rigjs 4.0.16 → 4.0.18

package/lib/classes/cicd/Deploy/CDN.ts

@@ -4,6 +4,7 @@ import crypto from 'crypto';
 import axios from 'axios';
 import * as uuid from 'uuid';
 import { DeployTarget } from '../CICD';
+import { redactCdnUrl } from '@/utils/redact';
 
 type TFlag = 'break' | 'enhance_break' | null;
 
@@ -64,7 +65,7 @@ class CDN {
     });
 
     const url = `http://cdn.ap-southeast-1.aliyuncs.com?${paramConfig}`;
-    console.log('cdn update url:', url);
+    console.log('cdn update url:', redactCdnUrl(url));
     const res = await axios.create().get(url);
     return res.data;
   }

package/lib/crew/index.ts

@@ -8,6 +8,7 @@ import crewAsk from './ask';
 import crewStub from './stub';
 import { projectAdd, projectList, projectStatus, projectSync } from './project';
 import { roleAdd, roleList, roleShow } from './roleCommand';
+import { pendingAdd, pendingAnswer, pendingList, pendingRemove } from './pending';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function registerCrewCommands(program: any): void {
@@ -105,6 +106,36 @@ export function registerCrewCommands(program: any): void {
     .option('-c, --crew <name>', 'target crew name')
     .action(roleShow);
 
+  const pending = crew.command('pending')
+    .description('list and manage materials the user must supply (per project)');
+  pending.command('list', { isDefault: true })
+    .description('list pending questions (default action; runs when `crew pending` is used without a subcommand)')
+    .option('--crew <name>', 'target crew name')
+    .option('-p, --project <name>', 'limit to one project')
+    .option('--all', 'include resolved questions')
+    .option('--json', 'machine-readable output')
+    .action(pendingList);
+  pending.command('add <title...>')
+    .description('record a new pending question / missing material')
+    .option('--crew <name>', 'target crew name')
+    .option('-p, --project <name>', 'project name (auto-detected from CWD if omitted)')
+    .option('--why <text>', 'why this information is needed')
+    .option('--need <text>', 'what to provide (file path, value, decision, etc.)')
+    .option('--priority <level>', 'high | medium | low')
+    .option('--asked-by <role>', 'role or person who raised the question (default: lead)')
+    .action((title: string[], opts: { crew?: string; project?: string; why?: string; need?: string; priority?: string; askedBy?: string }) => pendingAdd(title, opts));
+  pending.command('answer <id>')
+    .description('mark a pending question as resolved')
+    .option('--crew <name>', 'target crew name')
+    .option('-p, --project <name>', 'limit to one project')
+    .option('-n, --note <text>', 'short note describing what the user supplied')
+    .action(pendingAnswer);
+  pending.command('remove <id>')
+    .description('delete a pending question (use answer to keep history)')
+    .option('--crew <name>', 'target crew name')
+    .option('-p, --project <name>', 'limit to one project')
+    .action(pendingRemove);
+
   crew.command('plan').description('planned: Lead refine + decompose').action(crewStub('plan'));
   crew.command('refine').description('planned: update Shared/Spec.md').action(crewStub('refine'));
   crew.command('decompose').description('planned: split Spec into owner/role tasks').action(crewStub('decompose'));

