@ai-setting/roy-agent-core 1.7.53 → 1.7.56

package/dist/shared/@ai-setting/{roy-agent-core-x8n1r7h4.js → roy-agent-core-n3b7ztms.js}

@@ -1,12 +1,163 @@
 import {
   TracedAs,
   init_decorator
-} from "./roy-agent-core-dsevjbck.js";
+} from "./roy-agent-core-b599jgyd.js";
 import {
   __esm,
   __legacyDecorateClassTS
 } from "./roy-agent-core-fs0mn2jk.js";
 
+// src/env/workflow/utils/redact-command-secrets.ts
+function replaceTrailing(match, raw) {
+  if (raw.length === 0)
+    return match;
+  const idx = match.lastIndexOf(raw);
+  if (idx < 0)
+    return match;
+  return match.slice(0, idx) + MASK;
+}
+function looksLikeCredentialCommand(command) {
+  return PASSWORD_FLAG_TOOL_RE.test(command);
+}
+function looksLikeShortATool(command) {
+  return SHORT_A_TOOL_RE.test(command);
+}
+function looksLikePasswordValue(value) {
+  if (value.length === 0)
+    return false;
+  if (PATH_LIKE_RE.test(value))
+    return false;
+  if (NUMERIC_RE.test(value))
+    return false;
+  return true;
+}
+function redactCommandSecrets(command) {
+  if (!command)
+    return command;
+  let out = command;
+  out = out.replace(AUTH_SCHEME_RE, (match, prefix, scheme, value) => isMasked(value) ? match : `${prefix}${scheme} ${MASK}`);
+  out = out.replace(URL_USERINFO_RE, (match, head, value, at) => isMasked(value) ? match : `${head}${MASK}${at}`);
+  out = out.replace(URL_QUERY_RE, (match, amp, name, eq, value) => {
+    if (!SENSITIVE_QUERY_KEY_RE.test(name))
+      return match;
+    if (isMasked(value))
+      return match;
+    return `${amp}${name}${eq}${MASK}`;
+  });
+  out = out.replace(SHORT_U_RE, (match, lead, flag, user, pass) => {
+    if (isMasked(pass))
+      return match;
+    const name = user.slice(0, -1);
+    if (UID_GID_RE.test(name) && UID_GID_RE.test(pass))
+      return match;
+    if (name === pass)
+      return match;
+    return `${lead}${flag}${user}${MASK}`;
+  });
+  out = out.replace(LONG_USER_RE, (match, lead, flag, user, pass) => {
+    if (isMasked(pass))
+      return match;
+    const name = user.slice(0, -1);
+    if (UID_GID_RE.test(name) && UID_GID_RE.test(pass))
+      return match;
+    if (name === pass)
+      return match;
+    return `${lead}${flag}${user}${MASK}`;
+  });
+  if (looksLikeCredentialCommand(command)) {
+    const maskPassword = (match, lead, flag, dq, sq, bare) => {
+      const value = dq ?? sq ?? bare ?? "";
+      if (isMasked(value) || !looksLikePasswordValue(value))
+        return match;
+      if (dq !== undefined)
+        return `${lead}${flag}"${MASK}"`;
+      if (sq !== undefined)
+        return `${lead}${flag}'${MASK}'`;
+      return lead + flag + MASK;
+    };
+    out = out.replace(SHORT_P_SPACED_RE, maskPassword);
+    out = out.replace(SHORT_P_ATTACHED_RE, maskPassword);
