@stravica-ai/digital-operator-pa 0.1.57 → 0.1.59

package/dist/engineering-pa-cli/src/operator-attendance/cli.mjs

@@ -4,10 +4,10 @@
 //
 //   `pa-operator-attendance session-start`
 //     Wired into Claude Code's SessionStart hook. Computes the attendance
-//     stamp (TTY + env + no grant), persists it to a per-session cache,
-//     and emits a one-line `additionalContext` block carrying
-//     `operator-present: true|false[...]` for the loaded agent to read as
-//     the first line of its workState context.
+//     stamp (env + parent-process TTY + no grant), persists it to a
+//     per-session cache, and emits a one-line `additionalContext` block
+//     carrying `operator-present: true|false[...]` for the loaded agent
+//     to read as the first line of its workState context.
 //
 //   `pa-operator-attendance pre-tool-use`
 //     Wired into Claude Code's PreToolUse hook, matcher Bash + Edit +
@@ -31,10 +31,33 @@
 //
 // Zero dependencies beyond node stdlib and the shared grant module in
 // `@stravica-ai/engineering-pa-core/src/attendance/grant.mjs`.
+//
+// Attendance detection (0.1.58 fix for w-2026-10-02-dave-044, from Dex's
+// 0.1.57 review): the hook's own stdout is always a pipe (the client
+// reads the JSON envelope), so stdout.isTTY cannot discriminate. The
+// discriminator is the hook's PARENT process: in an attended session
+// the parent is the claude client attached to the operator's terminal
+// (ps reports a real tty, e.g. `ttys000`); in a `claude -p` worker or a
+// `claude --print` child the parent is a bash shell under a Bash tool
+// with no controlling tty (ps reports `??`). We therefore probe
+// `ps -o tty= -p <ppid>` and treat a non-empty, non-`?`/non-`??` result
+// as a real tty. On win32 ps is absent, so we fall back to the env var
+// alone and record `ttyProbe: 'unavailable'` on the stamp so the
+// limitation is visible in the decision log.
+//
+// Pattern un-anchoring and log redaction (0.1.58 fixes B and C): the
+// raw-claude and unattended-mutate regexes tolerate any number of
+// leading `NAME=value` (and `env NAME=value`) prefixes so a line like
+// `GITHUB_TOKEN=x gh pr create` still matches, and the Bash command is
+// run through `redactBashCommand` before it lands in the decision log,
+// stripping values of `NAME=value` prefixes, `Authorization:` header
+// values, `--token`/`token=` style arguments, and
+// `https://user:secret@` URL credentials.
 
 import { appendFile, mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { tmpdir } from 'node:os';
+import { spawnSync } from 'node:child_process';
 import {
   loadOrMintHostKey,
   verifyGrant,
@@ -60,8 +83,8 @@ Environment:
   PA_ATTENDANCE_LOG_DIR=/path/to/log/dir        override decision-log dir
 
 Decision log (observe mode): one JSONL line per would-deny at
-<logDir>/attendance-decisions.jsonl. Rejection log: a hostile grant lands
-at <logDir>/attendance-rejects.log.
+<logDir>/attendance-decisions.jsonl, with Bash commands redacted. A
+hostile grant lands at <logDir>/attendance-rejects.log.
 
 Usage:
   pa-operator-attendance session-start
@@ -69,37 +92,128 @@ Usage:
   pa-operator-attendance --help
 `;
 
-const RAW_CLAUDE_PATTERN = /^\s*claude(\s+[^-\s]|\s*$)/;
+// Env-prefix tolerance: zero or more `NAME=value` tokens (optionally
+// preceded by `env`) before the command word.
+const ENV_PREFIX = String.raw`(?:(?:env\s+)?[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*`;
+
+const RAW_CLAUDE_PATTERN = new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`claude(\s+[^-\s]|\s*$)`);
 
