dataiku-sdk 3.8.0 → 3.9.0

package/dist/src/resources/jobs.d.ts

@@ -80,7 +80,8 @@ export declare class JobsResource extends BaseResource {
     /**
      * Retrieve job log text.
      * Returns the last `maxLogLines` lines (default 500) from the tail.
-     * Use `0` or `-1` to return the log without line truncation.
+     * Use `0` or `-1` to return the log without line truncation. Credential-like
+     * JSON pairs (`"jobTicketSecret":"..."`) are redacted.
      *
      * The download is byte-bounded and deadline-covered: at most `maxLogBytes`
      * (default 10 MiB) of the *most recent* log output is retained, so a

package/dist/src/resources/jobs.js

@@ -2,6 +2,7 @@ import { ClientValidationError, DataikuError, } from "../errors.js";
 import { JobSummaryArraySchema, } from "../schemas.js";
 import { computeNextPollDelayMs, DEFAULT_POLL_INTERVAL_MS, DEFAULT_TIMEOUT_MS, isRequestDeadlineError, } from "../utils/polling.js";
 import { asRecord, } from "../utils/records.js";
+import { redactCredentialPairs, } from "../utils/secret-sanitize.js";
 import { BaseResource, } from "./base.js";
 const DEFAULT_MAX_LOG_LINES = 500;
 /**
@@ -104,6 +105,41 @@ function dssRecordMessage(line) {
 function isErrorContent(line) {
     return ERROR_KEYWORDS.test(line) || ERROR_CLASS_NAME.test(line) || PY_FILE_FRAME.test(line);
 }
+/**
+ * Remove embedded JSON object payloads (`{"...": ...}`) from a DSS record
+ * line. Structured payloads such as `SQL status {"statusWarnLevel":"ERROR",...}`
+ * carry level/class words as data, not as a failure of the record itself.
+ * An unbalanced payload (truncated line) is dropped to the end of the line.
+ */
+function stripJsonPayloads(line) {
+    let out = "";
+    let from = 0;
+    for (let start = line.indexOf('{"'); start !== -1; start = line.indexOf('{"', from)) {
+        out += line.slice(from, start);
+        let depth = 0;
+        let inString = false;
+        let end = line.length;
+        for (let i = start; i < line.length; i++) {
+            const ch = line[i];
+            if (inString) {
+                if (ch === "\\")
+                    i++;
+                else if (ch === '"')
+                    inString = false;
+            }
+            else if (ch === '"')
+                inString = true;
+            else if (ch === "{")
+                depth++;
+            else if (ch === "}" && --depth === 0) {
+                end = i + 1;
+                break;
+            }
+        }
+        from = end;
+    }
+    return out + line.slice(from);
+}
 function lineMatchesLogFilter(line, filter) {
     const normalized = line.toLowerCase();
     switch (filter) {
@@ -160,7 +196,7 @@ function filterJobLogToErrors(lines) {
             pyTraceback = false;
         }
         if (isHeader) {
-            recordMatches = isErrorContent(line) || PY_FILE_FRAME.test(message);
+            recordMatches = isErrorContent(stripJsonPayloads(line)) || PY_FILE_FRAME.test(message);
             if (recordMatches && (PY_TRACEBACK_HEAD.test(message) || PY_FILE_FRAME.test(message))) {
                 pyTraceback = true;
             }
@@ -176,7 +212,7 @@ function filterJobLogToErrors(lines) {
         if (recordMatches
             && !JVM_STACK_FRAME.test(line)
             && !JVM_MORE_FRAMES.test(line)
-            && isErrorContent(line))
+            && isErrorContent(stripJsonPayloads(line)))
             kept.push(line);
     }
     return kept.join("\n");
@@ -283,7 +319,8 @@ export class JobsResource extends BaseResource {
     /**
      * Retrieve job log text.
      * Returns the last `maxLogLines` lines (default 500) from the tail.
-     * Use `0` or `-1` to return the log without line truncation.
+     * Use `0` or `-1` to return the log without line truncation. Credential-like
+     * JSON pairs (`"jobTicketSecret":"..."`) are redacted.
      *
      * The download is byte-bounded and deadline-covered: at most `maxLogBytes`
      * (default 10 MiB) of the *most recent* log output is retained, so a
@@ -298,7 +335,9 @@ export class JobsResource extends BaseResource {
         const path = `/public/api/projects/${this.enc(opts?.projectKey)}/jobs/${jobEnc}/log/${query}`;
         const maxLogBytes = Math.max(1, opts?.maxLogBytes ?? DEFAULT_MAX_LOG_BYTES);
         const { text, } = await this.client.getTextTailLimited(path, maxLogBytes);
-        return limitJobLog(filterJobLog(text, opts?.logFilter), opts?.maxLogLines);
+        // Single download choke point (logFromUrl and wait/summary go through here):
+        // DSS logs embed the job ticket secret in start_session JSON.
+        return limitJobLog(filterJobLog(redactCredentialPairs(text), opts?.logFilter), opts?.maxLogLines);
     }
     async logFromUrl(logUrl, opts) {
         const parsed = new URL(logUrl, "http://dss.local");

