@clipboard-health/groundcrew 4.48.2 → 4.48.3

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiRH,wBAAsB,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAuF/C"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0SH,wBAAsB,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAyF/C"}

package/dist/commands/doctor.js

@@ -210,6 +210,29 @@ function gatherToolTargets(config) {
     }
     return [...all].map(([token, hint]) => (hint === undefined ? { token } : { token, hint }));
 }
+function preLaunchEnvAdvisories(config) {
+    const advisories = [];
+    for (const [agentName, definition] of Object.entries(config.agents.definitions)) {
+        const names = definition.preLaunchEnv ?? [];
+        if (names.length === 0) {
+            continue;
+        }
+        // The runtime empty-check is spliced only when `preLaunch` is present
+        // (see `hostPreLaunchSourceAndReadPrompt` / `preLaunchPromptAndExec` in
+        // `src/lib/launchCommand.ts`). Without `preLaunch`, forwarded values come
+        // straight from the parent shell and no launch-time guard runs.
+        const warnClause = definition.preLaunch === undefined
+            ? "no preLaunch is set, so empty values are NOT checked at launch"
+            : "empty values are warned at launch";
+        advisories.push({
+            name: `preLaunchEnv: ${agentName}`,
+            ok: true,
+            required: false,
+            hint: `forwards ${names.length} var(s): ${names.join(", ")}. ${warnClause}.`,
+        });
+    }
+    return advisories;
+}
 function agentCliHint(agentName, token) {
     if (!isBuiltInAgentName(agentName)) {
         return undefined;
@@ -289,6 +312,7 @@ export async function doctor() {
         const check = await checkCmd(token, required, required ? hint : "required for local runs");
         checks.push(check);
     }
+    checks.push(...preLaunchEnvAdvisories(config));
     const usageGatedAgents = gatedAgents(config);
     if (usageGatedAgents.length > 0) {
         const codexbarPath = await which("codexbar");

package/dist/lib/launchCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launchCommand.d.ts","sourceRoot":"","sources":["../../src/lib/launchCommand.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,CAE/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,GAAE,MAAwB,GAAG,MAAM,CAcvF;AA4OD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA8B9D;AAMD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC,CAAC;AAEH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,iBAAiB,CAMpB;AAwCD,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACpD;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,UAAU,uBAAuB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,sBAAsB;IAC9B,UAAU,EAAE,eAAe,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C;;;;;;OAMG;IACH,iCAAiC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvD;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,aAAa,EAAE,oBAAoB,CAAC;IACpC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACtD;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACxD;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9D;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE;;;OAGG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAClD;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,sBAAsB,GAAG,MAAM,CAoC7E"}
+{"version":3,"file":"launchCommand.d.ts","sourceRoot":"","sources":["../../src/lib/launchCommand.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAKrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,CAE/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,GAAE,MAAwB,GAAG,MAAM,CAcvF;AAmPD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA8B9D;AAMD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC,CAAC;AAEH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,iBAAiB,CAMpB;AAwCD,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACpD;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,UAAU,uBAAuB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,sBAAsB;IAC9B,UAAU,EAAE,eAAe,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C;;;;;;OAMG;IACH,iCAAiC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvD;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,aAAa,EAAE,oBAAoB,CAAC;IACpC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACtD;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACxD;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9D;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE;;;OAGG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAClD;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,sBAAsB,GAAG,MAAM,CAoC7E"}

package/dist/lib/launchCommand.js

@@ -2,6 +2,7 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { BUILD_SECRET_NAMES, hasPreLaunchEnv, } from "./config.js";
 import { clearanceAllowHostsFilesFromEnvironment } from "./clearanceAllowlist.js";
+import { buildPreLaunchEmptyCheckLines } from "./preLaunchEmptyCheck.js";
 import { shellSingleQuote } from "./shell.js";
 export { shellSingleQuote } from "./shell.js";
 /**
@@ -116,7 +117,7 @@ function hostSourceSecrets(secretsFile) {
 function preLaunchPromptAndExec(arguments_) {
     const lines = [];
     if (arguments_.definition.preLaunch !== undefined) {
-        lines.push(renderPreLaunch(arguments_.definition.preLaunch, arguments_.worktreeDir));
+        lines.push(renderPreLaunch(arguments_.definition.preLaunch, arguments_.worktreeDir), ...buildPreLaunchEmptyCheckLines(arguments_.definition.preLaunchEnv ?? []));
     }
     lines.push(`_p=$(cat ${shellSingleQuote(arguments_.promptFile)})`, `rm -rf ${shellSingleQuote(arguments_.promptDir)}`, arguments_.execLine);
     return lines;
@@ -150,7 +151,10 @@ function renderPrepareAndAgentCommand(arguments_) {
 function hostPreLaunchSourceAndReadPrompt(arguments_) {
     const lines = [];
     if (arguments_.definition.preLaunch !== undefined) {
-        lines.push(unsetEnvironmentLine([...BUILD_SECRET_NAMES, ...(arguments_.definition.preLaunchEnv ?? [])]), renderPreLaunch(arguments_.definition.preLaunch, arguments_.worktreeDir));
+        const preLaunchEnv = arguments_.definition.preLaunchEnv ?? [];
+        // Order is load-bearing: unset scrubs inherited values so the empty-check
+        // reads what preLaunch actually produced, not what the parent shell leaked.
+        lines.push(unsetEnvironmentLine([...BUILD_SECRET_NAMES, ...preLaunchEnv]), renderPreLaunch(arguments_.definition.preLaunch, arguments_.worktreeDir), ...buildPreLaunchEmptyCheckLines(preLaunchEnv));
     }
     lines.push(...hostSourceSecrets(arguments_.secretsFile), `_p=$(cat ${shellSingleQuote(arguments_.promptFile)})`, `rm -rf ${shellSingleQuote(arguments_.promptDir)}`);
     return lines;

