@coderook/cli 0.41.0 → 0.41.2

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.41.0",
+  "version": "0.41.2",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/README.md

@@ -526,9 +526,22 @@ cbx secret set DEPLOY_TOKEN        asked for at a hidden prompt; never shown aga
 cbx secret list
 ```
 
-Every run gets `CODEROOK_TOKEN`, `CODEROOK_API` and `CODEROOK_PROJECT`, so
-`cbx issue comment`, `cbx pr label` or `cbx release` inside a workflow need no
-setup. Secrets reach only runs started by people who can change the project.
+Runs get `CODEROOK_API` and `CODEROOK_PROJECT`. A job allowed to act on the
+project also receives a temporary `CODEROOK_TOKEN`; credential-free workspace
+checks and artifact-producing builds receive no project write token.
+
+Project secrets require approval tied to the saved source and execution
+settings. PR checks receive none. Workspace release recipes request only their
+configured secret names. Credential-capable jobs cannot retain artifacts: build
+packages in a separate credential-free job, then publish the approved artifact.
+
+CLI 0.41.1 buffers complete output lines before masking, including tokens split
+across process chunks. It also isolates the child process's HOME/npm settings
+and stops inheriting unrelated host environment credentials. Supply required
+service credentials through the approved Action, not the runner's own login.
+Use a dedicated native runner: these protections do not sandbox project code
+against the host filesystem or stop a malicious approved command sending a key
+over the network. Review and approve the exact release code before adding keys.
 
 ## Issues
 

package/dist/cbx/src/shared/run_output.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunOutputStream = void 0;
+exports.secretVariants = secretVariants;
+exports.redactRunOutput = redactRunOutput;
+exports.credentialArtifactPath = credentialArtifactPath;
+exports.artifactContainsSecret = artifactContainsSecret;
+/** Output protection, shared by the API and both runners. Not an exfiltration sandbox. */
+function secretVariants(values) {
+    const variants = new Set();
+    for (const value of values) {
+        if (!value)
+            continue;
+        for (const part of [value, ...value.split(/\r?\n/)]) {
+            if (!part)
+                continue;
+            variants.add(part);
+            variants.add(encodeURIComponent(part));
+            variants.add(JSON.stringify(part).slice(1, -1));
+        }
+    }
+    return [...variants].sort((a, b) => b.length - a.length);
+}
+function redactRunOutput(text, values = []) {
+    // Strip terminal escapes before matching, so ANSI colour cannot split a value.
+    let safe = text.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "");
+    for (const value of secretVariants(values))
+        safe = safe.split(value).join("***");
+    // Run tokens must be covered even after revocation, when only their hash remains.
+    safe = safe.replace(/\b(?:cr(?:r|w|k|p|pj|pt)_[A-Za-z0-9_-]{16,256}|npm_[A-Za-z0-9]{20,256})\b/g, "***");
+    safe = safe.replace(/(\b(?:authorization|proxy-authorization)\s*[:=]\s*)(?:Bearer|Basic)\s+[^\s"']+/gi, "$1***");
+    safe = safe.replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/@]+:[^\s/@]+@/gi, "$1***@");
+    safe = safe.replace(/([?&](?:access_token|api_key|apikey|token|password|secret|signature|x-amz-signature)=)[^&#\s"']+/gi, "$1***");
+    return safe;
+}
+/** Buffer complete lines: chunk boundaries must never turn a token into two public fragments. */
+class RunOutputStream {
+    values;
+    limit;
+    pending = "";
+    omitting = false;
+    constructor(values, limit = 64 * 1024) {
+        this.values = values;
+        this.limit = limit;
+    }
+    push(chunk) {
+        let safe = "";
+        for (const part of chunk.split(/([\r\n])/)) {
+            if (part === "\r" || part === "\n") {
+                if (!this.omitting)
+                    safe += redactRunOutput(this.pending, this.values) + part;
+                this.pending = "";
+                this.omitting = false;
+            }
+            else if (!this.omitting) {
+                if (this.pending.length + part.length > this.limit) {
+                    safe += "[Oversized output line omitted]\n";
+                    this.pending = "";
+                    this.omitting = true;
+                }
+                else
+                    this.pending += part;
+            }
+        }
+        return safe;
+    }
+    end() {
+        const safe = this.omitting ? "" : redactRunOutput(this.pending, this.values);
+        this.pending = "";
+        this.omitting = false;
+        return safe;
+    }
+}
+exports.RunOutputStream = RunOutputStream;
+/** Never export local authentication/configuration files, even under a broad glob. */
+function credentialArtifactPath(path) {
+    return path.replace(/\\/g, "/").split("/").some(part => /^(?:\.env(?:\..*)?|\.dev\.vars(?:\..*)?|\.npmrc|\.pypirc|\.netrc|\.git-credentials|id_rsa|id_ed25519|credentials(?:\.json)?|token(?:s)?\.json)$/i.test(part) ||