package/dist/src/utils/secret-sanitize.d.ts

@@ -7,8 +7,10 @@
  * - optionally redacts userinfo embedded in HTTP(S) URL authorities
  *   (`https://user:pass@host/...` -> `https://[redacted]@host/...`).
  *
- * The SDK resource layer forwards values verbatim to DSS over TLS; sanitization
- * is a CLI presentation concern and must never leak secret material instead.
+ * The SDK resource layer forwards values verbatim to DSS over TLS; sanitizing
+ * structured output is a CLI presentation concern and must never leak secret
+ * material instead. DSS-produced read text that consumers never need secrets
+ * from (job logs) is scrubbed at the SDK download via `redactCredentialPairs`.
  */
 /** Marker replacing every redacted value or secret occurrence. */
 export declare const SECRET_REDACTED = "[redacted]";
@@ -46,6 +48,13 @@ export declare function redactUrlUserinfo(text: string): string;
  * recurse, arrays recurse. Non-string scalars pass through unchanged.
  */
 export declare function sanitizeSecrets<T>(value: T, options: SecretSanitizeOptions): T;
+/**
+ * Redact the string value of every JSON-style `"key":"value"` pair in free
+ * text whose key is credential-like (e.g. the `jobTicketSecret` DSS writes
+ * into job logs). Bare `key` fields are not redacted here: in log text they
+ * name ordinary identifiers far more often than secrets.
+ */
+export declare function redactCredentialPairs(text: string): string;
 /**
  * Every string value under a credential-like key (any depth), plus bare
  * `key` fields such as `authRealm.key`. Collected from a command's own JSON