package/lib/crew/pending.ts

@@ -0,0 +1,388 @@
+import fs from 'fs';
+import path from 'path';
+import print from '../print';
+import { CrewEntry, CrewProject, requireCrew, shortPath } from './config';
+import { rootPath, writeText, readText } from './vault';
+
+export interface PendingQuestion {
+  id: string;
+  title: string;
+  asked: string;          // ISO date (YYYY-MM-DD)
+  askedBy?: string;
+  priority?: 'high' | 'medium' | 'low' | string;
+  why?: string;
+  need?: string;
+  notes?: string;
+  status: 'open' | 'resolved';
+  resolved?: string;      // ISO date when resolved
+  answer?: string;
+  bodyExtras?: string;    // extra free-form body lines we want to preserve
+}
+
+interface PendingListOpts {
+  crew?: string;
+  project?: string;
+  all?: boolean;
+  json?: boolean;
+}
+
+interface PendingAddOpts {
+  crew?: string;
+  project?: string;
+  why?: string;
+  need?: string;
+  priority?: string;
+  askedBy?: string;
+}
+
+interface PendingAnswerOpts {
+  crew?: string;
+  project?: string;
+  note?: string;
+}
+
+interface PendingRemoveOpts {
+  crew?: string;
+  project?: string;
+}
+
+export function pendingList(opts: PendingListOpts): void {
+  const crew = requireCrew(opts.crew);
+  const targets = resolveTargets(crew, opts.project);
+  const includeResolved = !!opts.all;
+  const result: { project: string; file: string; questions: PendingQuestion[] }[] = [];
+  for (const project of targets) {
+    const file = pendingFile(crew, project.name);
+    const questions = readQuestions(file)
+      .filter(q => includeResolved || q.status === 'open');
+    result.push({ project: project.name, file, questions });
+  }
+  if (opts.json) {
+    // eslint-disable-next-line no-console
+    console.log(JSON.stringify({ ok: true, data: result }, null, 2));
+    return;
+  }
+  const total = result.reduce((sum, r) => sum + r.questions.length, 0);
+  if (total === 0) {
+    print.info(includeResolved
+      ? 'no pending questions found.'
+      : 'no open pending questions. Use --all to include resolved.');
+    return;
+  }
+  print.info(`pending questions${includeResolved ? ' (all)' : ' (open)'}: ${total}`);
+  for (const block of result) {
+    if (block.questions.length === 0) continue;
+    print.info(`project: ${block.project}  file: ${shortPath(block.file)}`);
+    for (const q of block.questions) {
+      const tag = q.status === 'resolved' ? '[resolved]' : `[${q.priority || 'open'}]`;
+      // eslint-disable-next-line no-console
+      console.log(`- ${q.id} ${tag} ${q.title}`);
+      if (q.why) {
+        // eslint-disable-next-line no-console
+        console.log(`    why: ${q.why}`);
+      }
+      if (q.need) {
+        // eslint-disable-next-line no-console
+        console.log(`    need: ${q.need}`);
+      }
+      if (q.answer) {
+        // eslint-disable-next-line no-console
+        console.log(`    answer: ${q.answer}`);
+      }
+    }
+  }
+}
+
+export function pendingAdd(titleParts: string[] | undefined, opts: PendingAddOpts): void {
+  const crew = requireCrew(opts.crew);
+  const project = resolveSingleProject(crew, opts.project, 'add');
+  const title = (titleParts || []).join(' ').trim();
+  if (!title) {
+    print.error('missing question title. Usage: rig crew pending add "<title>" --project <name>');
+    process.exit(1);
+  }
+  const file = pendingFile(crew, project.name);
+  const questions = readQuestions(file);
+  const id = nextQuestionId(questions);
+  const today = isoDate(new Date());
+  const question: PendingQuestion = {
+    id,
+    title,
+    asked: today,
+    askedBy: opts.askedBy,
+    priority: opts.priority,
+    why: opts.why,
+    need: opts.need,
+    status: 'open',
+  };
+  questions.push(question);
+  writeQuestions(file, project, questions);
+  print.succeed(`added ${id} to ${shortPath(file)}`);
+}
+
+export function pendingAnswer(id: string, opts: PendingAnswerOpts): void {
+  const crew = requireCrew(opts.crew);
+  const located = findQuestion(crew, id, opts.project);
+  if (!located) {
+    print.error(`question not found: ${id}`);
+    process.exit(1);
+  }
+  const { project, questions, index } = located;
+  const question = questions[index];
+  question.status = 'resolved';
