claudeos-core 2.5.0 → 2.5.2

package/lib/env-parser.js

@@ -220,6 +220,54 @@ function extractApiTarget(vars) {
 const SENSITIVE_VAR_PATTERNS = [
   /password/i,
   /passwd/i,
+  // Abbreviated form (`DB_PASS`, `MYSQL_PASS`, bare `PASS`). Anchored to a
+  // name-segment boundary (start / `_` / `-`) rather than a bare substring,
+  // so `BYPASS_AUTH`, `PASSENGER_NAME` and `COMPASS_URL` are NOT swept up.
+  // maskUrlCredentials' PARAM_RE has accepted `pass` as a connection
+  // parameter name since v2.5.0; this closes the same gap on the env-key
+  // side, where the value is copied verbatim into project-analysis.json.
+  //
+  // KNOWN, ACCEPTED OVER-MATCH: a leading `PASS_` segment also matches
+  // benign names such as `PASS_RATE`. Narrowing to a trailing segment
+  // (`/(^|[_-])pass$/i`) would fix that but drop `DB_PASS_2` / `PASS_FILE`.
+  // The two failure modes are not symmetric — over-redaction costs one
+  // config fact in project-analysis.json, under-redaction writes a live
+  // credential into a file the Pass 3/4 prompts tell the model to read — so
+  // the broader rule stands. Do not narrow it without re-reading this.
+  /(^|[_-])pass([_-]|$)/i,
+  // Same segment-anchored treatment for the `PW` abbreviation
+  // (`DB_PW`, `ADMIN_PW`, `ROOT_PW`).
+  /(^|[_-])pw([_-]|$)/i,
+  /passphrase/i,
+  // Trailing-segment only: `PASSWORD_PEPPER` / `PEPPER` are the secret,
+  // `PEPPER_ROUNDS` is a cost parameter.
+  /(^|[_-])pepper$/i,
+  // Anchored so `SSH_KEYSCAN_HOSTS` (a host list) is not swept up, while
+  // `SSH_KEY` / `SSH_KEY_PATH` still are.
+  /ssh[_-]?key([_-]|$)/i,
+  /sign(ing)?[_-]?key([_-]|$)/i,
+  // Specific well-known secret-bearing `*_KEY` names. Deliberately NOT a
+  // blanket `/(^|[_-])key([_-]|$)/i`: that would also redact `ROUTING_KEY`,
+  // `PARTITION_KEY`, `SORT_KEY`, `IDEMPOTENCY_KEY` and `FOREIGN_KEY_CHECKS`,
+  // which are architecture facts this tool exists to document. Each name is
+  // anchored at its trailing boundary so `MASTER_KEYSPACE` (Cassandra) and
+  // `SERVER_KEYSTORE_PATH` are not swept up.
+  //
+  // This is a curated list and will always trail real-world naming. If a
+  // leak is found, add the specific name here rather than widening to a
+  // blanket `key` rule.
+  /master[_-]?key([_-]|$)/i,
+  /deploy[_-]?key([_-]|$)/i,
+  /license[_-]?key([_-]|$)/i,
+  /server[_-]?key([_-]|$)/i,
+  // Bare `SERVICE_ACCOUNT` (the JSON blob itself) and its secret-bearing
+  // suffixes only. `SERVICE_ACCOUNT_EMAIL` / `_NAME` / `_ID` identify the
+  // account, they do not authenticate as it — those are config facts.
+  // Two patterns, not one with an optional group: an optional group matches
+  // empty and the trailing `[_-]` then swallows the separator, which makes
+  // `SERVICE_ACCOUNT_EMAIL` match after all.
+  /service[_-]?account$/i,
+  /service[_-]?account[_-](keys?|json|file|secret|token|creds?|credentials?)([_-]|$)/i,
   /secret/i,
   /api[_-]?key/i,
   /access[_-]?key/i,
@@ -253,6 +301,108 @@ function isSensitiveVarName(name) {
  * Scheme, host, port, path and query are preserved so consumers can still
  * identify the DB engine / host. Non-URL values pass through unchanged.
  */
+// The userinfo rule maskUrlCredentials() applies. Shared so the backstop below
