@love-moon/conductor-cli 0.7.6 → 0.8.0

package/src/entity-helpers.js

@@ -192,8 +192,14 @@ export async function resolveProject(apis, options = {}) {
   if (!apis.projects || typeof apis.projects.resolveProject !== "function") {
     throw new Error("ProjectsApi.resolveProject is not available in conductor-sdk");
   }
+  const explicitProject = String(options.project ?? "").trim();
+  if (explicitProject) {
+    if (typeof apis.projects.getProject !== "function") {
+      throw new Error("ProjectsApi.getProject is not available in conductor-sdk");
+    }
+    return apis.projects.getProject(explicitProject);
+  }
   return apis.projects.resolveProject({
-    project: options.project,
     env: options.env || process.env,
     cwd: options.cwd || process.cwd(),
   });
@@ -332,11 +338,30 @@ export function emitDryRun(stream, json, payload) {
   }
 }
 
+/**
+ * Pull a human-readable reason out of a backend error payload. Backend routes
+ * respond with `{ error }` (occasionally `{ message }`), which the SDK attaches
+ * to BackendApiError.details. Surfacing it turns an opaque "Backend responded
+ * with 409" into the actual cause (e.g. "Project daemon X is offline").
+ */
+function backendErrorDetail(error) {
+  const details = error && typeof error === "object" ? error.details : null;
+  if (!details) return null;
+  if (typeof details === "string") return details.trim() || null;
+  if (typeof details === "object") {
+    const reason = details.error ?? details.message;
+    if (typeof reason === "string" && reason.trim()) return reason.trim();
+  }
+  return null;
+}
+
 /**
  * Translate an unknown error into a printable + exit-coded form.
  */
 export function reportError(consoleErr, error) {
   const message = error instanceof Error ? error.message : String(error);
-  consoleErr.error(`Error: ${message}`);
+  const detail = backendErrorDetail(error);
+  const line = detail && detail !== message ? `${message}: ${detail}` : message;
+  consoleErr.error(`Error: ${line}`);
   return exitCodeForError(error);
 }

package/src/handoff-log-mask.js

@@ -23,6 +23,49 @@ export function maskHandoffUrlForLogs(value) {
   });
 }
 
+// Secrets other than the handoff token can reach the same log/summary surface
+// once we start capturing a crashing child's output: the daemon puts
+// `CONDUCTOR_AGENT_TOKEN` into the fire's environment AND into tmux's argv
+// (`-e CONDUCTOR_AGENT_TOKEN=…`), and the fire inherits provider keys such as
+// ANTHROPIC_API_KEY / OPENAI_API_KEY. Backends routinely echo those back when
+// they fail ("invalid API key sk-ant-…", usage dumps, env dumps).
+//
+// A single-pattern denylist is the wrong shape for that, so this is a
+// redaction *pass*: exact known secret values first (the strongest signal —
+// the daemon holds its own token at runtime), then structural patterns.
+const SECRET_ASSIGNMENT_RE =
+  /\b([A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL)[A-Z0-9_]*)\s*[=:]\s*("[^"]*"|'[^']*'|\S+)/gi;
+const BEARER_RE = /\b(Bearer|Basic)\s+([A-Za-z0-9._~+/=-]{8,})/gi;
+// Provider key shapes (OpenAI/Anthropic `sk-…`, Google `AIza…`, GitHub `ghp_…`).
+const PROVIDER_KEY_RE = /\b(sk-[A-Za-z0-9_-]{12,}|AIza[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{16,})\b/g;
+
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * Redact secrets from text that is about to be logged or persisted into a task
+ * status summary.
+ *
+ * @param {string} value
+ * @param {string[]} [knownSecrets] exact literal values to strip (e.g. the
+ *   daemon's own AGENT_TOKEN). Short values are ignored so a 1-2 char token
+ *   cannot blank out the whole message.
+ */
+export function redactSecretsForLogs(value, knownSecrets = []) {
+  if (typeof value !== "string" || !value) {
+    return value;
+  }
+  let out = maskHandoffUrlForLogs(value);
+  for (const secret of knownSecrets) {
+    if (typeof secret === "string" && secret.length >= 8) {
+      out = out.replace(new RegExp(escapeRegExp(secret), "g"), "<redacted>");
+    }
+  }
+  out = out.replace(SECRET_ASSIGNMENT_RE, (_, key) => `${key}=<redacted>`);
+  out = out.replace(BEARER_RE, (_, scheme) => `${scheme} <redacted>`);
+  out = out.replace(PROVIDER_KEY_RE, "<redacted>");
+  return out;
+}
+
 // Scrub any handoff URL embedded in an error message before surfacing it via
 // logs or task status summaries. Belt-and-suspenders for the case where an
 // internal error stringifies the outbox payload.