@team-agent/installer 0.5.46 → 0.5.47

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.46"
+version = "0.5.47"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.46"
+version = "0.5.47"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/emit.rs

@@ -11,16 +11,22 @@ use std::io::Write as _;
 pub fn emit(output: &CmdOutput, as_json: bool) -> Option<String> {
     match output {
         CmdOutput::None => None,
-        CmdOutput::Human(text) => Some(text.clone()),
-        CmdOutput::Json(value) if as_json => serde_json::to_string_pretty(&sort_json(value)).ok(),
-        CmdOutput::Json(Value::Object(obj)) => {
-            let lines: Vec<String> = obj
-                .iter()
-                .map(|(key, value)| format!("{key}: {}", human_value(value)))
-                .collect();
-            Some(lines.join("\n"))
+        CmdOutput::Human(text) => Some(crate::redaction::redact_external_text(text)),
+        CmdOutput::Json(value) => {
+            let value = crate::redaction::redact_external_value(value);
+            if as_json {
+                return serde_json::to_string_pretty(&sort_json(&value)).ok();
+            }
+            if let Value::Object(obj) = value {
+                let lines: Vec<String> = obj
+                    .iter()
+                    .map(|(key, value)| format!("{key}: {}", human_value(value)))
+                    .collect();
+                Some(lines.join("\n"))
+            } else {
+                Some(human_value(&value))
+            }
         }
-        CmdOutput::Json(value) => Some(human_value(value)),
     }
 }
 
@@ -620,8 +626,24 @@ fn emit_cli_error(command: &str, args: &[String], cwd: &Path, error: &CliError)
     }
     let normalized = normalize_cli_error(error);
     let payload_error = normalized.as_ref().unwrap_or(error);
-    let _ = std::fs::write(&log_path, format!("{payload_error}\n"));
-    let payload = payload_error.to_payload(&log_path, command);
+    let safe_error = crate::redaction::redact_external_text(&payload_error.to_string());
+    let _ = std::fs::write(&log_path, format!("{safe_error}\n"));
+    let mut payload = payload_error.to_payload(&log_path, command);
+    payload.error = safe_error;
+    payload.action = crate::redaction::redact_external_text(&payload.action);
+    payload.log = crate::redaction::redact_external_text(&payload.log);
+    payload.reason = payload
+        .reason
+        .map(|value| crate::redaction::redact_external_text(&value));
+    payload.session_name = payload
+        .session_name
+        .map(|value| crate::redaction::redact_external_text(&value));
+    payload.next_actions = payload.next_actions.map(|values| {
+        values
+            .into_iter()
+            .map(|value| crate::redaction::redact_external_text(&value))
+            .collect()
+    });
     if has_arg(args, "--json") {
         if let Ok(value) = serde_json::to_value(payload) {
             println!("{}", python_compact_json(&value));

package/crates/team-agent/src/cli/status_port.rs

@@ -89,7 +89,7 @@ pub fn status_scoped(
         );
     }
     let readiness = crate::cli::diagnose::wait_readiness(&readiness_state);
-    let full = json!({
+    let full = crate::redaction::redact_external_value(&json!({
         "ok": true,
         "team": state.pointer("/leader/id").cloned().unwrap_or_else(|| json!("leader")),
         "session_name": state.get("session_name").cloned().unwrap_or(Value::Null),
@@ -124,7 +124,7 @@ pub fn status_scoped(
                 .tail(10)
                 .map_err(|e| CliError::Runtime(e.to_string()))?,
         ),
-    });
+    }));
     if compact {
         Ok(compact_status(full))
     } else {

