opencode-secrets-obfuscation 0.1.2 → 0.1.5

package/README.md

@@ -10,7 +10,7 @@ This plugin keeps configured dotenv values private and substitutes opaque secret
 
 ## Installation
 
-Install with: opencode plugin add opencode-secrets-obfuscation@0.1.2
+Install with: opencode plugin add opencode-secrets-obfuscation@0.1.5
 
 Configure the published package in opencode.jsonc with the options documented at https://github.com/jfomhhover/opencode-secrets-obfuscation/blob/main/INSTALL.md.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-secrets-obfuscation",
-  "version": "0.1.2",
+  "version": "0.1.5",
   "description": "Transparent OpenCode V2 secret substitution plugin",
   "license": "MIT",
   "repository": {

package/plugin.mjs

@@ -3445,6 +3445,7 @@ function redactHeaders(headers, state, options2) {
 }
 function redactBody(text, state) {
   if (!hasSecrets(state)) return text;
+  if (scanForSecrets(text, state.patterns, state.budget) === "clean") return text;
   const trimmed = text.trimStart();
   if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
     try {
@@ -3514,8 +3515,8 @@ async function redactRequest(request, state) {
   request.headers.forEach((value, name) => {
     record[name] = value;
   });
+  const originalHeaders = { ...record };
   if (redactHeaders(record, state, { skipAuth: true, strict: true }) === "withheld") return "withheld";
-  delete record["content-length"];
   let body;
   if (request.body !== null) {
     const read = await readBoundedBody(request.clone().body, verifyCeiling);
@@ -3528,6 +3529,12 @@ async function redactRequest(request, state) {
       if (safe !== read.text) body = safe;
     }
   }
+  const headersChanged = Object.keys(record).length !== Object.keys(originalHeaders).length || Object.keys(record).some((name) => record[name] !== originalHeaders[name]);
+  if (body === void 0 && !headersChanged) return request;
+  if (body !== void 0) {
+    delete record["content-length"];
+    record["content-length"] = String(encoder2.encode(body).byteLength);
+  }
   try {
     return new Request(request, {
       headers: record,
@@ -3723,14 +3730,19 @@ var realRuntimeFactory = (options2, location) => {
   };
   const sanitizeValue = (value) => {
     if (typeof value === "string") return redactString(value, filter) ?? WITHHELD;
+    try {
+      const serialized = JSON.stringify(value);
+      const scan = serialized === void 0 ? "none" : scanForSecrets(serialized, filter.patterns, filter.budget);
+      if (serialized !== void 0 && Buffer.byteLength(serialized, "utf8") <= scanCeiling && scan === "clean") return value;
+    } catch {
+    }
     redactTree(value, filter);
     return value;
   };
   const sanitizeRequestContext = (event) => {
     event.system = sanitizeValue(event.system);
-    redactTree(event.messages, filter);
+    event.messages = sanitizeValue(event.messages);
     event.options = sanitizeValue(event.options);
-    if (event.tools !== void 0) event.tools = sanitizeValue(event.tools);
   };
   const runtime = {
     close: () => Effect4.sync(() => store.teardown()),