@integrity-labs/agt-cli 0.28.673 → 0.28.674

package/dist/bin/agt.js

@@ -40,10 +40,10 @@ import {
   success,
   table,
   warn
-} from "../chunk-RSERKOS7.js";
+} from "../chunk-ZD72DPZT.js";
 import {
   readDirectChatSessionState
-} from "../chunk-YAVWYI5S.js";
+} from "../chunk-7Y54PSMR.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -73,7 +73,7 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-YOID6KOQ.js";
+} from "../chunk-AJNES24H.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4909,7 +4909,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.673" : "dev";
+var cliVersion = true ? "0.28.674" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6089,7 +6089,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.673" : "dev";
+var cliVersion2 = true ? "0.28.674" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-YAVWYI5S.js → chunk-7Y54PSMR.js}

@@ -2,6 +2,7 @@ import {
   INTEGRATION_REGISTRY,
   OAUTH_PROVIDERS,
   PLATFORM_STORAGE_RULE,
+  SECRET_PATTERNS,
   claudeModelAlias,
   getOrCreateDailySession,
   isClaudeFastMode,
@@ -16,7 +17,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-YOID6KOQ.js";
+} from "./chunk-AJNES24H.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -187,6 +188,52 @@ function agentRuntimeKey(codeName, homeDir) {
   return codeName;
 }
 
+// src/lib/pane-log-redactor.ts
+function buildRedactorProgram(patterns = SECRET_PATTERNS) {
+  const subs = patterns.map((p) => `  $buf =~ s/${p.re.source}/<redacted:${p.label}>/g;`).join("\n");
+  return [
+    "#!/usr/bin/perl",
+    "# ENG-9353 pane.log secret redactor \u2014 GENERATED by pane-log-redactor.ts from",
+    "# @augmented/core's SECRET_PATTERNS. Do not edit here; change the canonical",
+    "# list and respawn. Streams stdin to stdout in raw 64KB blocks so pane.log",
+    "# mtime stays as fresh as the `cat` it replaces.",
+    "use strict; use warnings;",
+    "use Errno qw(EINTR);",
+    "$| = 1;",
+    "binmode(STDIN); binmode(STDOUT);",
+    "my $buf;",
+    // Retry interrupted syscalls, exactly as the `cat` this replaces does. A
+    // signal during the blocking sysread makes it return undef with $! == EINTR;
+    // perl does NOT auto-restart, so `undef > 0` would end the loop, the sink
+    // would exit, and pane capture (with the mtime idle signal) would stop for
+    // the rest of the session. Same for a partial/interrupted syswrite.
+    "OUTER: while (1) {",
+    "  my $n = sysread(STDIN, $buf, 65536);",
+    "  if (!defined $n) { next OUTER if $! == EINTR; last OUTER; }",
+    "  last OUTER if $n == 0;",
+    subs,
+    "  my $off = 0;",
+    "  while ($off < length($buf)) {",
+    "    my $w = syswrite(STDOUT, $buf, length($buf) - $off, $off);",
+    "    unless (defined $w) { next if $! == EINTR; last OUTER; }",
+    "    $off += $w;",
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+}
+function buildPaneSinkCommand(opts) {
+  const log2 = shellSingleQuote(opts.logPath);
+  if (!opts.hasPerl) {
+    return `cat >> ${log2}`;
+  }
+  const script = shellSingleQuote(opts.scriptPath);
+  return `perl ${script} >> ${log2}`;
+}
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
 // src/lib/opencode-session.ts
 import { spawn, execSync } from "child_process";
 import { createServer } from "net";
@@ -3303,6 +3350,44 @@ var PANE_TAIL_LINES = 20;
 function paneLogPath(codeName) {
   return join6(PANE_LOG_DIR, codeName, "pane.log");
 }
+var PANE_REDACTOR_SCRIPT = join6(PANE_LOG_DIR, "pane-log-redactor.pl");
+var paneRedactorPerlAvailable = null;
+function paneSinkCommand(logPath, log2) {
+  if (paneRedactorPerlAvailable === null) {
+    try {
+      execSync2("command -v perl", { stdio: "ignore" });
+      paneRedactorPerlAvailable = true;
+    } catch {
+      paneRedactorPerlAvailable = false;
+      log2("[persistent-session] perl not found \u2014 pane.log secret redaction disabled, falling back to cat");
+    }
+  }
+  if (paneRedactorPerlAvailable) {
+    try {
+      mkdirSync4(dirname4(PANE_REDACTOR_SCRIPT), { recursive: true });
+      const tmp = `${PANE_REDACTOR_SCRIPT}.${randomUUID()}.tmp`;
+      try {
+        writeFileSync4(tmp, buildRedactorProgram(), { encoding: "utf-8", mode: 448 });
+        chmodSync3(tmp, 448);
+        renameSync(tmp, PANE_REDACTOR_SCRIPT);
+      } catch (e) {
+        try {
+          rmSync3(tmp, { force: true });
+        } catch {
+        }
+        throw e;
+      }
+    } catch (err) {
+      log2(`[persistent-session] pane.log redactor install failed, using cat: ${err.message}`);
+      return buildPaneSinkCommand({ logPath, hasPerl: false, scriptPath: PANE_REDACTOR_SCRIPT });
+    }
+  }
+  return buildPaneSinkCommand({
+    logPath,
+    hasPerl: paneRedactorPerlAvailable === true,
+    scriptPath: PANE_REDACTOR_SCRIPT
+  });
+}
 function setupPaneLog2(tmuxSession, codeName, log2) {
   const logPath = paneLogPath(codeName);
   try {
@@ -3315,7 +3400,7 @@ function setupPaneLog2(tmuxSession, codeName, log2) {
       "utf-8"
     );
     execSync2(
-      `tmux pipe-pane -o -t ${tmuxSession} 'cat >> ${logPath.replace(/'/g, `'\\''`)}'`,
+      `tmux pipe-pane -o -t '${tmuxSession.replace(/'/g, `'\\''`)}' '${paneSinkCommand(logPath, log2).replace(/'/g, `'\\''`)}'`,
       { stdio: "ignore" }
     );
   } catch (err) {
@@ -4446,4 +4531,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-YAVWYI5S.js.map
+//# sourceMappingURL=chunk-7Y54PSMR.js.map