@love-moon/conductor-cli 0.7.5 → 0.7.7

package/src/entity-helpers.js

@@ -15,12 +15,12 @@
  */
 
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 
 import { envForExplicitConfigFile } from "./config-env.js";
+import { resolveConductorConfigPath } from "./conductor-paths.js";
 
 // RFC §4 exit codes
 export const EXIT = {
@@ -50,14 +50,8 @@ export function getCliVersion() {
   return cachedPkgVersion;
 }
 
-const DEFAULT_CONFIG_PATH = path.join(os.homedir(), ".conductor", "config.yaml");
-
 export function resolveConfigPath(configFile, env = process.env) {
-  if (configFile) {
-    return path.resolve(configFile);
-  }
-  const home = env.HOME || env.USERPROFILE || os.homedir();
-  return path.join(home, ".conductor", "config.yaml");
+  return resolveConductorConfigPath(configFile, env);
 }
 
 /**

package/src/fire/resume.js

@@ -1,6 +1,5 @@
 import crypto from "node:crypto";
 import { promises as fsp } from "node:fs";
-import os from "node:os";
 import path from "node:path";
 
 import yaml from "js-yaml";
@@ -19,6 +18,7 @@ import {
   normalizeRuntimeBackendAlias,
   resolveConfiguredRuntimeBackend,
 } from "../runtime-backends.js";
+import { resolveConductorConfigPath, resolveConductorHome } from "../conductor-paths.js";
 
 function normalizeBackend(backend) {
   return String(backend || "").trim().toLowerCase();
@@ -28,23 +28,23 @@ function normalizeSessionId(sessionId) {
   return typeof sessionId === "string" ? sessionId.trim() : "";
 }
 
-function resolveHomeDir(options) {
-  if (options?.homeDir) {
-    return options.homeDir;
+function resolveConductorStorageDir(options = {}) {
+  if (typeof options.conductorHome === "string" && options.conductorHome.trim()) {
+    return path.resolve(options.conductorHome.trim());
   }
-  return os.homedir();
+  const env = options.env || process.env;
+  if (typeof options.homeDir === "string" && options.homeDir.trim()) {
+    return resolveConductorHome(env, { userHome: options.homeDir.trim() });
+  }
+  return resolveConductorHome(env);
 }
 
 function resolveConfigFilePath(options = {}) {
-  const configuredPath =
-    typeof options?.configFilePath === "string" && options.configFilePath.trim()
-      ? options.configFilePath.trim()
-      : typeof process.env.CONDUCTOR_CONFIG === "string" && process.env.CONDUCTOR_CONFIG.trim()
-        ? process.env.CONDUCTOR_CONFIG.trim()
-        : "";
-  return configuredPath
-    ? path.resolve(configuredPath)
-    : path.join(resolveHomeDir(options), ".conductor", "config.yaml");
+  const env = options.env || process.env;
+  if (typeof options.homeDir === "string" && options.homeDir.trim() && !env.CONDUCTOR_HOME) {
+    return resolveConductorConfigPath(options.configFilePath, env, { userHome: options.homeDir.trim() });
+  }
+  return resolveConductorConfigPath(options.configFilePath, env);
 }
 
 function normalizeProjectPathCandidate(value) {
@@ -93,10 +93,10 @@ function md5Hex(value) {
 }
 
 async function loadConductorSessionRecords(options = {}) {
-  const homeDir = resolveHomeDir(options);
+  const conductorHome = resolveConductorStorageDir(options);
   const defaultPaths = [
-    path.join(homeDir, ".conductor", "session.yaml"),
-    path.join(homeDir, ".conductor", "sessions"),
+    path.join(conductorHome, "session.yaml"),
+    path.join(conductorHome, "sessions"),
   ];
   const recordFiles = [];
   const pushFile = (filePath) => {

