poe-code 3.0.265 → 3.0.266

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.265",
+  "version": "3.0.266",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "type": "module",
   "main": "./dist/index.js",

package/packages/acp-telemetry/dist/redact.js

@@ -3,6 +3,9 @@ const MAX_JSON_BYTES = 262_144;
 const BINARY_SCAN_BYTES = 1_024;
 const REDACTED_SECRET = "[redacted]";
 const BEARER_TOKEN_PATTERN = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi;
+const AUTH_HEADER_PATTERN = /\b((?:Proxy-)?Authorization\s*:\s*(?:Bearer|Basic|Token)\s+)[^\s"'\r\n]+/gi;
+const COOKIE_HEADER_PATTERN = /\b((?:Set-)?Cookie\s*:\s*)[^\r\n"']+/gi;
+const URL_USERINFO_PATTERN = /\b([A-Za-z][A-Za-z0-9+.-]*:\/\/)([^/?#\s@]+@)/g;
 const ASSIGNED_SECRET_NAME_PATTERN = String.raw `(?:(?:[A-Za-z0-9]+[-_])*api[-_ ]?key|(?:[A-Za-z0-9]+[-_])*(?:token|secret|password|private[-_ ]?key))`;
 const ASSIGNED_SECRET_PATTERN = new RegExp(String.raw `\b(${ASSIGNED_SECRET_NAME_PATTERN}\s*[:=]\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[A-Za-z0-9._~+/=-]+)`, "gi");
 export function redact(value) {
@@ -51,7 +54,7 @@ function redactLeaf(value, ancestors, key) {
                 configurable: true,
                 enumerable: true,
                 value: redactLeaf(item, ancestors, key),
-                writable: true,
+                writable: true
             });
         }
         ancestors.delete(value);
@@ -65,6 +68,9 @@ function redactString(value) {
         return `[truncated:${bytes}]`;
     }
     return value
+        .replace(URL_USERINFO_PATTERN, `$1${REDACTED_SECRET}@`)
+        .replace(AUTH_HEADER_PATTERN, `$1${REDACTED_SECRET}`)
+        .replace(COOKIE_HEADER_PATTERN, `$1${REDACTED_SECRET}`)
         .replace(BEARER_TOKEN_PATTERN, `$1${REDACTED_SECRET}`)
         .replace(ASSIGNED_SECRET_PATTERN, redactAssignedSecretValue);
 }

package/packages/acp-telemetry/dist/trace.js

@@ -8,17 +8,17 @@ export function acpToTrace(ctx) {
             input: redact({
                 prompt: ctx.prompt,
                 mode: ctx.mode,
-                cwd: ctx.cwd,
+                cwd: ctx.cwd
             }),
             output: redact(accumulateAgentOutput(ctx.events)),
             metadata: redactRecord({
                 ...spawnCtx.metadata,
                 sessionId: ctx.sessionId,
-                threadId: ctx.threadId,
+                threadId: ctx.threadId
             }),
             metrics: buildMetrics(ctx),
-            children: logToolSpans(ctx.events),
-        },
+            children: logToolSpans(ctx.events)
+        }
     };
 }
 function logToolSpans(events) {
@@ -37,14 +37,14 @@ function logToolSpans(events) {
             output: redact(assembleToolOutput(events, index, toolCallId)),
             ...(metadata ? { metadata } : {}),
             ...readSpanTimestamps(metadata),
-            children: [],
+            children: []
         });
     }
     return spans;
 }
 function collectToolMeta(events, toolCallIndex, toolCallId) {
     const merged = {
-        ...(toolCallId !== undefined ? { toolCallId } : {}),
+        ...(toolCallId !== undefined ? { toolCallId } : {})
     };
     const startMeta = asRecord(asRecord(events[toolCallIndex])?._meta);
     if (startMeta) {
@@ -53,6 +53,9 @@ function collectToolMeta(events, toolCallIndex, toolCallId) {
         }
     }
     for (const event of events.slice(toolCallIndex + 1)) {
+        if (toolCallId === undefined && asToolCall(event) !== undefined) {
+            break;
+        }
         const update = asToolCallUpdate(event);
         if (update === undefined)
             continue;
@@ -91,6 +94,9 @@ function assembleToolOutput(events, toolCallIndex, toolCallId) {
     const outputs = [];
     let text = "";
     for (const event of events.slice(toolCallIndex + 1)) {
+        if (toolCallId === undefined && asToolCall(event) !== undefined) {
+            break;
+        }
         const update = asToolCallUpdate(event);
         if (update === undefined) {
             continue;
@@ -169,7 +175,7 @@ function readSpanTimestamps(metadata) {
     const endTs = readNumber(metadata.endTs);
     return {
         ...(startTs !== undefined ? { startTs } : {}),
-        ...(endTs !== undefined ? { endTs } : {}),
+        ...(endTs !== undefined ? { endTs } : {})
     };
 }
 function redactRecord(record) {
@@ -177,25 +183,21 @@ function redactRecord(record) {
     return asRecord(redacted) ?? { redacted };
 }
 function asRecord(value) {
-    return typeof value === "object" && value !== null
-        ? value
-        : undefined;
+    return typeof value === "object" && value !== null ? value : undefined;
 }
 function readString(value) {
     return typeof value === "string" ? value : undefined;
 }
 function readNumber(value) {
-    return typeof value === "number" && Number.isFinite(value)
-        ? value
-        : undefined;
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
 function addMetric(metrics, key, value) {
-    if (value !== undefined) {
+    if (value !== undefined && value >= 0) {
         metrics[key] = value;
     }
 }
 function sumIfPresent(left, right) {
-    if (left === undefined || right === undefined) {
+    if (left === undefined || right === undefined || left < 0 || right < 0) {
         return undefined;
     }
     return readNumber(left + right);
@@ -205,6 +207,6 @@ function setOwnProperty(target, key, value) {
         configurable: true,
         enumerable: true,
         value,
-        writable: true,
+        writable: true
     });
 }