 // Bash commands denied for an unattended + no-grant session. Any line
 // matching one of these is a durable estate side effect: a commit, a
 // push, a write through the pa-family CLI, a redirect, a tee, an rm.
 // Read-only verbs (git status, git log, ls, cat, grep, etc.) are not
-// listed and pass through.
+// listed and pass through. Each pattern begins with `^\s*${ENV_PREFIX}`
+// so a leading `GITHUB_TOKEN=x` or `env NAME=value` does not bypass the
+// rule.
 const UNATTENDED_MUTATE_PATTERNS = [
-  /^\s*git\s+(commit|push|merge|rebase|cherry-pick|reset|checkout|branch|tag|stash|am|revert|pull)\b/,
-  /^\s*gh\s+(pr\s+(create|edit|merge|close|comment|review)|repo\s+(create|edit|delete|archive)|issue\s+(create|edit|close|comment)|release\s+(create|edit|delete)|workflow\s+(enable|disable|run)|secret\s+(set|remove))\b/,
-  /^\s*(pnpm\s+exec\s+)?pa\s+(work|project|library|relay|autonomy|content-pub|secrets|scheduler)\s+(?!(?:help|list|ls|get|show|view|status|tail|find|search|export|path|inspect|whoami|context|overview|today|related|domain|orphans|read|print))/,
-  /^\s*(pnpm\s+exec\s+)?library\s+(put|flush|refresh-clones|up-merge)\b/,
-  /^\s*(pnpm\s+exec\s+)?claude-relay\s+(send|publish|post)\b/,
-  /^\s*rm\b/,
-  /^\s*mv\b/,
-  /^\s*cp\b/,
-  /^\s*mkdir\b/,
-  /^\s*touch\b/,
-  /^\s*(ln|chmod|chown)\b/,
-  /^\s*(tee|dd)\b/,
-  /^\s*(apt|apt-get|brew|npm|pnpm|yarn)\s+(install|add|remove|uninstall|upgrade|update|publish)\b/,
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`git\s+(commit|push|merge|rebase|cherry-pick|reset|checkout|branch|tag|stash|am|revert|pull)\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`gh\s+(pr\s+(create|edit|merge|close|comment|review)|repo\s+(create|edit|delete|archive)|issue\s+(create|edit|close|comment)|release\s+(create|edit|delete)|workflow\s+(enable|disable|run)|secret\s+(set|remove))\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`(pnpm\s+exec\s+)?pa\s+(work|project|library|relay|autonomy|content-pub|secrets|scheduler)\s+(?!(?:help|list|ls|get|show|view|status|tail|find|search|export|path|inspect|whoami|context|overview|today|related|domain|orphans|read|print))`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`(pnpm\s+exec\s+)?library\s+(put|flush|refresh-clones|up-merge)\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`(pnpm\s+exec\s+)?claude-relay\s+(send|publish|post)\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`rm\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`mv\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`cp\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`mkdir\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`touch\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`(ln|chmod|chown)\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`(tee|dd)\b`),
+  new RegExp(String.raw`^\s*` + ENV_PREFIX + String.raw`(apt|apt-get|brew|npm|pnpm|yarn)\s+(install|add|remove|uninstall|upgrade|update|publish)\b`),
   /[^<>]>\s*\S/,  // `foo > bar`, `foo 2> bar`: any single-redirect write
   />>\s*\S/,       // append redirect
 ];
 
