openAgent

1export * as SecretRedactor from "./redactor"
2 
3const secretValues = new Set<string>()
4const secretKeys = new Map<string, string>() // value -> keyName
5 
6export function register(secret: string, keyName?: string): void {
7  if (!secret || typeof secret !== "string" || secret.trim().length < 4) return
8  const trimmed = secret.trim()
9  secretValues.add(trimmed)
10  if (keyName) {
11    secretKeys.set(trimmed, keyName)
12  }
13}
14 
15export function registerFromEnv(): void {
16  for (const [key, value] of Object.entries(process.env)) {
17    if (!value || typeof value !== "string" || value.length < 4) continue
18    const upper = key.toUpperCase()
19    if (
20      upper.includes("KEY") ||
21      upper.includes("TOKEN") ||
22      upper.includes("SECRET") ||
23      upper.includes("PASSWORD") ||
24      upper.includes("AUTH")
25    ) {
26      register(value, key)
27    }
28  }
29}
30 
31// Common credential pattern detectors (OpenAI, Anthropic, GitHub, Slack, AWS, generic tokens)
32const sensitivePatterns = [
33  /(?:Bearer\s+)([a-zA-Z0-9_\-\.]{16,})/gi,
34  /(?:sk-[a-zA-Z0-9_\-]{20,})/gi,
35  /(?:ghp_[a-zA-Z0-9]{36})/gi,
36  /(?:gho_[a-zA-Z0-9]{36})/gi,
37  /(?:ghu_[a-zA-Z0-9]{36})/gi,
38  /(?:ghs_[a-zA-Z0-9]{36})/gi,
39  /(?:ghr_[a-zA-Z0-9]{36})/gi,
40  /(?:xox[baprs]-[0-9a-zA-Z]{10,48})/gi,
41  /(?:AKIA[0-9A-Z]{16})/gi,
42]
43 
44export function redact(input: string): string {
45  if (!input || typeof input !== "string") return input
46  let result = input
47 
48  // Redact known registered secret values
49  for (const secret of secretValues) {
50    if (result.includes(secret)) {
51      const keyName = secretKeys.get(secret)
52      const replacement = keyName ? `[REDACTED:${keyName}]` : "[REDACTED]"
53      result = result.replaceAll(secret, replacement)
54    }
55  }
56 
57  // Redact known sensitive patterns
58  for (const pattern of sensitivePatterns) {
59    result = result.replace(pattern, (match) => {
60      if (match.startsWith("Bearer ")) {
61        return "Bearer [REDACTED]"
62      }
63      return "[REDACTED]"
64    })
65  }
66 
67  return result
68}
69 
70export function redactObject<T>(obj: T): T {
71  if (obj === null || obj === undefined) return obj
72  if (typeof obj === "string") {
73    return redact(obj) as unknown as T
74  }
75  if (Array.isArray(obj)) {
76    return obj.map((item) => redactObject(item)) as unknown as T
77  }
78  if (typeof obj === "object") {
79    const copy = { ...obj } as Record<string, unknown>
80    for (const [k, v] of Object.entries(copy)) {
81      const upper = k.toUpperCase()
82      if (
83        (upper.includes("PASSWORD") ||
84          upper.includes("SECRET") ||
85          upper.includes("TOKEN") ||
86          upper.includes("KEY")) &&
87        typeof v === "string"
88      ) {
89        copy[k] = "[REDACTED]"
90      } else {
91        copy[k] = redactObject(v)
92      }
93    }
94    return copy as unknown as T
95  }
96  return obj
97}
98 
99// Initialize redactor with process.env secrets
100registerFromEnv()
101