@wrongstack/core 0.305.0 → 0.306.0

package/dist/observability/index.js

@@ -379,7 +379,10 @@ var SENSITIVE_FLAG_PATTERNS = [
   // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
   // The separator group is optional so the attached form (the common one) matches.
   // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
-  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+  // The value must be token-like (>= 8 chars) so ordinary combined flags such
+  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
+  // redacted, not just the first. Synced with packages/tools _redact-command.ts.
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
   // -p|-password|-a (redis auth) short flags: attached + separated + =value.
   // Same token-start anchor; over-redaction is an accepted tradeoff for a
   // redaction function (false positive = cosmetic noise; false negative = leak).
@@ -387,8 +390,9 @@ var SENSITIVE_FLAG_PATTERNS = [
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
   /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-  // when preceded by a flag name (e.g. --github-token=EyJ...).
-  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
+  // every such flag in the command line is redacted, not just the first.
+  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
 ];
 function redactCommand(cmd) {
   let result = cmd;

package/dist/plugin/index.d.ts

@@ -3,12 +3,13 @@ export { diffPluginConfig, type PluginConfigChange, type PluginConfigSource, typ
 export { KERNEL_API_VERSION, loadPlugins, type LoadPluginsOptions, type PluginHostHandle, type PluginLoadFailure, unloadPlugins, } from './loader.js';
 export type { PluginAPI } from '../types/plugin.js';
 export { buildReviewerModelPool, createAutoReviewPlugin, parseReviewSeverity, type ReviewerModelAssignment, selectRoundRobinReviewerAssignment, } from '../plugins/auto-review-plugin.js';
-export { type CascadeAgentKind, CHIMERA_REVIEW_PROMPT, createChimeraPlugin, type ChimeraCascadeNeededPayload, type ChimeraReviewCompletePayload, type ChimeraReviewNeededPayload, type ReviewContextBundle, } from '../plugins/chimera-plugin.js';
+export { type CascadeAgentKind, type CascadeEvidenceCheckResult, type CascadeEvidenceStatus, CHIMERA_REVIEW_PROMPT, createChimeraPlugin, type ChimeraCascadeNeededPayload, type ChimeraReviewCompletePayload, type ChimeraReviewNeededPayload, type ReviewContextBundle, } from '../plugins/chimera-plugin.js';
 export { createPromptsPlugin } from '../plugins/prompts-plugin.js';
 export { emitReviewIfChanged, recordCompletedReview, recordStartedReview, } from '../plugins/review-claim-registry.js';
-export { type FindingsIntegrationResult, integrateFindings, } from '../plugins/review-finding-integration.js';
+export { type FindingsIntegrationResult, classifyChimeraReviewSource, integrateFindings, } from '../plugins/review-finding-integration.js';
 export { type ParsedReviewReport, parseChimeraReviewReport, } from '../plugins/review-finding-parser.js';
-export { persistReviewReport, type ReportIntegrationResult, } from '../plugins/review-report-integration.js';
+export { verifyFindingsAgainstDisk, type VerifyFindingsOptions, } from '../plugins/review-finding-verification.js';
+export { persistReviewReport, type ReportIntegrationResult, updateReviewReportEvidence, } from '../plugins/review-report-integration.js';
 export { maybeCompactReviewStores, type ReviewStoreMaintenanceResult, } from '../plugins/review-store-maintenance.js';
 export { createSkillsPlugin } from '../plugins/skills-plugin.js';
 export { createSyncPlugin } from '../plugins/sync-plugin.js';