+// can ask "did this already get masked?" instead of guessing from the result.
+const USERINFO_RE = /^([a-z][a-z0-9+.:-]*:\/\/)([^/?#\s]*)@([^@/?#\s]+)/i;
+// Schemes whose values routinely carry an `@` inside a PATH: scoped npm
+// packages, image variants, `/users/@me`. A DSN scheme essentially never does.
+const WEB_SCHEME_RE = /^(?:https?|wss?)$/i;
+// A token that can follow the `@` terminating an authority: a host, an IPv6
+// literal in brackets, optionally `:port`, then end-of-value or a delimiter.
+const HOST_AFTER_AT_RE = /^(?:\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9._~%-]+)(?::\d+)?(?:[/?#]|$)/;
+// A complete `host[:port]` with a NUMERIC port.
+const HOST_PORT_RE = /^(?:[A-Za-z0-9._~-]+)(?::\d+)?$/;
+
+/**
+ * v2.5.2 — True when a `scheme://…` value carries userinfo that
+ * maskUrlCredentials() could not rewrite, because the password contains a raw
+ * `/`, `?`, `#` or space and so pushed the real authority past the point where
+ * the userinfo rule is forced to stop.
+ *
+ * The earlier implementation guessed from the TRUNCATED authority — the text
+ * before the first `/?#` — and asked whether the part after its `:` was
+ * all-digits. That inverted the test for the most common leak of all: in
+ * `postgres://user:12345/6@db/app` the truncated authority is `user:12345`,
+ * whose tail IS all digits, so a password merely BEGINNING with digits (which
+ * base64-generated passwords routinely do) was waved through. It also could
+ * not see a password holding a space, since the userinfo rule's own character
+ * class excludes whitespace.
+ *
+ * This version instead locates the `@` that actually terminates an authority
+ * and decides from there. `user:12345` and `a.com:8080` are syntactically
+ * indistinguishable, so where ambiguity is irreducible the scheme breaks the
+ * tie: for a DSN the value is treated as credentials, for http/https/ws/wss as
+ * a path.
+ *
+ *   postgres://u:p/w@host/db            true   password holds `/`
+ *   postgres://user:12345/6@db/app      true   digit-leading password
+ *   postgres://u:pa ss@host/db          true   password holds a space
+ *   redis://:pw?x@host/0                true   password holds `?`
+ *   postgres://u:p@host/db              false  the userinfo rule handles it
+ *   https://cdn.example.com/npm/@x/y    false  no credential shape at all
+ *   http://a.com:8080/img/@2x.png       false  web scheme, complete host:port
+ *   http://[::1]:8080/img/@2x.png       false  bracketed IPv6 is a host
+ *   mongodb://h:port/db?x=a@b           false  the `@` sits in the query
+ *   https://api:${PORT}/v1/@me          false  unexpanded template
+ */
+function hasUnmaskedUrlCredentials(value) {
+  if (typeof value !== "string") return false;
+  const m = value.match(/^([a-z][a-z0-9+.-]*(?::[a-z][a-z0-9+.-]*)*):\/\/(.*)$/i);
+  if (!m) return false;
+  const rest = m[2];
+  if (!rest || !rest.includes("@")) return false;
+  // An unexpanded `${VAR}` is a template, not a live secret. parseEnvContent
+  // deliberately does not expand these, so redacting one loses a host for
+  // nothing.
+  if (/\$\{[^}]*\}/.test(rest)) return false;
+  // Already masked by the userinfo rule — nothing is hidden.
+  if (USERINFO_RE.test(value)) return false;
+
+  const scheme = m[1].split(":")[0].toLowerCase();   // `jdbc:postgresql` → `jdbc`
