@yadsh/dsh-qa-surface 0.6.0 → 0.7.0

package/lib/admin/redaction.js

@@ -0,0 +1,45 @@
+/**
+ * Preview bounds. A review needs enough to judge a call, not a full dump: a
+ * large result would otherwise dominate the transcript and the wire payload.
+ */
+export const QA_ADMIN_TEXT_LIMIT = 8_000;
+export const QA_ADMIN_ARGUMENTS_LIMIT = 2_000;
+export const QA_ADMIN_RESULT_LIMIT = 6_000;
+const MASK = "[redacted]";
+/**
+ * Credential shapes masked out of tool traffic. The list is deliberately short
+ * and high-precision: a broad pattern would mangle legitimate review evidence,
+ * and a reviewer who cannot trust the transcript stops using it. Each entry
+ * keeps whatever prefix identifies the field and replaces only the value.
+ */
+const MASK_PATTERNS = [
+    // Authorization headers and bearer tokens.
+    { pattern: /\b(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/giu, replace: MASK },
+    // key=value pairs whose key names a secret.
+    {
+        pattern: /((?:password|passwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("?)[^\s",;]{4,}\2/giu,
+        replace: `$1${MASK}`,
+    },
+    // JSON string fields whose name says secret.
+    {
+        pattern: /("(?:password|secret|token|api[_-]?key|apiKey|access[_-]?key|client[_-]?secret|private[_-]?key)"\s*:\s*)"(?:[^"\\]|\\.)*"/gu,
+        replace: `$1"${MASK}"`,
+    },
+];
+export function maskSecrets(value) {
+    let masked = value;
+    for (const { pattern, replace } of MASK_PATTERNS) {
+        masked = masked.replace(pattern, replace);
+    }
+    return masked;
+}
+function bound(value, limit) {
+    return value.length <= limit ? value : `${value.slice(0, limit - 1)}…`;
+}
+/** The deployment default: bounded previews with credential shapes masked. */
+export const defaultAdminRedactor = Object.freeze({
+    redactMessage: (text) => maskSecrets(bound(text, QA_ADMIN_TEXT_LIMIT)),
+    redactToolArguments: (value) => maskSecrets(bound(value, QA_ADMIN_ARGUMENTS_LIMIT)),
+    redactToolResult: (value) => maskSecrets(bound(value, QA_ADMIN_RESULT_LIMIT)),
+});
+//# sourceMappingURL=redaction.js.map

package/lib/admin/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/admin/redaction.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,MAAM,IAAI,GAAG,YAAY,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,aAAa,GAGb;IACJ,2CAA2C;IAC3C,EAAE,OAAO,EAAE,gDAAgD,EAAE,OAAO,EAAE,IAAI,EAAE;IAC5E,4CAA4C;IAC5C;QACE,OAAO,EACL,gIAAgI;QAClI,OAAO,EAAE,KAAK,IAAI,EAAE;KACrB;IACD,6CAA6C;IAC7C;QACE,OAAO,EACL,6HAA6H;QAC/H,OAAO,EAAE,MAAM,IAAI,GAAG;KACvB;CACF,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,CAAC;QACjD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,KAAa;IACzC,OAAO,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;AACzE,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAoB,MAAM,CAAC,MAAM,CAAC;IACjE,aAAa,EAAE,CAAC,IAAY,EAAE,EAAE,CAC9B,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC/C,mBAAmB,EAAE,CAAC,KAAa,EAAE,EAAE,CACrC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IACrD,gBAAgB,EAAE,CAAC,KAAa,EAAE,EAAE,CAClC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;CACnD,CAAC,CAAC"}