package/crates/team-agent/src/event_log.rs

@@ -147,7 +147,7 @@ impl EventLog {
                 obj.insert(k, v);
             }
         }
-        let event = Value::Object(obj);
+        let event = crate::redaction::redact_external_value(&Value::Object(obj));
         self.maybe_rotate()?;
         // 单次 write_all(line+"\n"):POSIX O_APPEND 对 <PIPE_BUF 写原子,避免并发写者交错(对抗 P1)。
         let mut bytes = to_python_json(&sort_value(&event)).into_bytes();
@@ -176,11 +176,11 @@ impl EventLog {
         let mut out = Vec::new();
         for line in &lines[start..] {
             match serde_json::from_str::<Value>(line) {
-                Ok(v) => out.push(v),
+                Ok(v) => out.push(crate::redaction::redact_external_value(&v)),
                 Err(_) => {
                     let mut m = serde_json::Map::new();
                     m.insert("raw".to_string(), Value::String((*line).to_string()));
-                    out.push(Value::Object(m));
+                    out.push(crate::redaction::redact_external_value(&Value::Object(m)));
                 }
             }
         }

package/crates/team-agent/src/lib.rs

@@ -56,6 +56,7 @@ pub use crate::db::message_store;
 // step 8 (provider) — ProviderAdapter trait + typed provider/turn-state/liveness 等(ROUND-0 骨架;
 // fn body unimplemented!(),P2 porter 落实现)。MUST-NOT-13:provider 调用全走 trait。
 pub mod provider;
+mod redaction;
 /// unit-6 (Stage 2) compat shim. Physical home is now
 /// `crate::provider::session::capture`; this re-export keeps every
 /// `crate::session_capture::*` caller working without modification.

package/crates/team-agent/src/lifecycle/profile_smoke.rs

@@ -485,27 +485,17 @@ fn proxy_scheme(url: &str) -> Option<String> {
 
 fn redact_endpoint(raw: &str) -> String {
     let no_query = raw.split_once('?').map(|(head, _)| head).unwrap_or(raw);
-    let Some((scheme, rest)) = no_query.split_once("://") else {
-        return no_query.to_string();
-    };
-    let slash = rest.find('/').unwrap_or(rest.len());
-    let authority = &rest[..slash];
-    let path = &rest[slash..];
-    if let Some((_, host)) = authority.rsplit_once('@') {
-        format!("{scheme}://[redacted]@{host}{path}")
-    } else {
-        no_query.to_string()
-    }
+    crate::redaction::redact_external_text(no_query)
 }
 
 fn redact_text(raw: &str, secrets: &[&str]) -> String {
     let mut out = raw.chars().take(512).collect::<String>();
     for secret in secrets {
         if !secret.is_empty() {
-            out = out.replace(secret, "[redacted]");
+            out = out.replace(secret, "[REDACTED]");
         }
     }
-    out
+    crate::redaction::redact_external_text(&out)
 }
 
 fn auth_mode_wire(auth_mode: AuthMode) -> &'static str {

package/crates/team-agent/src/mcp_server/wire.rs

@@ -204,6 +204,7 @@ fn run_stdio_loop_inner<R: BufRead, W: Write>(
         report.requests_read = report.requests_read.saturating_add(1);
         let frame = handle_stdin_line(tools, &line, report)?;
         if let Some(value) = frame {
+            let value = crate::redaction::redact_external_value(&value);
             serde_json::to_writer(&mut *writer, &value)?;
             writer.write_all(b"\n")?;
             writer.flush()?;
@@ -266,7 +267,8 @@ fn rpc_id_from_request(request: &Value) -> RpcId {
 }
 
 fn tool_call_result_value(is_error: bool, body: &Value) -> Value {
-    let text = json_dumps_default(body);
+    let body = crate::redaction::redact_external_value(body);
+    let text = json_dumps_default(&body);
     let mut content = serde_json::Map::new();
     content.insert("type".to_string(), Value::String("text".to_string()));
     content.insert("text".to_string(), Value::String(text));

