@wrongstack/core 0.4.0 → 0.4.1

package/dist/index.js

@@ -870,7 +870,7 @@ function walkCount(node, vault, counter) {
   if (Array.isArray(node)) {
     return node.map((item) => walkCount(item, vault, counter));
   }
-  const out = {};
+  const out = /* @__PURE__ */ Object.create(null);
   for (const [k, v] of Object.entries(node)) {
     if (typeof v === "string" && isSecretField(k) && !vault.isEncrypted(v) && v.length > 0) {
       out[k] = vault.encrypt(v);
@@ -883,7 +883,15 @@ function walkCount(node, vault, counter) {
   }
   return out;
 }
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
 function deepMerge(a, b) {
   const out = { ...a };
   for (const [k, v] of Object.entries(b)) {
@@ -1636,12 +1644,15 @@ var PATTERNS = [
   { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
   {
     type: "bearer_token",
-    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{20,}=*(?![A-Za-z0-9_.~+/-])/g
+    // Bounded at 512 chars to prevent catastrophic backtracking on adversarial input.
+    // Negative lookahead is a simple single-char check — no backtracking risk.
+    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{20,512}=*(?![A-Za-z0-9_.~+/-])/g
   },
   {
     type: "high_entropy_env",
-    // Value-side word boundary + length gate to avoid matching short random strings
-    regex: /\b([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,})['"]?(?!\s*[A-Za-z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))/g
+    // Value bounded at 512 chars; negative lookahead simplified to avoid
+    // nested quantifier backtracking on adversarial input.
+    regex: /\b([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?/g
   }
 ];
 var SCRUB_CHUNK_BYTES = 64 * 1024;
@@ -4366,7 +4377,15 @@ var ENV_MAP = {
 function isPrimitiveArray(a) {
   return a.every((v) => v === null || typeof v !== "object");
 }
-var FORBIDDEN_PROTO_KEYS2 = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var FORBIDDEN_PROTO_KEYS2 = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
 function deepMerge2(base, patch) {
   if (typeof base !== "object" || base === null) return patch ?? base;
   if (typeof patch !== "object" || patch === null) return base;
@@ -10476,7 +10495,6 @@ var githubServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@modelcontextprotocol/server-github"],
-  env: { GITHUB_PERSONAL_ACCESS_TOKEN: process.env.GITHUB_PERSONAL_ACCESS_TOKEN ?? "" },
   permission: "confirm"
 });
 var context7Server = () => ({
@@ -10492,7 +10510,6 @@ var braveSearchServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@modelcontextprotocol/server-brave-search"],
-  env: { BRAVE_SEARCH_API_KEY: process.env.BRAVE_SEARCH_API_KEY ?? "" },
   permission: "confirm"
 });
 var blockServer = () => ({
@@ -10509,7 +10526,6 @@ var everArtServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@modelcontextprotocol/server-everart"],
-  env: { EVERART_API_KEY: process.env.EVERART_API_KEY ?? "" },
   permission: "confirm"
 });
 var slackServer = () => ({
@@ -10518,10 +10534,6 @@ var slackServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@modelcontextprotocol/server-slack"],
-  env: {
-    SLACK_BOT_TOKEN: process.env.SLACK_BOT_TOKEN ?? "",
-    SLACK_TEAM_ID: process.env.SLACK_TEAM_ID ?? ""
-  },
   permission: "confirm"
 });
 var awsServer = () => ({
@@ -10538,7 +10550,6 @@ var googleMapsServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@modelcontextprotocol/server-google-maps"],
-  env: { GOOGLE_MAPS_API_KEY: process.env.GOOGLE_MAPS_API_KEY ?? "" },
   permission: "confirm"
 });
 var sentinelServer = () => ({
@@ -10555,10 +10566,7 @@ var zaiVisionServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@z_ai/mcp-server@latest"],
-  env: {
-    Z_AI_API_KEY: process.env.Z_AI_API_KEY ?? "",
-    Z_AI_MODE: process.env.Z_AI_MODE ?? "ZAI"
-  },
+  env: { Z_AI_MODE: "ZAI" },
   allowedTools: [
     "image_analysis",
     "extract_text_from_screenshot",
@@ -10576,10 +10584,9 @@ var miniMaxVisionServer = () => ({
   command: "uvx",
   args: ["minimax-coding-plan-mcp", "-y"],
   env: {
-    MINIMAX_API_KEY: process.env.MINIMAX_API_KEY ?? "",
-    MINIMAX_MCP_BASE_PATH: process.env.MINIMAX_MCP_BASE_PATH ?? "./.wrongstack/minimax-output",
-    MINIMAX_API_HOST: process.env.MINIMAX_API_HOST ?? "https://api.minimax.io",
-    MINIMAX_API_RESOURCE_MODE: process.env.MINIMAX_API_RESOURCE_MODE ?? "url"
+    MINIMAX_MCP_BASE_PATH: "./.wrongstack/minimax-output",
+    MINIMAX_API_HOST: "https://api.minimax.io",
+    MINIMAX_API_RESOURCE_MODE: "url"
   },
   allowedTools: ["understand_image"],
   permission: "auto"
@@ -12073,6 +12080,7 @@ ${mem}`);
       try {
         proc = spawn("git", ["status", "--porcelain=v1", "--branch"], {
           cwd: root,
+          env: buildChildEnv(),
           stdio: ["ignore", "pipe", "ignore"]
         });
         let buf = "";