@rallycry/conveyor-agent 10.6.0 → 10.6.1

package/dist/{chunk-5FRDOFI4.js → chunk-5ELLQUP4.js}

@@ -2308,6 +2308,9 @@ var SpawnTaskSessionRequestSchema = z.object({
   taskId: z.string(),
   kind: z.enum(["tui", "shell"])
 });
+var SpawnTaskReviewRequestSchema = z.object({
+  taskId: z.string()
+});
 var ReportSessionSpawnFailureRequestSchema = z.object({
   sessionId: z.string(),
   spawnedSessionId: z.string(),
@@ -4117,11 +4120,16 @@ async function readRaw(path4) {
   }
 }
 async function ensureClaudeCredentials(env = process.env) {
+  const isCloud = isConveyorCloudEnv(env);
+  const token = env.CLAUDE_CODE_OAUTH_TOKEN;
+  if (isCloud && token) {
+    await sanitizeApprovedApiKeys(token);
+  }
   try {
     const path4 = claudeCredentialsPath();
     const plan = planCredentialsWrite({
-      isCloud: isConveyorCloudEnv(env),
-      token: env.CLAUDE_CODE_OAUTH_TOKEN,
+      isCloud,
+      token,
       existingRaw: await readRaw(path4),
       now: Date.now()
     });
@@ -4136,6 +4144,40 @@ async function ensureClaudeCredentials(env = process.env) {
 `);
   }
 }
+function apiKeyApprovalSuffix(token) {
+  return token.slice(-20);
+}
+function planApprovedApiKeyCleanup(existingRaw, oauthToken) {
+  if (!oauthToken) return null;
+  const config = parseClaudeJson(existingRaw);
+  const responses = config.customApiKeyResponses;
+  if (typeof responses !== "object" || responses === null || Array.isArray(responses)) {
+    return null;
+  }
+  const record = responses;
+  const approved = record.approved;
+  if (!Array.isArray(approved)) return null;
+  const suffix = apiKeyApprovalSuffix(oauthToken);
+  const filtered = approved.filter((entry) => entry !== suffix);
+  if (filtered.length === approved.length) return null;
+  record.approved = filtered;
+  return JSON.stringify(config);
+}
+async function sanitizeApprovedApiKeys(oauthToken) {
+  try {
+    const path4 = claudeJsonPath();
+    const cleaned = planApprovedApiKeyCleanup(await readRaw(path4), oauthToken);
+    if (cleaned === null) return;
+    await writeFile4(path4, cleaned, "utf8");
+    process.stderr.write(
+      "[conveyor-agent] removed poisoned customApiKeyResponses.approved entry from .claude.json\n"
+    );
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[conveyor-agent] claude approved-key sanitize failed: ${message}
+`);
+  }
+}
 function claudeJsonPath() {
   const configDir = process.env.CLAUDE_CONFIG_DIR;
   return configDir ? join3(configDir, ".claude.json") : join3(homedir2(), ".claude.json");
@@ -4255,7 +4297,10 @@ function resolvePlanDialogTiming() {
   return {
     firstPressMs: envMs("CONVEYOR_PTY_PLAN_DIALOG_FIRST_PRESS_MS", PLAN_DIALOG_FIRST_PRESS_MS),
     intervalMs: envMs("CONVEYOR_PTY_PLAN_DIALOG_INTERVAL_MS", PLAN_DIALOG_INTERVAL_MS),
-    slowIntervalMs: envMs("CONVEYOR_PTY_PLAN_DIALOG_SLOW_INTERVAL_MS", PLAN_DIALOG_SLOW_INTERVAL_MS),
+    slowIntervalMs: envMs(
+      "CONVEYOR_PTY_PLAN_DIALOG_SLOW_INTERVAL_MS",
+      PLAN_DIALOG_SLOW_INTERVAL_MS
+    ),
     fastWindowMs: envMs("CONVEYOR_PTY_PLAN_DIALOG_FAST_WINDOW_MS", PLAN_DIALOG_FAST_WINDOW_MS),
     windowMs: envMs("CONVEYOR_PTY_PLAN_DIALOG_WINDOW_MS", PLAN_DIALOG_WINDOW_MS)
   };
@@ -4289,6 +4334,9 @@ function inheritedEnv(socketPath) {
   for (const [key, value] of Object.entries(process.env)) {
     if (typeof value === "string") env[key] = value;
   }
+  if (env.CLAUDE_CODE_OAUTH_TOKEN) {
+    delete env.ANTHROPIC_API_KEY;
+  }
   if (socketPath) {
     env.CONVEYOR_HOOK_SOCKET = socketPath;
   }
@@ -11149,4 +11197,4 @@ export {
   runStartCommand,
   unshallowRepo
 };
-//# sourceMappingURL=chunk-5FRDOFI4.js.map
+//# sourceMappingURL=chunk-5ELLQUP4.js.map