+  }
+  out = out.replace(AUTH_FAILURE_CRED_RE, (match, head, user, pass) => isMasked(pass) ? match : `${head}${user}:${MASK}`);
+  out = out.replace(AWS_SET_SECRET_RE, (match, key, value) => isMasked(value) ? match : `${key} ${MASK}`);
+  if (looksLikeShortATool(command)) {
+    out = out.replace(SHORT_A_SECRET_RE, (match, lead, flag, value) => isMasked(value) || !looksLikePasswordValue(value) ? match : `${lead}${flag}${MASK}`);
+    out = out.replace(SHORT_A_ATTACHED_RE, (match, lead, flag, value) => isMasked(value) || !looksLikePasswordValue(value) ? match : `${lead}${flag}${MASK}`);
+  }
+  out = out.replace(ASSIGNMENT_RE, (match, key, dq, sq, bare) => {
+    if (!SENSITIVE_KEY_RE.test(key))
+      return match;
+    const value = dq ?? sq ?? bare ?? "";
+    if (value === MASK)
+      return match;
+    const isAuthHeaderKey = /^(?:proxy-)?authorization$/i.test(key);
+    if (isAuthHeaderKey && AUTH_SCHEME_WORD_RE.test(value))
+      return match;
+    const raw = dq !== undefined ? `"${value}"` : sq !== undefined ? `'${value}'` : value;
+    return replaceTrailing(match, raw);
+  });
+  out = out.replace(FLAG_RE, (match, lead, flag, _sep, dq, sq, bare) => {
+    if (!SENSITIVE_KEY_RE.test(flag))
+      return match;
+    const value = dq ?? sq ?? bare ?? "";
+    if (value === MASK)
+      return match;
+    const raw = dq !== undefined ? `"${value}"` : sq !== undefined ? `'${value}'` : value;
+    return replaceTrailing(match, raw);
+  });
+  return out;
+}
+function summarizeCommand(command, maxLen = 120) {
+  if (!command)
+    return "";
+  const collapsed = command.replace(/\s+/g, " ").trim();
+  if (collapsed.length <= maxLen)
+    return collapsed;
+  return `${collapsed.slice(0, maxLen)}…`;
+}
+var MASK = "[REDACTED]", SENSITIVE_KEY_RE, BARE_VALUE = `[^\\s;&|]+[^\\s;&|"'<>()]|[^\\s;&|]`, ASSIGNMENT_RE, FLAG_RE, AUTH_SCHEME_RE, SENSITIVE_QUERY_KEY_RE, URL_QUERY_RE, URL_USERINFO_RE, AUTH_FAILURE_CRED_RE, SHORT_U_RE, LONG_USER_RE, UID_GID_RE, SHORT_P_SPACED_RE, SHORT_P_ATTACHED_RE, isMasked = (value) => (value ?? "").trim() === MASK, AUTH_SCHEME_WORD_RE, PASSWORD_FLAG_TOOL_RE, SHORT_A_TOOL_RE, SHORT_A_SECRET_RE, SHORT_A_ATTACHED_RE, AWS_SET_SECRET_RE, PATH_LIKE_RE, NUMERIC_RE;
+var init_redact_command_secrets = __esm(() => {
+  SENSITIVE_KEY_RE = /(?:pass(?:word|wd|phrase)?|token|secret|api[_-]?key|apikey|credential|authorization|private[_-]?key)/i;
+  ASSIGNMENT_RE = new RegExp(`(?<![A-Za-z0-9_.-])([A-Za-z0-9_][A-Za-z0-9_.-]*)\\s*[=:]\\s*(?:"([^"]*)"|'([^']*)'|(${BARE_VALUE}))`, "g");
+  FLAG_RE = new RegExp(`(^|[\\s])(--?[A-Za-z0-9][A-Za-z0-9_.-]*)(=\\s*|\\s+)(?:"([^"]*)"|'([^']*)'|(${BARE_VALUE}))`, "g");
+  AUTH_SCHEME_RE = new RegExp(`((?:Proxy-)?Authorization["']?\\s*[:=]\\s*["']?\\s*)(Bearer|Basic|Token|Digest)\\s+(${BARE_VALUE}|\\[REDACTED\\])`, "gi");
