gina 0.6.6 → 0.6.7

package/framework/{v0.6.6 → v0.6.7}/core/config.js

@@ -2379,6 +2379,9 @@ function Config(opt, contextResetNeeded) {
             // Expose files['settings'] directly on conf so that getConfig() (no-arg) callers
             // can access it as conf.settings — mirrors how conf.security is set via merge(files, conf)
             // at the top of loadBundleConfig. Previously implicit through an older conf merge path.
+            // NOTE (#B257): this binding is PRE-substitution; it is re-pointed at the resolved
+            // copy after the `whisper()` pass further down — see the re-bind next to
+            // `conf[bundle][env].content = files`.
             conf[bundle][env].settings = files['settings'];
 
             if ( staticsPathObj.existsSync() ) {
@@ -2896,6 +2899,25 @@ function Config(opt, contextResetNeeded) {
             conf[bundle][env].content = {}
         }
 
+        // #B257 — re-point the `.settings` alias at the POST-substitution copy.
+        // `whisper()` above returns a NEW object instead of mutating in place: a plain
+        // object's constructor stringifies to '... [native code] ...', so whisper's
+        // in-place branch is skipped and it falls through to stringify → replace →
+        // JSON.parse. The binding made before that pass therefore keeps the ORIGINAL
+        // object, in which every token this pass is the first to know stays literal —
+        // ${bundlePath}, ${libPath}, ${publicPath}, ${handlersPath}, ${mountPath},
+        // ${gina}, ${project}, ${root}, ${source}, ${<name>Port}, ${templates}/${html}/
+        // ${theme} and the scalar harvest, none of which exist in the earlier pass's
+        // dictionary. (Tokens that pass already resolved — ${homedir}, ${scope}, … —
+        // were fine; ${secret:…} is fine too, since secrets.resolve() walks in place.)
+        // Re-binding here makes getConfig().settings and getConfig().content.settings
+        // the same resolved object.
+        // Guarded: whisper hands back the raw string when its JSON.parse throws, and
+        // overwriting a populated `.settings` with undefined would be a regression.
+        if ( typeof(files['settings']) != 'undefined' ) {
+            conf[bundle][env].settings = files['settings'];
+        }
+
 
         conf[bundle][env].bundle    = bundle;
         if (bundle == self.startingApp)

package/framework/{v0.6.6 → v0.6.7}/core/connectors/couchbase/index.js

@@ -2,6 +2,7 @@
 // Imports.
 var fs              = require('fs');
 var sqlParser       = require('./../sql-parser'); // #SQL1 state-machine comment stripper
+var paramRedact     = require('./../param-redact'); // #B350 — bound-value redaction for dev/Inspector sinks
 // CB-LOW-3 fix: removed dead `const { version } = require('os')` — `version` was never referenced.
 // Use couchbase module from the user's project dependencies if not found
 var couchbasePath   = _(getPath('project') +'/node_modules/couchbase');
@@ -933,7 +934,11 @@ function Couchbase(conn, infos) {
                         console.debug('[ ' + trigger +' ] '+ statement);
                         //console.debug('[ ' + trigger +' ] options: '+ JSON.stringify(queryOptions, null, 2));
                         if (queryParams.length > 0) {
-                            console.debug('[ ' + trigger +' ] Found query params: '+ queryParams);
+                            // #B350 — bound values are secrets to the calling app (tokens, key
+                            // hashes); this line previously printed them verbatim. A positional
+                            // bind array has no key names for the key-based redactor, so the
+                            // default is count + types; `inspector.queries.captureValues` opts in.
+                            console.debug('[ ' + trigger +' ] Found query params: '+ (paramRedact.captureValues() ? queryParams : paramRedact.describeParams(queryParams)));
                         }
 
                         var _alsStore = process.gina && process.gina._queryALS ? process.gina._queryALS.getStore() : null;
@@ -943,7 +948,7 @@ function Couchbase(conn, infos) {
                                 type        : 'N1QL',
                                 trigger     : entityName.toLowerCase() + '#' + name,
                                 statement   : String(statement),
-                                params      : queryParams.length > 0 ? queryParams.slice() : [],
+                                params      : queryParams.length > 0 ? (paramRedact.captureValues() ? queryParams.slice() : paramRedact.summarize(queryParams)) : [],
                                 durationMs  : 0,
                                 resultCount : 0,
                                 resultSize  : 0,
@@ -1428,7 +1433,14 @@ function Couchbase(conn, infos) {
             var _biQueryEntry = null;
             // #INS10 — capture during a prod instrumentation window too (not just dev mode).
             if (envIsDev || (process.gina && process.gina._inspectorWindowUntil > Date.now())) {
-                console.debug('[ ' + trigger +' ] '+statement);
+                // #B350 — the bulkInsert statement inlines every record's full document
+                // values (stringified per record above), so the raw statement is itself a
+                // value disclosure; the default logs op + record count, and
+                // `inspector.queries.captureValues` opts back in to the full statement.
+                var _biStatementForLog = paramRedact.captureValues()
+                    ? statement
+                    : 'INSERT INTO ' + this.database + ' (KEY, VALUE) -- ' + recCount + ' record(s) [values redacted]';
+                console.debug('[ ' + trigger +' ] '+_biStatementForLog);
 
