chat-recall 0.5.7 → 0.5.8

package/dist/cli.js

@@ -18259,23 +18259,57 @@ function commandPreview(cfg) {
   }
   return "";
 }
+function redactInlineSecrets(value) {
+  let redacted = false;
+  let out = value;
+  out = out.replace(/(\w+:\/\/[^:/@\s]+:)([^@\s]{1,512})(@)/g, (_m, head, _pw, tail) => {
+    redacted = true;
+    return `${head}__SECRET_NOT_SYNCED__${tail}`;
+  });
+  const tokenShapes = [
+    /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+    // OpenAI-style
+    /\bgh[pousr]_[A-Za-z0-9]{16,}\b/g,
+    // GitHub
+    /\bAIza[0-9A-Za-z_-]{20,}\b/g,
+    // Google
+    /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g
+    // Slack
+  ];
+  for (const re of tokenShapes) {
+    out = out.replace(re, () => {
+      redacted = true;
+      return "__SECRET_NOT_SYNCED__";
+    });
+  }
+  return { text: out, redacted };
+}
 function reconstructionSpec(cfg) {
   const out = {
     type: cfg.type || (cfg.url ? "remote" : "local"),
     enabled: cfg.enabled !== false
   };
+  let hidSecret = false;
+  const clean = (v) => {
+    const r = redactInlineSecrets(v);
+    if (r.redacted)
+      hidSecret = true;
+    return r.text;
+  };
   if (typeof cfg.url === "string" && cfg.url)
-    out.url = cfg.url;
+    out.url = clean(cfg.url);
   if (Array.isArray(cfg.command))
-    out.command = cfg.command;
+    out.command = cfg.command.map(clean);
   else if (typeof cfg.command === "string")
-    out.command = cfg.command;
+    out.command = clean(cfg.command);
   if (Array.isArray(cfg.args))
-    out.args = cfg.args;
+    out.args = cfg.args.map((a) => clean(String(a)));
   if (Array.isArray(cfg.alwaysAllow))
     out.alwaysAllow = cfg.alwaysAllow;
   if (cfg.env && typeof cfg.env === "object")
     out.envKeys = Object.keys(cfg.env).sort();
+  if (hidSecret)
+    out.secretsRedacted = true;
   return out;
 }
 var McpsSource;
@@ -18358,7 +18392,7 @@ var init_mcps_source = __esm({
         }
         for (const [name, cfgRaw] of Object.entries(obj)) {
           const cfg = cfgRaw || {};
-          const cmd = commandPreview(cfg);
+          const cmd = redactInlineSecrets(commandPreview(cfg)).text;
           const allow = Array.isArray(cfg.alwaysAllow) ? cfg.alwaysAllow.slice(0, 8) : [];
           const spec = reconstructionSpec(cfg);
           yield {
@@ -19589,7 +19623,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync33(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.7";
+        if (true) CLI_VERSION = "0.5.8";
       } catch {
       }
     }
@@ -20101,7 +20135,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion2 = () => {
       try {
-        return true ? "0.5.7" : "dev";
+        return true ? "0.5.8" : "dev";
       } catch {
         return "dev";
       }
@@ -21869,7 +21903,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync36(join44(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.7";
+        if (true) ownVersion = "0.5.8";
       } catch {
       }
     }
@@ -23403,6 +23437,16 @@ function executePull(rows, opts = {}) {
         outcomes.push({ type: "mcp", name, tool, status: "present" });
         continue;
       }
+      if (spec.secretsRedacted) {
+        outcomes.push({
+          type: "mcp",
+          name,
+          tool,
+          status: "skipped",
+          reason: "its command contains a secret, which is never uploaded \u2014 register this one by hand"
+        });
+        continue;
+      }
       const entry = { ...built.entry };
       let rewrittenCommand;
       if (!entry.url) {
@@ -25325,7 +25369,7 @@ var init_intent_drain = __esm({
       ownVersion2 = JSON.parse(readFileSync45(join55(dir, "../package.json"), "utf-8")).version || ownVersion2;
     } catch {
       try {
-        if (true) ownVersion2 = "0.5.7";
+        if (true) ownVersion2 = "0.5.8";
       } catch {
       }
     }