+  SENSITIVE_QUERY_KEY_RE = new RegExp([
+    "^pass(?:word|wd)?$",
+    "^pwd$",
+    "^token$",
+    "^access[_-]?token$",
+    "^refresh[_-]?token$",
+    "^id[_-]?token$",
+    "^secret$",
+    "^client[_-]?secret$",
+    "^api[_-]?key$",
+    "^apikey$",
+    "^credential$",
+    "^credentials$",
+    "^sig$",
+    "^signature$",
+    "^auth$",
+    "^authorization$",
+    "^private[_-]?key$"
+  ].join("|"), "i");
+  URL_QUERY_RE = /([?&])([A-Za-z_][A-Za-z0-9_.-]*)(=)([^&#\s"']+)/g;
+  URL_USERINFO_RE = /(\/\/[^/\s:@]+:)([^/\s"']+)(@)/g;
+  AUTH_FAILURE_CRED_RE = /(\b(?:auth(?:entication|orization)?|login|credentials?|password|passwd|token)\b[^\n:]{0,40}?[\s"'])([A-Za-z0-9_.-]{1,64}):([^\s;&|"'<>]{3,})/gi;
+  SHORT_U_RE = /(^|\s)(-u\s+)([^:\s]+:)([^\s;&|"']+)/g;
+  LONG_USER_RE = /(^|\s)(--user(?:=|\s+))([^:\s]+:)([^\s;&|"']+)/g;
+  UID_GID_RE = /^\d+$/;
+  SHORT_P_SPACED_RE = new RegExp(`(^|\\s)(-p\\s+)(?:"([^"]*)"|'([^']*)'|(${BARE_VALUE}))`, "g");
+  SHORT_P_ATTACHED_RE = new RegExp(`(^|\\s)(-p)(?:"([^"]*)"|'([^']*)'|(${BARE_VALUE}))`, "g");
+  AUTH_SCHEME_WORD_RE = /^(?:bearer|basic|token|digest|negotiate|ntlm)$/i;
+  PASSWORD_FLAG_TOOL_RE = /(?<![\w/.-])(?:docker\s+login|helm\s+(?:registry\s+)?login|mysql|mysqldump|mariadb|sshpass)\b/i;
+  SHORT_A_TOOL_RE = /(?<![\w/.-])redis-cli\b/i;
+  SHORT_A_SECRET_RE = new RegExp(`(^|\\s)(-a\\s+)(?!-)(${BARE_VALUE})`, "g");
+  SHORT_A_ATTACHED_RE = new RegExp(`(^|\\s)(-a)(${BARE_VALUE})`, "g");
+  AWS_SET_SECRET_RE = new RegExp(`\\b((?:aws[_-])?(?:secret[_-]?access[_-]?key|session[_-]?token))\\s+(?!set\\b)([^=\\s;&|][^\\s;&|]*[^\\s;&|"'<>()]|[^=\\s;&|])`, "gi");
+  PATH_LIKE_RE = /^(?:\/|\.\/|\.\.\/|~\/)/;
+  NUMERIC_RE = /^\d+$/;
+});
+
 // src/env/workflow/nodes/tool-node.ts
 function isPositiveNumber(v) {
   return typeof v === "number" && Number.isFinite(v) && v > 0;
@@ -23,9 +174,39 @@ function getToolTimeoutMs(input, config) {
   }
   return DEFAULT_TOOL_TIMEOUT_MS;
 }
-var DEFAULT_TOOL_TIMEOUT_MS = 60000, ToolNode;
+function redactTail(text, tailChars) {
+  const window = text.length > tailChars + REDACT_TAIL_SLACK ? text.slice(-(tailChars + REDACT_TAIL_SLACK)) : text;
+  return redactCommandSecrets(window).trim().slice(-tailChars).trim();
+}
+function redactErrorForOutput(err) {
+  const message = redactCommandSecrets(err.message);
+  const stack = typeof err.stack === "string" ? redactCommandSecrets(err.stack) : undefined;
+  if (message === err.message && stack === err.stack)
+    return err;
+  const clone = new Error(message, { cause: err });
+  clone.name = err.name;
+  if (stack)
+    clone.stack = stack;
+  return clone;
+}
+function buildExitCodeError(exitCode, md, toolInput) {