package/src/handoff-log-mask.js

@@ -23,6 +23,49 @@ export function maskHandoffUrlForLogs(value) {
   });
 }
 
+// Secrets other than the handoff token can reach the same log/summary surface
+// once we start capturing a crashing child's output: the daemon puts
+// `CONDUCTOR_AGENT_TOKEN` into the fire's environment AND into tmux's argv
+// (`-e CONDUCTOR_AGENT_TOKEN=…`), and the fire inherits provider keys such as
+// ANTHROPIC_API_KEY / OPENAI_API_KEY. Backends routinely echo those back when
+// they fail ("invalid API key sk-ant-…", usage dumps, env dumps).
+//
+// A single-pattern denylist is the wrong shape for that, so this is a
+// redaction *pass*: exact known secret values first (the strongest signal —
+// the daemon holds its own token at runtime), then structural patterns.
+const SECRET_ASSIGNMENT_RE =
+  /\b([A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL)[A-Z0-9_]*)\s*[=:]\s*("[^"]*"|'[^']*'|\S+)/gi;
+const BEARER_RE = /\b(Bearer|Basic)\s+([A-Za-z0-9._~+/=-]{8,})/gi;
+// Provider key shapes (OpenAI/Anthropic `sk-…`, Google `AIza…`, GitHub `ghp_…`).
+const PROVIDER_KEY_RE = /\b(sk-[A-Za-z0-9_-]{12,}|AIza[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{16,})\b/g;
+
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * Redact secrets from text that is about to be logged or persisted into a task
+ * status summary.
+ *
+ * @param {string} value
+ * @param {string[]} [knownSecrets] exact literal values to strip (e.g. the
+ *   daemon's own AGENT_TOKEN). Short values are ignored so a 1-2 char token
+ *   cannot blank out the whole message.
+ */
+export function redactSecretsForLogs(value, knownSecrets = []) {
+  if (typeof value !== "string" || !value) {
+    return value;
+  }
+  let out = maskHandoffUrlForLogs(value);
+  for (const secret of knownSecrets) {
+    if (typeof secret === "string" && secret.length >= 8) {
+      out = out.replace(new RegExp(escapeRegExp(secret), "g"), "<redacted>");
+    }
+  }
+  out = out.replace(SECRET_ASSIGNMENT_RE, (_, key) => `${key}=<redacted>`);
+  out = out.replace(BEARER_RE, (_, scheme) => `${scheme} <redacted>`);
+  out = out.replace(PROVIDER_KEY_RE, "<redacted>");
+  return out;
+}
+
 // Scrub any handoff URL embedded in an error message before surfacing it via
 // logs or task status summaries. Belt-and-suspenders for the case where an
 // internal error stringifies the outbox payload.

package/src/runtime-backends.js

@@ -4,6 +4,7 @@ import { pathToFileURL } from "node:url";
 
 import yaml from "js-yaml";
 import { BUILT_IN_BACKENDS as AI_SDK_BUILT_IN_BACKENDS } from "@love-moon/ai-sdk";
+import { resolveConductorConfigPath } from "./conductor-paths.js";
 
 // CLI display order for built-in backends. ai-sdk owns the canonical set of
 // built-in backends; CLI just picks an ordering for "Supported Backends:" log
@@ -349,10 +350,7 @@ export function isCommandOptionalBuiltInRuntimeBackend(backend) {
 }
 
 function readConfigEnvValue(configFilePath, key) {
-  const targetPath =
-    typeof configFilePath === "string" && configFilePath.trim()
-      ? path.resolve(configFilePath.trim())
-      : path.join(process.env.HOME || "", ".conductor", "config.yaml");
+  const targetPath = resolveConductorConfigPath(configFilePath);
   try {
     if (!targetPath || !fs.existsSync(targetPath)) {
       return "";

package/src/serve-ai/config.js

@@ -1,24 +1,18 @@
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
 
 import yaml from "js-yaml";
+import { resolveConductorConfigPath } from "../conductor-paths.js";
 
 export const DEFAULT_CONDUCTOR_CONFIG_BASENAME = "config.yaml";
 export const DEFAULT_SERVE_AI_CONFIG_BASENAME = "config-ai-serve.yaml";
 
-function resolvePrimaryConfigPath(configFilePath) {
-  if (typeof configFilePath === "string" && configFilePath.trim()) {
-    return path.resolve(configFilePath.trim());
-  }
-  if (typeof process.env.CONDUCTOR_CONFIG === "string" && process.env.CONDUCTOR_CONFIG.trim()) {
-    return path.resolve(process.env.CONDUCTOR_CONFIG.trim());
-  }
-  return path.join(os.homedir(), ".conductor", DEFAULT_CONDUCTOR_CONFIG_BASENAME);
+function resolvePrimaryConfigPath(configFilePath, env = process.env) {
+  return resolveConductorConfigPath(configFilePath, env);
 }
 
-export function resolveServeAiConfigPaths(configFilePath) {
-  const conductorConfigPath = resolvePrimaryConfigPath(configFilePath);
+export function resolveServeAiConfigPaths(configFilePath, env = process.env) {
+  const conductorConfigPath = resolvePrimaryConfigPath(configFilePath, env);
   return {
     conductorConfigPath,
     serveAiConfigPath: path.join(path.dirname(conductorConfigPath), DEFAULT_SERVE_AI_CONFIG_BASENAME),
@@ -37,8 +31,8 @@ function parseYamlFile(filePath) {
   return parsed;
 }
 
-export function loadServeAiRuntimeConfig(configFilePath) {
-  const { conductorConfigPath, serveAiConfigPath } = resolveServeAiConfigPaths(configFilePath);
+export function loadServeAiRuntimeConfig(configFilePath, env = process.env) {
+  const { conductorConfigPath, serveAiConfigPath } = resolveServeAiConfigPaths(configFilePath, env);
   const conductorExists = fs.existsSync(conductorConfigPath);
   const serveAiExists = fs.existsSync(serveAiConfigPath);