mirror of
https://github.com/nightly-labs/openbot.git
synced 2026-11-15 14:01:41 +08:00
NB
e50c1b3bf6
* Isolate tests from the shell, mask registered secrets, and trace main-process crashes - Each test file now starts with no credential variables, no provider directory overrides, TZ=UTC, LANG=C.UTF-8, and a temporary HOME, so a test cannot reach a real provider or the real profile. - registerSecretValue in @openbot/logging masks exact secret values in all later log lines. The provider credential store and the MCP store register secrets when they load them. - The main process logs unhandled rejections and uncaught exceptions through the redacting logger and writes a crash span to the local trace. * Run label redaction before exact-value masking, and keep secrets per owner - A registered value that is also a label, such as `password`, no longer erases the label before the rules hide the value after it. - `setSecretValues(owner, values)` replaces `registerSecretValue`. Each owner replaces only its own values, so a full registry can no longer push out an active provider key. A rotated or removed key and a removed MCP server leave the set. * Keep replaced secrets masked, and move HOME before renderer threads start - The registry adds values and removes none. A client started with a replaced provider key can still print it until it stops, so the old key stays masked. The set grows only by the secrets the user saves while the app runs. - The renderer project runs files in worker threads, where `process.env` does not reach the native `homedir()`. A global setup now moves HOME in the main process before the threads start. * Mask registered values before label rules, and redirect Windows app data in tests - Registered values are replaced first by a marker that the label rules treat as a secret label. A label rule can no longer cut a registered value and leave part of it in the log, and a registered label still hides the value after it. - A value that cannot be URL-encoded no longer throws, so a stored MCP configuration that holds one stays readable. - The test guard points APPDATA and LOCALAPPDATA at the temporary home. * Mask registered values that hold a rule word after the rules run A registered value such as `Authorization` or `password` is also a word the label and scheme rules read. Masking it first erased the header name, so the Basic credential after it stayed visible. Such values are now masked after the rules. All other values are still masked first, so no rule can cut them. * Mask every registered value before the rules, with a label marker for rule words All registered values are replaced in one pass before the rules run, so no rule can cut one. A value with a word the rules read becomes a marker that is itself a secret label and ends in `authorization`, so a label or header name it replaced still hides the value after it. * Mask the whole token around a registered value A longer credential that starts with a registered value, such as `Bearer abc…` after `Bearer abc` was saved, lost its scheme to the marker and kept its unregistered part. A match now grows to the credential, URL path or email characters around it. The marker kind now follows the whole token. * Find every registered match before growing tokens A registered value that started inside the token an earlier match grew to was skipped, so part of it could stay visible. Every exact match is now found first, then each grows, and ranges that overlap or touch become one token.
20 lines
423 B
JSON
20 lines
423 B
JSON
{
|
|
"extends": "./tsconfig.base.json",
|
|
"compilerOptions": {
|
|
"types": ["node"],
|
|
"verbatimModuleSyntax": true
|
|
},
|
|
"include": [
|
|
"electron.vite.config.ts",
|
|
"vitest.config.ts",
|
|
"knip.config.ts",
|
|
"scripts/**/*.ts",
|
|
"tools/vitest/**/*.ts",
|
|
"src/backend/**/*.ts",
|
|
"src/main/**/*.ts",
|
|
"src/preload/**/*.ts",
|
|
"packages/contracts/src/**/*.ts",
|
|
"packages/logging/src/**/*.ts"
|
|
]
|
|
}
|