verytis 0.1.1 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verytis",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "license": "UNLICENSED",
   "files": [
     "packages"

package/packages/mcp/retrieval.ts

@@ -200,7 +200,47 @@ function extractSharedSignals(
 
 // --- Safe text helpers ---
 
-import { sanitizePublicText } from "@/lib/fixgraph/redact-secrets"
+const secretPatterns: Array<[RegExp, string]> = [
+  [/https?:\/\/[^/\s:@]+:[^/\s@]+@/gi, "https://[REDACTED]@"],
+  [/\bOPENAI_API_KEY\s*=\s*[^\s]+/gi, "OPENAI_API_KEY=[REDACTED]"],
+  [/\b(?:NEXT_PUBLIC_)?SUPABASE(?:_[A-Z]+)*_KEY\s*=\s*[^\s]+/gi, "SUPABASE_KEY=[REDACTED]"],
+  [/\bDATABASE_URL\s*=\s*[^\s]+/gi, "DATABASE_URL=[REDACTED]"],
+  [/\bJWT_SECRET\s*=\s*[^\s]+/gi, "JWT_SECRET=[REDACTED]"],
+  [/\b[A-Z0-9_]*(?:API_)?(?:KEY|TOKEN|SECRET|PASSWORD|PWD)\s*=\s*[^\s]+/gi, "[SECRET]=[REDACTED]"],
+  [/"[^"]*(?:key|token|secret|password|pwd)[^"]*"\s*:\s*"[^"]*"/gi, '"[SECRET]":"[REDACTED]"'],
+  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "PRIVATE_KEY=[REDACTED]"],
+  [/\bPRIVATE_KEY\s*=\s*[^\n]+/gi, "PRIVATE_KEY=[REDACTED]"],
+  [/\bsk-[A-Za-z0-9_-]{16,}\b/g, "sk-[REDACTED]"],
+  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{16,}\b/g, "github_[REDACTED]"],
+  [/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, "github_pat_[REDACTED]"],
+  [/\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/gi, "Bearer [REDACTED]"],
+  [/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[EMAIL_REDACTED]"],
+];
+
+function redactPrivatePaths(input: string): string {
+  return input
+    .replace(/\b[A-Za-z]:\\Users\\[^\\\s:)'"`]+(?:\\[^\\\s:)'"`]+)*/g, "[path]")
+    .replace(/\b[A-Za-z]:\\[^\\\s:)'"`]+(?:\\[^\\\s:)'"`]+)*/g, "[path]")
+    .replace(/\/Users\/[^\s:)'"`]+/g, "[path]")
+    .replace(/\/home\/[^\s:)'"`]+/g, "[path]")
+    .replace(/\/private\/var\/[^\s:)'"`]+/g, "[path]")
+    .replace(/\/Users\/\S+/g, "<local-path>")
+    .replace(/\/home\/\S+/g, "<local-path>")
+    .replace(/[A-Za-z]:\\Users\\\S+/g, "<local-path>");
+}
+
+function redactSecrets(input: string): string {
+  const redacted = secretPatterns.reduce(
+    (acc, [pattern, replacement]) => acc.replace(pattern, replacement),
+    input
+  );
+  return redactPrivatePaths(redacted);
+}
+
+function sanitizePublicText(value: string | null | undefined, maxLength = 500): string {
+  if (!value) return "";
+  return redactSecrets(value).slice(0, maxLength).trim();
+}
 
 function safeText(text: string | null | undefined, maxLength = 500): string {
   if (!text) return ""