+// Default TTY probe: ask `ps` for the controlling TTY of the hook's
+// parent process. Returns `null` on no-tty (`??` / `?` / empty) or
+// probe error, a non-empty TTY name (e.g. `ttys000`, `pts/0`) when the
+// parent has one, and `'unavailable'` on win32 (where `ps` is absent).
+// Fail-safe: any error path returns `null` so the detection drops to
+// "unattended", which never grants writes it should not.
+function defaultTtyProbe({ ppid, platform }) {
+  if (platform === 'win32') return 'unavailable';
+  if (!Number.isInteger(ppid) || ppid <= 0) return null;
+  try {
+    const result = spawnSync('ps', ['-o', 'tty=', '-p', String(ppid)], {
+      encoding: 'utf8',
+      timeout: 2000,
+    });
+    if (result.error || result.status !== 0) return null;
+    const tty = (result.stdout || '').trim();
+    if (!tty || tty === '?' || tty === '??') return null;
+    return tty;
+  } catch {
+    return null;
+  }
+}
+
+// Resolve the detection: returns { attended, parentTty, envAttended,
+// grantPresent }. The attended gate is positive-proof: env === '1' AND
+// a real controlling TTY on the parent process AND no grant. On a
+// platform where the TTY probe is unavailable (win32), fall back to the
+// env var alone so a Windows operator can still mark the session
+// attended; the stamp records `ttyProbe: 'unavailable'` so the
+// limitation is visible in the decision log.
+function resolveAttendance({ env, ttyProbe, platform, ppid }) {
+  const envAttended = env.CLAUDE_CODE_SESSION_ATTENDED === '1';
+  const grantPresent = typeof env.PA_WORKER_GRANT === 'string' && env.PA_WORKER_GRANT.length > 0;
+  const parentTty = ttyProbe({ ppid, platform, env });
+  let attended;
+  if (parentTty === 'unavailable') {
+    attended = envAttended && !grantPresent;
+  } else {
+    attended = envAttended && typeof parentTty === 'string' && parentTty.length > 0 && !grantPresent;
+  }
+  return { attended, parentTty, envAttended, grantPresent };
+}
+
+// Redact a Bash command before writing it into the decision log or any
+// stderr trace line. Values redacted:
+//   1. `NAME=value` and `env NAME=value` prefixes (and inline forms):
+//      the key is kept, the value is replaced with `<redacted>`.
+//   2. `Authorization: Bearer ...` and `Authorization: ...` header
+//      values.
+//   3. `--token <x>`, `--token=<x>`, `token=<x>` argument-borne tokens.
+//   4. `https://user:secret@host` URL credentials: user kept, secret
+//      replaced.
+export function redactBashCommand(cmd) {
+  if (typeof cmd !== 'string') return cmd;
+  let out = cmd;
+  // user:secret@host URL credential (do this BEFORE the KEY=VALUE pass
+  // so the scheme:// does not accidentally feed the key regex).
+  out = out.replace(/(https?:\/\/[^:/\s@]+):([^@\s'"`]+)@/gi, '$1:<redacted>@');
+  // Authorization header value (any scheme: Bearer, token, Basic,
+  // Digest, or an unknown word; and the raw-value no-scheme form). Three
+  // passes handle the single-quoted, double-quoted, and unquoted header
+  // forms. The quoted passes consume up to the closing quote so secrets
+  // that contain whitespace or inner punctuation (token schemes, Basic
+  // base64, Digest comma-separated field lists with inner "quoted"
+  // fields) never leak past the scheme word. 0.1.58 only redacted the
+  // scheme word for non-Bearer schemes, so `Authorization: token <x>`
+  // landed in the log as `Authorization: <redacted> <x>` (Dex's 0.1.58
+  // verification). 0.1.59 extends the redaction to the full header
+  // value.
+  out = out.replace(/'([^'\n]*?Authorization\s*:\s*)[^'\n]+(?=')/gi, (_m, pre) => `'${pre}<redacted>`);
+  out = out.replace(/"([^"\n]*?Authorization\s*:\s*)[^"\n]+(?=")/gi, (_m, pre) => `"${pre}<redacted>`);
+  out = out.replace(/(Authorization\s*:\s*)[^\s'"`,;)]+(?:\s+[^\s'"`,;)]+)?/gi, '$1<redacted>');
+  // --token / --token=  and  token=
+  out = out.replace(/(--?token[\s=]+)([^\s'"`;)]+)/gi, '$1<redacted>');
+  // NAME=value (env-style). Match a word boundary that is not preceded
+  // by `-` or `=` so `--foo=bar` and `=key=val` do not re-match the
+  // trailing key.
+  out = out.replace(/(^|[\s;&|`(])((?:env\s+)?)([A-Za-z_][A-Za-z0-9_]*)=([^\s'"`]+)/g,
+    (_m, lead, envWord, key, _val) => `${lead}${envWord}${key}=<redacted>`);
+  return out;
+}
+
 export async function main(argv = [], {
   stdin = process.stdin,
   stdout = process.stdout,
   stderr = process.stderr,
   env = process.env,
   now = () => new Date(),
+  ttyProbe = defaultTtyProbe,
+  platform = process.platform,
+  ppid = process.ppid,
 } = {}) {
   if (argv.includes('-h') || argv.includes('--help')) {
     stderr.write(USAGE);
@@ -112,10 +226,10 @@ export async function main(argv = [], {
   }
   try {
     if (sub === 'session-start') {
-      return await runSessionStart({ stdin, stdout, stderr, env, now });
+      return await runSessionStart({ stdin, stdout, stderr, env, now, ttyProbe, platform, ppid });
     }
     if (sub === 'pre-tool-use') {
-      return await runPreToolUse({ stdin, stdout, stderr, env, now });
+      return await runPreToolUse({ stdin, stdout, stderr, env, now, ttyProbe, platform, ppid });
     }
     stderr.write(`pa-operator-attendance: unknown subcommand "${sub}"\n`);
     return 1;
@@ -131,25 +245,13 @@ export async function main(argv = [], {
 
 // --- session-start ---------------------------------------------------------
 
-async function runSessionStart({ stdin, stdout, stderr, env, now }) {
+async function runSessionStart({ stdin, stdout, stderr, env, now, ttyProbe, platform, ppid }) {
   const payload = await readPayload(stdin);
   // SessionStart has no required fields we gate on; we still parse it so
   // a payload with `session_id` can key the cache properly.
   const sessionId = (payload && payload.session_id) || env.CLAUDE_CODE_SESSION_ID || 'unknown';
 