+  question.resolved = isoDate(new Date());
+  if (opts.note) question.answer = opts.note;
+  writeQuestions(pendingFile(crew, project.name), project, questions);
+  print.succeed(`resolved ${id} in project ${project.name}`);
+}
+
+export function pendingRemove(id: string, opts: PendingRemoveOpts): void {
+  const crew = requireCrew(opts.crew);
+  const located = findQuestion(crew, id, opts.project);
+  if (!located) {
+    print.error(`question not found: ${id}`);
+    process.exit(1);
+  }
+  const { project, questions, index } = located;
+  questions.splice(index, 1);
+  writeQuestions(pendingFile(crew, project.name), project, questions);
+  print.succeed(`removed ${id} from project ${project.name}`);
+}
+
+export function pendingFile(crew: CrewEntry, project: string): string {
+  return rootPath(crew, path.join('Projects', project, 'Pending-Questions.md'));
+}
+
+function resolveTargets(crew: CrewEntry, projectName?: string): CrewProject[] {
+  if (projectName) {
+    const project = (crew.projects || []).find(p => p.name === projectName);
+    if (!project) {
+      print.error(`unknown project: ${projectName}`);
+      process.exit(1);
+    }
+    return [project];
+  }
+  return crew.projects || [];
+}
+
+function resolveSingleProject(crew: CrewEntry, projectName: string | undefined, action: string): CrewProject {
+  const name = projectName || autoProject(crew);
+  if (!name) {
+    print.error(`cannot determine project for "${action}". Use --project <name>.`);
+    process.exit(1);
+  }
+  const project = (crew.projects || []).find(p => p.name === name);
+  if (!project) {
+    print.error(`unknown project: ${name}`);
+    process.exit(1);
+  }
+  return project;
+}
+
+function autoProject(crew: CrewEntry): string | undefined {
+  const cwd = process.cwd();
+  const match = (crew.projects || []).find(p => isInside(cwd, p.path));
+  return match?.name;
+}
+
+function findQuestion(
+  crew: CrewEntry,
+  id: string,
+  projectName?: string,
+): { project: CrewProject; questions: PendingQuestion[]; index: number } | undefined {
+  const targets = resolveTargets(crew, projectName);
+  for (const project of targets) {
+    const file = pendingFile(crew, project.name);
+    const questions = readQuestions(file);
+    const index = questions.findIndex(q => q.id === id);
+    if (index >= 0) return { project, questions, index };
+  }
+  return undefined;
+}
+
+function isInside(child: string, parent: string): boolean {
+  const rel = path.relative(path.resolve(parent), path.resolve(child));
+  return rel === '' || (!!rel && !rel.startsWith('..') && !path.isAbsolute(rel));
+}
+
+const HEADER_LINE = '<!-- rig-crew-pending:v1 -->';
+const OPEN_HEADING = '## Open';
+const RESOLVED_HEADING = '## Resolved';
+
+export function readQuestions(file: string): PendingQuestion[] {
+  if (!fs.existsSync(file)) return [];
+  const text = readText(file);
+  const lines = text.split(/\r?\n/);
+  const questions: PendingQuestion[] = [];
+  let currentStatus: 'open' | 'resolved' = 'open';
+  let buffer: string[] = [];
+  let buffering = false;
+
+  const flush = () => {
+    if (!buffering) return;
+    const parsed = parseQuestionBlock(buffer, currentStatus);
+    if (parsed) questions.push(parsed);
+    buffer = [];
+    buffering = false;
+  };
+
+  for (const line of lines) {
+    if (line.trim() === OPEN_HEADING) {
+      flush();
+      currentStatus = 'open';
+      continue;
+    }
+    if (line.trim() === RESOLVED_HEADING) {
+      flush();
+      currentStatus = 'resolved';
+      continue;
+    }
+    if (/^###\s+/.test(line)) {
+      flush();
+      buffering = true;
+      buffer.push(line);
+      continue;
+    }
+    if (buffering) buffer.push(line);
+  }
+  flush();
+  return questions;
+}
+
+function parseQuestionBlock(lines: string[], status: 'open' | 'resolved'): PendingQuestion | undefined {
+  if (lines.length === 0) return undefined;
+  const heading = lines[0].replace(/^###\s+/, '').trim();
+  const m = heading.match(/^([A-Z]+-\d{6}-\d{3})\s*[—-]?\s*(.*)$/);
+  if (!m) return undefined;
+  const id = m[1];
+  let title = m[2].trim();
+  const resolvedMark = title.match(/_\(resolved\s+(\d{4}-\d{2}-\d{2})\)_\s*$/);
+  let resolved: string | undefined;
+  if (resolvedMark) {
