pi-git-auth 1.0.1 → 1.1.0

package/README.md

@@ -36,6 +36,10 @@ TypeScript directly.
 - A `tool_call` hook watches every `bash` invocation. When an active
   account exists and the command runs `git`, the command is rewritten to
   authenticate that account's host (see [git auth](#git-auth)).
+- A `tool_result` hook masks token-shaped strings (GitHub/GitLab PATs,
+  URL-embedded credentials) in **every** tool output before it enters
+  the transcript — an accidental `env` dump or config echo can never
+  print the live token into the conversation.
 
 ## Layout
 
@@ -50,6 +54,7 @@ github.ts    GitHub REST client
 gitlab.ts    GitLab REST client
 details.ts   read-only repo details overlay (tree + commits + metadata)
 git-gate.ts  command rewriting that injects the token for a host
+redact.ts    secret redaction of tool outputs (PAT / URL-credential patterns)
 ```
 
 ## Usage

package/index.ts

@@ -5,6 +5,7 @@ import { loadStore, activeAccount } from "./store";
 import { SERVICES } from "./forge";
 import { findAccounts, setActiveAccount, statusDetail } from "./auth";
 import { instrumentGit } from "./git-gate";
+import { redactSecrets } from "./redact";
 import { handleAuthCommand } from "./commands";
 
 export default function (pi: ExtensionAPI) {
@@ -20,6 +21,25 @@ export default function (pi: ExtensionAPI) {
     event.input.command = instrumentGit(event.input.command, host, acc.accessToken);
   });
 
+  // ------------------------------------------------------------------
+  // Secret redaction: never let token-shaped strings reach the
+  // transcript. The gate keeps the token out of argv and off disk,
+  // but any bash output (env dump, config echo) would otherwise land
+  // in the session file and the conversation.
+  // ------------------------------------------------------------------
+  pi.on("tool_result", (event) => {
+    let changed = false;
+    const content = event.content.map((block) => {
+      if (block.type !== "text") return block;
+      const text = redactSecrets(block.text);
+      if (text === block.text) return block;
+      changed = true;
+      return { ...block, text };
+    });
+    if (!changed) return;
+    return { content };
+  });
+
   // ------------------------------------------------------------------
   // /auth command
   // ------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-git-auth",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "pi coding-agent extension: git auth for GitHub and GitLab: keyring-stored login tokens, account switching, transparent git auth, repo list/create with details overlay",
   "license": "MIT",
   "author": "Carlo Onofrio",
@@ -22,8 +22,7 @@
   "files": [
     "*.ts",
     "README.md",
-    "LICENSE",
-    "preview.png"
+    "LICENSE"
   ],
   "engines": {
     "node": ">=20"
@@ -36,7 +35,6 @@
   "pi": {
     "extensions": [
       "./index.ts"
-    ],
-    "image": "https://raw.githubusercontent.com/comicrocharly/pi-git-auth/main/preview.png"
+    ]
   }
 }

package/redact.ts

@@ -0,0 +1,32 @@
+/**
+ * Secret redaction for tool results.
+ *
+ * The git gate keeps the active token out of argv and off disk, but a
+ * bash command (an `env` dump, a `git config` echo, a `printenv`) can
+ * still print it into the tool output, which then lands in the session
+ * transcript. This module masks token-shaped strings in tool results
+ * before they are stored, so an accidental echo can never put the live
+ * token into the conversation — and there is nothing to rotate because
+ * of it.
+ *
+ * Patterns (masked to a short fingerprint, e.g. `ghp_…7SAQ`):
+ *  - GitHub classic PATs:      gh[pousr]_ + 20+ base62
+ *  - GitHub fine-grained PATs: github_pat_ + 30+
+ *  - GitLab PATs:              glpat- + 16+
+ *  - URL-embedded credentials: user:secret@ — the secret part only
+ *
+ * Masking is idempotent: a masked string never matches the patterns
+ * again, so repeated passes are a no-op.
+ */
+
+function maskTail(match: string, head: number): string {
+  return match.length <= head + 4 ? "***" : `${match.slice(0, head)}…${match.slice(-4)}`;
+}
+
+export function redactSecrets(text: string): string {
+  return text
+    .replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, (m) => maskTail(m, 4))
+    .replace(/\bgithub_pat_[A-Za-z0-9_]{30,}/g, (m) => maskTail(m, 10))
+    .replace(/\bglpat-[A-Za-z0-9_-]{16,}/g, (m) => maskTail(m, 6))
+    .replace(/(\/\/[^/\s:@]+:)([^@\s]{4,})(@)/g, "$1***$3");
+}