bdo-cli 0.49.0 → 0.49.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +24 -0
- package/README.md +1 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,30 @@ All notable changes to Bushido (bdo) will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [0.49.1] (2026-10-29)
|
|
9
|
+
|
|
10
|
+
### Security
|
|
11
|
+
|
|
12
|
+
- **Redaction: values starting with `-` and multi-part shell words.** A secret
|
|
13
|
+
beginning with `-` was left in plain text for env assignments
|
|
14
|
+
(`DATABASE_PASSWORD=-…`), `curl -u alice:-…`, mysql `-p-…` and
|
|
15
|
+
`password=-…` — only a value after a `--flag` may be the next flag. And a
|
|
16
|
+
value the shell reads as one word but built from several quoted and
|
|
17
|
+
unquoted parts was masked only in part (`--password "abc"defgh` kept
|
|
18
|
+
`defgh`) or not at all (`abc"d e"f`). The whole word is now masked; a value
|
|
19
|
+
that is exactly one quoted string still keeps its quotes, so JSON stays
|
|
20
|
+
valid, and `""`, `''` and `$VAR` / `"$VAR"` references are left alone.
|
|
21
|
+
- **Redaction: `curl -u` arguments are one shell word too.** A credential
|
|
22
|
+
quoted as a whole and continued after the quote — `curl -u 'alice:abc'defgh`
|
|
23
|
+
— kept `defgh`, because the quoted-argument rule stopped at the closing
|
|
24
|
+
quote. The `-u` / `--user` / `-uUSER` / `--user=` argument is now captured
|
|
25
|
+
as one shell word and split at its first `:`: the user is kept and the rest
|
|
26
|
+
of the word masked, with quotes re-balanced. No `:` (curl prompts) and
|
|
27
|
+
`$VAR` references the shell expands (unquoted or in `"…"`) are left alone,
|
|
28
|
+
while a `$` inside `'…'` is literal and masked
|
|
29
|
+
(`curl -u 'alice:$literalSecret9'`). `--user` must be followed by `=` or a
|
|
30
|
+
space, so `--user-agent=client:1.0` is not touched.
|
|
31
|
+
|
|
8
32
|
## [0.49.0] (2026-10-29)
|
|
9
33
|
|
|
10
34
|
### Security
|
package/README.md
CHANGED
|
@@ -119,7 +119,7 @@ gh attestation verify "$(brew --cache bushido)" --repo tedorigawa001/TokenReduct
|
|
|
119
119
|
### Verify Installation
|
|
120
120
|
|
|
121
121
|
```bash
|
|
122
|
-
bdo --version # Should show "bdo 0.49.
|
|
122
|
+
bdo --version # Should show "bdo 0.49.1"
|
|
123
123
|
bdo gain # Should show token savings stats
|
|
124
124
|
```
|
|
125
125
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"artifactDownloadUrls": [
|
|
3
|
-
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.49.
|
|
3
|
+
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.49.1"
|
|
4
4
|
],
|
|
5
5
|
"author": "Patrick Szymkowiak",
|
|
6
6
|
"bin": {
|
|
@@ -91,7 +91,7 @@
|
|
|
91
91
|
"zipExt": ".tar.xz"
|
|
92
92
|
}
|
|
93
93
|
},
|
|
94
|
-
"version": "0.49.
|
|
94
|
+
"version": "0.49.1",
|
|
95
95
|
"volta": {
|
|
96
96
|
"node": "18.14.1",
|
|
97
97
|
"npm": "9.5.0"
|