opencode-secrets-obfuscation 0.1.6 → 0.1.7

package/README.md

@@ -10,7 +10,7 @@ This plugin keeps configured dotenv values private and substitutes opaque secret
 
 ## Installation
 
-Install with: opencode plugin add opencode-secrets-obfuscation@0.1.6
+Install with: opencode plugin add opencode-secrets-obfuscation@0.1.7
 
 Configure the published package in opencode.jsonc with the options documented at https://github.com/jfomhhover/opencode-secrets-obfuscation/blob/main/INSTALL.md.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-secrets-obfuscation",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Transparent OpenCode V2 secret substitution plugin",
   "license": "MIT",
   "repository": {

package/plugin.mjs

@@ -3359,7 +3359,6 @@ function verifyCeilingBytes(patterns) {
 var WITHHELD = "SANITIZATION_UNAVAILABLE";
 var encoder2 = new TextEncoder();
 var decoder = new TextDecoder();
-var AUTH_CHANNEL = /* @__PURE__ */ new Set(["authorization", "api-key", "x-api-key", "proxy-authorization"]);
 var NULL_BODY_STATUS = /* @__PURE__ */ new Set([101, 204, 205, 304]);
 var hasSecrets = (state) => state.patterns.length > 0;
 function redactNode(current, depth, state, counters) {
@@ -3419,30 +3418,6 @@ function containsSecret(value, state) {
   if (!hasSecrets(state)) return false;
   return scanForSecrets(value, state.patterns, state.budget) !== "clean";
 }
-function redactHeaders(headers, state, options2) {
-  if (!hasSecrets(state)) return;
-  for (const name of Object.keys(headers)) {
-    if (options2.skipAuth && AUTH_CHANNEL.has(name.toLowerCase())) continue;
-    const value = headers[name];
-    if (typeof value !== "string") {
-      if (options2.strict) return "withheld";
-      delete headers[name];
-      continue;
-    }
-    const safeValue = redactString(value, state);
-    const safeName = redactString(name, state);
-    if (safeValue === null || safeName === null) {
-      if (options2.strict) return "withheld";
-      delete headers[name];
-      continue;
-    }
-    if (safeValue !== value) headers[name] = safeValue;
-    if (safeName !== name) {
-      delete headers[name];
-      headers[safeName] = safeValue;
-    }
-  }
-}
 function redactBody(text, state) {
   if (!hasSecrets(state)) return text;
   if (scanForSecrets(text, state.patterns, state.budget) === "clean") return text;
@@ -3511,12 +3486,6 @@ async function redactRequest(request, state) {
   const verifyCeiling = verifyCeilingBytes(state.patterns);
   const declared = Number(request.headers.get("content-length") ?? Number.NaN);
   if (Number.isFinite(declared) && declared > verifyCeiling) return "withheld";
-  const record = {};
-  request.headers.forEach((value, name) => {
-    record[name] = value;
-  });
-  const originalHeaders = { ...record };
-  if (redactHeaders(record, state, { skipAuth: true, strict: true }) === "withheld") return "withheld";
   let body;
   if (request.body !== null) {
     const read = await readBoundedBody(request.clone().body, verifyCeiling);
@@ -3529,34 +3498,25 @@ async function redactRequest(request, state) {
       if (safe !== read.text) body = safe;
     }
   }
-  const headersChanged = Object.keys(record).length !== Object.keys(originalHeaders).length || Object.keys(record).some((name) => record[name] !== originalHeaders[name]);
-  if (body === void 0 && !headersChanged) return request;
-  if (body !== void 0) {
-    delete record["content-length"];
-    record["content-length"] = String(encoder2.encode(body).byteLength);
-  }
+  if (body === void 0) return request;
   try {
-    return new Request(request, {
-      headers: record,
-      ...body === void 0 ? {} : { body },
-      signal: request.signal
+    const headers = {};
+    request.headers.forEach((value, name) => {
+      headers[name] = value;
     });
+    headers["content-length"] = String(encoder2.encode(body).byteLength);
+    return new Request(request, { headers, body, signal: request.signal });
   } catch {
     return "withheld";
   }
 }
 async function redactResponse(response2, state) {
   if (!hasSecrets(state)) return response2;
-  const headers = {};
-  response2.headers.forEach((value, name) => {
-    headers[name] = value;
-  });
-  redactHeaders(headers, state, { skipAuth: false, strict: false });
   const status = response2.status;
   const nullBody = NULL_BODY_STATUS.has(status);
   if (nullBody) {
     try {
-      return new Response(null, { status, headers });
+      return new Response(null, { status, headers: response2.headers });
     } catch {
       return new Response(null, { status: 502 });
     }
@@ -3565,7 +3525,7 @@ async function redactResponse(response2, state) {
   const declared = Number(response2.headers.get("content-length") ?? Number.NaN);
   if (Number.isFinite(declared) && declared > verifyCeiling) {
     try {
-      return new Response(null, { status, headers });
+      return new Response(null, { status, headers: response2.headers });
     } catch {
       return new Response(null, { status: 502 });
     }
@@ -3573,7 +3533,7 @@ async function redactResponse(response2, state) {
   const read = await readBoundedBody(response2.clone().body, verifyCeiling);
   if (read === null) {
     try {
-      return new Response(null, { status, headers });
+      return new Response(null, { status, headers: response2.headers });
     } catch {
       return new Response(null, { status: 502 });
     }
@@ -3581,14 +3541,14 @@ async function redactResponse(response2, state) {
   let body;
   if (read.bytes > state.maxInputBytes) {
     body = scanForSecrets(read.text, state.patterns, state.budget) === "clean" ? read.text : "";
-  } else if ((headers["content-type"] ?? "").toLowerCase().includes("text/event-stream")) {
+  } else if ((response2.headers.get("content-type") ?? "").toLowerCase().includes("text/event-stream")) {
     body = redactEventStream(read.text, state) ?? "";
   } else {
     const safe = redactBody(read.text, state);
     body = safe === null ? "" : safe;
   }
   try {
-    return new Response(body, { status, headers });
+    return new Response(body, { status, headers: response2.headers });
   } catch {
     return new Response(null, { status: 502 });
   }
@@ -3771,7 +3731,6 @@ var realRuntimeFactory = (options2, location) => {
       }),
       modelRequest: (event) => Effect4.gen(function* () {
         if (!hasSecrets(filter)) return;
-        if (redactHeaders(event.headers, filter, { skipAuth: true, strict: true }) === "withheld") yield* Effect4.die(new Error(WITHHELD));
         if (event.baseURL !== void 0) event.baseURL = redactString(event.baseURL, filter) ?? WITHHELD;
       }),
       httpRequest: (event) => Effect4.promise(async () => {