orkestrator 2.26.0-alpha → 2.26.1-alpha

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orkestrator",
-  "version": "2.26.0-alpha",
+  "version": "2.26.1-alpha",
   "description": "Run the Orkestrator backend service without the desktop application",
   "homepage": "https://orkestrator.dev",
   "repository": {
@@ -39,8 +39,8 @@
     "sharp": "0.35.5"
   },
   "devDependencies": {
-    "@orkestrator/protocol": "2.26.0-alpha",
-    "@orkestrator/toolchain": "2.26.0-alpha"
+    "@orkestrator/protocol": "2.26.1-alpha",
+    "@orkestrator/toolchain": "2.26.1-alpha"
   },
   "engines": {
     "bun": ">=1.4.3"

package/resources/claude-bridge/dist/index.js

@@ -12477,6 +12477,41 @@ function recordTerminalSlashCommands(version, commands) {
 // ../../bridges/claude-bridge/src/services/session-manager-catalog.ts
 import { createHash as createHash9 } from "node:crypto";
 
+// ../protocol/src/secret-redaction.ts
+var TEXT_RULES = [
+  {
+    pattern: /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+(?::[^/\s@]*)?@/gi,
+    replacement: "$1[redacted]@"
+  },
+  {
+    pattern: /([?&](?:access[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|apikey|auth|authorization|token|secret|password|passwd|signature|sig|key|state|code)=)[^&\s"'`]+/gi,
+    replacement: "$1[redacted]"
+  },
+  { pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi, replacement: "Bearer [redacted]" },
+  { pattern: /\bBasic\s+[A-Za-z0-9+/=]{8,}/gi, replacement: "Basic [redacted]" },
+  {
+    pattern: /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}/g,
+    replacement: "[redacted]"
+  },
+  { pattern: /\bgh[pousr]_[A-Za-z0-9]{16,}/g, replacement: "[redacted]" },
+  { pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, replacement: "[redacted]" },
+  { pattern: /\b(?:sk|rk|pk)-[A-Za-z0-9_-]{12,}/g, replacement: "[redacted]" },
+  { pattern: /\bxox[baprse]-[A-Za-z0-9-]{8,}/g, replacement: "[redacted]" },
+  { pattern: /\bAKIA[0-9A-Z]{12,}/g, replacement: "[redacted]" },
+  { pattern: /\bAIza[0-9A-Za-z_-]{20,}/g, replacement: "[redacted]" },
+  {
+    pattern: /\b((?:[A-Za-z0-9]+[_-])*(?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|auth[_-]?token|token|secret|client[_-]?secret|password|passwd|passphrase|authorization))("?\s*[:=]\s*)("?)(?!Bearer\b|Basic\b|\[redacted\])[^\s"',;)&]{6,}\3/gi,
+    replacement: "$1$2[redacted]"
+  }
+];
+function redactSecrets(value) {
+  let result = value;
+  for (const rule of TEXT_RULES) {
+    result = result.replace(new RegExp(rule.pattern.source, rule.pattern.flags), rule.replacement);
+  }
+  return result;
+}
+
 // ../../bridges/claude-bridge/src/services/claude-sign-in.ts
 var AUTH_CACHE_TTL_MS = 30000;
 var FAILED_AUTH_CACHE_TTL_MS = 5000;
@@ -12734,6 +12769,9 @@ function mcpTransport(status) {
     return "http";
   return;
 }
+function mcpError(error) {
+  return redactSecrets(error).slice(0, 2000);
+}
 function normalizeMcp(status) {
   const mappedStatus = status.status === "pending" ? "connecting" : status.status;
   const tools = (status.tools ?? []).map((tool) => tool.name).filter(Boolean).slice(0, 256);
@@ -12747,7 +12785,7 @@ function normalizeMcp(status) {
     ...transport ? { transport } : {},
     toolCount: tools.length,
     ...tools.length ? { tools } : {},
-    ...status.error ? { error: status.error.slice(0, 2000) } : {},
+    ...status.error ? { error: mcpError(status.error) } : {},
     actions
   };
 }
@@ -12771,7 +12809,7 @@ async function readSessionMcpServers(sessionId) {
       ...server.scope ? { scope: server.scope } : {},
       ...server.transport ? { transport: server.transport } : {},
       ...server.tools ? { tools: server.tools.slice(0, 256), toolCount: server.tools.length } : {},
-      ...server.error ? { error: server.error.slice(0, 2000) } : {}
+      ...server.error ? { error: mcpError(server.error) } : {}
     }));
   }
   return session.mcpInventory ?? [];