@wraps.dev/cli 2.17.16 → 2.17.18

package/dist/cli.js

@@ -28156,6 +28156,7 @@ import pc36 from "picocolors";
 init_events();
 init_aws();
 init_config();
+init_errors();
 init_fs();
 init_json_output();
 init_metadata();
@@ -28681,7 +28682,7 @@ You can try the manual flow: ${pc36.cyan("wraps auth logout")} then ${pc36.cyan(
     const duration = Date.now() - startTime;
     const errorCode = error instanceof Error ? error.name : "UNKNOWN_ERROR";
     trackError(errorCode, "platform:connect", {
-      message: error instanceof Error ? error.message : String(error)
+      message: sanitizeErrorMessage(error)
     });
     trackCommand("platform:connect", {
       success: false,
@@ -28959,7 +28960,7 @@ ${pc36.bold("Next Steps:")}`);
     const duration = Date.now() - startTime;
     const errorCode = error instanceof Error ? error.name : "UNKNOWN_ERROR";
     trackError(errorCode, "platform:connect", {
-      message: error instanceof Error ? error.message : String(error)
+      message: sanitizeErrorMessage(error)
     });
     trackCommand("platform:connect", {
       success: false,
@@ -29431,10 +29432,16 @@ import { createHttpTerminator } from "http-terminator";
 
 // src/console/middleware/auth.ts
 init_esm_shims();
+import { timingSafeEqual } from "crypto";
 function authenticateToken(expectedToken) {
   return (req, res, next) => {
     const token = req.query.token || req.headers["x-auth-token"];
-    if (!token || token !== expectedToken) {
+    if (!token) {
+      return res.status(401).json({ error: "Unauthorized" });
+    }
+    const expectedBuf = Buffer.from(expectedToken);
+    const tokenBuf = Buffer.from(token);
+    if (expectedBuf.length !== tokenBuf.length || !timingSafeEqual(expectedBuf, tokenBuf)) {
       return res.status(401).json({ error: "Unauthorized" });
     }
     next();
@@ -31992,7 +31999,8 @@ async function startConsoleServer(config2) {
     next();
   });
   app.use((req, _res, next) => {
-    console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${req.method} ${req.url}`);
+    const logUrl = req.url.replace(/([?&])token=[^&]+/g, "$1token=***");
+    console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${req.method} ${logUrl}`);
     next();
   });
   app.use(