                 var _biAlsStore = process.gina && process.gina._queryALS ? process.gina._queryALS.getStore() : null;
                 var _biDevLog = _biAlsStore ? _biAlsStore._devQueryLog : null;
@@ -1436,7 +1448,7 @@ function Couchbase(conn, infos) {
                     _biQueryEntry = {
                         type        : 'N1QL',
                         trigger     : this.name.toLowerCase() + '#' + name,
-                        statement   : String(statement),
+                        statement   : String(_biStatementForLog),
                         params      : [],
                         durationMs  : 0,
                         resultCount : 0,

package/framework/{v0.6.6 → v0.6.7}/core/connectors/duckdb/index.js

@@ -9,6 +9,7 @@
 
 var fs        = require('fs');
 var sqlParser = require('./../sql-parser'); // #SQL1 state-machine comment stripper
+var paramRedact = require('./../param-redact'); // #B350 — bound-value redaction for dev/Inspector sinks
 var lib       = require('./../../../lib') || require.cache[require.resolve('./../../../lib')];
 var inherits  = lib.inherits;
 var console   = lib.logger;
@@ -342,7 +343,9 @@ function Duckdb(conn, infos) {
             if (envIsDev) {
                 console.debug('[ ' + trigger + ' ] ' + queryString);
                 if (args.length > 0) {
-                    console.debug('[ ' + trigger + ' ] params: ' + JSON.stringify(args));
+                    // #B350 — bound values redacted by default (count + types);
+                    // `inspector.queries.captureValues` opts in to real values.
+                    console.debug('[ ' + trigger + ' ] params: ' + (paramRedact.captureValues() ? JSON.stringify(args) : paramRedact.describeParams(args)));
                 }
             }
 
@@ -370,7 +373,7 @@ function Duckdb(conn, infos) {
                         type        : 'DUCKDB',
                         trigger     : entityName.toLowerCase() + '#' + name,
                         statement   : String(queryString),
-                        params      : args.length > 0 ? args.slice() : [],
+                        params      : args.length > 0 ? (paramRedact.captureValues() ? args.slice() : paramRedact.summarize(args)) : [],
                         durationMs  : 0,
                         resultCount : 0,
                         resultSize  : 0,

package/framework/{v0.6.6 → v0.6.7}/core/connectors/mongodb/index.js

@@ -10,6 +10,7 @@
 var fs       = require('fs');
 var loader   = require('./lib/pipeline-loader');
 var lib      = require('./../../../lib') || require.cache[require.resolve('./../../../lib')];
+var paramRedact = require('./../param-redact'); // #B350 — bound-value redaction for dev/Inspector sinks
 var inherits = lib.inherits;
 var console  = lib.logger;
 
@@ -409,7 +410,11 @@ function Mongodb(conn, infos) {
             }
 
             if (envIsDev) {
-                console.debug('[ ' + trigger + ' ] op=' + op + ' body=' + JSON.stringify(resolvedBody));
+                // #B350 — the resolved body inlines the caller's values (filter values,
+                // whole documents); the default logs a structure-preserving redaction
+                // (keys + nesting kept, every primitive leaf replaced by its type marker),
+                // and `inspector.queries.captureValues` opts back in to real values.
+                console.debug('[ ' + trigger + ' ] op=' + op + ' body=' + JSON.stringify(paramRedact.captureValues() ? resolvedBody : paramRedact.redactValuesDeep(resolvedBody)));
             }
 
             var _devLog = null, _queryEntry = null;
@@ -422,8 +427,8 @@ function Mongodb(conn, infos) {
                     _queryEntry = {
                         type        : 'MQL',
                         trigger     : entityName.toLowerCase() + '#' + name,
-                        statement   : op + ' ' + JSON.stringify(resolvedBody),
-                        params      : args.length > 0 ? args.slice() : [],
+                        statement   : op + ' ' + JSON.stringify(paramRedact.captureValues() ? resolvedBody : paramRedact.redactValuesDeep(resolvedBody)),
+                        params      : args.length > 0 ? (paramRedact.captureValues() ? args.slice() : paramRedact.summarize(args)) : [],
                         durationMs  : 0,
                         resultCount : 0,
                         resultSize  : 0,

