dsh-agy-link 0.4.83 → 0.4.85

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.4.85 (2026-10-29)
+
+### English
+
+- **Security(doctor): redact `Authorization: Basic`, `Cookie` and `X-Api-Key` headers.**
+  - `redactLine()` only masked `Bearer …` tokens, so a doctor log line carrying `Authorization: Basic <base64>`, `Cookie:` / `Set-Cookie:`, or `X-Api-Key:` values landed in the report verbatim. All auth-carrying headers are now masked (`<name>: <redacted>`) while ordinary text is preserved. Adds a regression test.
+
+### 中文
+
+- **安全(doctor)：脱敏 `Authorization: Basic`、`Cookie`、`X-Api-Key` 等头。**
+  - `redactLine()` 此前只处理 `Bearer …`，因此 doctor 日志中 `Authorization: Basic <base64>`、`Cookie:`/`Set-Cookie:`、`X-Api-Key:` 的值会原样落入报告。现将这些携带凭据的头统一脱敏为 `<name>: <redacted>`，普通文本不变。补充回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.84...v0.4.85
+
+## 0.4.84 (2026-10-29)
+
+### English
+
+- **Perf(parser): parse a multi-line chunk in O(n) instead of O(n²).**
+  - `StreamJsonParser.feed()` walked the buffer with a `while` loop that re-sliced `this.buffer` on every newline — each slice copies the whole remainder, so a large chunk carrying many lines was quadratic in copied bytes. It now splits once (`split('\n')`, keep the torn tail), which is linear; behaviour (incl. `\r\n` stripping and torn-chunk buffering) is unchanged. Adds a large-single-chunk regression test.
+
+### 中文
+
+- **性能(parser)：多行 chunk 由 O(n²) 改为 O(n) 解析。**
+  - `StreamJsonParser.feed()` 原来用 `while` 循环逐行 `this.buffer = this.buffer.slice(...)`，每次 slice 都会复制整个剩余缓冲，含大量行的大 chunk 呈平方级复制。现改为一次性 `split('\n')` 并保留未完成的尾部（线性）；`\r\n` 去除与断块缓冲等行为不变。补充「单个大 chunk」回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.83...v0.4.84
+
 ## 0.4.83 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -2721,12 +2721,13 @@ var StreamJsonParser = class {
 	feed(chunk) {
 		this.buffer += chunk;
 		const out = [];
-		let nl;
-		while ((nl = this.buffer.indexOf("\n")) >= 0) {
-			const line = this.buffer.slice(0, nl).replace(/\r$/, "");
-			this.buffer = this.buffer.slice(nl + 1);
-			const ev = this.takeLine(line);
-			if (ev) out.push(ev);
+		if (this.buffer.indexOf("\n") >= 0) {
+			const parts = this.buffer.split("\n");
+			this.buffer = parts.pop() ?? "";
+			for (const part of parts) {
+				const ev = this.takeLine(part.replace(/\r$/, ""));
+				if (ev) out.push(ev);
+			}
 		}
 		if (this.buffer.length > 8388608) {
 			const dropped = this.buffer.length;
@@ -32412,6 +32413,7 @@ function redactLine(line) {
 	out = out.replace(/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g, "<jwt-redacted>");
 	out = out.replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, "<api-key-redacted>");
 	out = out.replace(/\bGOCSPX-[A-Za-z0-9_-]{10,}\b/g, "<api-key-redacted>");
+	out = out.replace(/\b((?:proxy-)?authorization|cookie|set-cookie|x-api-key)\s*:\s*[^\r\n]+/gi, "$1: <redacted>");
 	out = out.replace(/\b(?:https?|socks[45]):\/\/[^\s/]*:[^\s/@]*@[^\s]+/gi, "<proxy-url-redacted>");
 	return out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.83",
+  "version": "0.4.85",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",