package/dist/mcp.js

@@ -17597,23 +17597,57 @@ function commandPreview(cfg) {
   }
   return "";
 }
+function redactInlineSecrets(value) {
+  let redacted = false;
+  let out = value;
+  out = out.replace(/(\w+:\/\/[^:/@\s]+:)([^@\s]{1,512})(@)/g, (_m, head, _pw, tail) => {
+    redacted = true;
+    return `${head}__SECRET_NOT_SYNCED__${tail}`;
+  });
+  const tokenShapes = [
+    /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+    // OpenAI-style
+    /\bgh[pousr]_[A-Za-z0-9]{16,}\b/g,
+    // GitHub
+    /\bAIza[0-9A-Za-z_-]{20,}\b/g,
+    // Google
+    /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g
+    // Slack
+  ];
+  for (const re of tokenShapes) {
+    out = out.replace(re, () => {
+      redacted = true;
+      return "__SECRET_NOT_SYNCED__";
+    });
+  }
+  return { text: out, redacted };
+}
 function reconstructionSpec(cfg) {
   const out = {
     type: cfg.type || (cfg.url ? "remote" : "local"),
     enabled: cfg.enabled !== false
   };
+  let hidSecret = false;
+  const clean = (v) => {
+    const r = redactInlineSecrets(v);
+    if (r.redacted)
+      hidSecret = true;
+    return r.text;
+  };
   if (typeof cfg.url === "string" && cfg.url)
-    out.url = cfg.url;
+    out.url = clean(cfg.url);
   if (Array.isArray(cfg.command))
-    out.command = cfg.command;
+    out.command = cfg.command.map(clean);
   else if (typeof cfg.command === "string")
-    out.command = cfg.command;
+    out.command = clean(cfg.command);
   if (Array.isArray(cfg.args))
-    out.args = cfg.args;
+    out.args = cfg.args.map((a) => clean(String(a)));
   if (Array.isArray(cfg.alwaysAllow))
     out.alwaysAllow = cfg.alwaysAllow;
   if (cfg.env && typeof cfg.env === "object")
     out.envKeys = Object.keys(cfg.env).sort();
+  if (hidSecret)
+    out.secretsRedacted = true;
   return out;
 }
 var McpsSource;
@@ -17696,7 +17730,7 @@ var init_mcps_source = __esm({
         }
         for (const [name, cfgRaw] of Object.entries(obj)) {
           const cfg = cfgRaw || {};
-          const cmd = commandPreview(cfg);
+          const cmd = redactInlineSecrets(commandPreview(cfg)).text;
           const allow = Array.isArray(cfg.alwaysAllow) ? cfg.alwaysAllow.slice(0, 8) : [];
           const spec = reconstructionSpec(cfg);
           yield {
@@ -18901,7 +18935,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync33(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.7";
+        if (true) CLI_VERSION = "0.5.8";
       } catch {
       }
     }
@@ -19413,7 +19447,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion2 = () => {
       try {
-        return true ? "0.5.7" : "dev";
+        return true ? "0.5.8" : "dev";
       } catch {
         return "dev";
       }
@@ -21113,7 +21147,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync35(join45(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.7";
+        if (true) ownVersion = "0.5.8";
       } catch {
       }
     }

package/dist/watch.js

@@ -17701,23 +17701,57 @@ function commandPreview(cfg) {
   }
   return "";
 }
+function redactInlineSecrets(value) {
+  let redacted = false;
+  let out = value;
+  out = out.replace(/(\w+:\/\/[^:/@\s]+:)([^@\s]{1,512})(@)/g, (_m, head, _pw, tail) => {
+    redacted = true;
+    return `${head}__SECRET_NOT_SYNCED__${tail}`;
+  });
+  const tokenShapes = [
+    /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+    // OpenAI-style
+    /\bgh[pousr]_[A-Za-z0-9]{16,}\b/g,
+    // GitHub
+    /\bAIza[0-9A-Za-z_-]{20,}\b/g,
+    // Google
+    /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g
+    // Slack
+  ];
+  for (const re of tokenShapes) {
+    out = out.replace(re, () => {
+      redacted = true;
+      return "__SECRET_NOT_SYNCED__";
+    });
+  }
+  return { text: out, redacted };
+}
 function reconstructionSpec(cfg) {
   const out = {
     type: cfg.type || (cfg.url ? "remote" : "local"),
     enabled: cfg.enabled !== false
   };
+  let hidSecret = false;
+  const clean = (v) => {
+    const r = redactInlineSecrets(v);
+    if (r.redacted)
+      hidSecret = true;
+    return r.text;
+  };
   if (typeof cfg.url === "string" && cfg.url)
-    out.url = cfg.url;
+    out.url = clean(cfg.url);
   if (Array.isArray(cfg.command))
-    out.command = cfg.command;
+    out.command = cfg.command.map(clean);
   else if (typeof cfg.command === "string")
-    out.command = cfg.command;
+    out.command = clean(cfg.command);
   if (Array.isArray(cfg.args))
-    out.args = cfg.args;
+    out.args = cfg.args.map((a) => clean(String(a)));
   if (Array.isArray(cfg.alwaysAllow))
     out.alwaysAllow = cfg.alwaysAllow;
   if (cfg.env && typeof cfg.env === "object")
     out.envKeys = Object.keys(cfg.env).sort();
+  if (hidSecret)
+    out.secretsRedacted = true;
   return out;
 }
 var McpsSource;
@@ -17800,7 +17834,7 @@ var init_mcps_source = __esm({
         }
         for (const [name, cfgRaw] of Object.entries(obj)) {
           const cfg = cfgRaw || {};
-          const cmd = commandPreview(cfg);
+          const cmd = redactInlineSecrets(commandPreview(cfg)).text;
           const allow = Array.isArray(cfg.alwaysAllow) ? cfg.alwaysAllow.slice(0, 8) : [];
           const spec = reconstructionSpec(cfg);
           yield {
@@ -19072,7 +19106,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync33(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.7";
+        if (true) CLI_VERSION = "0.5.8";
       } catch {
       }
     }
@@ -19580,7 +19614,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion = () => {
       try {
-        return true ? "0.5.7" : "dev";
+        return true ? "0.5.8" : "dev";
       } catch {
         return "dev";
       }
@@ -21218,7 +21252,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync36(join44(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.7";
+        if (true) ownVersion = "0.5.8";
       } catch {
       }
     }
@@ -23571,7 +23605,7 @@ try {
   ownVersion2 = JSON.parse(readFileSync40(join48(dir, "../package.json"), "utf-8")).version || ownVersion2;
 } catch {
   try {
-    if (true) ownVersion2 = "0.5.7";
+    if (true) ownVersion2 = "0.5.8";
   } catch {
   }
 }
@@ -23915,7 +23949,7 @@ async function runCollectorMigration(opts) {
 init_sync_ledger();
 init_collector_health();
 import { existsSync as existsSync49, readFileSync as readFileSync45 } from "fs";
-var CLI_VERSION3 = true ? "0.5.7" : "0.0.0";
+var CLI_VERSION3 = true ? "0.5.8" : "0.0.0";
 var DEBOUNCE_MS = 5e3;
 var CLAUDE_DIR = claudeBackend.projectsDir();
 var PLANS_DIR = claudeBackend.plansDir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chat-recall",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/munhq/chat-recall.git"