dsh-agent-plugins-market 0.8.2 → 0.8.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -13,8 +13,31 @@ const SENSITIVE_KEY = /(authorization|auth|bearer|token|secret|password|passwd|c
|
|
|
13
13
|
* walk descends into it and the per-value checks apply instead.
|
|
14
14
|
*/
|
|
15
15
|
const STRUCTURE_KEY = /^auth$/i;
|
|
16
|
-
/**
|
|
17
|
-
|
|
16
|
+
/**
|
|
17
|
+
* Whether a value carries a `${NAME}` credential reference.
|
|
18
|
+
*
|
|
19
|
+
* Scanned rather than matched: a regular expression retries the braced run
|
|
20
|
+
* from every `${` it finds, so a hostile value (`"${{".repeat(n)`) costs
|
|
21
|
+
* quadratic time on data that arrives from an endpoint or a log line. The
|
|
22
|
+
* scan moves one cursor forward through the string — the first `${` either
|
|
23
|
+
* reaches a closing brace (a reference, whatever follows it) or has none at
|
|
24
|
+
* all, which ends the search.
|
|
25
|
+
*/
|
|
26
|
+
function hasPlaceholder(value) {
|
|
27
|
+
let search = 0;
|
|
28
|
+
for (;;) {
|
|
29
|
+
const start = value.indexOf('${', search);
|
|
30
|
+
if (start === -1)
|
|
31
|
+
return false;
|
|
32
|
+
const close = value.indexOf('}', start + 2);
|
|
33
|
+
if (close === -1)
|
|
34
|
+
return false;
|
|
35
|
+
if (close > start + 2)
|
|
36
|
+
return true;
|
|
37
|
+
// `${}` names no credential; keep looking after it.
|
|
38
|
+
search = close + 1;
|
|
39
|
+
}
|
|
40
|
+
}
|
|
18
41
|
export function redactMcpConfig(value) {
|
|
19
42
|
return redactValue(value);
|
|
20
43
|
}
|
|
@@ -38,7 +61,7 @@ export function redactUrl(raw) {
|
|
|
38
61
|
.filter(part => part !== '')
|
|
39
62
|
.map(part => {
|
|
40
63
|
const [name = '', value = ''] = splitOnce(part, '=');
|
|
41
|
-
if (
|
|
64
|
+
if (hasPlaceholder(value))
|
|
42
65
|
return `${name}=${value}`;
|
|
43
66
|
return isSensitiveKey(name) ? `${name}=[redacted]` : `${name}=${value}`;
|
|
44
67
|
})
|
|
@@ -84,7 +107,7 @@ function redactValue(value, key = '') {
|
|
|
84
107
|
return Object.fromEntries(Object.entries(value).map(([childKey, childValue]) => [childKey, redactValue(childValue, childKey)]));
|
|
85
108
|
}
|
|
86
109
|
if (isSensitiveKey(key)) {
|
|
87
|
-
if (typeof value === 'string' &&
|
|
110
|
+
if (typeof value === 'string' && hasPlaceholder(value))
|
|
88
111
|
return value;
|
|
89
112
|
return '[redacted]';
|
|
90
113
|
}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "dsh-agent-plugins-market",
|
|
3
3
|
"description": "One-stop skills, subagent, MCP and LSP manager inside DeepSeek Harness (DSH), compatible with Claude Code, Codex, Cursor, Kimi and other agent plugin layouts.",
|
|
4
|
-
"version": "0.8.
|
|
4
|
+
"version": "0.8.3",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "lib/index.js",
|
|
7
7
|
"types": "lib/types/index.d.ts",
|
|
@@ -108,7 +108,7 @@
|
|
|
108
108
|
"@modelcontextprotocol/sdk": "^1.30.0",
|
|
109
109
|
"ajv": "^8.17.1",
|
|
110
110
|
"fflate": "^0.8.3",
|
|
111
|
-
"smol-toml": "^1.
|
|
111
|
+
"smol-toml": "^1.9.0",
|
|
112
112
|
"yaml": "^2.7.0",
|
|
113
113
|
"zod": "^4.6.5"
|
|
114
114
|
},
|
|
@@ -117,7 +117,7 @@
|
|
|
117
117
|
"@codemirror/lang-json": "^6.0.2",
|
|
118
118
|
"@codemirror/lang-markdown": "^6.5.2",
|
|
119
119
|
"@codemirror/language": "^6.12.4",
|
|
120
|
-
"@codemirror/state": "^6.7.
|
|
120
|
+
"@codemirror/state": "^6.7.6",
|
|
121
121
|
"@codemirror/view": "^6.43.12",
|
|
122
122
|
"@deepseek-ai/cordis": "~4.0.4",
|
|
123
123
|
"@deepseek-ai/cosmokit": "^1.8.5",
|
|
@@ -148,7 +148,7 @@
|
|
|
148
148
|
"clsx": "^2.1.1",
|
|
149
149
|
"dependency-cruiser": "^18.4.0",
|
|
150
150
|
"diff": "^9.0.0",
|
|
151
|
-
"eslint": "^10.
|
|
151
|
+
"eslint": "^10.11.0",
|
|
152
152
|
"immer": "^11.1.18",
|
|
153
153
|
"jsdom": "^30.0.1",
|
|
154
154
|
"katex": "^0.16.47",
|