@zgeoff/atc 2.26.6 → 2.26.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.26.6",
+  "version": "2.26.7",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",

package/src/daemon/imp-harness.ts

@@ -1,5 +1,7 @@
 import { DaemonError } from '../protocol/daemon-error';
 import { isRecord } from '../shared/report';
+import { sanitizeDetail } from '../shared/sanitize-detail';
+import { truncateSummary } from '../shared/truncate-summary';
 import type {
   HarnessAttachment,
   HarnessExit,
@@ -925,10 +927,29 @@ function collectColdBoots(value: unknown): { readonly bootId: unknown; readonly
     }));
 }
 
+// A refusal's message as detail a session list row can hold: credentials
+// redacted while line breaks still bound a header's value, then control
+// characters taken out so the text cannot redraw the row, and whitespace
+// flattened to one line.
+function buildSafeDetail(message: string): string {
+  return sanitizeDetail(message)
+    .replaceAll(/[\p{Cc}\p{Cf}]/gu, ' ')
+    .replaceAll(/\s+/gu, ' ')
+    .trim();
+}
+
 // An end other than an exit, as a session's last message.
 function formatOutcome(outcome: Exclude<ImpSessionOutcome, { kind: 'exit' }>): string {
   if (outcome.kind === 'failed') {
-    return `imp refused the session (${outcome.code ?? 'error'})`;
+    const code = outcome.code ?? 'error';
+    const detail = buildSafeDetail(outcome.message);
+
+    const line =
+      detail === ''
+        ? `imp refused the session (${code})`
+        : `imp refused the session (${code}): ${detail}`;
+
+    return truncateSummary(line);
   }
 
   if (outcome.kind === 'detached') {

package/src/shared/sanitize-detail.ts

@@ -0,0 +1,20 @@
+/**
+ * Replaces credential-shaped text with `[redacted]`, whatever its length:
+ * URL userinfo, whole authorization header values, values of secret-named
+ * parameters and headers — quoted values included, whole — and long
+ * token-like runs. Ordinary words pass through.
+ */
+export function sanitizeDetail(text: string): string {
+  return text
+    .replaceAll(/(?<scheme>[a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/giu, '$<scheme>[redacted]@')
+    .replaceAll(
+      /(?<name>["']?authorization["']?\s*:\s*)(?:"(?:[^"\\]|\\.)*"|[^\n]*)/giu,
+      '$<name>[redacted]',
+    )
+    .replaceAll(
+      /(?<name>["']?[a-z0-9_.-]*(?:key|token|secret|password|passwd|credential|signature)[a-z0-9_.-]*["']?\s*[:=]\s*)(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s;,;&"']+)/giu,
+      '$<name>[redacted]',
+    )
+    .replaceAll(/\b(?<scheme>bearer|basic)\s+[a-z0-9+/=._-]+/giu, '$<scheme> [redacted]')
+    .replaceAll(/[a-z0-9+/_=-]{32,}/giu, '[redacted]');
+}