oh-my-promptfoo 1.20.5 → 1.20.6

package/dist/delegate-runner.js

@@ -9535,6 +9535,39 @@ async function runNative(frame, signal, peerPath) {
 		if (typeof provider?.cleanup === "function") await provider.cleanup();
 	}
 }
+const REDACTION_MASK = "******";
+const MAX_MASKS = 64;
+const MAX_MASKED_SPAN = 256;
+const MAX_ALIGNMENT_STEPS = 1e6;
+/**
+* Exact equality, or a bounded redaction of the local body: every visible character
+* matches in order, each mask hides one non-empty single-line span of at most
+* MAX_MASKED_SPAN characters, and at least 90% of the body stays visible.
+*/
+function matchesLoadedBody(body, content) {
+	if (body === content) return true;
+	const parts = content.split(REDACTION_MASK);
+	const masks = parts.length - 1;
+	const visible = content.length - masks * 6;
+	if (masks === 0 || masks > MAX_MASKS || visible * 10 < body.length * 9) return false;
+	if (!body.startsWith(parts[0])) return false;
+	const failed = /* @__PURE__ */ new Set();
+	let steps = 0;
+	const align = (index, position) => {
+		if (index === masks) return position === body.length;
+		const key = `${index}:${position}`;
+		if (failed.has(key)) return false;
+		const next = parts[index + 1];
+		for (let span = 1; span <= MAX_MASKED_SPAN && position + span <= body.length; span++) {
+			if (body[position + span - 1] === "\n" || ++steps > MAX_ALIGNMENT_STEPS) break;
+			const start = position + span;
+			if (body.startsWith(next, start) && align(index + 1, start + next.length)) return true;
+		}
+		failed.add(key);
+		return false;
+	};
+	return align(0, parts[0].length);
+}
 function verifiedSkillLoaderRecord(entry, workingDir) {
 	if (!entry || typeof entry !== "object" || Array.isArray(entry)) return;
 	const { name, path, content } = entry;
@@ -9543,7 +9576,7 @@ function verifiedSkillLoaderRecord(entry, workingDir) {
 	if (!local || local.name !== name) return;
 	try {
 		const body = readFileSync(local.path, "utf8").replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n/, "").replace(/\r\n/g, "\n").trim();
-		if (!body || body !== content.replace(/\r\n/g, "\n").trim()) return;
+		if (!body || !matchesLoadedBody(body, content.replace(/\r\n/g, "\n").trim())) return;
 		return {
 			...local,
 			source: "sdk-skill-loader"