package/crates/team-agent/src/redaction.rs

@@ -0,0 +1,185 @@
+use std::sync::LazyLock;
+
+use regex::{Captures, Regex};
+use serde_json::Value;
+
+const REDACTED: &str = "[REDACTED]";
+const SENSITIVE_FAMILIES: [&str; 7] = [
+    "PROXY",
+    "TOKEN",
+    "KEY",
+    "PASSWORD",
+    "AUTH",
+    "SECRET",
+    "CREDENTIAL",
+];
+const STRUCTURAL_KEYS: [&str; 13] = [
+    "active_team_key",
+    "cohort_key",
+    "dedupe_key",
+    "error_key",
+    "error_observation_key",
+    "last_check_key",
+    "last_error_observation_key",
+    "last_notified_key",
+    "last_suppressed_key",
+    "parent_team_key",
+    "runtime_team_key",
+    "team_key",
+    "team_state_key",
+];
+
+static SHELL_ASSIGNMENT: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(
+        r#"(?i)(?P<prefix>^|[\s\[,;('"])(?P<key>[a-z_][a-z0-9_]*)=(?P<value>'[^']*'|"[^"]*"|[^\s,\]\[};)]+)"#,
+    )
+    .expect("shell assignment redaction regex")
+});
+
+static URL_USERINFO: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"(?P<scheme>[A-Za-z][A-Za-z0-9+.-]*://)[^\s/?#]+@")
+        .expect("URL userinfo redaction regex")
+});
+
+pub(crate) fn redact_external_value(value: &serde_json::Value) -> serde_json::Value {
+    match value {
+        Value::Object(object) => Value::Object(
+            object
+                .iter()
+                .map(|(key, value)| {
+                    let value = if is_sensitive_env_key(key) {
+                        Value::String(REDACTED.to_string())
+                    } else {
+                        redact_external_value(value)
+                    };
+                    (key.clone(), value)
+                })
+                .collect(),
+        ),
+        Value::Array(values) => Value::Array(values.iter().map(redact_external_value).collect()),
+        Value::String(text) => Value::String(redact_external_text(text)),
+        other => other.clone(),
+    }
+}
+
+pub(crate) fn redact_external_text(text: &str) -> String {
+    let assignments = SHELL_ASSIGNMENT.replace_all(text, |captures: &Captures<'_>| {
+        let key = captures.name("key").map_or("", |value| value.as_str());
+        if !is_sensitive_env_key(key) {
+            return captures[0].to_string();
+        }
+        let prefix = captures.name("prefix").map_or("", |value| value.as_str());
+        let value = captures.name("value").map_or("", |value| value.as_str());
+        let quote = match (value.as_bytes().first(), value.as_bytes().last()) {
+            (Some(b'\''), Some(b'\'')) => "'",
+            (Some(b'"'), Some(b'"')) => "\"",
+            _ => "",
+        };
+        let unquoted = value
+            .strip_prefix(quote)
+            .and_then(|value| value.strip_suffix(quote))
+            .unwrap_or(value);
+        let has_url_userinfo = URL_USERINFO.is_match(unquoted);
+        let redacted_url = URL_USERINFO
+            .replace_all(unquoted, "${scheme}[REDACTED]@")
+            .into_owned();
+        let safe_value = if has_url_userinfo {
+            &redacted_url
+        } else {
+            REDACTED
+        };
+        format!("{prefix}{key}={quote}{safe_value}{quote}")
+    });
+    URL_USERINFO
+        .replace_all(&assignments, "${scheme}[REDACTED]@")
+        .into_owned()
+}
+
+fn is_sensitive_env_key(key: &str) -> bool {
+    if STRUCTURAL_KEYS
+        .iter()
+        .any(|structural| key.eq_ignore_ascii_case(structural))
+    {
+        return false;
+    }
+    let key = key.to_ascii_uppercase();
+    SENSITIVE_FAMILIES
+        .iter()
+        .any(|family| key == *family || key.ends_with(&format!("_{family}")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn recursive_values_mask_env_families_without_erasing_wire_truth() {
+        let input = json!({
