mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-12 02:02:13 +03:00
613464c24d
* feat(guardrails): add CredentialMaskerGuardrail for API key/secret redaction - New CredentialMaskerGuardrail (src/lib/guardrails/credentialMasker.ts) extends BaseGuardrail - preCall: redacts well-known credential patterns from upstream payload (message content, tool_call function.arguments, tool results) before sending to the provider - postCall: redacts credentials from the provider response - Patterns (13+ types, conservative/low-false-positive): OpenAI (sk-/sk-proj-), Anthropic (sk-ant-), GitHub (gh[pousr]_), Slack (xox[bpoa]-), Google (AIza), HuggingFace (hf_), Replicate (r8_), Stripe (sk_live_/rk_live_), Square, AWS (AKIA), Twilio, SendGrid, Mailgun, Discord, Notion, Linear, npm, Postman, private keys (PEM), JWTs, connection strings (mongodb/postgres/mysql/redis), auth headers (Authorization: Bearer / x-api-key) - Registered in registerDefaultGuardrails + exported from index - Opt-in via CREDENTIAL_REDACTION_ENABLED=true (mirrors PII_REDACTION_ENABLED) - Tested: all 13 pattern types redacted, benign text unchanged, tool_call args + tool results scrubbed, tsc + eslint clean * feat(guardrails): make credential-masker settings-driven + Security tab toggle - Add credentialRedactionEnabled setting (default false) to getSettings + updateSettingsSchema - Guardrail preCall/postCall now read getSettings().credentialRedactionEnabled (with CREDENTIAL_REDACTION_ENABLED env fallback) instead of constructor-only enable - Add Credential Redaction toggle Card to SecurityTab (PATCHes /api/settings) - Toggleable from the dashboard Security settings, no restart needed * fix: harden credential redaction guardrail * fix: cover auth header redaction edge cases * fix(i18n): propagate CredentialMaskerGuardrail keys to all locales (#6695 drift) en.json gained 4 new settings.* keys (credentialRedaction, credentialRedactionDesc, enableCredentialRedaction, enableCredentialRedactionDesc) that were never mirrored into the other locale catalogs, tripping the "no drift" regression guard added for #6695. Fill them with the __MISSING__ sentinel (same convention as scripts/i18n/sync-ui-keys.mjs) across all 42 non-English locales. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>