+        /\.(?:pem|p12|pfx|key)$/i.test(part));
+}
+/** A best-effort raw-byte check; credential-bearing jobs must not export archives at all. */
+function artifactContainsSecret(bytes, values) {
+    const text = new TextDecoder().decode(bytes);
+    return secretVariants(values).some(value => text.includes(value)) ||
+        /\b(?:cr(?:r|w|k|p|pj|pt)_[A-Za-z0-9_-]{16,256}|npm_[A-Za-z0-9]{20,256})\b/.test(text);
+}

package/dist/cli/src/cli.js

@@ -2755,9 +2755,9 @@ const SPECS = [
         name: "workspace",
         group: "Workspaces",
         summary: "edit, save and run a private project remotely without a checkout",
-        usage: "workspace <open|list|show|read|files|search|diff|patch|save|run|logs|cancel|deploy|preview|handoff|close|recipe|assign|assignments|unassign|checkout> <project> [workspace] [job] | workspace push [folder]",
+        usage: "workspace <usage|open|list|show|read|files|search|diff|patch|save|run|logs|cancel|deploy|preview|handoff|close|recipe|assign|assignments|unassign|checkout> <project> [workspace] [job] | workspace push [folder]",
         brief: "workspace <action> <project>",
-        detail: "Works on CodeRook's durable remote draft, never the current local folder. Use --data-file for structured edits or recipe configuration. Mutations need the reviewed --revision and a unique --key; reuse the same key and request when retrying. Recipes reference existing project workflows. Saving and deploying are separate operations.",
+        detail: "Works on CodeRook's durable remote draft, never the current local folder. Use --data-file for structured edits or recipe configuration. Mutations need the reviewed --revision and a unique --key; reuse the same key and request when retrying. Recipes reference existing project workflows. Usage reads the shared workspace credits and separate PR allowance without a draft ID. Saving and deploying are separate operations.",
         options: [
             { flags: "--data-file <path>", description: "read an operation's JSON from this local file" },
             { flags: "--name <name>", description: "name a new workspace" },

package/dist/cli/src/mcp.js

@@ -105,6 +105,20 @@ async function withVersion(projectId, wanted) {
     return { id: found.id, sequence: found.sequence };
 }
 const TOOLS = [
+    {
+        name: "coderook_usage",
+        description: "Read the project's shared billing-account workspace credits (included, spent, reserved and purchased), separate PR assistant allowance and UTC monthly reset. Supply a project or use the linked folder. Hosted jobs reserve included then purchased credits; insufficient funds leave jobs queued. Native runners use no hosted credits. Workspace top-ups do not refill PR allowance. This tool cannot buy credits or enable recurring payments; purchases stay in CodeRook Subscription or repository Settings.",
+        inputSchema: {
+            type: "object",
+            properties: { project: { type: "string" } },
+            additionalProperties: false,
+        },
+        run: async (input) => {
+            const project = await resolve(input.project);
+            await assertMayRead(project.id, project.slug);
+            return JSON.stringify(await (0, api_js_1.callApi)(`/v1/repositories/${encodeURIComponent(project.id)}/workspace-usage`), null, 2);
+        },
+    },
     {
         name: "coderook_projects",
         description: "Every project on the signed-in CodeRook account, with how much each " +

package/dist/cli/src/runner.js

@@ -30,6 +30,8 @@ exports.report = report;
  * decision somebody made rather than one they discovered.
  */
 const node_child_process_1 = require("node:child_process");
+const node_string_decoder_1 = require("node:string_decoder");
+const run_output_js_1 = require("../../cbx/src/shared/run_output.js");
 const node_crypto_1 = require("node:crypto");
 const promises_1 = require("node:fs/promises");
 const node_fs_1 = require("node:fs");
@@ -44,12 +46,7 @@ const config_js_1 = require("./config.js");
 const progress_js_1 = require("./progress.js");
 /** Replace each secret's value with ***, longest first. */
 function maskSecrets(text, secrets) {
-    let out = text;
-    for (const value of secrets) {
-        if (value.length >= 4 && out.includes(value))
-            out = out.split(value).join("***");
-    }
-    return out;
+    return (0, run_output_js_1.redactRunOutput)(text, secrets);
 }
 /** How often to tell the service the machine is still working. */
 const HEARTBEAT_MS = 30_000;
@@ -154,14 +151,15 @@ class LogShipper {
  * the run log, which read access is enough to see — so a collaborator could
  * walk off with the account of whoever was hosting the runner.
  *
- * The rest of the environment is left alone. PATH, HOME and the compiler
- * settings are what makes a build possible, and stripping them would break
- * every real workflow to guard against a risk the runner already announces.
