pi-roundtable 0.7.7 → 0.7.8

package/CHANGELOG.md

@@ -5,6 +5,12 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.7.8] - 2026-10-03
+
+### Fixed
+
+- `scrubDiagnostic` masks a value to its end when an earlier rule had masked only its head (`password=sk-…!tail`, `GITHUB_TOKEN=ghp_…!tail`, a quoted value that continues after a token shape). A `[redacted]` an earlier rule wrote is read as part of an unquoted value, so `password=https://user:pw@host/x` ends as `password=[redacted]` with no `]]`.
+
 ## [0.7.7] - 2026-10-03
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable",
-	"version": "0.7.7",
+	"version": "0.7.8",
 	"description": "A plugin-driven Pi agent server for Discord",
 	"type": "module",
 	"license": "MIT",

package/src/kit/diagnostics.ts

@@ -61,8 +61,11 @@ function secretKind(name: string): "secret" | "token" | undefined {
 
 /** The name and separator of an assignment, query parameter or JSON field; the value is read separately. */
 const ASSIGNMENT = /(?<![a-z0-9_-])([a-z0-9_-]+)(["']?\s*[:=]\s*["']?)/gi;
-/** An unquoted value ends at a blank, a quote, a separator or a closing bracket. */
-const UNQUOTED = /[^\s"',&;}\]]+/y;
+/**
+ * An unquoted value ends at a blank, a quote, a separator or a closing bracket, except that a
+ * `[redacted]` an earlier rule wrote is part of the value, so what follows it is read too.
+ */
+const UNQUOTED = /(?:\[redacted\]|[^\s"',&;}\]])+/y;
 /** A quoted value runs to its closing quote, whatever it holds. */
 const DOUBLE_QUOTED = /[^"]+/y;
 const SINGLE_QUOTED = /[^']+/y;
@@ -94,8 +97,8 @@ function maskAssignments(text: string): string {
 		const kind = secretKind(match[1] ?? "");
 		if (!kind) continue;
 		const value = valueAt(text, end, match[2] ?? "");
-		// An earlier rule already masked this value.
-		if (value === undefined || value.startsWith("[redacted")) continue;
+		// An earlier rule already masked this whole value; if it masked only the head, the rest goes too.
+		if (value === undefined || value === "[redacted]") continue;
 		if (kind === "token" && /^[0-9]+$/.test(value)) continue;
 		out += `${text.slice(cursor, end)}[redacted]`;
 		cursor = end + value.length;