+  // What a strict parser would read as the authority: everything up to the
+  // first `/`, `?` or `#`.
+  const head = rest.slice(0, rest.search(/[/?#]/) === -1 ? rest.length : rest.search(/[/?#]/));
+  // A bracketed IPv6 literal can only ever be a host, never userinfo.
+  if (head.startsWith("[")) return false;
+  // No `user:secret` shape at all. The empty-user form (`redis://:pw@host`)
+  // starts with `:`, so it is admitted here.
+  if (!head.includes(":")) return false;
+  // For a web scheme, a head that is ALREADY a complete `host:port` means the
+  // authority ended there and the `@` belongs to the path.
+  if (WEB_SCHEME_RE.test(scheme) && HOST_PORT_RE.test(head)) return false;
+
+  // The `@` that would terminate the real authority: the last one followed by
+  // something that can be a host.
+  // The loop stops at `i > 0`, NOT `i !== -1`. `String.prototype.lastIndexOf`
+  // clamps a negative `fromIndex` to 0 rather than returning -1, so an `@`
+  // sitting at index 0 that fails the host test re-finds itself forever and
+  // hangs `init` at 100% CPU with no error (`postgres://@ :x` reproduces it).
+  // Stopping at index 0 loses nothing: an `@` there means empty userinfo.
+  for (let i = rest.lastIndexOf("@"); i > 0; i = rest.lastIndexOf("@", i - 1)) {
+    // `continue`, NOT `return false`. Abandoning the whole search on the first
+    // `@` that turns out to be query content let a DSN carrying an email or a
+    // redirect URL in its query string defeat the backstop entirely:
+    // `postgres://app:pa/ss@db/app?redirect=user@host` starts at the LAST `@`,
+    // decides it is query content, and never examines the earlier `@` that
+    // terminates the real authority.
+    if (!HOST_AFTER_AT_RE.test(rest.slice(i + 1))) continue;
+    // If a `?` precedes this `@` AND a `/` precedes that `?`, then a path had
+    // already begun before the query started, so the authority was long since
+    // over and this `@` is query content (`mongodb://h:port/db?x=a@b`). When
+    // the `?` comes before any `/` it is inside the password instead
+    // (`redis://:pw?x@host/0`).
+    const q = rest.indexOf("?");
+    if (q !== -1 && q < i && rest.slice(0, q).includes("/")) continue;
+    return true;
+  }
+  return false;
+}
+
+const REDACTED = "***REDACTED***";
+// Scalar env-derived fields (host, apiTarget) are rendered directly into
+// generated docs, so the sentinel must never become their value.
+const nullIfRedacted = (v) => (v === REDACTED ? null : v);
+
 function maskUrlCredentials(value) {
   if (typeof value !== "string") return value;
   // Scheme may itself contain `:` (`jdbc:postgresql://`, `jdbc:mysql://`).
@@ -270,9 +420,36 @@ function maskUrlCredentials(value) {
   // The parameter NAME is kept, the value becomes `***`.
   const PARAM_RE = /([?&;](?:password|passwd|pwd|pass|secret|token|access[_-]?key|secret[_-]?key|api[_-]?key|sas|signature)=)[^&;\s]*/gi;
   if (/^[a-z][a-z0-9+.:-]*:\/\//i.test(value)) {
-    return value
-      .replace(/^([a-z][a-z0-9+.:-]*:\/\/)([^/?#\s]*)@([^@/?#\s]+)/i, "$1***:***@$3")
+    const userinfoMasked = USERINFO_RE.test(value);
+    const masked = value
+      .replace(USERINFO_RE, "$1***:***@$3")
       .replace(PARAM_RE, "$1***");
