root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat(engine): extract shared PTY native-asset loader and redactSecrets (U16)

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
gsxdsm
2026-06-04 22:53:02 -07:00
parent e5bab640f9
commit ea18ef8d44
13 changed files with 602 additions and 202 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
plugins/fusion-plugin-acp-runtime/package.json
View File

@@ -27,6 +27,7 @@
},
"dependencies": {
"@agentclientprotocol/sdk": "0.24.0",
"@fusion/core": "workspace:*",
"@fusion/plugin-sdk": "workspace:*"
},
"peerDependencies": {

29
plugins/fusion-plugin-acp-runtime/src/process-manager.ts
View File

@@ -13,6 +13,7 @@
// to the agent.
import { spawn, type ChildProcess } from "node:child_process";
import { redactSecrets } from "@fusion/core";
function debugLog(message: string): void {
if (process.env.PI_ACP_DEBUG !== "1") return;
@@ -113,31 +114,9 @@ export function spawnAgent(options: SpawnAgentOptions): ChildProcess {
/** Maximum stderr bytes retained; older output is dropped to bound memory. */
const STDERR_BUFFER_CEILING = 64 * 1024;
/**
* Redact token-like / auth patterns from text so auth errors don't leak
* verbatim into the stderr buffer or logs (Risk S8). Best-effort: covers
* bearer tokens, `Authorization:` header values, `key=`/`token=`/`secret=`
* assignments, and long base64/hex secrets.
*/
export function redactSecrets(text: string): string {
return (
text
// Authorization: Bearer <token> / Authorization: <token>
.replace(/(authorization\s*[:=]\s*)(bearer\s+)?[^\s,;"']+/gi, "$1$2[REDACTED]")
// Bearer <token>
.replace(/\b(bearer)\s+[A-Za-z0-9._\-+/=]+/gi, "$1 [REDACTED]")
// key=... token=... secret=... password=... apikey=... (quoted or bare)
.replace(
/\b((?:api[_-]?key|key|token|secret|password|passwd|pwd|access[_-]?token|refresh[_-]?token|client[_-]?secret)\s*[:=]\s*)("?)[^\s,;"']+\2/gi,
"$1$2[REDACTED]$2",
)
// sk-/ghp_/github_pat_/xoxb-/AKIA-style long opaque tokens
.replace(/\b(sk-|ghp_|gho_|github_pat_|xox[abpr]-|AKIA)[A-Za-z0-9_\-]{8,}/g, "[REDACTED]")
// standalone long base64/hex secrets (>=32 chars)
.replace(/\b[A-Za-z0-9+/]{40,}={0,2}\b/g, "[REDACTED]")
.replace(/\b[0-9a-fA-F]{32,}\b/g, "[REDACTED]")
);
}
// Secret redaction (Risk S8) lives in @fusion/core so PTY/process owners share
// one implementation; re-exported here to preserve this module's public surface.
export { redactSecrets };
/**
* Accumulate stderr into a bounded, secret-redacted buffer.