package/dist/lib/preLaunchEmptyCheck.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Emit POSIX-shell lines that WARN (to stderr, never abort) when a
+ * `preLaunchEnv` name resolves to an empty string after `preLaunch` runs.
+ * Length-0 is the reliable tell for the `export VAR="$(cat missing-file)"`
+ * failure mode: `export` masks the substitution's non-zero exit status, so
+ * `set -e` and exit-code checks do not catch it.
+ *
+ * Warn-only is deliberate — a hard-abort mode is a separate opt-in, so the
+ * chain (prompt read, prompt-dir cleanup, exec) must not be short-circuited
+ * by an empty value here.
+ *
+ * Returns `[]` for an empty input list so callers can splat unconditionally
+ * into their `&&` chain.
+ *
+ * Caveat: the check reads the shell's post-preLaunch view of the var. On the
+ * safehouse chain (`hostPreLaunchSourceAndReadPrompt`) the caller unsets each
+ * `preLaunchEnv` name before running `preLaunch`, so the check truly reflects
+ * what `preLaunch` produced. On the unwrapped-host chain
+ * (`preLaunchPromptAndExec`) no unset happens first, so a value inherited
+ * from the parent shell can survive `preLaunch` and mask a failed `export`.
+ * That asymmetry is a property of the runners; closing it requires an env
+ * scrub on the runner=none path, tracked as a follow-up.
+ *
+ * Names must be POSIX identifiers (`[A-Za-z_][A-Za-z0-9_]*`); groundcrew's
+ * `validatePreLaunchEnv` in `src/lib/config.ts` enforces that, so no shell
+ * escaping is done here.
+ */
+export declare function buildPreLaunchEmptyCheckLines(names: readonly string[]): string[];
+//# sourceMappingURL=preLaunchEmptyCheck.d.ts.map

package/dist/lib/preLaunchEmptyCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preLaunchEmptyCheck.d.ts","sourceRoot":"","sources":["../../src/lib/preLaunchEmptyCheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAQhF"}

package/dist/lib/preLaunchEmptyCheck.js

@@ -0,0 +1,33 @@
+/**
+ * Emit POSIX-shell lines that WARN (to stderr, never abort) when a
+ * `preLaunchEnv` name resolves to an empty string after `preLaunch` runs.
+ * Length-0 is the reliable tell for the `export VAR="$(cat missing-file)"`
+ * failure mode: `export` masks the substitution's non-zero exit status, so
+ * `set -e` and exit-code checks do not catch it.
+ *
+ * Warn-only is deliberate — a hard-abort mode is a separate opt-in, so the
+ * chain (prompt read, prompt-dir cleanup, exec) must not be short-circuited
+ * by an empty value here.
+ *
+ * Returns `[]` for an empty input list so callers can splat unconditionally
+ * into their `&&` chain.
+ *
+ * Caveat: the check reads the shell's post-preLaunch view of the var. On the
+ * safehouse chain (`hostPreLaunchSourceAndReadPrompt`) the caller unsets each
+ * `preLaunchEnv` name before running `preLaunch`, so the check truly reflects
+ * what `preLaunch` produced. On the unwrapped-host chain
+ * (`preLaunchPromptAndExec`) no unset happens first, so a value inherited
+ * from the parent shell can survive `preLaunch` and mask a failed `export`.
+ * That asymmetry is a property of the runners; closing it requires an env
+ * scrub on the runner=none path, tracked as a follow-up.
+ *
+ * Names must be POSIX identifiers (`[A-Za-z_][A-Za-z0-9_]*`); groundcrew's
+ * `validatePreLaunchEnv` in `src/lib/config.ts` enforces that, so no shell
+ * escaping is done here.
+ */
+export function buildPreLaunchEmptyCheckLines(names) {
+    if (names.length === 0) {
+        return [];
+    }
+    return [...new Set(names)].map((name) => `if [ -z "\${${name}-}" ]; then echo "preLaunchEnv: ${name} is empty after preLaunch (value length 0)" >&2; fi`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clipboard-health/groundcrew",
-  "version": "4.48.2",
+  "version": "4.48.3",
   "description": "Linear-driven orchestrator that launches AI coding agents in git worktrees, with workspace lifecycle and usage tracking.",
   "keywords": [
     "agent",
@@ -90,7 +90,7 @@
     "jscpd": "5.0.12",
     "knip": "6.27.0",
     "lint-staged": "17.0.8",
-    "markdownlint-cli2": "0.23.0",
+    "markdownlint-cli2": "0.23.1",
     "nx": "22.7.7",
     "oxfmt": "0.59.0",
     "oxlint": "1.73.0",