@wrongstack/core 0.310.1 → 0.313.1

package/dist/chunk-NDBIPFNY.js

@@ -0,0 +1,102 @@
+import {
+  expectDefined
+} from "./chunk-PFZO3C6H.js";
+
+// src/observability/redact-command.ts
+var SENSITIVE_FLAG_PATTERNS = [
+  // --flag=value  or  --flag "value"  (value captured up to next space or comma)
+  /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
+  // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
+  // The separator group is optional so the attached form (the common one) matches.
+  // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+  // The value must be token-like (>= 8 chars) so ordinary combined flags such
+  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
+  // redacted, not just the first. Synced with packages/tools _redact-command.ts.
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
+  // -p|-password|-a (redis auth) short flags: attached + separated + =value.
+  // Same token-start anchor; over-redaction is an accepted tradeoff for a
+  // redaction function (false positive = cosmetic noise; false negative = leak).
+  /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
+  // env var–style secrets: TOKEN=x, API_KEY=y, etc.
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
+  // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
+  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
+  // every such flag in the command line is redacted, not just the first.
+  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
+];
+function redactCommand(cmd) {
+  let result = cmd;
+  for (const pattern of SENSITIVE_FLAG_PATTERNS) {
+    result = result.replace(pattern, (match) => {
+      const eq = match.indexOf("=");
+      const sp = match.search(/\s/);
+      const delim = eq !== -1 ? "=" : sp !== -1 ? match[sp] : null;
+      if (delim !== null) {
+        const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);
+        return `${flag}[REDACTED]`;
+      }
+      if (match.startsWith("--")) {
+        return match;
+      }
+      return `${match.slice(0, 2)}[REDACTED]`;
+    });
+  }
+  return result;
+}
+var BARE_SENSITIVE_LONG_FLAG = /^--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)$/i;
+var BARE_SENSITIVE_SHORT_FLAG = /^-(?:p|t|a)$/i;
+function redactCommandArgs(command, args) {
+  const redactedCommand = redactCommand(command);
+  const redactedArgs = args.map((a) => redactCommand(a));
+  for (let i = 0; i < redactedArgs.length - 1; i++) {
+    const flag = redactedArgs[i];
+    const next = redactedArgs[i + 1];
+    if (flag === void 0 || next === void 0) continue;
+    const isBareSensitive = (BARE_SENSITIVE_LONG_FLAG.test(flag) || BARE_SENSITIVE_SHORT_FLAG.test(flag)) && !flag.includes("[REDACTED]");
+    if (isBareSensitive && !next.startsWith("-")) {
+      redactedArgs[i + 1] = "[REDACTED]";
+    }
+  }
+  return { command: redactedCommand, args: redactedArgs };
+}
+
+// src/observability/process-telemetry.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash } from "node:crypto";
+var storage = new AsyncLocalStorage();
+function runWithProcessTelemetry(context, run) {
+  return storage.run(context, run);
+}
+function emitProcessStarted(event) {
+  const { command, args } = redactCommandArgs(event.command, event.args);
+  emit("process.started", { ...event, command, args });
+}
+function emitProcessOutput(input) {
+  const bytes = Buffer.byteLength(input.chunk);
+  emit("process.output", {
+    ...input.pid !== void 0 ? { pid: input.pid } : {},
+    stream: input.stream,
+    bytes,
+    chunkHash: createHash("sha256").update(input.chunk).digest("hex"),
+    at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function emitProcessCompleted(event) {
+  emit("process.completed", event);
+}
+function emit(name, event) {
+  const context = storage.getStore();
+  if (!context) return;
+  const { events, ...identity } = context;
+  events.emit(name, { ...identity, ...event });
+}
+
+export {
+  redactCommand,
+  redactCommandArgs,
+  runWithProcessTelemetry,
+  emitProcessStarted,
+  emitProcessOutput,
+  emitProcessCompleted
+};
+//# sourceMappingURL=chunk-NDBIPFNY.js.map