+    resolved = resolvedMark[1];
+    title = title.slice(0, resolvedMark.index).trim();
+  }
+  const question: PendingQuestion = {
+    id,
+    title,
+    asked: '',
+    status,
+  };
+  if (resolved) {
+    question.status = 'resolved';
+    question.resolved = resolved;
+  }
+  const extras: string[] = [];
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    const bullet = line.match(/^\s*-\s+([A-Za-z][A-Za-z ]+?):\s+(.*)$/);
+    if (bullet) {
+      const key = bullet[1].toLowerCase().replace(/\s+/g, '-');
+      const value = bullet[2].trim();
+      switch (key) {
+        case 'asked':
+          question.asked = value;
+          break;
+        case 'asked-by':
+          question.askedBy = value;
+          break;
+        case 'priority':
+          question.priority = value;
+          break;
+        case 'why-needed':
+        case 'why':
+          question.why = value;
+          break;
+        case 'what-to-provide':
+        case 'need':
+          question.need = value;
+          break;
+        case 'notes':
+          question.notes = value;
+          break;
+        case 'resolved':
+          question.resolved = value;
+          question.status = 'resolved';
+          break;
+        case 'answer':
+          question.answer = value;
+          break;
+        default:
+          extras.push(line);
+      }
+    } else if (line.trim().length > 0) {
+      extras.push(line);
+    }
+  }
+  if (extras.length > 0) question.bodyExtras = extras.join('\n').trim();
+  return question;
+}
+
+function writeQuestions(file: string, project: CrewProject, questions: PendingQuestion[]): void {
+  const open = questions.filter(q => q.status === 'open');
+  const resolved = questions.filter(q => q.status === 'resolved');
+  const sections: string[] = [
+    `# ${project.name} Pending Questions`,
+    '',
+    HEADER_LINE,
+    '',
+    'Materials / facts / decisions the user must supply before the crew can proceed.',
+    'Add with `rig crew pending add "<title>" --project <name>`; resolve with `rig crew pending answer <id> --note "..."`.',
+    '',
+    OPEN_HEADING,
+    '',
+  ];
+  if (open.length === 0) {
+    sections.push('_No open questions._');
+    sections.push('');
+  } else {
+    for (const q of open) sections.push(renderQuestion(q), '');
+  }
+  sections.push(RESOLVED_HEADING, '');
+  if (resolved.length === 0) {
+    sections.push('_No resolved questions yet._');
+    sections.push('');
+  } else {
+    for (const q of resolved) sections.push(renderQuestion(q), '');
+  }
+  writeText(file, sections.join('\n').replace(/\n{3,}/g, '\n\n').trimEnd() + '\n');
+}
+
+function renderQuestion(q: PendingQuestion): string {
+  const headingExtra = q.status === 'resolved' && q.resolved ? ` _(resolved ${q.resolved})_` : '';
+  const lines: string[] = [`### ${q.id} — ${q.title}${headingExtra}`];
+  if (q.asked) lines.push(`- Asked: ${q.asked}`);
+  if (q.askedBy) lines.push(`- Asked by: ${q.askedBy}`);
+  if (q.priority) lines.push(`- Priority: ${q.priority}`);
+  if (q.why) lines.push(`- Why needed: ${q.why}`);
+  if (q.need) lines.push(`- What to provide: ${q.need}`);
+  if (q.notes) lines.push(`- Notes: ${q.notes}`);
+  if (q.status === 'resolved') {
+    if (q.resolved && !q.asked) lines.push(`- Resolved: ${q.resolved}`);
+    if (q.answer) lines.push(`- Answer: ${q.answer}`);
+  }
+  if (q.bodyExtras) lines.push('', q.bodyExtras);
+  return lines.join('\n');
+}
+
+function nextQuestionId(questions: PendingQuestion[]): string {
+  const now = new Date();
+  const yy = String(now.getFullYear()).slice(-2);
+  const mm = String(now.getMonth() + 1).padStart(2, '0');
+  const dd = String(now.getDate()).padStart(2, '0');
+  const prefix = `Q-${yy}${mm}${dd}-`;
+  let max = 0;
+  for (const q of questions) {
+    if (!q.id.startsWith(prefix)) continue;
+    const suffix = parseInt(q.id.slice(prefix.length), 10);
+    if (!Number.isNaN(suffix) && suffix > max) max = suffix;
+  }
+  return `${prefix}${String(max + 1).padStart(3, '0')}`;
+}
+
+function isoDate(d: Date): string {
+  const yyyy = d.getFullYear();
+  const mm = String(d.getMonth() + 1).padStart(2, '0');
+  const dd = String(d.getDate()).padStart(2, '0');
+  return `${yyyy}-${mm}-${dd}`;
+}