+            "HTTPS_PROXY": "proxy-secret",
+            "Copilot_Github_Token": "token-secret",
+            "nested": [{"db_password": "password-secret"}],
+            "team_key": "current",
+            "active_team_key": "current",
+            "dedupe_key": "restart:worker",
+            "auth_mode": "subscription",
+            "model_source": "role",
+            "model_stale": true,
+        });
+
+        let redacted = redact_external_value(&input);
+
+        assert_eq!(redacted["HTTPS_PROXY"], REDACTED);
+        assert_eq!(redacted["Copilot_Github_Token"], REDACTED);
+        assert_eq!(redacted["nested"][0]["db_password"], REDACTED);
+        assert_eq!(redacted["team_key"], "current");
+        assert_eq!(redacted["active_team_key"], "current");
+        assert_eq!(redacted["dedupe_key"], "restart:worker");
+        assert_eq!(redacted["auth_mode"], "subscription");
+        assert_eq!(redacted["model_source"], "role");
+        assert_eq!(redacted["model_stale"], true);
+        assert_eq!(redact_external_value(&redacted), redacted);
+    }
+
+    #[test]
+    fn text_masks_quoted_assignments_and_url_userinfo_idempotently() {
+        let input = "HTTPS_PROXY='https://user:pass@proxy.invalid:8443/path' http_proxy=other endpoint=https://user:pass@proxy.invalid:8443/path";
+        let expected = "HTTPS_PROXY='https://[REDACTED]@proxy.invalid:8443/path' http_proxy=[REDACTED] endpoint=https://[REDACTED]@proxy.invalid:8443/path";
+
+        let redacted = redact_external_text(input);
+
+        assert_eq!(redacted, expected);
+        assert_eq!(redact_external_text(&redacted), redacted);
+    }
+
+    #[test]
+    fn text_leaves_non_env_assignments_and_plain_urls_unchanged() {
+        let input = "team_key=current author=operator endpoint=https://proxy.invalid/health";
+        assert_eq!(redact_external_text(input), input);
+    }
+
+    #[test]
+    fn mixed_external_value_is_idempotent() {
+        let marker = "synthetic-redaction-unit-marker";
+        let credential_url = format!("https://demo-user:{marker}@proxy.invalid:8443/path");
+        let diagnostic = format!(
+            "subprocess exited 37: argv=[tmux, HTTPS_PROXY='{credential_url}']; endpoint={credential_url}"
+        );
+        let input = json!({
+            "HTTPS_PROXY": marker,
+            "ordinary_diagnostic": format!(
+                "HTTPS_PROXY='{credential_url}' http_proxy=\"{credential_url}\" OPENAI_API_KEY={marker} endpoint={credential_url}"
+            ),
+            "nested": [[diagnostic, credential_url]],
+            "team_key": "current",
+        });
+
+        let once = redact_external_value(&input);
+        let twice = redact_external_value(&once);
+        let text = once.to_string();
+
+        assert!(!text.contains(marker));
+        assert!(text.contains("https://[REDACTED]@proxy.invalid:8443/path"));
+        assert_eq!(twice, once);
+    }
+}

package/crates/team-agent/src/tmux_backend.rs

@@ -1338,6 +1338,7 @@ fn strip_ansi_escapes_inplace(input: &str) -> String {
 }
 
 fn scrub_secrets(line: &str) -> String {
+    let line = crate::redaction::redact_external_text(line);
     // Five shapes: sk-XXXX, ghp_XXXX, AKIAXXXX (16-char uppercase id), Bearer XXXX,
     // 32+ hex (token).
     let mut out = String::with_capacity(line.len());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.46",
+  "version": "0.5.47",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.46",
-    "@team-agent/cli-darwin-x64": "0.5.46",
-    "@team-agent/cli-linux-x64": "0.5.46"
+    "@team-agent/cli-darwin-arm64": "0.5.47",
+    "@team-agent/cli-darwin-x64": "0.5.47",
+    "@team-agent/cli-linux-x64": "0.5.47"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",