package/dist/src/utils/secret-sanitize.js

@@ -7,8 +7,10 @@
  * - optionally redacts userinfo embedded in HTTP(S) URL authorities
  *   (`https://user:pass@host/...` -> `https://[redacted]@host/...`).
  *
- * The SDK resource layer forwards values verbatim to DSS over TLS; sanitization
- * is a CLI presentation concern and must never leak secret material instead.
+ * The SDK resource layer forwards values verbatim to DSS over TLS; sanitizing
+ * structured output is a CLI presentation concern and must never leak secret
+ * material instead. DSS-produced read text that consumers never need secrets
+ * from (job logs) is scrubbed at the SDK download via `redactCredentialPairs`.
  */
 /** Marker replacing every redacted value or secret occurrence. */
 export const SECRET_REDACTED = "[redacted]";
@@ -92,6 +94,24 @@ const CREDENTIAL_KEY_FRAGMENTS = [
 ];
 /** Keys naming how credentials work (`credentialsMode`, `passwordType`), not secrets. */
 const CREDENTIAL_SETTING_SUFFIXES = ["mode", "type", "policy",];
+/** Credential-like key (normalized fragment match, minus credential settings). */
+function isCredentialKey(key) {
+    const normalized = normalizeSecretKey(key);
+    if (CREDENTIAL_SETTING_SUFFIXES.some((suffix) => normalized.endsWith(suffix)))
+        return false;
+    return CREDENTIAL_KEY_FRAGMENTS.some((fragment) => normalized.includes(fragment));
+}
+/** JSON-style `"key": "value"` pair with escape-aware string bodies. */
+const JSON_STRING_PAIR = /"((?:[^"\\\n]|\\.)*)"(\s*:\s*)"((?:[^"\\\n]|\\.)*)"/g;
+/**
+ * Redact the string value of every JSON-style `"key":"value"` pair in free
+ * text whose key is credential-like (e.g. the `jobTicketSecret` DSS writes
+ * into job logs). Bare `key` fields are not redacted here: in log text they
+ * name ordinary identifiers far more often than secrets.
+ */
+export function redactCredentialPairs(text) {
+    return text.replace(JSON_STRING_PAIR, (pair, key, separator, value) => value.length > 0 && isCredentialKey(key) ? `"${key}"${separator}"${SECRET_REDACTED}"` : pair);
+}
 /**
  * Every string value under a credential-like key (any depth), plus bare
  * `key` fields such as `authRealm.key`. Collected from a command's own JSON
@@ -114,10 +134,7 @@ export function credentialValues(value) {
         if (node === null || typeof node !== "object")
             return;
         for (const [key, item,] of Object.entries(node)) {
-            const normalized = normalizeSecretKey(key);
-            const setting = CREDENTIAL_SETTING_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
-            visit(item, sensitive || (!setting && (normalized === "key"
-                || CREDENTIAL_KEY_FRAGMENTS.some((fragment) => normalized.includes(fragment)))));
+            visit(item, sensitive || isCredentialKey(key) || normalizeSecretKey(key) === "key");
         }
     };
     visit(value, false);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "dataiku-sdk",
-	"version": "3.8.0",
+	"version": "3.9.0",
 	"description": "Dataiku DSS SDK and CLI for programmatic access to DSS REST APIs",
 	"repository": {
 		"type": "git",
@@ -48,12 +48,12 @@
 		"node-stream-zip": "^1.16.0"
 	},
 	"devDependencies": {
-		"@oxlint/plugins": "1.86.0",
+		"@oxlint/plugins": "1.87.0",
 		"@types/bun": "^1.4.2",
 		"cross-env": "^10.1.0",
-		"dprint": "^0.60.1",
+		"dprint": "^0.61.1",
 		"js-tiktoken": "1.0.21",
-		"oxlint": "1.86.0",
+		"oxlint": "1.87.0",
 		"typescript": "^7.0.2"
 	},
 	"bundleDependencies": [

package/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "dataiku-sdk",
-	"version": "3.8.0",
+	"version": "3.9.0",
 	"description": "Dataiku DSS SDK and agent-oriented CLI for programmatic access to DSS REST APIs.",
 	"homepage": "https://github.com/clssck/dataiku-sdk",
 	"repository": "https://github.com/clssck/dataiku-sdk",

