pi-roundtable 0.7.4 → 0.7.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +15 -0
- package/package.json +1 -1
- package/src/kit/diagnostics.ts +10 -3
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,21 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
|
|
5
5
|
|
|
6
6
|
## [Unreleased]
|
|
7
7
|
|
|
8
|
+
## [0.7.5] - 2026-10-03
|
|
9
|
+
|
|
10
|
+
### Added
|
|
11
|
+
|
|
12
|
+
- Coding: `workerBlockText` (what the worker reads for a declined or held call), `limits` (`reportChars`, `heldEntries`, `heldChars`) and `diagnosticChars`.
|
|
13
|
+
- Drawing: `permissive` accepts what a looser host's callers send (unknown card exclusions, shared spread cells, repeated or empty node ids, self-edges), and `mapLimits` values are checked.
|
|
14
|
+
- Sandbox: `ScopedSandboxDelegator` accepts `maxTitleChars`, `maxReportChars` and `diagnosticChars`.
|
|
15
|
+
- Web: `skills.errorDetail` shows why a skill could not be read.
|
|
16
|
+
|
|
17
|
+
### Changed
|
|
18
|
+
|
|
19
|
+
- `scrubDiagnostic` also masks token, secret, password and API-key assignments in any case (query strings and JSON fields included), Cookie and API-key headers and JWTs, and works on a bounded prefix so hostile input stays fast.
|
|
20
|
+
- Sandbox: `ScopedSandboxDelegator` limits a title to 200 characters again by default.
|
|
21
|
+
- Web: the skill detail no longer refuses a body over 1 MiB or frontmatter over 64 KiB.
|
|
22
|
+
|
|
8
23
|
## [0.7.4] - 2026-10-03
|
|
9
24
|
|
|
10
25
|
### Added
|
package/package.json
CHANGED
package/src/kit/diagnostics.ts
CHANGED
|
@@ -10,10 +10,16 @@ const CREDENTIALS: [RegExp, string][] = [
|
|
|
10
10
|
/\b(gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{16,}|sk-[A-Za-z0-9_-]{16,}|xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{30,})\b/g,
|
|
11
11
|
"[redacted]",
|
|
12
12
|
],
|
|
13
|
+
// Assignments, query parameters and JSON fields whose name says it is a secret, in any case.
|
|
13
14
|
[
|
|
14
|
-
/\b([
|
|
15
|
-
"$1
|
|
15
|
+
/\b([a-z0-9_-]*(?:token|secret|password|passwd|api[_-]?key|credential)[a-z0-9_-]*)(["']?\s*[:=]\s*["']?)[^\s"',&;]+/gi,
|
|
16
|
+
"$1$2[redacted]",
|
|
16
17
|
],
|
|
18
|
+
[
|
|
19
|
+
/\b(cookie|set-cookie|x-api-key|x-auth-token|x-access-token)\s*:\s*[^\r\n]+/gi,
|
|
20
|
+
"$1: [redacted]",
|
|
21
|
+
],
|
|
22
|
+
[/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g, "[redacted]"],
|
|
17
23
|
[
|
|
18
24
|
/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,
|
|
19
25
|
"[redacted]",
|
|
@@ -25,7 +31,8 @@ const CREDENTIALS: [RegExp, string][] = [
|
|
|
25
31
|
* masked, control characters are removed, and the length is bounded. Empty input returns "".
|
|
26
32
|
*/
|
|
27
33
|
export function scrubDiagnostic(text: string, max = 600): string {
|
|
28
|
-
|
|
34
|
+
// The patterns run on a bounded prefix, so hostile input cannot make them slow.
|
|
35
|
+
let clean = text.slice(0, Math.max(max * 4, 4096));
|
|
29
36
|
for (const [pattern, replacement] of CREDENTIALS)
|
|
30
37
|
clean = clean.replace(pattern, replacement);
|
|
31
38
|
clean = Array.from(clean, (char) => {
|