pi-information-protecter 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog / 更新日志
 
+## 0.8.1 — Example Bearer rule no longer matches short strings / 示例 Bearer 规则不再匹配短字符串
+
+### Fixed / 修复
+
+- Require at least 16 characters in the shipped Bearer rule. `(?<=Bearer )[A-Za-z0-9._~+/-]+=*` matched a single character and ordinary words such as `token`. A short match has few shape-preserving candidates, and on a compaction payload, which holds the whole conversation, every candidate already occurs, so `/compact` failed with `SCAN_UNIQUE_FAILED`.
+  示例 Bearer 规则要求至少 16 个字符。原规则会匹配单个字符和 `token` 这类普通单词；短匹配的同形候选值很少，而压缩载荷包含整个会话，每个候选值都已出现，导致 `/compact` 以 `SCAN_UNIQUE_FAILED` 失败。
+- Add a regression asserting that no shipped rule matches a string of four characters or fewer.
+  新增回归，断言示例中任何规则都不会匹配四个及以下字符的字符串。
+
+### Documentation / 文档
+
+- Warn against rules that can match a very short string, and show a minimum-length pattern instead.
+  提示避免可能匹配极短字符串的规则，并给出带最小长度的写法。
+
 ## 0.8.0 — Protected summarization / 受保护的摘要生成
 
 ### Added / 新增

package/README.md

@@ -67,6 +67,7 @@ More examples are in [`protecter.example.json`](protecter.example.json), coverin
 - Overlapping matches are merged to avoid exposing a longer secret's suffix. Equal values reuse a token within the extension instance.
 - Learned originals remain exact-match protected within the instance even if regex context disappears or a rule is removed. Exit/reload clears these records.
 - `/protecter` opens the local audit viewer; `/protecter logs 50` shows up to 50 recent records. `/protecter status` reports memory counts without reading configuration. `/protecter reload` invokes Pi's full reload after idle. Do not enter secrets as command arguments.
+- Avoid rules that can match a very short string. A short match has few shape-preserving candidates, and on a large payload such as a compaction request every candidate already occurs elsewhere, so the request fails with `SCAN_UNIQUE_FAILED`. Require a realistic minimum length, for example `[A-Za-z0-9._~+/-]{16,}` rather than `+`.
 - Limits: 1000 rules, 8192 characters per literal/pattern, 2-second scan timeout and 8 MiB request JSON. Exceeding limits rejects the request rather than sending plaintext.
 
 ### Fixed replacement values
@@ -324,6 +325,7 @@ pi update npm:pi-information-protecter
 - 合并重叠匹配，避免暴露长敏感值的后缀；同一实例内相同原文复用占位符。
 - 已识别原文在当前实例内持续受到精确匹配保护，即使正则上下文消失或规则被删除；退出或重载清除记录。
 - `/protecter` 打开本地审计查看器，`/protecter logs 50` 查看最近最多 50 条；`/protecter status` 只报告内存数量，不读取配置。`/protecter reload` 等待空闲后完整重载。不要在命令参数中填写秘密。
+- 避免可能匹配极短字符串的规则。短匹配的同形候选值很少，而在压缩请求这类大载荷下每个候选值都已出现在别处，请求会以 `SCAN_UNIQUE_FAILED` 失败。请设定合理的最小长度，例如用 `[A-Za-z0-9._~+/-]{16,}` 而非 `+`。
 - 限制为 1000 条规则、每个词或模式 8192 字符、扫描 2 秒、请求 JSON 8 MiB；超限拒绝，不降级发送明文。
 
 ### 固定替换值

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-information-protecter",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Sensitive Personal Information (SPI) Protecter — local reversible privacy redaction for Pi",
   "type": "module",
   "license": "MIT",

package/protecter.example.json

@@ -58,7 +58,7 @@
     },
     {
       "type": "regex",
-      "pattern": "(?<=Bearer )[A-Za-z0-9._~+/-]+=*",
+      "pattern": "(?<=Bearer )[A-Za-z0-9._~+/-]{16,}={0,2}",
       "flags": "i"
     }
   ]