+    // v2.5.2 — last-resort backstop for a password containing a raw `/`, `?`
+    // or `#` (`postgres://u:p/w@host/db`). The rule above deliberately does
+    // not rewrite an `@` that appears after the first `/` — such an `@`
+    // normally belongs to the path (`https://cdn.example.com/npm/@scope/pkg`)
+    // and masking it would replace the real host. The value therefore passed
+    // through verbatim, and because its key is `DATABASE_URL` the key-name
+    // rule did not backstop it either: it was the one combination that could
+    // still write a plaintext password into project-analysis.json, which
+    // Pass 3/4 prompts instruct the model to read.
+    //
+    // Base64-generated passwords contain `/` routinely, so this is not an
+    // exotic shape. When the value carries the tell (see
+    // hasUnmaskedUrlCredentials) the WHOLE value is dropped rather than
+    // rewritten — the host cannot be located reliably once the authority is
+    // ambiguous, and a lost host is a far cheaper failure than a leaked
+    // credential. Callers are told which key it was via
+    // envInfo.credentialWarnings.
+    //
+    // Gated on the USERINFO rule not having fired — NOT on `masked === value`.
+    // PARAM_RE may rewrite a query parameter on the same value
+    // (`postgres://u:p/w@host/db?sslmode=require&password=x`); a
+    // "did anything change" gate would then skip the backstop and let `p/w`
+    // through verbatim. Whether the userinfo rule matched is the only signal
+    // that says the authority itself was masked.
+    if (!userinfoMasked && hasUnmaskedUrlCredentials(value)) return "***REDACTED***";
+    return masked;
   }
   // Scheme-less credentials are recognized ONLY in the Go/MySQL DSN shape
   // (`user:pw@tcp(host:3306)/db`, `user:pw@unix(/path)/db`); the password may
@@ -329,9 +506,25 @@ function readStackEnvInfo(root) {
   return {
     source: file,
     vars: redactSensitiveVars(vars),
+    // v2.5.2 — the keys whose value `maskUrlCredentials` dropped whole rather
+    // than partially masking. The credential is not leaked, but the user loses
+    // the host for that key, so `init` names the keys in its Phase 1 summary
+    // instead of silently swallowing them. Key NAMES only, never any part of
+    // the value.
+    //
+    // Derived from what `maskUrlCredentials` ACTUALLY returned, so the list can
+    // never name a key whose value was kept (masked) rather than dropped. The
+    // `!== REDACTED` guard covers an env value that is literally the sentinel.
+    credentialWarnings: Object.keys(vars).filter(
+      k => !isSensitiveVarName(k) && vars[k] !== REDACTED && maskUrlCredentials(vars[k]) === REDACTED
+    ),
     port: extractPort(vars),
-    host: maskUrlCredentials(extractHost(vars)),
-    apiTarget: maskUrlCredentials(extractApiTarget(vars)),
+    // A value the backstop dropped whole must not travel on as the literal
+    // sentinel: `host` / `apiTarget` are rendered straight into CLAUDE.md §3,
+    // and the scaffold's only sentinel guard covers `envInfo.vars`. Null makes
+    // the row simply absent, which is what the scaffold already handles.
+    host: nullIfRedacted(maskUrlCredentials(extractHost(vars))),
+    apiTarget: nullIfRedacted(maskUrlCredentials(extractApiTarget(vars))),
   };
 }
 