package/lib/crew/vault.ts

@@ -47,6 +47,7 @@ export function ensureProject(crew: CrewEntry, project: CrewProject): void {
   writeProjectOwnerFile(path.join(base, 'Owner.md'), project);
   writeIfMissing(path.join(base, 'Context.md'), `# ${project.name} Context\n\n`);
   writeIfMissing(path.join(base, 'Tasks.md'), renderProjectTasksFile(project));
+  writeIfMissing(path.join(base, 'Pending-Questions.md'), renderProjectPendingFile(project));
   ensureTasklists(base);
   writeIfMissing(path.join(base, 'Decisions.md'), `# ${project.name} Decisions\n\n`);
   writeIfMissing(path.join(base, 'Test-Plan.md'), `# ${project.name} Test Plan\n\n`);
@@ -185,6 +186,26 @@ function renderProjectTasksFile(project: CrewProject): string {
   ].join('\n');
 }
 
+function renderProjectPendingFile(project: CrewProject): string {
+  return [
+    `# ${project.name} Pending Questions`,
+    '',
+    '<!-- rig-crew-pending:v1 -->',
+    '',
+    'Materials / facts / decisions the user must supply before the crew can proceed.',
+    'Add with `rig crew pending add "<title>" --project <name>`; resolve with `rig crew pending answer <id> --note "..."`.',
+    '',
+    '## Open',
+    '',
+    '_No open questions._',
+    '',
+    '## Resolved',
+    '',
+    '_No resolved questions yet._',
+    '',
+  ].join('\n');
+}
+
 function renderProjectAgentTasksFile(project: CrewProject, role: CrewRoleDefinition): string {
   return [
     `# ${project.name} ${role.title} Tasks`,
@@ -254,6 +275,7 @@ function renderVaultAgentInstructions(crew: CrewEntry): string {
     `- Role registry: \`${root}/Shared/Roles.md\``,
     `- Reusable role descriptions: \`${root}/<role>/Role.md\` and \`${root}/Roles/<custom-role>/Role.md\``,
     `- Project owner memory: \`${root}/Projects/<project>/\``,
+    `- Per-project pending questions (待补充资料): \`${root}/Projects/<project>/Pending-Questions.md\` — managed by \`rig crew pending\``,
     `- Project-scoped agent tasks: \`${root}/Projects/<project>/Agents/<role>/Tasks.md\``,
     `- Large active task batches: \`${root}/Projects/<project>/Tasklists/active/*.md\` and \`${root}/Projects/<project>/Agents/<role>/Tasklists/active/*.md\`. Keep \`Tasks.md\` short; archived tasklists are not part of the active dashboard.`,
     '- Vault-local scratch projects belong under `tmp/<project>/`.',
@@ -272,6 +294,7 @@ function renderVaultAgentInstructions(crew: CrewEntry): string {
     '5. Treat Crew Lead as the default orchestrator prompt/protocol, not as a required Claude/Codex subagent. Subagents may be used as optional executors for specific roles, but Vault files are the source of truth.',
     '6. Lead communicates with other roles through Markdown tasks and delegation packets, not private chat state. Use `[role:: <role>]`, `[owner:: <owner>]`, `[project:: <project>]`, `[executor:: <executor>]`, and status fields in the relevant project-scoped `Tasks.md`.',
     `7. Worker results must be written back to the relevant role/project files under \`${root}/\`; user-facing questions go to \`${root}/Inbox.md\` for Lead to surface.`,
+    `8. Whenever a project is blocked by missing user-supplied material (API key, screenshot, vendor decision, sample data), record it with \`rig crew pending add ...\` rather than silently asking the human; when the user supplies it, the agent itself calls \`rig crew pending answer <id> --note "<summary>"\` and continues. Check \`rig crew pending --project <name>\` before starting any new tick on that project.`,
     '',
     AGENT_RULES_END,
   ].join('\n');

package/lib/deploy/index.ts

@@ -3,6 +3,7 @@ import path from 'path';
 import CICD from '@/classes/cicd/CICD';
 import CICDCmd from '@/classes/cicd/CICDCmd';
 import AliOSS from '@/classes/cicd/Deploy/AliDeploy';
+import { redactTarget } from '@/utils/redact';
 
 let filesList: string[] = [];
 const traverseFolder = (url: string) => {
@@ -33,7 +34,7 @@ export default async (cmd: any) => {
     const target = Array.isArray(cicdCmd.cicd.target)
       ? cicdCmd.cicd.target[0]
       : cicdCmd.cicd.target;
-    console.log('oss tagert', target);
+    console.log('oss tagert', redactTarget(target));
     const aliOss = new AliOSS(target);
     console.log('Please Wait for Upload OSS...');
     if (!cicdCmd.endpoints || cicdCmd.endpoints.length === 0) {