+  const parts = [`Tool exited with code ${exitCode}`];
+  const rawCommand = toolInput && typeof toolInput === "object" ? toolInput.command ?? toolInput.cmd : undefined;
+  if (typeof rawCommand === "string" && rawCommand.trim().length > 0) {
+    const safe = summarizeCommand(redactCommandSecrets(rawCommand));
+    if (safe.length > 0) {
+      parts.push(`command: ${safe}`);
+    }
+  }
+  const stdout = typeof md.stdout === "string" ? md.stdout : "";
+  const stdoutTail = redactTail(stdout, 300);
+  parts.push(stdoutTail.length > 0 ? `stdout tail: ${stdoutTail}` : "(no stdout)");
+  return parts.join(" | ");
+}
+var DEFAULT_TOOL_TIMEOUT_MS = 60000, REDACT_TAIL_SLACK = 4096, ToolNode;
 var init_tool_node = __esm(() => {
   init_decorator();
+  init_redact_command_secrets();
   ToolNode = class ToolNode {
     definition;
     toolRegistry;
@@ -125,7 +306,7 @@ var init_tool_node = __esm(() => {
           }
         }
         const extractedOutput = this.extractFromWrapper(output);
-        const wrapperError = this.extractErrorFromWrapper(output);
+        const wrapperError = this.extractErrorFromWrapper(output, input);
         return {
           output: extractedOutput,
           error: wrapperError,
@@ -134,7 +315,7 @@ var init_tool_node = __esm(() => {
       } catch (error) {
         return {
           output: undefined,
-          error: error instanceof Error ? error : new Error(String(error)),
+          error: error instanceof Error ? redactErrorForOutput(error) : new Error(redactCommandSecrets(String(error))),
           durationMs: Date.now() - startTime
         };
       }
@@ -159,7 +340,7 @@ var init_tool_node = __esm(() => {
       }
       return result;
     }
-    extractErrorFromWrapper(value) {
+    extractErrorFromWrapper(value, toolInput) {
       if (value === null || value === undefined) {
         return;
       }
@@ -172,10 +353,10 @@ var init_tool_node = __esm(() => {
       }
       const err = obj.error;
       if (typeof err === "string" && err.length > 0) {
-        return err;
+        return redactCommandSecrets(err);
       }
       if (err instanceof Error) {
-        return err;
+        return redactErrorForOutput(err);
       }
       const md = obj.metadata;
       if (md) {
@@ -185,7 +366,7 @@ var init_tool_node = __esm(() => {
         }
         if (typeof md.exit_code === "number" && md.exit_code !== 0) {
           const stderr = typeof md.stderr === "string" ? md.stderr : "";
-          return stderr.length > 0 ? stderr : `Tool exited with code ${md.exit_code}`;
+          return stderr.length > 0 ? redactCommandSecrets(stderr) : buildExitCodeError(md.exit_code, md, toolInput);
         }
       }
       return `Tool execution failed (success=false, no error message)`;

