my-pi 0.1.4 → 0.1.5

package/dist/{api-BtlxiHyw.js → api-DgvJRqr3.js}

@@ -819,7 +819,39 @@ const SECRET_PATTERNS = [
 		pattern: /github_pat_[a-zA-Z0-9_]{20,}/g
 	}
 ];
-function redact(text) {
+const SSH_CONFIG_VALUE_DIRECTIVE_PATTERN = /^([ \t]*)(HostName|User|IdentityFile|CertificateFile|ProxyJump|ProxyCommand|LocalForward|RemoteForward|DynamicForward|HostKeyAlias)(\s+)(.+)$/gim;
+const SSH_CONFIG_HOST_PATTERN = /^([ \t]*)(Host)(\s+)(.+)$/gim;
+const SSH_CONFIG_MATCH_PATTERN = /^([ \t]*)(Match)(\s+)(.+)$/gim;
+function looks_like_ssh_config(text) {
+	const has_scope_line = /^\s*(?:Host|Match)\b/m.test(text);
+	const has_sensitive_directive = /^\s*(?:HostName|User|IdentityFile|CertificateFile|ProxyJump|ProxyCommand|LocalForward|RemoteForward|DynamicForward|HostKeyAlias)\b/im.test(text);
+	return has_scope_line && has_sensitive_directive;
+}
+function redact_ssh_config_metadata(text) {
+	let count = 0;
+	const redact_directive_value = (match, indent, directive, spacing, value) => {
+		if (value.includes("[REDACTED:")) return match;
+		count++;
+		return `${indent}${directive}${spacing}[REDACTED:SSH ${directive}]`;
+	};
+	let result = text.replace(SSH_CONFIG_VALUE_DIRECTIVE_PATTERN, redact_directive_value);
+	result = result.replace(SSH_CONFIG_HOST_PATTERN, (match, indent, directive, spacing, value) => {
+		if (value.trim() === "*" || value.includes("[REDACTED:")) return match;
+		count++;
+		return `${indent}${directive}${spacing}[REDACTED:SSH Host]`;
+	});
+	result = result.replace(SSH_CONFIG_MATCH_PATTERN, (match, indent, directive, spacing, value) => {
+		if (value.trim().toLowerCase() === "all") return match;
+		if (value.includes("[REDACTED:")) return match;
+		count++;
+		return `${indent}${directive}${spacing}[REDACTED:SSH Match]`;
+	});
+	return {
+		redacted: result,
+		count
+	};
+}
+function redact_secret_patterns(text) {
 	let count = 0;
 	let result = text;
 	for (const sp of SECRET_PATTERNS) {
@@ -834,14 +866,44 @@ function redact(text) {
 		count
 	};
 }
+function is_ssh_config_path(path) {
+	if (typeof path !== "string") return false;
+	const normalized = path.replaceAll("\\", "/").toLowerCase();
+	return /(?:^|\/)(?:\.ssh\/(?:config|config\.d\/.+|conf\.d\/.+)|ssh_config)$/.test(normalized);
+}
+function should_force_ssh_config_redaction(event) {
+	if (event.toolName !== "read") return false;
+	if (!event.input || typeof event.input !== "object") return false;
+	return is_ssh_config_path(event.input.path);
+}
+function is_text_content(item) {
+	return item.type === "text";
+}
+function redact_text(text, options) {
+	let count = 0;
+	let result = text;
+	if (options?.force_ssh_config || looks_like_ssh_config(result)) {
+		const ssh_redaction = redact_ssh_config_metadata(result);
+		result = ssh_redaction.redacted;
+		count += ssh_redaction.count;
+	}
+	const secret_redaction = redact_secret_patterns(result);
+	result = secret_redaction.redacted;
+	count += secret_redaction.count;
+	return {
+		redacted: result,
+		count
+	};
+}
 async function filter_output(pi) {
 	let totalRedacted = 0;
 	pi.on("tool_result", async (event) => {
 		if (!event.content) return;
+		const force_ssh_config = should_force_ssh_config_redaction(event);
 		let modified = false;
 		const newContent = event.content.map((item) => {
-			if (item.type !== "text" || !item.text) return item;
-			const { redacted, count } = redact(item.text);
+			if (!is_text_content(item) || !item.text) return item;
+			const { redacted, count } = redact_text(item.text, { force_ssh_config });
 			if (count > 0) {
 				modified = true;
 				totalRedacted += count;
@@ -5353,4 +5415,4 @@ async function create_my_pi(options = {}) {
 //#endregion
 export { runPrintMode$1 as i, create_my_pi as n, get_force_disabled_builtins as r, InteractiveMode$1 as t };
 
-//# sourceMappingURL=api-BtlxiHyw.js.map
+//# sourceMappingURL=api-DgvJRqr3.js.map