package/packages/superintendent/dist/mcp.js

@@ -41850,6 +41850,9 @@ var MAX_JSON_BYTES = 262144;
 var BINARY_SCAN_BYTES = 1024;
 var REDACTED_SECRET = "[redacted]";
 var BEARER_TOKEN_PATTERN = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi;
+var AUTH_HEADER_PATTERN = /\b((?:Proxy-)?Authorization\s*:\s*(?:Bearer|Basic|Token)\s+)[^\s"'\r\n]+/gi;
+var COOKIE_HEADER_PATTERN = /\b((?:Set-)?Cookie\s*:\s*)[^\r\n"']+/gi;
+var URL_USERINFO_PATTERN = /\b([A-Za-z][A-Za-z0-9+.-]*:\/\/)([^/?#\s@]+@)/g;
 var ASSIGNED_SECRET_NAME_PATTERN = String.raw`(?:(?:[A-Za-z0-9]+[-_])*api[-_ ]?key|(?:[A-Za-z0-9]+[-_])*(?:token|secret|password|private[-_ ]?key))`;
 var ASSIGNED_SECRET_PATTERN = new RegExp(
   String.raw`\b(${ASSIGNED_SECRET_NAME_PATTERN}\s*[:=]\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[A-Za-z0-9._~+/=-]+)`,
@@ -41914,7 +41917,7 @@ function redactString(value) {
   if (bytes > MAX_STRING_BYTES) {
     return `[truncated:${bytes}]`;
   }
-  return value.replace(BEARER_TOKEN_PATTERN, `$1${REDACTED_SECRET}`).replace(ASSIGNED_SECRET_PATTERN, redactAssignedSecretValue);
+  return value.replace(URL_USERINFO_PATTERN, `$1${REDACTED_SECRET}@`).replace(AUTH_HEADER_PATTERN, `$1${REDACTED_SECRET}`).replace(COOKIE_HEADER_PATTERN, `$1${REDACTED_SECRET}`).replace(BEARER_TOKEN_PATTERN, `$1${REDACTED_SECRET}`).replace(ASSIGNED_SECRET_PATTERN, redactAssignedSecretValue);
 }
 function redactAssignedSecretValue(match, prefix) {
   const secret = match.slice(prefix.length);
@@ -42000,6 +42003,9 @@ function collectToolMeta(events, toolCallIndex, toolCallId) {
     }
   }
   for (const event of events.slice(toolCallIndex + 1)) {
+    if (toolCallId === void 0 && asToolCall(event) !== void 0) {
+      break;
+    }
     const update = asToolCallUpdate(event);
     if (update === void 0) continue;
     if (readToolCallId(update) !== toolCallId) continue;
@@ -42035,6 +42041,9 @@ function assembleToolOutput(events, toolCallIndex, toolCallId) {
   const outputs = [];
   let text4 = "";
   for (const event of events.slice(toolCallIndex + 1)) {
+    if (toolCallId === void 0 && asToolCall(event) !== void 0) {
+      break;
+    }
     const update = asToolCallUpdate(event);
     if (update === void 0) {
       continue;
@@ -42138,12 +42147,12 @@ function readNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function addMetric(metrics, key2, value) {
-  if (value !== void 0) {
+  if (value !== void 0 && value >= 0) {
     metrics[key2] = value;
   }
 }
 function sumIfPresent(left, right) {
-  if (left === void 0 || right === void 0) {
+  if (left === void 0 || right === void 0 || left < 0 || right < 0) {
     return void 0;
   }
   return readNumber(left + right);