+ * Only platform and toolchain variables are inherited. The command gets a
+ * temporary HOME, npm configuration and cache inside the job folder. This
+ * prevents accidental inheritance; a native runner is still trusted code on
+ * its host, not a filesystem or network sandbox.
  */
 function withoutCredentials(source) {
     const safe = { ...source };
     for (const name of Object.keys(safe)) {
-        if (/^CODEROOK_(TOKEN|SECRET|PASSWORD|API_KEY)$/i.test(name)) {
+        if (!/^(?:PATH|PATHEXT|SYSTEMROOT|WINDIR|COMSPEC|TEMP|TMP|HOME|USERPROFILE|LANG|LC_[A-Z_]+|TERM|COLORTERM|NUMBER_OF_PROCESSORS|PROCESSOR_ARCHITECTURE|JAVA_HOME|DOTNET_ROOT|CARGO_HOME|RUSTUP_HOME|GOROOT|GOPATH)$/i.test(name)) {
             delete safe[name];
         }
     }
@@ -231,12 +229,20 @@ function defaultLabels() {
  * waiting for, and losing a build that passed because the network went odd
  * afterwards would be a worse answer than a pass with a missing download.
  */
-async function uploadArtifacts(repositoryId, runId, workspace, patterns, say) {
+async function uploadArtifacts(repositoryId, runId, workspace, patterns, say, secrets = []) {
     const wanted = await collectArtifacts(workspace, patterns);
     let kept = 0;
     for (const file of wanted) {
         try {
+            if ((0, run_output_js_1.credentialArtifactPath)(file.relative)) {
+                say("Skipped an authentication/configuration artifact");
+                continue;
+            }
             const bytes = await (0, promises_1.readFile)(file.absolute);
+            if ((0, run_output_js_1.artifactContainsSecret)(bytes, secrets)) {
+                say("Skipped an artifact containing credential material");
+                continue;
+            }
             const digest = (0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex");
             const token = await (0, config_js_1.loadToken)();
             const stored = await fetch(`${(0, config_js_1.apiOrigin)()}/v1/repositories/${repositoryId}` +
@@ -374,7 +380,7 @@ async function performRun(repositoryId, run, runner) {
             }
         }
     };
-    const logs = new LogShipper(repositoryId, run.runId, (line) => progress.say(line));
+    const logs = new LogShipper(repositoryId, run.runId, (line) => progress.say(maskSecrets(line, secrets)));
     const started = Date.now();
     const workspace = await (0, promises_1.mkdtemp)(node_path_1.default.join((0, node_os_1.tmpdir)(), "coderook-run-"));
     let beating;
@@ -452,7 +458,14 @@ async function performRun(repositoryId, run, runner) {
         const directory = run.workingDirectory
             ? insideWorkspace(workspace, run.workingDirectory)
             : workspace;
-        progress.step("Running", command);
+        progress.step("Running", maskSecrets(command, secrets));
+        // npm and other tools must not automatically reuse the runner owner's login files.
+        const home = node_path_1.default.join(workspace, ".run-home");
+        await (0, promises_1.mkdir)(home, { recursive: true });
+        const temporary = node_path_1.default.join(home, "tmp");
+        await (0, promises_1.mkdir)(temporary, { recursive: true });
+        const emptyConfig = node_path_1.default.join(home, "empty.npmrc");
+        await (0, promises_1.writeFile)(emptyConfig, "", { mode: 0o600 });
         flushing = setInterval(() => void logs.flush(), FLUSH_MS);
         const code = await new Promise((settle) => {
             /*
@@ -473,6 +486,16 @@ async function performRun(repositoryId, run, runner) {
                 env: {
                     ...withoutCredentials(process.env),
                     ...(run.environment ?? {}),
+                    HOME: home,
+                    USERPROFILE: home,
+                    TEMP: temporary,
+                    TMP: temporary,
+                    TMPDIR: temporary,
+                    XDG_CONFIG_HOME: node_path_1.default.join(home, ".config"),
+                    XDG_CACHE_HOME: node_path_1.default.join(home, ".cache"),
+                    NPM_CONFIG_USERCONFIG: emptyConfig,
+                    NPM_CONFIG_GLOBALCONFIG: emptyConfig,
+                    NPM_CONFIG_CACHE: node_path_1.default.join(home, ".npm-cache"),
                     CI: "true",
                     CODEROOK_RUN: String(run.number),
                     CODEROOK_VERSION: run.versionSequence
@@ -485,18 +508,25 @@ async function performRun(repositoryId, run, runner) {
               a failed run can be read later; the person watching needs it so they
               can tell a slow build from a stuck one.
