pi-webdav-backup 1.0.0 → 1.0.1

package/README.md

@@ -326,7 +326,7 @@ npm test
 node extensions/webdav-backup/verify-load.mjs
 ```
 
-6 个测试文件、277 项断言，用内置的内存 WebDAV 服务端做真实 HTTP 往返：
+6 个测试文件、284 项断言，用内置的内存 WebDAV 服务端做真实 HTTP 往返：
 
 | 文件 | 覆盖 |
 |---|---|

package/extensions/webdav-backup/backup.mjs

@@ -200,7 +200,11 @@ export function redactSensitive(relPath, buf, opts = {}) {
   const aggressive = opts.aggressive !== false;
   const base = relPath.split("/").pop() ?? "";
 
-  const SECRET_KEY_RE = /key|token|secret|password|passwd|credential|api[-_]?key|auth|cookie|session|bearer|private/i;
+  const SECRET_KEY_RE = /key|token|secret|password|passwd|credential|api[-_]?key|auth(?!or)|cookie|session[-_]?(token|key|secret|id)|bearer|private/i;
+  // 密钥引用（$ENV / !cmd / dpapi: / file:）是“密钥放在哪”的指针，不是秘密本身，应保留
+  const SECRET_REF_SCHEMES = ["$", "!", "dpapi:", "file:"];
+  const isRef = (v) =>
+    typeof v === "string" && SECRET_REF_SCHEMES.some((p) => v.trim().startsWith(p));
   // 常见凭据前缀，以及“长且像随机串”的值
   const SECRET_VALUE_RE =
     /^(sk-[A-Za-z0-9_-]{8,}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{30,}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}|[A-Za-z0-9_+/=-]{32,})$/;
@@ -214,8 +218,15 @@ export function redactSensitive(relPath, buf, opts = {}) {
         const out = {};
         for (const [k, val] of Object.entries(v)) {
           if (SECRET_KEY_RE.test(k)) {
-            // 保留结构，抹掉值
-            out[k] = typeof val === "object" && val !== null ? walk(val, k) : "__REDACTED__";
+            // 保留结构，抹掉值。
+            // 只替换字符串：布尔/数字不可能是凭据，
+            // 把 false 替换成字符串会破坏恢复后的配置语义（回归：includeSessions 曾被误伤）
+            out[k] =
+              typeof val === "object" && val !== null
+                ? walk(val, k)
+                : typeof val === "string"
+                  ? "__REDACTED__"
+                  : val;
           } else {
             out[k] = walk(val, k);
           }
@@ -236,10 +247,6 @@ export function redactSensitive(relPath, buf, opts = {}) {
   if (base.startsWith("auth.json")) {
     try {
       const obj = JSON.parse(buf.toString("utf8"));
-      const SECRET_REF_SCHEMES = ["$", "!", "dpapi:", "file:"];
-      const isRef = (v) =>
-        typeof v === "string" && SECRET_REF_SCHEMES.some((p) => v.trim().startsWith(p));
-
       const walkCredential = (cred) => {
         if (!cred || typeof cred !== "object") return redactJson(cred, { aggressiveValues: aggressive });
         const out = {};
@@ -270,7 +277,11 @@ export function redactSensitive(relPath, buf, opts = {}) {
     try {
       const obj = JSON.parse(buf.toString("utf8"));
       const cleaned = redactJson(obj, { aggressiveValues: false });
-      if (obj.encryptKey) cleaned.encryptKey = "__REDACTED__";
+      // 与 auth.json 同一约定：密钥引用保留（指针非秘密），
+      // 明文由字段名规则抹掉，这里只需把被误抹的引用还原
+      if (typeof obj.encryptKey === "string" && isRef(obj.encryptKey)) cleaned.encryptKey = obj.encryptKey;
+      const pw = obj.remote && typeof obj.remote === "object" ? obj.remote.password : undefined;
+      if (typeof pw === "string" && isRef(pw) && cleaned.remote) cleaned.remote.password = pw;
       return Buffer.from(JSON.stringify(cleaned, null, 2), "utf8");
     } catch {
       return buf;

package/extensions/webdav-backup/test-redact.mjs

@@ -107,6 +107,30 @@ check("嵌套路径 auth.json 也被脱敏", !r12.includes("sk-nested-canary"),
 check("空对象不报错", (() => { try { redact("auth.json", "{}"); return true; } catch { return false; } })());
 check("null 值不报错", (() => { try { redact("auth.json", '{"a":null,"b":1}'); return true; } catch { return false; } })());
 
+// ── 10b. 回归：布尔/数字不被误伤，密钥引用保留（本地实测发现）
+const rBool = redact(
+  "webdav-backup.json",
+  JSON.stringify({ includeSessions: false, snapshot: true, keepVersions: 10, sessionDir: "C:/sessions" }),
+);
+check("includeSessions:false 不被误伤（回归）", !rBool.includes("__REDACTED__"), rBool);
+check("sessionDir 不被误伤", rBool.includes("C:/sessions"), rBool);
+
+const rTokFlag = redact("webdav-backup.json", JSON.stringify({ tokenEnabled: false, keyCount: 3 }));
+check("布尔/数字在敏感字段名下也不误替换", !rTokFlag.includes("__REDACTED__"), rTokFlag);
+
+const rSessTok = redact("webdav-backup.json", JSON.stringify({ sessionToken: "tok-123456789012" }));
+check("sessionToken 仍被脱敏", !rSessTok.includes("tok-123456789012"), rSessTok);
+
+const rRef2 = redact(
+  "webdav-backup.json",
+  JSON.stringify({ remote: { password: "dpapi:webdav-password" }, encryptKey: "$PI_WEBDAV_BACKUP_KEY" }),
+);
+check("password 的 dpapi: 引用保留", rRef2.includes("dpapi:webdav-password"), rRef2);
+check("encryptKey 的 $ENV 引用保留", rRef2.includes("$PI_WEBDAV_BACKUP_KEY"), rRef2);
+
+const rPlain2 = redact("webdav-backup.json", JSON.stringify({ remote: { password: "MyPassword123" } }));
+check("password 明文仍被脱敏", !rPlain2.includes("MyPassword123"), rPlain2);
+
 // ── 12. 明文审计（防止备份副本把密钥带上云）
 {
   const { auditForPlaintext, looksCredentialFile } = await import("./backup.mjs");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-webdav-backup",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "pi 配置自动备份到 WebDAV（坚果云 / Nextcloud / 群晖 / 自建）：归档与快照两种模式、AES-256-GCM 加密、DPAPI 密钥管理、敏感字段脱敏、退出自动备份与每日定时备份。",
   "keywords": [
     "pi-package",
@@ -33,7 +33,9 @@
     "test": "node extensions/webdav-backup/run-tests.mjs"
   },
   "pi": {
-    "extensions": ["./extensions/webdav-backup.ts"]
+    "extensions": [
+      "./extensions/webdav-backup.ts"
+    ]
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "*"