package/skills/dataiku-dss/references/discovery.md

@@ -3,12 +3,12 @@
 ## Contract
 
 - Stdout: exactly one compact JSON value; void success: `{ok:true}`. No prompts, help screens, tables, banners, or prose.
-- Dispatch/runtime failure: stdout error object (`type:"error"`, `ok:false`, `error`, `code`, `category`, `exitCode`), nonzero exit. `doctor`/`batch`/`cleanup` failures instead return direct result objects; inspect exit code and fields.
+- Dispatch/runtime failure: stdout error object (`type:"error"`, `error`, `code`, `category`, `exitCode`; `projectKey` when resolved), nonzero exit. `doctor`/`batch`/`cleanup` failures instead return direct result objects; inspect exit code and fields.
 - Stderr: JSONL diagnostics only; `type:"warning"` / `type:"trace"` for warnings / `--verbose` HTTP traces, flushed before success or failure output.
 - Exits: 0 success, 1 usage/configuration, 2 DSS/internal/permission-or-environment, 3 transient/retryable DSS error, 4 failed long-running result/assertion.
 - Recipe payload stdout: JSON string. With `--output PATH`: exact bytes to file, JSON string equal to `PATH` on stdout.
 - General `--fields a,b,c`: object projection, element-wise for object arrays. Dotted paths traverse nested objects; missing fields become `null`; strings/scalars pass through.
-- `*.list`: compact items (ids, kind, next-step fields such as recipe `inputs`/`outputs`); `--full`/`--fields` use DSS objects. `--contains TEXT` filters ids; `--limit N` caps (`list_truncated` warning).
+- Compact by default: `*.list` (ids, kind, next-step fields such as recipe `inputs`/`outputs`), `job get` (no log tail), `dataset get`/`info`, `project get`; `--full`/`--fields` use DSS objects. Lists: `--contains TEXT` filters ids; `--limit N` caps (`list_truncated` warning).
 
 ## Discovery
 

package/skills/dataiku-dss/references/troubleshooting.md

@@ -3,7 +3,7 @@
 ## Platform, builds, data
 
 - Code/SQL: use `--file`/`--sql-file`; shells, especially PowerShell, mangle quotes, `$`, and multiline text. Non-UTF-8 consoles (e.g. Windows cp1252): write non-ASCII results to UTF-8 files or `--output PATH`, not the console.
-- Build errors: `dss job log <id> --errors-only` selects errors/tracebacks. For full logs, use `--output PATH` without `--errors-only`. Logs may arrive as one JVM-noisy line; `Error in Python process: At line <N>` identifies the payload source line.
+- Build errors: `dss job log <id> --errors-only` selects errors/tracebacks. Plain `job log` prints the last 100 lines (`log_truncated`); for full logs, use `--output PATH` without `--errors-only`. Logs may arrive as one JVM-noisy line; `Error in Python process: At line <N>` identifies the payload source line.
 - Schemas: code recipes set output schemas at run time. Visual/SQL query recipes: `recipe create` fills created or empty outputs (`outputSchemaUpdated`); `recipe set-payload` updates empty or DSS-derived ones, warns `recipe_output_schema_outdated` for hand-edited ones. Apply with `dss recipe update-schema NAME` (one recipe), `dss flow propagate-schema DATASET --wait` (every downstream recipe), or build `--auto-update-schema`. `built_dataset_has_no_columns`: the DONE build wrote nothing. `nothing_to_build` (exit 4): no recipe writes the managed target. Manual columns: `dss dataset refresh-schema NAME --data-file columns.json`. `dss dataset validate-build` catches file-backed misconfiguration.
 - `Inline` (editable) datasets: the public API cannot write rows, so `dataset create` rejects them; use `UploadedFiles` + `dataset upload-file`, or a python recipe output. `code run` is a scenario step; some DSS versions refuse dataset writes there.
 - `dss dataset download`: default 100k rows; result `{ path, rows, truncated, limit }`. If truncated, raise `--limit`. Specify `--output` or read the `dataset_download_default_location` path warning. CSV is spreadsheet-safe; `--raw-data` retains formula prefixes. For large tables, aggregate in SQL or use a recipe.
@@ -22,7 +22,7 @@
 
 Dispatch/runtime failure: one compact stdout error:
 ```json
-{"type":"error","ok":false,"error":"Missing API key.","code":"missing_required_flag","category":"usage","exitCode":1,"resource":"dataset","action":"list"}
+{"type":"error","error":"Missing API key.","code":"missing_required_flag","category":"usage","exitCode":1}
 ```
 
 `doctor`/`batch`/`cleanup` command failures return direct stdout result objects; check nonzero exit before interpreting. Recover from structured `code`, `category`, `exitCode`, `retryable`, `status`, `details`, never message scraping.