-  // Attendance detection. The empirical probe for w-2026-10-02-dave-018
-  // (session-start leg) proved against client 2.1.287 that:
-  //   - a `claude -p` child always sees CLAUDE_CODE_SESSION_ATTENDED=0
-  //     (not unset; the client zeroes it explicitly)
-  //   - a SessionStart hook fired by a `claude -p` child sees both
-  //     stdin and stdout as non-TTY
-  // So the positive-proof gate is: stdout.isTTY AND env === '1' AND no
-  // grant. Any other combination is unattended, which is the fail-safe
-  // direction (a client bump that strips the var defaults to absent).
-  const grantPresent = typeof env.PA_WORKER_GRANT === 'string' && env.PA_WORKER_GRANT.length > 0;
-  const envAttended = env.CLAUDE_CODE_SESSION_ATTENDED === '1';
-  const stdoutIsTty = Boolean(stdout.isTTY);
-  const attended = stdoutIsTty && envAttended && !grantPresent;
+  const { attended, parentTty, envAttended, grantPresent } = resolveAttendance({ env, ttyProbe, platform, ppid });
 
   let stamp;
   if (attended) {
@@ -209,7 +311,7 @@ async function runSessionStart({ stdin, stdout, stderr, env, now }) {
     decision: 'stamp',
     stamp,
     sessionId,
-    attendedSignals: { stdoutIsTty, envAttended, grantPresent },
+    attendedSignals: { parentTty, envAttended, grantPresent, platform },
   });
   return 0;
 }
@@ -224,7 +326,7 @@ function formatStampLine(stamp) {
 
 // --- pre-tool-use ----------------------------------------------------------
 
-async function runPreToolUse({ stdin, stdout, stderr, env, now }) {
+async function runPreToolUse({ stdin, stdout, stderr, env, now, ttyProbe, platform, ppid }) {
   const mode = env.PA_OPERATOR_ATTENDANCE_MODE === 'enforce' ? 'enforce' : 'observe';
   let payload;
   try {
@@ -240,7 +342,7 @@ async function runPreToolUse({ stdin, stdout, stderr, env, now }) {
     return 1;
   }
   const sessionId = (payload && payload.session_id) || env.CLAUDE_CODE_SESSION_ID || 'unknown';
-  const stamp = await readStamp({ env, sessionId }) || recomputeStamp(env);
+  const stamp = await readStamp({ env, sessionId }) || recomputeStamp({ env, ttyProbe, platform, ppid });
 
   const bashCommand = toolName === 'Bash' && typeof toolInput.command === 'string'
     ? toolInput.command
@@ -250,7 +352,8 @@ async function runPreToolUse({ stdin, stdout, stderr, env, now }) {
   // The flag-only forms (`claude --help`, `claude --version`, `claude -v`,
   // `claude -h`) pass; everything else (`claude help foo`, `claude -p`,
   // `claude mcp list`, bare `claude`) is a session launch and must go
-  // through the launcher.
+  // through the launcher. Leading `NAME=value` prefixes do not bypass
+  // the rule (0.1.58 fix B).
   if (bashCommand) {
     for (const line of bashCommand.split('\n')) {
       if (RAW_CLAUDE_PATTERN.test(line)) {
@@ -299,7 +402,7 @@ async function runPreToolUse({ stdin, stdout, stderr, env, now }) {
   return 0;
 }
 
-function recomputeStamp(env) {
+function recomputeStamp({ env, ttyProbe, platform, ppid }) {
   // Fallback when the session-start cache is missing (hook ordering, cold
   // start). Mirror the session-start detection without the key material,
   // which means a grant that LOOKS valid shape-wise is treated as
@@ -307,24 +410,24 @@ function recomputeStamp(env) {
   // closed if session-start's richer stamp was lost, but it does not
   // fabricate a verdict it does not have evidence for.
   const grantPresent = typeof env.PA_WORKER_GRANT === 'string' && env.PA_WORKER_GRANT.length > 0;
-  const envAttended = env.CLAUDE_CODE_SESSION_ATTENDED === '1';
-  // In the pre-tool-use leg, stdout is always the hook pipe, so TTY check
-  // alone is unreliable. Trust the env signal only when there is no grant.
   if (grantPresent) return { operatorPresent: false, grant: 'present', scope: 'dispatch-only' };
-  if (envAttended) return { operatorPresent: true, grant: 'none', scope: 'attended' };
-  return { operatorPresent: false, grant: 'none', scope: 'refusal', refusal: 'no stamp cache, env signals absent' };
+  const { attended } = resolveAttendance({ env, ttyProbe, platform, ppid });
+  if (attended) return { operatorPresent: true, grant: 'none', scope: 'attended' };
+  return { operatorPresent: false, grant: 'none', scope: 'refusal', refusal: 'no stamp cache, env/parent-tty signals absent' };
 }
 