package/framework/{v0.6.6 → v0.6.7}/core/connectors/mysql/index.js

@@ -9,6 +9,7 @@
 
 var fs        = require('fs');
 var sqlParser = require('./../sql-parser'); // #SQL1 state-machine comment stripper
+var paramRedact = require('./../param-redact'); // #B350 — bound-value redaction for dev/Inspector sinks
 var lib       = require('./../../../lib') || require.cache[require.resolve('./../../../lib')];
 var inherits  = lib.inherits;
 var console   = lib.logger;
@@ -336,7 +337,9 @@ function Mysql(conn, infos) {
             if (envIsDev) {
                 console.debug('[ ' + trigger + ' ] ' + queryString);
                 if (args.length > 0) {
-                    console.debug('[ ' + trigger + ' ] params: ' + JSON.stringify(args));
+                    // #B350 — bound values redacted by default (count + types);
+                    // `inspector.queries.captureValues` opts in to real values.
+                    console.debug('[ ' + trigger + ' ] params: ' + (paramRedact.captureValues() ? JSON.stringify(args) : paramRedact.describeParams(args)));
                 }
             }
 
@@ -364,7 +367,7 @@ function Mysql(conn, infos) {
                         type        : 'MySQL',
                         trigger     : entityName.toLowerCase() + '#' + name,
                         statement   : String(queryString),
-                        params      : args.length > 0 ? args.slice() : [],
+                        params      : args.length > 0 ? (paramRedact.captureValues() ? args.slice() : paramRedact.summarize(args)) : [],
                         durationMs  : 0,
                         resultCount : 0,
                         resultSize  : 0,

