From 357e1c6beb8fb038cfa9a1dadb417e436216f745 Mon Sep 17 00:00:00 2001
From: AshSgDe29071999 <AshSgDe29071999@users.noreply.github.com>
Date: Thu, 20 Aug 2026 14:31:40 +0530
Subject: [PATCH] fix: align Node evt_/emk_ redaction with the Go CLI

The SDK only masked exactly 32 alphanumeric chars, so shorter, longer,
or hyphenated tokens leaked into plugin logs and host LLM context.

Closes #7
---
 plugins/agent-sdk/src/client.js        |  9 ++++-----
 plugins/agent-sdk/tests/client.test.js | 15 ++++++++++++++-
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/plugins/agent-sdk/src/client.js b/plugins/agent-sdk/src/client.js
index 9f108df..62ba2ac 100644
--- a/plugins/agent-sdk/src/client.js
+++ b/plugins/agent-sdk/src/client.js
@@ -23,11 +23,10 @@ const noop = { info() {}, warn() {} };
  * accidentally lands in an error message (defense-in-depth, the same
  * shape evercli's output.redact uses).
  */
-// Token regex: case-insensitive on both alphabet AND prefix. Current
-// issuance is lowercase hex but defense-in-depth covers a future
-// alphabet change without us having to chase every log/error sink.
-const evtRe = /evt_[a-zA-Z0-9]{32}/g;
-const emkRe = /emk_[a-zA-Z0-9]{32}/g;
+// Match evercli's output.redact: ≥20 chars, tolerate _/- so a future
+// key-format change (and any non-32-char token) is still masked (#7).
+const evtRe = /evt_[A-Za-z0-9_\-]{20,}/g;
+const emkRe = /emk_[A-Za-z0-9_\-]{20,}/g;
 
 // AWS S3 presigned-POST / GET URLs carry short-lived but real
 // credentials. The query-string fields below are issued for ~15 min
diff --git a/plugins/agent-sdk/tests/client.test.js b/plugins/agent-sdk/tests/client.test.js
index e6d3fdb..1f90707 100644
--- a/plugins/agent-sdk/tests/client.test.js
+++ b/plugins/agent-sdk/tests/client.test.js
@@ -1,7 +1,7 @@
 import { test, describe, beforeEach } from "node:test";
 import assert from "node:assert/strict";
 import http from "node:http";
-import { createClient, EvermeError } from "../src/client.js";
+import { createClient, EvermeError, redactError } from "../src/client.js";
 
 /**
  * Helper: spin up a tiny HTTP server, return its base URL + a
@@ -110,6 +110,19 @@ describe("client", () => {
     }
   });
 
+  test("redactError masks non-32-char and hyphenated evt_/emk_ tokens", async (t) => {
+    t.after(async () => s.close());
+    const hyphen = "evt_abcdefghij-klmnopqrs"; // 20+ with hyphen, used to leak
+    const shortish = "emk_" + "A".repeat(20);
+    const long = "evt_" + "b".repeat(40);
+    const got = redactError(`leaked ${hyphen} and ${shortish} and ${long}`);
+    assert.equal(got.includes(hyphen), false);
+    assert.equal(got.includes(shortish), false);
+    assert.equal(got.includes(long), false);
+    assert.match(got, /evt_abcd_REDACTED/);
+    assert.match(got, /emk_AAAA_REDACTED/);
+  });
+
   test("query params are appended", async (t) => {
     t.after(async () => s.close());
     const c = createClient({ baseUrl: s.baseUrl, agentId: "x", agentToken: "evt_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" });