package/lib/utils/redact.test.ts

@@ -0,0 +1,43 @@
+import { maskSecret, redactTarget, redactCdnUrl } from '@/utils/redact';
+
+test('maskSecret keeps a head+tail hint for long secrets', () => {
+	const ak = 'LTAI5t9GjXQc7itTohf68ZLq';
+	const masked = maskSecret(ak);
+	expect(masked).not.toContain('GjXQc7it'); // no middle bytes
+	expect(masked.startsWith('LTAI')).toBe(true);
+	expect(masked.endsWith('8ZLq')).toBe(true);
+});
+
+test('maskSecret returns plain mask for short / empty input', () => {
+	expect(maskSecret('')).toBe('');
+	expect(maskSecret(undefined)).toBe('');
+	expect(maskSecret('abc')).toBe('****');
+	expect(maskSecret('abcdefgh')).toBe('****');
+});
+
+test('redactTarget masks access_key / access_secret only', () => {
+	const out = redactTarget({
+		id: 'alicloud',
+		type: 'alicloud',
+		bucket: 'my-bucket',
+		region: 'oss-ap-southeast-1',
+		access_key: 'LTAI5t9GjXQc7itTohf68ZLq',
+		access_secret: '8jfykQQoK66RldfSo9YlfdLh423GXA',
+		root_path: '/',
+	});
+	expect(out.bucket).toBe('my-bucket');
+	expect(out.region).toBe('oss-ap-southeast-1');
+	expect(out.root_path).toBe('/');
+	expect(out.access_key).not.toContain('GjXQc7it');
+	expect(out.access_secret).not.toContain('QQoK66Rld');
+});
+
+test('redactCdnUrl masks AccessKeyId and Signature only', () => {
+	const url =
+		'http://cdn.ap-southeast-1.aliyuncs.com?AccessKeyId=LTAI5t9GjXQc7itTohf68ZLq&Action=BatchSetCdnDomainConfig&Signature=iUppVaZSIecVi3DhZZeBCf24Ag0%3D&Timestamp=2026-05-25T08%3A40%3A51.135Z';
+	const masked = redactCdnUrl(url);
+	expect(masked).not.toContain('LTAI5t9GjXQc7itTohf68ZLq');
+	expect(masked).not.toContain('iUppVaZSIecVi3DhZZeBCf24Ag0');
+	expect(masked).toContain('Action=BatchSetCdnDomainConfig');
+	expect(masked).toContain('Timestamp=2026-05-25');
+});

package/lib/utils/redact.ts

@@ -0,0 +1,48 @@
+// Helpers to keep cloud credentials out of stdout.
+//
+// rig's deploy/publish flow prints (a) the resolved deploy target and
+// (b) every Aliyun CDN API URL. Both carry the AccessKeyId / AccessKeySecret
+// in clear, which makes the console output unsafe to copy/paste into issues,
+// CI logs, or chat.
+//
+// Use `maskSecret` for short identifiers (keeps a head+tail hint so two
+// different keys are still distinguishable in logs), `redactTarget` before
+// console-logging a DeployTarget, and `redactCdnUrl` before logging any
+// signed Aliyun OpenAPI URL.
+
+/** Mask a credential while keeping a short prefix + suffix for debuggability. */
+export function maskSecret(s: string | undefined | null): string {
+	if (!s) return '';
+	if (s.length <= 8) return '****';
+	return `${s.slice(0, 4)}…${s.slice(-4)}`;
+}
+
+/**
+ * Return a shallow copy of a DeployTarget-shaped object with `access_key`
+ * and `access_secret` masked. Unknown keys pass through unchanged.
+ */
+export function redactTarget<T extends Record<string, any>>(target: T): T {
+	if (!target || typeof target !== 'object') return target;
+	const out: Record<string, any> = { ...target };
+	if (typeof out.access_key === 'string') out.access_key = maskSecret(out.access_key);
+	if (typeof out.access_secret === 'string') out.access_secret = maskSecret(out.access_secret);
+	return out as T;
+}
+
+/**
+ * Redact `AccessKeyId` and `Signature` query parameters from an Aliyun
+ * OpenAPI URL so the URL can be safely logged. Leaves all other params
+ * (Action, Timestamp, etc.) intact for debugging.
+ */
+export function redactCdnUrl(url: string): string {
+	if (!url) return url;
+	return url
+		.replace(/([?&]AccessKeyId=)([^&]+)/i, (_m, p1, v) => `${p1}${maskSecret(v)}`)
+		.replace(/([?&]Signature=)([^&]+)/i, (_m, p1) => `${p1}REDACTED`);
+}
+
+export default {
+	maskSecret,
+	redactTarget,
+	redactCdnUrl,
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rigjs",
-  "version": "4.0.16",
-  "versionCode": 26052423,
+  "version": "4.0.18",
+  "versionCode": 26052501,
   "description": "A multi-repos dev tool based on yarn and git.Rigjs is intended to be the simplest way to develop,share and deliver codes between different developers or different projects.",
   "keywords": [
     "modular",