arena-bridge 0.7.1 → 0.7.3

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/) and the project uses
 [Semantic Versioning](https://semver.org/).
 
+## 0.7.3
+
+### Fixed
+- `mac_scroll` speaks the current Peekaboo grammar: the removed `--ticks` option was replaced
+  with `--amount`, and the tool also accepts `amount` as an argument.
+
+## 0.7.2
+
+### Fixed
+- The audit log masks credentials: a Telegram bot token, a GitHub, npm or PyPI token in a
+  command or an argument is written as `***`, so the log cannot become a secret store the
+  agent may read.
+
 ## 0.7.1
 
 ### Fixed

package/README.md

@@ -12,7 +12,7 @@
   <img src="https://img.shields.io/badge/license-MIT-blue.svg?style=flat-square" alt="license">
   <img src="https://img.shields.io/badge/node-%3E%3D18-green.svg?style=flat-square" alt="node">
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen.svg?style=flat-square" alt="dependencies">
-  <img src="https://img.shields.io/badge/tests-147%20passed-brightgreen.svg?style=flat-square" alt="tests">
+  <img src="https://img.shields.io/badge/tests-149%20passed-brightgreen.svg?style=flat-square" alt="tests">
 </p>
 
 <p align="center">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arena-bridge",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "Give a cloud AI agent (Arena.ai Agent Mode, Claude, Cursor, ...) controlled access to your own machine over HTTP/MCP: files, shell, Chrome and the macOS desktop, with an approval gate, trust windows and an audit log.",
   "type": "module",
   "bin": {

package/src/audit.mjs

@@ -11,11 +11,35 @@ export function auditPath() {
   return path.join(configDir(), 'audit.log');
 }
 
+const SECRETS = [
+  /(?<!\d)\d{6,12}:[A-Za-z0-9_-]{25,}/g, // telegram bot tokens
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, // github tokens
+  /\bnpm_[A-Za-z0-9]{20,}\b/g, // npm tokens
+  /\bpypi-[A-Za-z0-9_-]{20,}\b/g, // pypi tokens
+  /\bsk-[A-Za-z0-9]{20,}\b/g, // api keys
+];
+
+/** Mask anything that looks like a credential, so the log never becomes a secret store. */
+export function scrub(value) {
+  if (typeof value === 'string') {
+    let out = value;
+    for (const re of SECRETS) out = out.replace(re, '***');
+    return out;
+  }
+  if (Array.isArray(value)) return value.map(scrub);
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = scrub(v);
+    return out;
+  }
+  return value;
+}
+
 export function audit(entry) {
   try {
     const dir = configDir();
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const rec = { ts: new Date().toISOString(), ...entry };
+    const rec = { ts: new Date().toISOString(), ...scrub(entry) };
     fs.appendFileSync(auditPath(), JSON.stringify(rec) + '\n', { mode: 0o600 });
   } catch {
     /* auditing must never break the request */

package/src/direct.mjs

@@ -52,7 +52,7 @@ export function createDirectServer(cfg, engine) {
           ok: true,
           mode: 'direct',
           device: cfg.device,
-          version: '0.7.1',
+          version: '0.7.3',
           uptime_sec: Math.round(process.uptime()),
         });
       }

package/src/hub.mjs

@@ -90,7 +90,7 @@ export function createHubServer(cfg) {
         return sendJson(res, 200, {
           ok: true,
           mode: 'hub',
-          version: '0.7.1',
+          version: '0.7.3',
           devices: [...devices.keys()],
         });
       }

package/src/mac.mjs

@@ -423,6 +423,7 @@ export function macTools(cfg = {}) {
         {
           direction: { type: 'string', description: 'up or down' },
           ticks: { type: 'number', description: 'how many steps, default 3' },
+          amount: { type: 'number', description: 'how many steps to scroll (same as ticks)' },
           on: { type: 'string', description: 'element id from mac_see' },
           app: { type: 'string' },
           window_id: { type: 'string' },
@@ -439,7 +440,7 @@ export function macTools(cfg = {}) {
         const res = await runVariants(
           p.bin,
           [
-            ['scroll', '--direction', dir, '--ticks', String(args.ticks || 3), ...on, ...flags],
+            ['scroll', '--direction', dir, '--amount', String(args.amount ?? args.ticks ?? 3), ...on, ...flags],
             ['scroll', '--direction', dir, ...on, ...flags],
           ],
           { timeout: 30 },

package/src/mcp.mjs

@@ -48,7 +48,7 @@ export async function handleMcp(req, res, ctx) {
           mcpResponse(id, {
             protocolVersion: PROTOCOL_VERSION,
             capabilities: { tools: { listChanged: false } },
-            serverInfo: { name: 'arena-bridge', version: '0.7.1' },
+            serverInfo: { name: 'arena-bridge', version: '0.7.3' },
             instructions:
               'Tools operate the user\'s own machine. Dangerous operations may return ' +
               'PROTECTED and require a local human approval.',