bazis 0.117.1 → 0.118.0

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.117.1" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.118.0" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/core/kernel/config/Secret.ts

@@ -1,3 +1,5 @@
+import { rememberSecretValue } from "../../../library/redaction";
+
 const REDACTED = "***";
 
 /**
@@ -9,6 +11,8 @@ export class Secret {
 
   public constructor(value: string) {
     this.#value = value;
+    // Logs and errors drop the value even where it was pasted as plain text.
+    rememberSecretValue(value);
   }
 
   public reveal(): string {

package/library/orm/Schema/OwnedStoreCatalog.ts

@@ -607,7 +607,7 @@ function row(v: unknown): OwnedStoreRegistryRowV1 {
     bad();
   return Object.freeze(out as OwnedStoreRegistryRowV1);
 }
-export function validateOwnedStoreRegistryV1(rows: unknown, defs: readonly OrmOwnedStoreDefinitionV1[]): readonly OwnedStoreRegistryRowV1[] {
+export function validateOwnedStoreRegistryV1(rows: unknown, _defs: readonly OrmOwnedStoreDefinitionV1[]): readonly OwnedStoreRegistryRowV1[] {
   const out = dense(rows, row, 4096);
   const keys = new Set<string>();
   for (const x of out) {
@@ -619,9 +619,9 @@ export function validateOwnedStoreRegistryV1(rows: unknown, defs: readonly OrmOw
     if (keys.has(x.storeKey))
       throw failure("ORM_OWNED_STORE_OWNERSHIP_CONFLICT");
     keys.add(x.storeKey);
-    const d = defs.find(y => y.storeKey === x.storeKey);
-    if (d && (x.formatVersion !== String(d.formatVersion) || x.ownedSchema !== d.ownedScope.schema || x.tablePrefix !== d.ownedScope.tablePrefix))
-      throw failure("ORM_OWNED_STORE_IDENTITY_MISMATCH");
+    // A row that differs from the code (format version, scope) is refused by
+    // admission's assertCurrent, after the row is recorded for the explainer,
+    // so the message can name what changed.
   }
   for (let i = 0; i < out.length; i++)
     for (let j = i + 1; j < out.length; j++) {

package/library/redaction/index.ts

@@ -47,6 +47,42 @@ export function redactTraceValues<T>(values: readonly T[], options: SensitiveRed
   return values.map(() => replacement);
 }
 
+/** Values shorter than this are not remembered: masking them would hide ordinary words ("postgres"). */
+export const MIN_REMEMBERED_SECRET_LENGTH = 10;
+const rememberedSecrets = new Set<string>();
+let longestFirst: readonly string[] = [];
+
+/**
+ * Remembers a secret value: from now on every redaction removes it wherever it
+ * appears, also in plain text without a marker such as `password=`. `Secret`
+ * calls it for every configuration secret. Process-wide; values shorter than
+ * {@link MIN_REMEMBERED_SECRET_LENGTH} are recognised only by their shape.
+ */
+export function rememberSecretValue(value: string): void {
+  // A connection URL keeps naming its server: only its password is the secret,
+  // and the userinfo pattern already hides user:password@ in the URL itself.
+  const password = urlPassword(value);
+  if (password !== undefined) {
+    if (password !== "") rememberSecretValue(password);
+    return;
+  }
+  if (value.length < MIN_REMEMBERED_SECRET_LENGTH || rememberedSecrets.has(value)) return;
+  rememberedSecrets.add(value);
+  // A longer value first, so a secret that contains another one goes whole.
+  longestFirst = [...rememberedSecrets].sort((left, right) => right.length - left.length);
+}
+
+/** The decoded password of a URL with userinfo (`""` for user only), or undefined for other values. */
+function urlPassword(value: string): string | undefined {
+  if (!/^[a-z][a-z0-9+.-]*:\/\/[^\s/?#@]+@/i.test(value)) return undefined;
+  try {
+    const url = new URL(value);
+    return decodeURIComponent(url.password);
+  } catch {
+    return undefined;
+  }
+}
+
 export function isSensitiveKey(key: string, options: SensitiveRedactionOptions = {}): boolean {
   return keyIsSensitive(key, normalizeOptions(options));
 }
@@ -177,7 +213,9 @@ function normalizeKey(key: string): string {
 }
 
 function redactText(value: string, replacement: string): string {
-  return value
+  let text = value;
+  for (const secret of longestFirst) if (text.includes(secret)) text = text.replaceAll(secret, replacement);
+  return text
     .replace(SECRET_TEXT_PATTERN, (_match, name: string, separator: string) => `${name}${separator}${replacement}`)
     .replace(BEARER_TEXT_PATTERN, (_match, scheme: string) => `${scheme} ${replacement}`)
     .replace(URL_USERINFO_PATTERN, (_match, scheme: string, userinfo: string) =>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.117.1",
+  "version": "0.118.0",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",