package/framework/v0.6.7/core/connectors/param-redact.js

@@ -0,0 +1,177 @@
+/**
+ * @module param-redact
+ *
+ * #B350 — redaction of bound query parameter VALUES (and value-bearing
+ * statement bodies) before they reach developer-facing sinks: the dev-mode
+ * console lines and the per-request Inspector query log (`_devQueryLog`).
+ *
+ * Why this exists: a bound parameter's sensitivity is a property of the
+ * calling application that a connector cannot infer — a bind value may be a
+ * session or credential token, an API key, a password hash. The key-based
+ * `lib/inspector-redact` cannot help here: it matches on KEY NAMES, and a
+ * positional bind array has no keys. So the fail-safe default is to log the
+ * SHAPE (count + types — arity and coercion bugs stay diagnosable) and let a
+ * developer opt in to real values via `settings.inspector.queries.captureValues`
+ * (seeded onto `process.gina._inspectorQueryCaptureValues` at boot, default
+ * false — same contract as `inspector.ai.captureText` and
+ * `inspector.events.captureArgs`).
+ *
+ * Consumers: the query-capable connectors (couchbase, postgresql, mysql,
+ * sqlite, duckdb, scylladb, mongodb). The AI connector needs nothing from
+ * this module — its value-class capture (prompt text) is already gated by
+ * `inspector.ai.captureText`.
+ *
+ * Loaded with a relative require like the sibling `sql-parser` — connectors
+ * are load-once modules, and this module must stay dependency-free (no lib
+ * registry, no logger) so it can never affect a query path.
+ */
+
+'use strict';
+
+/**
+ * Classify a single bound value into a bracketed type marker.
+ *
+ * Never returns the value itself, only its type family — `Buffer` and `Date`
+ * get their own markers because they are common bind types whose family is
+ * more diagnostic than a bare `[object]`.
+ *
+ * @memberof module:param-redact
+ * @param {*} value - a single bound parameter value
+ * @returns {string} a marker like `[string]`, `[number]`, `[null]`, `[buffer]`
+ *
+ * @example
+ * typeMarker('abc')        // -> '[string]'
+ * @example
+ * typeMarker(null)         // -> '[null]'
+ */
+function typeMarker(value) {
+    if (value === null) return '[null]';
+    var t = typeof value;
+    if (t === 'undefined') return '[undefined]';
+    if (t === 'string')    return '[string]';
+    if (t === 'number')    return '[number]';
+    if (t === 'boolean')   return '[boolean]';
+    if (t === 'bigint')    return '[bigint]';
+    if (t === 'function')  return '[function]';
+    if (t === 'symbol')    return '[symbol]';
+    if (Array.isArray(value)) return '[array]';
+    if (value instanceof Date) return '[date]';
+    if (typeof Buffer !== 'undefined' && Buffer.isBuffer(value)) return '[buffer]';
+    return '[object]';
+}
+
+/**
+ * Whether bound values may ride the dev sinks in clear.
+ *
+ * Reads the boot-seeded `process.gina._inspectorQueryCaptureValues` slot
+ * (from `settings.inspector.queries.captureValues`). Fail-closed: absent
+ * slot, absent `process.gina`, or any non-`true` value all mean redact.
+ *
+ * @memberof module:param-redact
+ * @returns {boolean} true only when the operator explicitly opted in
+ *
+ * @example
+ * if (paramRedact.captureValues()) { console.debug(params); }
+ */
+function captureValues() {
+    return !!(process.gina && process.gina._inspectorQueryCaptureValues);
+}
+
+/**
+ * Length-preserving redaction of a positional bind array for the Inspector
+ * query-log payload: each value becomes its type marker, so the Inspector
+ * UI keeps rendering the params table (arity + types) without receiving a
+ * single value byte.
+ *
+ * @memberof module:param-redact
+ * @param {Array} params - the positional bind array
+ * @returns {string[]} same-length array of type markers; `[]` for non-arrays
+ *
+ * @example
+ * summarize(['tok', 42])   // -> ['[string]', '[number]']
+ * @example
+ * summarize(null)          // -> []
+ */
+function summarize(params) {
+    if (!Array.isArray(params)) return [];
+    var out = new Array(params.length);
+    for (var i = 0, len = params.length; i < len; i++) {
+        out[i] = typeMarker(params[i]);
+    }
+    return out;
+}
+
+/**
+ * Human-oriented redacted form for the dev console lines:
+ * `count [type, type, ...]` — the shape a developer needs for the usual
+ * reasons to read a params line (arity mismatches, type coercion bugs).
+ *
+ * @memberof module:param-redact
+ * @param {Array} params - the positional bind array
+ * @returns {string} e.g. `3 [string, number, string]`; `0 []` for empty/non-arrays
+ *
+ * @example
+ * describeParams(['tok', 7, 'x'])   // -> '3 [string, number, string]'
+ */
+function describeParams(params) {
+    if (!Array.isArray(params) || params.length === 0) return '0 []';
+    var names = new Array(params.length);
+    for (var i = 0, len = params.length; i < len; i++) {
+        // strip the brackets off the marker for the joined human form
+        names[i] = typeMarker(params[i]).slice(1, -1);
+    }
+    return params.length + ' [' + names.join(', ') + ']';
+}
+
+/**
+ * Structure-preserving deep redaction for value-bearing statement BODIES
+ * (a resolved document-database body, a bulk record set): keys and nesting
+ * survive — which fields are touched stays diagnosable — while every
+ * primitive leaf value becomes its type marker.
+ *
+ * Depth-capped and circular-safe; never mutates the input.
+ *
+ * @memberof module:param-redact
+ * @param {*} value - the body to redact
+ * @param {number} [depth=0] - internal recursion depth
+ * @param {WeakSet} [seen] - internal circular-reference guard
+ * @returns {*} a redacted deep copy; primitives become markers
+ *
+ * @example
+ * redactValuesDeep({ filter: { token: 'abc' }, limit: 5 })
+ * // -> { filter: { token: '[string]' }, limit: '[number]' }
+ */
+function redactValuesDeep(value, depth, seen) {
+    depth = depth || 0;
+    if (depth > 12) return '[deep]';
+    if (value === null || typeof value !== 'object') return typeMarker(value);
+    if (value instanceof Date) return '[date]';
+    if (typeof Buffer !== 'undefined' && Buffer.isBuffer(value)) return '[buffer]';
+
+    seen = seen || new WeakSet();
+    if (seen.has(value)) return '[circular]';
+    seen.add(value);
+
+    var i, out;
+    if (Array.isArray(value)) {
+        out = new Array(value.length);
+        for (i = 0; i < value.length; i++) {
+            out[i] = redactValuesDeep(value[i], depth + 1, seen);
+        }
+        return out;
+    }
+    out = {};
+    var keys = Object.keys(value);
+    for (i = 0; i < keys.length; i++) {
+        out[keys[i]] = redactValuesDeep(value[keys[i]], depth + 1, seen);
+    }
+    return out;
+}
+
+module.exports = {
+    typeMarker       : typeMarker,
+    captureValues    : captureValues,
+    summarize        : summarize,
+    describeParams   : describeParams,
+    redactValuesDeep : redactValuesDeep
+};