 async function denyOrObserve({ env, now, mode, stdout, stderr, sessionId, toolName, bashCommand, stamp, rule, matched, message }) {
+  const safeBashCommand = bashCommand == null ? null : redactBashCommand(bashCommand);
+  const safeMatched = typeof matched === 'string' ? redactBashCommand(matched) : matched;
   await appendDecisionLog({
     env,
     now: now(),
     leg: 'pre-tool-use',
     decision: mode === 'enforce' ? 'deny' : 'observe',
     rule,
-    matched,
+    matched: safeMatched,
     toolName,
-    bashCommand,
+    bashCommand: safeBashCommand,
     stamp,
     sessionId,
     mode,
@@ -335,7 +438,9 @@ async function denyOrObserve({ env, now, mode, stdout, stderr, sessionId, toolNa
   }
   // Observe mode: write a one-line stderr note so the operator can see
   // what would have been denied without the tool call being blocked.
-  stderr.write(`pa-operator-attendance: OBSERVE would deny (${rule}: ${matched})\n`);
+  // The matched text is redacted so a secret-bearing command does not
+  // leak into stderr either.
+  stderr.write(`pa-operator-attendance: OBSERVE would deny (${rule}: ${safeMatched})\n`);
   return 0;
 }
 

package/dist/engineering-pa-core/knowledge/delegation-dispatch/dispatch-envelope.md

@@ -212,9 +212,9 @@ The stamp is produced by `pa-operator-attendance session-start` (a Claude Code S
 
 A dispatch that genuinely needs its own child session goes through `pa-worker-launcher`, which mints the signed grant, strips the attended envelope, and spawns `claude --print` with `--setting-sources user` from a neutral cwd. Workers never invoke `claude` directly from Bash: the coordinator-hook deny plus the attendance pre-tool-use leg catch both.
 
-Rollout is observe-mode by default for one point release: every would-deny lands as a JSONL line under `~/.local/share/pa/attendance-decisions.jsonl` but the tool call proceeds, so operators can inspect the gate's behaviour on real traffic before `PA_OPERATOR_ATTENDANCE_MODE=enforce` becomes the shipped default. Attendance detection is positive-proof: `stdout.isTTY && CLAUDE_CODE_SESSION_ATTENDED === '1' && !PA_WORKER_GRANT`. Any other combination is unattended, which is the fail-safe direction. A client bump that strips the env var defaults the gate to "unattended" and surfaces loudly rather than silently failing open.
+Rollout is observe-mode by default for one point release: every would-deny lands as a JSONL line under `~/.local/share/pa/attendance-decisions.jsonl` (with Bash commands redacted so argument-borne tokens, Authorization headers and URL credentials never land in the log) but the tool call proceeds, so operators can inspect the gate's behaviour on real traffic before `PA_OPERATOR_ATTENDANCE_MODE=enforce` becomes the shipped default. Attendance detection is positive-proof: `CLAUDE_CODE_SESSION_ATTENDED === '1' && parentHasControllingTty && !PA_WORKER_GRANT`. The hook's own stdout is always a pipe (the client reads the JSON envelope), so the discriminator is the hook's PARENT process: in an attended session the parent is the claude client attached to the operator's terminal; in a `claude -p` worker or any Bash-tool child the parent is a bash shell with no controlling tty. We probe `ps -o tty= -p <ppid>` on POSIX and treat a non-empty, non-`?`/non-`??` result as a real tty; on win32 we fall back to the env var alone and record `parentTty: 'unavailable'` on the stamp. Any other combination is unattended, which is the fail-safe direction. A client bump that strips the env var defaults the gate to "unattended" and surfaces loudly rather than silently failing open.
 
-Reference: `packages/cli/src/operator-attendance/cli.mjs`, `packages/cli/src/worker-launcher/cli.mjs`, `packages/core/src/attendance/grant.mjs`. Rationale and incident: `w-2026-10-02-dave-016` (review), `w-2026-10-02-dave-018` (build).
+Reference: `packages/cli/src/operator-attendance/cli.mjs`, `packages/cli/src/worker-launcher/cli.mjs`, `packages/core/src/attendance/grant.mjs`. Rationale and incidents: `w-2026-10-02-dave-016` (review), `w-2026-10-02-dave-018` (build), `w-2026-10-02-dave-044` (0.1.58 detection + pattern + redaction fix, from Dex's 0.1.57 review).
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.57",
+  "version": "0.1.59",
   "description": "Digital Operator PA: single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",