package/dist/shared/@ai-setting/{roy-agent-core-4vpk40ss.js → roy-agent-core-nhk0dsxr.js}

@@ -1,7 +1,7 @@
 import {
   exports_node_registry_helper,
   init_node_registry_helper
-} from "./roy-agent-core-vrsxhw9e.js";
+} from "./roy-agent-core-e677am8e.js";
 import {
   askUserTool,
   createRunWorkflowTool,
@@ -13,18 +13,18 @@ import {
   createWorkflowSearchTool,
   createWorkflowTagListTool,
   createWorkflowValidateTool
-} from "./roy-agent-core-vvxb9522.js";
+} from "./roy-agent-core-0bmk44ye.js";
 import {
   WorkflowService
-} from "./roy-agent-core-7evvpfwc.js";
+} from "./roy-agent-core-5rxs0ra3.js";
 import {
   WorkflowEngine,
   exports_engine,
   init_engine
-} from "./roy-agent-core-35s1w7tc.js";
+} from "./roy-agent-core-v2188rnk.js";
 import {
   BaseComponent
-} from "./roy-agent-core-tdbv7ff4.js";
+} from "./roy-agent-core-40xzbjtm.js";
 import {
   createLogger,
   init_logger
@@ -104,7 +104,7 @@ class WorkflowComponent extends BaseComponent {
       return;
     try {
       const { NodeRegistry } = await import("../../env/workflow/engine/index.js");
-      const { registerDecoratorNodeType: registerDecoratorNodeType2 } = await import("./roy-agent-core-9jzysq50.js");
+      const { registerDecoratorNodeType: registerDecoratorNodeType2 } = await import("./roy-agent-core-heft3j4c.js");
       this.nodeRegistry = new NodeRegistry;
       registerDecoratorNodeType2(this.nodeRegistry);
       this.decoratorsRegistered = true;
@@ -134,14 +134,14 @@ class WorkflowComponent extends BaseComponent {
   }
   async runWorkflow(definition, input, options) {
     const { NodeRegistry } = await import("../../env/workflow/engine/index.js");
-    const { registerDecoratorNodeType: registerDecoratorNodeType2 } = await import("./roy-agent-core-9jzysq50.js");
+    const { registerDecoratorNodeType: registerDecoratorNodeType2 } = await import("./roy-agent-core-heft3j4c.js");
     const toolComponent = this.toolComponent || this._workflowEnv?.getComponent("tool");
     const skillComponent = this._workflowEnv?.getComponent("skill");
     let agentRunner = this.agentRunner;
     if (!agentRunner && this._workflowEnv) {
       const agentComponent = this._workflowEnv.getComponent("agent");
       if (agentComponent) {
-        const { AgentComponentAdapter } = await import("./roy-agent-core-skzjs973.js");
+        const { AgentComponentAdapter } = await import("./roy-agent-core-pjxa78mp.js");
         agentRunner = new AgentComponentAdapter(agentComponent, {}, this.sessionComponent);
       }
     }
@@ -163,7 +163,7 @@ class WorkflowComponent extends BaseComponent {
     if (this.workflowService) {
       this.workflowService = null;
       try {
-        const { closeDatabase } = await import("./roy-agent-core-2k4xffaa.js");
+        const { closeDatabase } = await import("./roy-agent-core-8cgtwytv.js");
         closeDatabase();
         componentLogger.info("[WorkflowComponent] SQLite database closed");
       } catch (error) {
@@ -241,9 +241,9 @@ class WorkflowComponent extends BaseComponent {
   }
   async initSqliteService() {
     try {
-      const { getDatabase, initializeTables } = await import("./roy-agent-core-2k4xffaa.js");
-      const { WorkflowRepository } = await import("./roy-agent-core-1cv9j4dg.js");
-      const { TagRepository } = await import("./roy-agent-core-ne2t1pay.js");
+      const { getDatabase, initializeTables } = await import("./roy-agent-core-8cgtwytv.js");
+      const { WorkflowRepository } = await import("./roy-agent-core-d14h726p.js");
+      const { TagRepository } = await import("./roy-agent-core-f8sp1txg.js");
       const db = getDatabase();
       initializeTables();
       const workflowRepository = new WorkflowRepository(db);
@@ -309,7 +309,7 @@ class WorkflowComponent extends BaseComponent {
     this.workflowService = null;
     this.nodeRegistry = null;
     try {
-      const { closeDatabase } = await import("./roy-agent-core-2k4xffaa.js");
+      const { closeDatabase } = await import("./roy-agent-core-8cgtwytv.js");
       closeDatabase();
     } catch {}
     this._status = "stopped";

