutSecrets = (text, mark = "[redacted]") => text
     .replace(PRIVATE_KEY, mark)
@@ -84,5 +101,7 @@ export const withoutSecrets = (text, mark = "[redacted]") => text
 // A URL or a path is somebody's address, not a key; a credential in one is caught by the rules above.
 token.includes("://") || /^(?:\/|~\/|\.\.?\/)/.test(token)
     ? token
-    : token.replace(RUN, (run) => (looksRandom(run) ? mark : run)));
+    : token.replace(RUN, (run) => looksRandom(run) ? mark : run.replace(HEX, (hex) => (entropy(hex) >= 3 ? mark : hex))));
 const RUN = /(?<![A-Za-z0-9_+/-])[A-Za-z0-9_+/-]{20,}/g;
+// Lower case only: WhatsApp message ids are upper-case hex of 20–32 characters. A dash ends a run, so a UUID stays.
+const HEX = /(?<![A-Za-z0-9])(?=[0-9]*[a-f])[0-9a-f]{20,}(?![A-Za-z0-9])/g;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.443.0",
+  "version": "0.444.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",