             */
-            const tee = (chunk, stream) => {
-                const text = maskSecrets(chunk.toString("utf8"), secrets);
+            const decoders = { stdout: new node_string_decoder_1.StringDecoder("utf8"), stderr: new node_string_decoder_1.StringDecoder("utf8") };
+            const protectedStreams = { stdout: new run_output_js_1.RunOutputStream(secrets), stderr: new run_output_js_1.RunOutputStream(secrets) };
+            const show = (text, stream) => { if (text) {
                 logs.add(text, stream);
                 progress.say(text);
+            } };
+            const tee = (chunk, stream) => show(protectedStreams[stream].push(decoders[stream].write(chunk)), stream);
+            const finishOutput = () => {
+                for (const stream of ["stdout", "stderr"]) {
+                    show(protectedStreams[stream].push(decoders[stream].end()) + protectedStreams[stream].end(), stream);
+                }
             };
             child.stdout?.on("data", (chunk) => tee(chunk, "stdout"));
             child.stderr?.on("data", (chunk) => tee(chunk, "stderr"));
             child.on("error", (error) => {
-                logs.add(errorText(error), "stderr");
+                logs.add(maskSecrets(errorText(error), secrets), "stderr");
                 settle(1);
             });
-            child.on("close", (status) => settle(status ?? 1));
+            child.on("close", (status) => { finishOutput(); settle(status ?? 1); });
             if (run.timeoutMinutes) {
                 limitTimer = setTimeout(() => {
                     timedOut = true;
@@ -514,16 +544,18 @@ async function performRun(repositoryId, run, runner) {
           very log or partial output somebody needs to work out why, and throwing
           that away is exactly when they would have wanted it.
         */
-        if (run.artifactPaths?.length) {
+        if (run.artifactPaths?.length && (run.artifactsAllowed ?? !run.secretNames?.length)) {
             progress.step("Keeping what it built");
             const kept = await uploadArtifacts(repositoryId, run.runId, workspace, run.artifactPaths, (line) => {
-                logs.add(line, "stdout");
-                progress.say(line);
-            });
+                logs.add(maskSecrets(line, secrets), "stdout");
+                progress.say(maskSecrets(line, secrets));
+            }, secrets);
             if (!kept) {
                 logs.add("Nothing matched the paths this workflow keeps.", "stdout");
             }
         }
+        if (run.artifactPaths?.length && !(run.artifactsAllowed ?? !run.secretNames?.length))
+            logs.add("Artifacts disabled for this credential-capable run; use a separate credential-free build job.", "stdout");
         await logs.flush();
         const seconds = Math.round((Date.now() - started) / 1000);
         if (timedOut)
@@ -535,9 +567,10 @@ async function performRun(repositoryId, run, runner) {
             : { status: "failed", summary: `Exited ${code} after ${seconds}s` };
     }
     catch (error) {
-        logs.add(errorText(error), "stderr");
+        const safeError = maskSecrets(errorText(error), secrets);
+        logs.add(safeError, "stderr");
         await logs.flush();
-        return { status: "failed", summary: errorText(error).slice(0, 200) };
+        return { status: "failed", summary: safeError.slice(0, 200) };
     }
     finally {
         /*
@@ -552,7 +585,13 @@ async function performRun(repositoryId, run, runner) {
         if (flushing)
             clearInterval(flushing);
         await logs.flush();
-        await (0, promises_1.rm)(workspace, { recursive: true, force: true }).catch(() => { });
+        await (0, promises_1.rm)(workspace, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 }).catch(async () => {
+            const summary = "Runner cleanup failed. Stop this runner and remove its temporary job folder before processing more credential-bearing work.";
+            // Report a final failure before stopping the runner, rather than leaving
+            // a completed publish queued for a lease-expiry retry.
+            await report(repositoryId, run.runId, { status: "failed", summary }, Date.now() - started).catch(() => undefined);
+            throw new Error(summary);
+        });
     }
 }
 /** Say how it went. */

package/dist/cli/src/workspace_command.js

@@ -41,7 +41,10 @@ async function commandWorkspace(parsed) {
     const key = flag("key") ?? data.operationKey;
     const revision = integer("revision") ?? data.expectedRevision;
     let path = `${root}/workspaces`, method = "GET", body;
-    if (operation === "open") {
+    if (operation === "usage") {
+        path = `${root}/workspace-usage`;
+    }
+    else if (operation === "open") {
         method = "POST";
         body = {
             ...data,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.41.0",
+  "version": "0.41.2",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",
@@ -53,7 +53,8 @@
     "test:runner": "node test/runner-live.mjs",
     "sync:plugin": "node scripts/sync-plugin-version.mjs",
     "test:track": "node test/get-track.mjs",
-    "package:remote": "node ../scripts/package-cli-release.mjs"
+    "package:remote": "node ../scripts/package-cli-release.mjs",
+    "publish:remote": "node ../scripts/publish-cli-release.mjs"
   },
   "devDependencies": {
     "@types/node": "24.10.1",