bdo-cli 0.48.3 → 0.49.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +25 -0
- package/README.md +1 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,31 @@ All notable changes to Bushido (bdo) will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [0.49.0] (2026-10-29)
|
|
9
|
+
|
|
10
|
+
### Security
|
|
11
|
+
|
|
12
|
+
- **Secret redaction covers far more forms.** What bdo stores locally
|
|
13
|
+
(tracking DB, tee recovery files, hook audit fields) is now masked for:
|
|
14
|
+
environment-style assignments whose name ends in a secret word
|
|
15
|
+
(`GITHUB_TOKEN=…`, `OPENAI_API_KEY=…`, `AWS_SECRET_ACCESS_KEY=…`) — the old
|
|
16
|
+
rule missed these because `_TOKEN` has no word boundary; passwords in URL
|
|
17
|
+
userinfo (`https://user:PASS@host`, `postgres://…`); secret-named flags with a
|
|
18
|
+
separate value (`--password X`, `--token X`); mysql `-pPASS` and
|
|
19
|
+
`curl -u user:PASS`; Cookie headers; Slack/Discord webhook URLs; AWS/Azure
|
|
20
|
+
signed-URL parameters; and Hugging Face, Docker Hub, DigitalOcean, PyPI,
|
|
21
|
+
SendGrid, Google OAuth and further GitLab token formats. A probe of 23
|
|
22
|
+
common forms went from 2 masked to all 23. Look-alikes are pinned as
|
|
23
|
+
untouched: `MAX_TOKENS=4096`, `GITHUB_TOKEN=$GH_TOKEN`, `--password-stdin`,
|
|
24
|
+
`--token-file`, `ssh://git@host:22`, `cargo test -p`, `docker run -p`,
|
|
25
|
+
mysql's `-P3306`. Values may be quoted and contain spaces
|
|
26
|
+
(`PASSWORD="my secret pass"`, `--password ' leading'`, `-p'a b'`,
|
|
27
|
+
`curl -u 'alice:a b'`, `my\ pass`): the whole value is masked and its quotes
|
|
28
|
+
kept, and a Cookie value containing quotes (`session="…"`) is masked whole.
|
|
29
|
+
Each rule now compiles only when its trigger substrings appear, so the
|
|
30
|
+
per-command cost dropped despite the larger rule set (e.g. ~0.2 ms for an
|
|
31
|
+
env token, ~0.005 ms for a command with no secret word, vs ~2.8 ms before).
|
|
32
|
+
|
|
8
33
|
## [0.48.3] (2026-10-27)
|
|
9
34
|
|
|
10
35
|
### Security
|
package/README.md
CHANGED
|
@@ -119,7 +119,7 @@ gh attestation verify "$(brew --cache bushido)" --repo tedorigawa001/TokenReduct
|
|
|
119
119
|
### Verify Installation
|
|
120
120
|
|
|
121
121
|
```bash
|
|
122
|
-
bdo --version # Should show "bdo 0.
|
|
122
|
+
bdo --version # Should show "bdo 0.49.0"
|
|
123
123
|
bdo gain # Should show token savings stats
|
|
124
124
|
```
|
|
125
125
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"artifactDownloadUrls": [
|
|
3
|
-
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.
|
|
3
|
+
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.49.0"
|
|
4
4
|
],
|
|
5
5
|
"author": "Patrick Szymkowiak",
|
|
6
6
|
"bin": {
|
|
@@ -91,7 +91,7 @@
|
|
|
91
91
|
"zipExt": ".tar.xz"
|
|
92
92
|
}
|
|
93
93
|
},
|
|
94
|
-
"version": "0.
|
|
94
|
+
"version": "0.49.0",
|
|
95
95
|
"volta": {
|
|
96
96
|
"node": "18.14.1",
|
|
97
97
|
"npm": "9.5.0"
|