@@ -10,23 +10,31 @@ const DEFAULT_REDACT_MIN_LENGTH = 18;
1010const DEFAULT_REDACT_KEEP_START = 6;
1111const DEFAULT_REDACT_KEEP_END = 4;
121213+const PAYMENT_CREDENTIAL_ENV_KEYS = String.raw`CARD[_-]?NUMBER|CARD[_-]?CVC|CARD[_-]?CVV|CVC|CVV|SECURITY[_-]?CODE|PAYMENT[_-]?CREDENTIAL|SHARED[_-]?PAYMENT[_-]?TOKEN`;
14+const PAYMENT_CREDENTIAL_QUERY_KEYS = String.raw`card[-_]?number|card[-_]?cvc|card[-_]?cvv|cvc|cvv|security[-_]?code|payment[-_]?credential|shared[-_]?payment[-_]?token`;
15+const PAYMENT_CREDENTIAL_JSON_KEYS = String.raw`cardNumber|card_number|cardCvc|card_cvc|cardCvv|card_cvv|cvc|cvv|securityCode|security_code|paymentCredential|payment_credential|sharedPaymentToken|shared_payment_token`;
16+const STRUCTURED_SECRET_FIELD_RE = new RegExp(
17+String.raw`^(?:api[-_]?key|apiKey|token|secret|password|passwd|access[-_]?token|accessToken|refresh[-_]?token|refreshToken|client[-_]?secret|clientSecret|${PAYMENT_CREDENTIAL_QUERY_KEYS}|${PAYMENT_CREDENTIAL_JSON_KEYS})$`,
18+"i",
19+);
20+1321const DEFAULT_REDACT_PATTERNS: string[] = [
1422// ENV-style assignments. Keep this case-sensitive so diagnostics like
1523// `Unrecognized key: "llm"` do not lose the actual config key.
16-String.raw`/\b[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD)\b\s*[=:]\s*(["']?)([^\s"'\\]+)\1/g`,
24+String.raw`/\b[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|${PAYMENT_CREDENTIAL_ENV_KEYS})\b\s*[=:]\s*(["']?)([^\s"'\\]+)\1/g`,
1725// URL query parameters. Keep this separate from ENV-style assignments so
1826// lower-case URL secrets stay redacted without hiding config-key diagnostics.
19-String.raw`/[?&](?:access[-_]?token|auth[-_]?token|hook[-_]?token|refresh[-_]?token|api[-_]?key|client[-_]?secret|token|key|secret|password|pass|passwd|auth|signature)=([^&\s"'<>]+)/gi`,
27+String.raw`/[?&](?:access[-_]?token|auth[-_]?token|hook[-_]?token|refresh[-_]?token|api[-_]?key|client[-_]?secret|token|key|secret|password|pass|passwd|auth|signature|${PAYMENT_CREDENTIAL_QUERY_KEYS})=([^&\s"'<>]+)/gi`,
2028// JSON fields.
21-String.raw`"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*"([^"]+)"`,
29+String.raw`"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken|${PAYMENT_CREDENTIAL_JSON_KEYS})"\s*:\s*"([^"]+)"`,
2230// CLI flags.
23-String.raw`--(?:api[-_]?key|hook[-_]?token|token|secret|password|passwd)\s+(["']?)([^\s"']+)\1`,
31+String.raw`--(?:api[-_]?key|hook[-_]?token|token|secret|password|passwd|${PAYMENT_CREDENTIAL_QUERY_KEYS})\s+(["']?)([^\s"']+)\1`,
2432// Authorization headers.
2533String.raw`Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)`,
2634String.raw`\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b`,
2735// Standalone token assignments in CLI or HTTP diagnostics. URL query params
2836// are handled above so non-secret params survive and long values stay hinted.
29-String.raw`(^|[\s,;])(?:access_token|refresh_token|api[-_]?key|token|secret|password|passwd)=([^\s&#]+)`,
37+String.raw`(^|[\s,;])(?:access_token|refresh_token|api[-_]?key|token|secret|password|passwd|${PAYMENT_CREDENTIAL_QUERY_KEYS})=([^\s&#]+)`,
3038// PEM blocks.
3139String.raw`-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----`,
3240// Common token prefixes.
@@ -186,6 +194,17 @@ export function redactToolPayloadText(text: string): string {
186194return redactSensitiveText(text, { mode: "tools", patterns });
187195}
188196197+export function redactSensitiveFieldValue(key: string, value: string): string {
198+const redacted = redactToolPayloadText(value);
199+if (redacted !== value) {
200+return redacted;
201+}
202+if (STRUCTURED_SECRET_FIELD_RE.test(key)) {
203+return maskToken(value);
204+}
205+return value;
206+}
207+189208export function getDefaultRedactPatterns(): string[] {
190209return [...DEFAULT_REDACT_PATTERNS];
191210}
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。