@@ -346,6 +539,7 @@ module.exports = {
   isSensitiveVarName,
   redactSensitiveVars,
   maskUrlCredentials,
+  hasUnmaskedUrlCredentials,
   // Exported for test visibility:
   ENV_FILE_ORDER,
   PORT_VAR_KEYS,

package/package.json

@@ -1,92 +1,92 @@
-{
-  "name": "claudeos-core",
-  "version": "2.5.0",
-  "description": "Auto-generate Claude Code documentation from your actual source code — Standards, Rules, Skills, and Guides tailored to your project",
-  "main": "bin/cli.js",
-  "bin": {
-    "claudeos-core": "bin/cli.js"
-  },
-  "files": [
-    "bin/",
-    "lib/",
-    "claude-md-validator/",
-    "content-validator/",
-    "health-checker/",
-    "manifest-generator/",
-    "pass-json-validator/",
-    "pass-prompts/",
-    "plan-installer/",
-    "plan-validator/",
-    "sync-checker/",
-    "bootstrap.sh",
-    "README.md",
-    "README.ko.md",
-    "LICENSE",
-    "CHANGELOG.md",
-    "CONTRIBUTING.md",
-    "CODE_OF_CONDUCT.md",
-    "SECURITY.md",
-    "README.zh-CN.md",
-    "README.ja.md",
-    "README.es.md",
-    "README.vi.md",
-    "README.hi.md",
-    "README.ru.md",
-    "README.fr.md",
-    "README.de.md"
-  ],
-  "scripts": {
-    "init": "node bin/cli.js init",
-    "lint": "node bin/cli.js lint",
-    "health": "node bin/cli.js health",
-    "validate": "node bin/cli.js validate",
-    "refresh": "node bin/cli.js refresh",
-    "restore": "node bin/cli.js restore",
-    "pretest": "node -e \"try{require('glob')}catch(e){process.exit(1)}\" || npm install",
-    "test": "node scripts/run-tests.js",
-    "test:health": "node health-checker/index.js"
-  },
-  "keywords": [
-    "claude-code",
-    "automation",
-    "code-analysis",
-    "CLAUDE.md",
-    "standards",
-    "rules",
-    "skills",
-    "scaffolding",
-    "i18n",
-    "multi-language",
-    "spring-boot",
-    "kotlin",
-    "exposed",
-    "jooq",
-    "cqrs",
-    "bff",
-    "multi-module",
-    "monorepo",
-    "nextjs",
-    "express",
-    "fastify",
-    "angular",
-    "django",
-    "fastapi"
-  ],
-  "author": "claudeos-core <claudeoscore@gmail.com> (https://github.com/claudeos-core)",
-  "license": "ISC",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/claudeos-core/claudeos-core.git"
-  },
-  "homepage": "https://github.com/claudeos-core/claudeos-core#readme",
-  "bugs": {
-    "url": "https://github.com/claudeos-core/claudeos-core/issues"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "dependencies": {
-    "glob": "^13.0.6",
-    "gray-matter": "^4.0.3"
-  }
-}
+{
+  "name": "claudeos-core",
+  "version": "2.5.2",
+  "description": "Auto-generate Claude Code documentation from your actual source code — Standards, Rules, Skills, and Guides tailored to your project",
+  "main": "bin/cli.js",
+  "bin": {
+    "claudeos-core": "bin/cli.js"
+  },
+  "files": [
+    "bin/",
+    "lib/",
+    "claude-md-validator/",
+    "content-validator/",
+    "health-checker/",
+    "manifest-generator/",
+    "pass-json-validator/",
+    "pass-prompts/",
+    "plan-installer/",
+    "plan-validator/",
+    "sync-checker/",
+    "bootstrap.sh",
+    "README.md",
+    "README.ko.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "CONTRIBUTING.md",
+    "CODE_OF_CONDUCT.md",
+    "SECURITY.md",
+    "README.zh-CN.md",
+    "README.ja.md",
+    "README.es.md",
+    "README.vi.md",
+    "README.hi.md",
+    "README.ru.md",
+    "README.fr.md",
+    "README.de.md"
+  ],
+  "scripts": {
+    "init": "node bin/cli.js init",
+    "lint": "node bin/cli.js lint",
+    "health": "node bin/cli.js health",
+    "validate": "node bin/cli.js validate",
+    "refresh": "node bin/cli.js refresh",
+    "restore": "node bin/cli.js restore",
+    "pretest": "node -e \"try{require('glob')}catch(e){process.exit(1)}\" || npm install",
+    "test": "node scripts/run-tests.js",
+    "test:health": "node health-checker/index.js"
+  },
+  "keywords": [
+    "claude-code",
+    "automation",
+    "code-analysis",
+    "CLAUDE.md",
+    "standards",
+    "rules",
+    "skills",
+    "scaffolding",
+    "i18n",
+    "multi-language",
+    "spring-boot",
+    "kotlin",
+    "exposed",
+    "jooq",
+    "cqrs",
+    "bff",
+    "multi-module",
+    "monorepo",
+    "nextjs",
+    "express",
+    "fastify",
+    "angular",
+    "django",
+    "fastapi"
+  ],
+  "author": "claudeos-core <claudeoscore@gmail.com> (https://github.com/claudeos-core)",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/claudeos-core/claudeos-core.git"
+  },
+  "homepage": "https://github.com/claudeos-core/claudeos-core#readme",
+  "bugs": {
+    "url": "https://github.com/claudeos-core/claudeos-core/issues"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "glob": "^13.0.6",
+    "gray-matter": "^4.0.3"
+  }
+}

