dotmd-cli 0.68.0 → 0.70.0

package/src/journal.mjs

@@ -15,6 +15,107 @@ const ERROR_LOG_BACKUP = 'dotmd-errors.log.1';
 
 const MISUSE_LOG_FILE = 'dotmd-misuse.log';
 const MISUSE_LOG_BACKUP = 'dotmd-misuse.log.1';
+const TELEMETRY_SCHEMA = 2;
+const REDACTED = '[redacted]';
+const SENSITIVE_VALUE_FLAGS = new Set([
+  '--body', '--message', '--note',
+  '--token', '--password', '--passphrase', '--secret', '--api-key', '--apikey',
+  '--auth', '--authorization', '--cookie', '--header',
+]);
+
+function sanitizeCredentialShapes(value) {
+  return String(value)
+    .replace(/\b(Bearer\s+)[^\s'"`]+/gi, `$1${REDACTED}`)
+    .replace(/\b([A-Z0-9_]*(?:TOKEN|PASSWORD|PASSPHRASE|SECRET|API_KEY|APIKEY|AUTH|DATABASE_URL|DB_URL|CONNECTION_STRING|DSN)[A-Z0-9_]*)=([^\s]+)/gi, `$1=${REDACTED}`)
+    .replace(/([a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:)[^\s@]+@/gi, `$1${REDACTED}@`)
+    .replace(/(-----BEGIN [^-]*PRIVATE KEY-----)[\s\S]*?(-----END [^-]*PRIVATE KEY-----)/g, `$1${REDACTED}$2`);
+}
+
+function sanitizeArgvWithSecrets(args) {
+  const input = Array.isArray(args) ? args.map(value => String(value)) : [];
+  const output = [...input];
+  const secrets = [];
+  const redactAt = (index) => {
+    if (index < 0 || index >= output.length) return;
+    if (output[index] && output[index] !== '-' && !output[index].startsWith('@')) secrets.push(output[index]);
+    output[index] = REDACTED;
+  };
+
+  for (let i = 0; i < output.length; i++) {
+    const arg = output[i];
+    const sensitiveFlag = SENSITIVE_VALUE_FLAGS.has(arg)
+      || /^--[^=]*(?:token|password|passphrase|secret|api[-_]?key|auth(?:orization)?|cookie)$/i.test(arg);
+    if (sensitiveFlag) {
+      redactAt(i + 1);
+      i += 1;
+      continue;
+    }
+    const eq = arg.indexOf('=');
+    const flagName = eq > 0 ? arg.slice(0, eq) : '';
+    if (eq > 0 && (SENSITIVE_VALUE_FLAGS.has(flagName)
+      || /^--.*(?:token|password|passphrase|secret|api[-_]?key|auth(?:orization)?|cookie)$/i.test(flagName))) {
+      const value = arg.slice(eq + 1);
+      if (value) secrets.push(value);
+      output[i] = `${arg.slice(0, eq)}=${REDACTED}`;
+      continue;
+    }
+    output[i] = sanitizeCredentialShapes(arg);
+    if (output[i] !== arg) secrets.push(arg);
+  }
+
+  const globalValueFlags = new Set(['--config', '--root', '--type']);
+  let commandIndex = -1;
+  for (let i = 0; i < input.length; i++) {
+    if (globalValueFlags.has(input[i])) { i += 1; continue; }
+    if (input[i].startsWith('-')) continue;
+    commandIndex = i;
+    break;
+  }
+  const command = input[commandIndex];
+  const commandArgs = commandIndex >= 0 ? input.slice(commandIndex + 1) : [];
+  const commandOffset = commandIndex + 1;
+  const collectPositionals = (valueFlags, dashLeadingAfter = null) => {
+    const positions = [];
+    for (let i = 0; i < commandArgs.length; i++) {
+      const arg = commandArgs[i];
+      if (valueFlags.has(arg) || globalValueFlags.has(arg)) { i += 1; continue; }
+      if (arg.startsWith('-') && arg !== '-'
+        && !(dashLeadingAfter !== null && positions.length >= dashLeadingAfter)) continue;
+      positions.push(commandOffset + i);
+    }
+    return positions;
+  };
+  if (command === 'new') {
+    const positions = collectPositionals(new Set(['--status', '--title', '--runlist', '--body', '--message', '--root']), 2);
+    if (positions.length >= 3 && input[positions[0]] === 'prompt') positions.slice(2).forEach(redactAt);
+  } else if (command === 'prompts' || command === 'prompt') {
+    const positions = collectPositionals(new Set(['--status', '--body', '--message', '--title']), 2);
+    if (positions.length >= 3 && input[positions[0]] === 'new') positions.slice(2).forEach(redactAt);
+  } else if (command === 'baton') {
+    const positions = collectPositionals(new Set(['--status', '--note', '--body', '--message']));
+    if (positions.length >= 2) positions.slice(1).forEach(redactAt);
+  }
+
+  const argv = commandIndex > 0
+    ? [output[commandIndex], ...output.slice(commandIndex + 1), ...output.slice(0, commandIndex)]
+    : output;
+  return { argv, secrets };
+}
+
+export function sanitizeTelemetryArgv(args) {
+  return sanitizeArgvWithSecrets(args).argv;
+}
+
+export function sanitizeTelemetryText(value, secrets = []) {
+  let text = String(value ?? '');
+  for (const secret of [...new Set(secrets.filter(Boolean))].sort((a, b) => b.length - a.length)) {
+    text = text.split(secret).join(REDACTED);
+  }
+  return sanitizeCredentialShapes(text)
+    .replace(/((?:--body|--message|--note|--token|--password|--passphrase|--secret|--api-key|--apikey|--auth|--authorization|--cookie|--header)(?:=|\s+))([^\s]+)/gi, `$1${REDACTED}`)
+    .replace(/(git\s+commit\b[^\n]*?(?:\s-m|\s--message)(?:=|\s+))((?:"[^"]*")|(?:'[^']*')|[^\s]+)/gi, `$1${REDACTED}`)
+    .replace(/((?:sed|perl|g?awk)\b[^\n]*?\s(?:-e\s+)?)((?:"[^"]*")|(?:'[^']*'))/gi, `$1${REDACTED}`);
+}
 