package/dist/shared/@ai-setting/{roy-agent-core-j8e92gj8.js → roy-agent-core-nntphgww.js}

@@ -1,7 +1,7 @@
 import {
   TracedAs,
   init_decorator
-} from "./roy-agent-core-dsevjbck.js";
+} from "./roy-agent-core-b599jgyd.js";
 import {
   createLogger,
   init_logger
@@ -287,34 +287,6 @@ function buildChatAppLink(chatId, base = DEFAULT_APP_LINK_BASE) {
   return `${base}/client/chat/open?openChatId=${chatId}`;
 }
 var DEFAULT_APP_LINK_BASE = "https://applink.feishu.cn";
-function buildRedirectCard(opts) {
-  const taskLabel = opts.taskId !== undefined ? `#${opts.taskId}` : "本任务";
-  const title = opts.taskTitle ? ` ${sanitizeInlineText(opts.taskTitle, 120)}` : "";
-  const link = buildChatAppLink(opts.targetChatId);
-  const groupName = opts.targetChatName ? sanitizeInlineText(opts.targetChatName, 60) : "专属群";
-  return {
-    schema: "2.0",
-    header: {
-      title: { tag: "plain_text", content: "\uD83D\uDCC2 任务卡片已改投专属群" },
-      subtitle: { tag: "plain_text", content: "这里不是本任务的群，进展请看专属群" },
-      template: "grey"
-    },
-    body: {
-      elements: [
-        {
-          tag: "markdown",
-          content: [
-            `- **任务**：${taskLabel}${title}`,
-            `- **专属群**：[${groupName}](${link})`,
-            `- **群 ID**：\`${opts.targetChatId}\`（搜群名也能进）`,
-            opts.reason ? `- **原因**：${sanitizeInlineText(opts.reason, 280)}` : ""
-          ].filter(Boolean).join(`
-`)
-        }
-      ]
-    }
-  };
-}
 var WORKFLOW_STATUS_LABEL = {
   running: "\uD83D\uDD04 运行中",
   completed: "✅ 已完成",
@@ -449,7 +421,6 @@ class LarkCardPatchNotifier {
   mutexes = new Map;
   states = new Map;
   workflowStates = new Map;
-  redirectsSent = new Set;
   constructor(options = {}) {
     this.options = {
       pinOnStart: true,
@@ -505,36 +476,6 @@ class LarkCardPatchNotifier {
     }
     return { messageId, pinned, pinError };
   }
-  async sendRedirectNotice(opts) {
-    const redirectKey = opts.taskId !== undefined ? `${opts.taskId}:${opts.targetChatId}` : undefined;
-    if (redirectKey) {
-      if (this.redirectsSent.has(redirectKey)) {
-        logger.debug(`sendRedirectNotice: 已发过改投卡片（${redirectKey}）→ 跳过重复发送`);
-        return false;
-      }
-      this.redirectsSent.add(redirectKey);
-    }
-    const card = buildRedirectCard({
-      taskId: opts.taskId,
-      taskTitle: opts.taskTitle,
-      targetChatId: opts.targetChatId,
-      targetChatName: opts.targetChatName,
-      reason: opts.reason
-    });
-    try {
-      await this.runLarkCli(this.buildSendCardArgs({
-        chatId: opts.chatId,
-        profile: opts.profile,
-        card
-      }), "send-redirect");
-      return true;
-    } catch (err) {
-      if (redirectKey)
-        this.redirectsSent.delete(redirectKey);
-      logger.warn(`sendRedirectNotice failed (non-fatal) for chat ${opts.chatId}: ${err.message}`);
-      return false;
-    }
-  }
   async updateTask(opts) {
     await this.mutexFor(opts.messageId).run(async () => {
       const state = this.states.get(opts.messageId) ?? {

package/dist/shared/@ai-setting/{roy-agent-core-8s9jd2qy.js → roy-agent-core-nra8vfrs.js}

@@ -5,7 +5,7 @@ import {
 import {
   TracedAs,
   init_decorator
-} from "./roy-agent-core-dsevjbck.js";
+} from "./roy-agent-core-b599jgyd.js";
 import {
   __esm,
   __legacyDecorateClassTS

package/dist/shared/@ai-setting/{roy-agent-core-pk1b3kvf.js → roy-agent-core-ns3pbyz4.js}

@@ -1,6 +1,6 @@
 import {
   safeParseToolArgs
-} from "./roy-agent-core-zy3hqfwg.js";
+} from "./roy-agent-core-yv9x4wmg.js";
 
 // src/env/session/session-message-converter.ts
 import { randomUUID } from "crypto";

package/dist/shared/@ai-setting/{roy-agent-core-7g03zkkb.js → roy-agent-core-pemxr5n4.js}

@@ -2,7 +2,7 @@ import {
   getEnvContextOrEmpty,
   init_env_context,
   setCurrentTaskId
-} from "./roy-agent-core-5apmk4qw.js";
+} from "./roy-agent-core-jszgaevt.js";
 import {
   createLogger,
   init_logger

package/dist/shared/@ai-setting/{roy-agent-core-skzjs973.js → roy-agent-core-pjxa78mp.js}

@@ -1,14 +1,14 @@
 import {
   AgentComponentAdapter,
   init_agent_component_adapter
-} from "./roy-agent-core-6167phd4.js";
+} from "./roy-agent-core-833t16n1.js";
 import"./roy-agent-core-1db4vpc6.js";
 import"./roy-agent-core-ze068vc9.js";
 import"./roy-agent-core-e25xkv53.js";
-import"./roy-agent-core-4z3rq5gw.js";
-import"./roy-agent-core-k8b440n3.js";
-import"./roy-agent-core-5apmk4qw.js";
-import"./roy-agent-core-dsevjbck.js";
+import"./roy-agent-core-1pnfkspm.js";
+import"./roy-agent-core-16t0zfbk.js";
+import"./roy-agent-core-jszgaevt.js";
+import"./roy-agent-core-b599jgyd.js";
 import"./roy-agent-core-8seq65bp.js";
 import"./roy-agent-core-jnszp0jq.js";
 import"./roy-agent-core-fs0mn2jk.js";