You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The option:redaction.entropy takes true or { minLength, threshold } and is off by default. true means 24 characters or more and at most 4.5 bits per character. Out-of-range values fall back to the defaults, and pangularConfigProblems reports them.
Where it applies: it plugs into the shared redaction helpers, so every path that already redacts gets it: serialize (values and keys), NgRx, router, forms, HTTP (URL, previews, headers), Analog (including the server log message and body, which had skipped it), Capacitor and errors.
Display: the Dashboard summary shows Entropy masking: On, and the option reaches pages and the panel through redaction-config.
Docs:configuration.md and the "High-entropy strings" section of security.md. The changelog lines are under ## 1.0.0.
entropy-redaction.test.ts (41 tests, every token generated at runtime from a seed, no real-looking keys committed). It checks 22 redaction paths: readable with the option off, masked with it on, readable again when it's turned off. It also checks that a 200 KB worst-case input takes under 30 ms. Plus redaction-entropy-config.test.ts (6) and a panel test (2).
hub-entry.test.ts failed locally on Node 22.22 (the repo needs 24+). CI runs the right Node.
Added optional entropy masking for long, high-entropy strings in redacted text and paths. It is off by default and can be configured with minimum-length and entropy-threshold options.
Entropy masking is applied across supported page and devtools data, including forms, HTTP activity, and server logs.
Documentation
Added configuration guidance, defaults, validation details, and an explanation of which strings qualify for masking.
The name and shape rules miss a random token in a field with a harmless
name, or a cloud secret with no known prefix. With redaction.entropy on,
the shared redaction helpers mask runs that mix case and digits, are not
hex or a ULID, don't read as camelCase words and have high Shannon
entropy. It runs last, so known shapes keep their readable prefix, and it
reaches every path: serialize, router text and URLs, forms messages, HTTP
calls, NgRx state, Analog reports and server logs, Capacitor calls and
errors, on the page and on the devtools server.
The option is off by default. true uses runs of 24 characters or more
and up to 4.5 bits per character; { minLength, threshold } sets other
limits, checked by pangularConfigProblems. It reaches trusted pages and
the panel through the redaction-config answer and shows as Entropy
masking on the Dashboard. The check is one linear regex pass, and a test
keeps 200 KB inputs of awkward shapes fast. Tests build every token at
runtime from a seeded generator.
"Workers Builds: angular-devtools" fails on every PR right now because of a Cloudflare dashboard setting (#431, tracked in #482). It isn't caused by this PR.
Review was skipped as selected files did not have any reviewable changes.
Files ignored due to path filters: 1
extension/ui/assets/index-c_kN6QAL.js is excluded by !**/assets/index-[0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-].js
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 6528ca8c-27ec-45d1-b698-7b782518af52
Commits
Reviewing files that changed from the base of the PR and between e49b1d7 and ca0ac23.
Files ignored due to path filters: 1
extension/ui/assets/index-c_kN6QAL.js is excluded by !**/assets/index-[0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-].js
You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.
Use the checkbox below for a quick retry:
Trigger review
No actionable comments were generated in the recent review.
Walkthrough
This change adds opt-in entropy masking for long, high-entropy strings. It adds configurable limits and validation, applies masking across multiple text-redaction paths, and passes resolved redaction options to trusted pages.
Changes: Entropy Redaction
Layer / File(s)
Summary
Entropy configuration and documentation packages/devtools/src/config.ts, packages/devtools/src/__tests__/redaction-entropy-config.test.ts, apps/docs/src/content/getting-started/configuration.md, packages/devtools/CHANGELOG.md
Adds redaction.entropy with default minimum length 24 and threshold 4.5, validates option values, reports invalid settings, and includes enabled settings in configuration summaries. Updates the configuration docs and changelog.
Entropy detection and redaction paths packages/devtools/src/entropy-redact.ts, packages/devtools/src/{text-redact.ts,forms-privacy.ts,analog-server-log.ts}, packages/devtools/src/__tests__/entropy-redaction.test.ts, apps/docs/src/content/security.md
Adds entropy detection and masking rules, then applies masking after existing redaction in text, forms, and server-log paths. Tests cover detection, redaction paths, and long inputs. Security documentation describes the rules and coverage.
Adds resolved entropy options to redaction configuration returned through the trusted-page path. Tests cover the RPC configuration and its handling. Updates extension asset references.
pangular-inspector/devtools#472: Changes earlier redaction steps in analog-server-log.ts, forms-privacy.ts, and text-redact.ts, which this PR extends with entropy masking.
pangular-inspector/devtools#437: Introduces the trusted redaction-config RPC path that this PR extends to carry entropy options.
Merge Risk: Minimal · previous review e49b1
No merge-blocking issue was established for opt-in entropy masking; the PR is mergeable after normal checks.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title "feat(overlay): opt-in redaction.entropy masks high-entropy strings" matches the main change. The PR adds an opt-in redaction.entropy setting that masks high-entropy strings, and the summa…
Docstring Coverage
Docstring coverage is 84.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentati…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title "feat(overlay): opt-in redaction.entropy masks high-entropy strings" matches the main change. The PR adds an opt-in redaction.entropy setting that masks high-entropy strings, and the summaries show config, redaction helpers, docs, and tests for this feature. The title names the feature and its opt-in default. It uses a conventional commit prefix, which is consistent with the repository history. The objectives describe the same feature. The title is specific and clear.
Full details: Docstring Coverage
Explanation
Docstring coverage is 84.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 25 functions across 11 files. (3 skipped: 3 unsupported.)
Finishing Touches
Generate docstrings
Commit to this branch
Create a new PR
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: ace76ad9-306c-4230-aef8-1334257ea292
Commits
Reviewing files that changed from the base of the PR and between c5d62e9 and e49b1d7.
Files ignored due to path filters: 1
extension/ui/assets/index-c_kN6QAL.js is excluded by !**/assets/index-[0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-].js
Files skipped from review as they are similar to previous changes: 1
packages/devtools/CHANGELOG.md
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
area: panel
What and why
Refs #371 (decision Q44). Ships in 1.0.0.
redaction.entropytakestrueor{ minLength, threshold }and is off by default.truemeans 24 characters or more and at most 4.5 bits per character. Out-of-range values fall back to the defaults, andpangularConfigProblemsreports them.redaction-config.configuration.mdand the "High-entropy strings" section ofsecurity.md. The changelog lines are under## 1.0.0.How it was verified
pnpm typecheck,pnpm format:check,pnpm commit:check,pnpm docs:build,pnpm extension:build(withextension/uicommitted),pnpm test:panelentropy-redaction.test.ts(41 tests, every token generated at runtime from a seed, no real-looking keys committed). It checks 22 redaction paths: readable with the option off, masked with it on, readable again when it's turned off. It also checks that a 200 KB worst-case input takes under 30 ms. Plusredaction-entropy-config.test.ts(6) and a panel test (2).hub-entry.test.tsfailed locally on Node 22.22 (the repo needs 24+). CI runs the right Node.Generated by Claude Code
Summary by CodeRabbit