 export function isJournalEnabled(config) {
   if (process.env.DOTMD_JOURNAL === '1') return true;
@@ -30,14 +131,14 @@ export function journalBackupPath(config) {
   return path.join(config.repoRoot, JOURNAL_DIR, JOURNAL_BACKUP);
 }
 
-function firstEntryVersion(file) {
+function firstEntry(file) {
   try {
     const sample = readFileSync(file, 'utf8');
     const nl = sample.indexOf('\n');
     const first = nl >= 0 ? sample.slice(0, nl) : sample;
     if (!first.trim()) return null;
     const obj = JSON.parse(first);
-    return obj?.v == null ? null : String(obj.v);
+    return obj;
   } catch {
     return null;
   }
@@ -45,11 +146,20 @@ function firstEntryVersion(file) {
 
 function maybeRotate(file, backup, nextEntry = null) {
   pruneStaleBackup(backup);
+  if (nextEntry?.schema != null) {
+    for (const candidate of [file, backup]) {
+      if (!existsSync(candidate)) continue;
+      const existingSchema = firstEntry(candidate)?.schema;
+      if (existingSchema !== nextEntry.schema) {
+        try { unlinkSync(candidate); } catch {}
+      }
+    }
+  }
   if (!existsSync(file)) return;
   let st;
   try { st = statSync(file); } catch { return; }
   if (nextEntry?.v) {
-    const existingVersion = firstEntryVersion(file);
+    const existingVersion = firstEntry(file)?.v;
     if (existingVersion !== String(nextEntry.v)) {
       try { renameSync(file, backup); } catch {}
       return;
@@ -89,21 +199,38 @@ export function appendJournalEntry(config, entry) {
   if (!isJournalEnabled(config)) return;
   if (!config?.repoRoot) return;
   try {
+    const sanitized = sanitizeArgvWithSecrets(entry?.argv);
+    const safeEntry = {
+      ...entry,
+      schema: TELEMETRY_SCHEMA,
+      ...(Array.isArray(entry?.argv) ? { argv: sanitized.argv } : {}),
+      ...(entry?.err ? { err: sanitizeTelemetryText(entry.err, sanitized.secrets) } : {}),
+    };
     const dir = path.join(config.repoRoot, JOURNAL_DIR);
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
     const file = journalFilePath(config);
-    maybeRotate(file, journalBackupPath(config), entry);
+    maybeRotate(file, journalBackupPath(config), safeEntry);
     // O_APPEND is atomic for writes under PIPE_BUF (4KB on Linux, 512B on
     // macOS). Entries are well under either threshold, so concurrent CLI
     // invocations interleave cleanly without locking.
-    appendFileSync(file, JSON.stringify(entry) + '\n', { flag: 'a' });
+    appendFileSync(file, JSON.stringify(safeEntry) + '\n', { flag: 'a' });
   } catch {
     // Journal write must never break a command.
   }
 }
 