package/framework/{v0.6.6 → v0.6.7}/core/connectors/postgresql/index.js

@@ -9,6 +9,7 @@
 
 var fs        = require('fs');
 var sqlParser = require('./../sql-parser'); // #SQL1 state-machine comment stripper
+var paramRedact = require('./../param-redact'); // #B350 — bound-value redaction for dev/Inspector sinks
 var lib       = require('./../../../lib') || require.cache[require.resolve('./../../../lib')];
 var inherits  = lib.inherits;
 var console   = lib.logger;
@@ -323,7 +324,9 @@ function Postgresql(conn, infos) {
             if (envIsDev) {
                 console.debug('[ ' + trigger + ' ] ' + queryString);
                 if (args.length > 0) {
-                    console.debug('[ ' + trigger + ' ] params: ' + JSON.stringify(args));
+                    // #B350 — bound values redacted by default (count + types);
+                    // `inspector.queries.captureValues` opts in to real values.
+                    console.debug('[ ' + trigger + ' ] params: ' + (paramRedact.captureValues() ? JSON.stringify(args) : paramRedact.describeParams(args)));
                 }
             }
 
@@ -351,7 +354,7 @@ function Postgresql(conn, infos) {
                         type        : 'PG',
                         trigger     : entityName.toLowerCase() + '#' + name,
                         statement   : String(queryString),
-                        params      : args.length > 0 ? args.slice() : [],
+                        params      : args.length > 0 ? (paramRedact.captureValues() ? args.slice() : paramRedact.summarize(args)) : [],
                         durationMs  : 0,
                         resultCount : 0,
                         resultSize  : 0,

package/framework/{v0.6.6 → v0.6.7}/core/connectors/scylladb/index.js

@@ -9,6 +9,7 @@
 
 var fs        = require('fs');
 var sqlParser = require('./../sql-parser');
+var paramRedact = require('./../param-redact'); // #B350 — bound-value redaction for dev/Inspector sinks
 var lib       = require('./../../../lib') || require.cache[require.resolve('./../../../lib')];
 var inherits  = lib.inherits;
 var console   = lib.logger;
@@ -278,7 +279,9 @@ function Scylladb(conn, infos) {
             if (envIsDev) {
                 console.debug('[ ' + trigger + ' ] ' + queryString);
                 if (args.length > 0) {
-                    console.debug('[ ' + trigger + ' ] params: ' + JSON.stringify(args));
+                    // #B350 — bound values redacted by default (count + types);
+                    // `inspector.queries.captureValues` opts in to real values.
+                    console.debug('[ ' + trigger + ' ] params: ' + (paramRedact.captureValues() ? JSON.stringify(args) : paramRedact.describeParams(args)));
                 }
             }
 
@@ -293,7 +296,7 @@ function Scylladb(conn, infos) {
                         type        : 'CQL',
                         trigger     : entityName.toLowerCase() + '#' + name,
                         statement   : String(queryString),
-                        params      : args.length > 0 ? args.slice() : [],
+                        params      : args.length > 0 ? (paramRedact.captureValues() ? args.slice() : paramRedact.summarize(args)) : [],
                         durationMs  : 0,
                         resultCount : 0,
                         resultSize  : 0,

package/framework/{v0.6.6 → v0.6.7}/core/connectors/sqlite/index.js

@@ -9,6 +9,7 @@
 
 var fs        = require('fs');
 var sqlParser = require('./../sql-parser'); // #SQL1 state-machine comment stripper
+var paramRedact = require('./../param-redact'); // #B350 — bound-value redaction for dev/Inspector sinks
 var lib       = require('./../../../lib') || require.cache[require.resolve('./../../../lib')];
 var inherits  = lib.inherits;
 var console   = lib.logger;
@@ -371,7 +372,9 @@ function Sqlite(conn, infos) {
             if (envIsDev) {
                 console.debug('[ ' + trigger + ' ] ' + queryString);
                 if (args.length > 0) {
-                    console.debug('[ ' + trigger + ' ] params: ' + JSON.stringify(args));
+                    // #B350 — bound values redacted by default (count + types);
+                    // `inspector.queries.captureValues` opts in to real values.
+                    console.debug('[ ' + trigger + ' ] params: ' + (paramRedact.captureValues() ? JSON.stringify(args) : paramRedact.describeParams(args)));
                 }
             }
 
@@ -399,7 +402,7 @@ function Sqlite(conn, infos) {
                         type        : 'SQL',
                         trigger     : entityName.toLowerCase() + '#' + name,
                         statement   : String(queryString),
-                        params      : args.length > 0 ? args.slice() : [],
+                        params      : args.length > 0 ? (paramRedact.captureValues() ? args.slice() : paramRedact.summarize(args)) : [],
                         durationMs  : 0,
                         resultCount : 0,
                         resultSize  : 0,