package/pass-json-validator/index.js

@@ -228,7 +228,7 @@ async function main() {
           const framework = paData.stack?.framework;
           const language = paData.stack?.language;
           const architecture = paData.stack?.architecture;
-          isBackend = !frontend || ["express", "nestjs", "fastify", "django", "fastapi", "flask", "spring-boot"].includes(framework);
+          isBackend = !frontend || ["express", "nestjs", "fastify", "django", "fastapi", "flask", "spring-boot", "spring-framework"].includes(framework);
           isKotlin = language === "kotlin";
           isKotlinCqrs = isKotlin && (architecture === "cqrs" || paData.stack?.multiModule);
         } catch (_e) { /* If project-analysis parsing fails, conservatively assume backend */ }

package/pass-prompts/templates/java-spring/pass1.md

@@ -21,8 +21,16 @@ Required reads (if the file exists):
      the variable inside `ext { ... }` or `<properties>`. Record the
      ACTUAL Java version — do NOT infer "Java 17+" from the Spring
      Boot version.
-   - Spring Boot version: verify it matches `project-analysis.json`'s
-     frameworkVersion field; if they disagree, trust the build file.
+   - Spring version: verify it matches `project-analysis.json`'s
+     frameworkVersion field (Spring Boot, or the Spring Framework line when
+     `framework` is `"spring-framework"` — a pre-Boot project); if they
+     disagree, trust the build file. For a non-Boot project, also read
+     `WEB-INF/web.xml` and the Spring XML configs it references
+     (`applicationContext*.xml`, `*-servlet.xml`, `*.properties`) — they
+     hold what `application.yml` holds in a Boot project, and step 2 below
+     will find no `application.yml`. Do NOT describe Boot features
+     (auto-configuration, starters, actuator, `@SpringBootApplication`)
+     for a project that does not declare Boot.
    - Dependencies that indicate specific patterns (MyBatis/iBatis/JPA,
      multiple DB drivers, Jasypt, JWT library, Logback extras).
 

package/pass-prompts/templates/java-spring/pass3.md

@@ -68,7 +68,8 @@ Generation targets:
    Content within each section adapts to this project based on pass2-merged.json.
    The scaffold's validation checklist MUST pass.
 
-   Stack-specific hints for this project (Java Spring Boot):
+   Stack-specific hints for this project (Java Spring — Boot, or Spring Framework
+   without Boot when `project-analysis.json` says `framework: "spring-framework"`):
    - Project type for Section 1 PROJECT_CONTEXT: "Backend Application" or "REST API Server"
    - Architecture diagram (Section 4): layered architecture (Controller → Service → Mapper/Repository)
    - Section 2 should include: JDK version, Gradle/Maven, DB, session/cache, server port

package/plan-installer/index.js

@@ -52,7 +52,23 @@ async function main() {
     console.log(`    Database:    ${stack.database || "none"}`);
   }
   console.log(`    ORM:         ${stack.orm || "none"}`);
-  console.log(`    PackageMgr:  ${stack.packageManager || "none"}\n`);
+  console.log(`    PackageMgr:  ${stack.packageManager || "none"}`);
+  // v2.5.2 — a URL value whose password holds a raw `/`, `?` or `#` cannot
+  // have its userinfo rewritten without risking the host, so the whole value
+  // is dropped. Say so: silently losing a DATABASE_URL would otherwise look
+  // like a detection bug. Key names only, never any part of the value.
+  // Both env sources are reported. A sub-directory SPA keeps its own
+  // `frontend/.env`, read into `stack.frontendEnvInfo`, and reading only
+  // `stack.envInfo` swallowed exactly the drop this warning exists to announce.
+  for (const info of [stack.envInfo, stack.frontendEnvInfo]) {
+    const credWarn = (info && info.credentialWarnings) || [];
+    if (!credWarn.length) continue;
+    console.warn(`\n  ⚠️  Credential-shaped value dropped from ${credWarn.join(", ")} (${info.source}).`);
+    console.warn("  The password contains a raw '/', '?', '#' or space, which makes the URL's host");
+    console.warn("  ambiguous, so the value was redacted whole rather than partially masked.");
+    console.warn("  Percent-encode the password (e.g. '/' as %2F) to keep the host visible.");
+  }
+  console.log("");
 
   // Phase 2: Structure scan
   console.log("  [Phase 2] Scanning structure...");