+function purgeLegacyTelemetry(file, backup) {
+  for (const candidate of [file, backup]) {
+    if (!existsSync(candidate)) continue;
+    if (firstEntry(candidate)?.schema !== TELEMETRY_SCHEMA) {
+      try { unlinkSync(candidate); } catch {}
+    }
+  }
+}
+
 export function readJournalEntries(config) {
   const file = journalFilePath(config);
+  purgeLegacyTelemetry(file, journalBackupPath(config));
   if (!existsSync(file)) return [];
   let raw;
   try { raw = readFileSync(file, 'utf8'); } catch { return []; }
@@ -117,11 +244,13 @@ export function readJournalEntries(config) {
 
 export function recordCliInvocation({ config, startMs, args, err, version }) {
   if (!config) return;
+  const sanitized = sanitizeArgvWithSecrets(args);
   const entry = {
+    schema: TELEMETRY_SCHEMA,
     ts: new Date().toISOString(),
     sid: currentSessionId(),
     pid: process.pid,
-    argv: args,
+    argv: sanitized.argv,
     exit: process.exitCode ?? 0,
     ms: Date.now() - startMs,
     v: version,
@@ -130,7 +259,7 @@ export function recordCliInvocation({ config, startMs, args, err, version }) {
     // Normalize whitespace so multi-line error messages (e.g. unknown-command
     // hints) render as a single line in `dotmd journal --tail`. Cap at 200
     // chars so a stray stack trace can't bloat the journal.
-    const flat = String(err.message ?? err).replace(/\s+/g, ' ').trim();
+    const flat = sanitizeTelemetryText(err.message ?? err, sanitized.secrets).replace(/\s+/g, ' ').trim();
     entry.err = flat.length > 200 ? flat.slice(0, 197) + '...' : flat;
   }
   appendJournalEntry(config, entry);
@@ -155,13 +284,15 @@ export function globalErrorLogBackupPath() {
 
 export function recordGlobalError({ config, startMs, args, err, version }) {
   if (!err) return;
-  const flatMsg = String(err.message ?? err).replace(/\s+/g, ' ').trim();
+  const sanitized = sanitizeArgvWithSecrets(args);
+  const flatMsg = sanitizeTelemetryText(err.message ?? err, sanitized.secrets).replace(/\s+/g, ' ').trim();
   const entry = {
+    schema: TELEMETRY_SCHEMA,
     ts: new Date().toISOString(),
     repo: config?.repoRoot || process.cwd(),
     sid: currentSessionId(),
     pid: process.pid,
-    argv: args,
+    argv: sanitized.argv,
     exit: process.exitCode ?? 1,
     ms: typeof startMs === 'number' ? Date.now() - startMs : null,
     v: version,
@@ -171,7 +302,7 @@ export function recordGlobalError({ config, startMs, args, err, version }) {
   if (err && err.stack) {
     // Keep the first few frames; stacks for DotmdError are short anyway and
     // for unexpected exceptions five frames is usually enough to localize.
-    const stack = String(err.stack).split('\n').slice(0, 6).join('\n');
+    const stack = sanitizeTelemetryText(err.stack, sanitized.secrets).split('\n').slice(0, 6).join('\n');
     entry.stack = stack.length > 1000 ? stack.slice(0, 997) + '...' : stack;
   }
   try {
@@ -203,6 +334,7 @@ export function globalMisuseLogBackupPath() {
 export function recordGuardEvent(event) {
   if (!event) return;
   const entry = {
+    schema: TELEMETRY_SCHEMA,
     ts: new Date().toISOString(),
     repo: event.repo || process.cwd(),
     sid: currentSessionId(),
@@ -211,7 +343,7 @@ export function recordGuardEvent(event) {
     rule: event.rule ?? null,
     decision: event.decision ?? null,
     detail: typeof event.detail === 'string'
-      ? (event.detail.length > 300 ? event.detail.slice(0, 297) + '...' : event.detail)
+      ? (sanitizeTelemetryText(event.detail).length > 300 ? sanitizeTelemetryText(event.detail).slice(0, 297) + '...' : sanitizeTelemetryText(event.detail))
       : null,
     v: event.version ?? null,
   };
@@ -219,7 +351,7 @@ export function recordGuardEvent(event) {
     const dir = globalErrorLogDir();
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
     const file = globalMisuseLogPath();
-    maybeRotate(file, globalMisuseLogBackupPath());
+    maybeRotate(file, globalMisuseLogBackupPath(), entry);
     appendFileSync(file, JSON.stringify(entry) + '\n', { flag: 'a' });
   } catch {
     // Logging must never break the hook.
@@ -228,6 +360,7 @@ export function recordGuardEvent(event) {
 
 export function readMisuseEntries() {
   const file = globalMisuseLogPath();
+  purgeLegacyTelemetry(file, globalMisuseLogBackupPath());
   if (!existsSync(file)) return [];
   let raw;
   try { raw = readFileSync(file, 'utf8'); } catch { return []; }