@wenrwa/marketplace-cli 0.8.4 → 0.8.6

package/dist/bridge/termSnapshot.js

@@ -36,7 +36,10 @@ function createTermSnapshot(cols, rows, opts) {
     // stable public API).
     const term = new Terminal({ cols, rows, scrollback, allowProposedApi: true });
     const serializer = new SerializeAddon();
-    term.loadAddon(serializer);
+    // The addon reads the terminal through a CLIPPED VIEW, not the terminal
+    // itself — see clippedView below. activate() only stores the reference
+    // (the addon has no other loadAddon-time wiring); dispose() releases it.
+    serializer.activate(clippedView(term));
     // Terminal.write() is async: the parser runs on an internal write queue
     // and only calls the callback once that write has actually been applied
     // to the buffer. Resolving our promise from that callback means callers
@@ -56,7 +59,7 @@ function createTermSnapshot(cols, rows, opts) {
         },
         serialize: async () => {
             await flush();
-            return serializer.serialize({ scrollback });
+            return serializer.serialize({ scrollback }) + extraModes(term);
         },
         dispose: () => {
             serializer.dispose();
@@ -64,3 +67,112 @@ function createTermSnapshot(cols, rows, opts) {
         },
     };
 }
+// ---------------------------------------------------------------------------
+// Narrow-after-wide clipping.
+//
+// xterm does not truncate buffer lines when the terminal shrinks: the
+// alternate buffer (where full-screen TUIs like OpenCode draw) never reflows,
+// so after a 40→20 col shrink every alt row still holds 40 cells. The
+// serialize addon walks `line.length` cells per row, so the snapshot wrote
+// each row at its OLD width, the replay terminal (at the new width)
+// auto-wrapped the tail onto the next row, and the frame came back garbled
+// on reattach. The live screen only ever shows the first `cols` cells, so the
+// snapshot clips every row to `cols` — via a read-only view, never by
+// mutating the emulator (growing back must still reveal what xterm kept).
+// ---------------------------------------------------------------------------
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/** Forward every property of `target`, with functions bound to it, except the overrides. */
+function forwardingProxy(target, override) {
+    return new Proxy(target, {
+        get(t, prop) {
+            const o = override(prop);
+            if (o)
+                return o.value;
+            const v = Reflect.get(t, prop, t);
+            return typeof v === 'function' ? v.bind(t) : v;
+        },
+    });
+}
+/** The number of cells of `line` that are visible at `cols` — never splits a
+ *  wide (2-cell) character: one that straddles the edge is dropped whole. */
+function visibleLength(line, cols) {
+    if (!line || line.length <= cols)
+        return line ? line.length : 0;
+    const edge = line.getCell(cols - 1);
+    return edge && edge.getWidth() === 2 ? cols - 1 : cols;
+}
+function clippedBuffer(buffer, term) {
+    return forwardingProxy(buffer, (prop) => {
+        if (prop !== 'getLine')
+            return null;
+        return {
+            hit: true,
+            value: (y) => {
+                const line = buffer.getLine(y);
+                if (!line)
+                    return line;
+                const cols = term.cols;
+                const len = visibleLength(line, cols);
+                // A row that continued a now-clipped wider row is no longer a soft
+                // wrap of it at this width — the serializer must end the previous
+                // row with a hard CRLF, not rely on auto-wrap.
+                const prev = y > 0 ? buffer.getLine(y - 1) : undefined;
+                const wrapped = line.isWrapped && !(prev && prev.length > cols);
+                if (len === line.length && wrapped === line.isWrapped)
+                    return line;
+                return forwardingProxy(line, (p) => {
+                    if (p === 'length')
+                        return { hit: true, value: len };
+                    if (p === 'isWrapped')
+                        return { hit: true, value: wrapped };
+                    return null;
+                });
+            },
+        };
+    });
+}
+/** The terminal as the serialize addon sees it: same object, but every
+ *  buffer row is clipped to the CURRENT cols. Rows need no clipping: the
+ *  alt buffer is exactly `rows` long after a resize, and the normal buffer
+ *  pushes the overflow into scrollback (which the replay scrolls too). */
+function clippedView(term) {
+    // Resolved NOW, not on first serialize: xterm creates + registers the
+    // buffer namespace lazily, and doing that on a terminal already disposed
+    // (a serialize racing dispose) leaks a disposable with a warning.
+    const ns = term.buffer;
+    const view = forwardingProxy(ns, (prop) => {
+        if (prop === 'normal' || prop === 'alternate' || prop === 'active') {
+            return { hit: true, value: clippedBuffer(ns[prop], term) };
+        }
+        return null;
+    });
+    return forwardingProxy(term, (prop) => (prop === 'buffer' ? { hit: true, value: view } : null));
+}
+// ---------------------------------------------------------------------------
+// Terminal modes the serialize addon drops.
+//
+// The addon re-emits mouse TRACKING (?9/?1000/?1002/?1003), bracketed paste,
+// application cursor/keypad, focus, insert/origin/wrap and the alt screen
+// (?1049) — but not the mouse ENCODING (?1006 SGR / ?1016 SGR-pixels) nor a
+// hidden cursor (?25l). Without ?1006 a reattached client reports wheel and
+// clicks in the legacy X10 byte encoding, which an SGR-expecting TUI
+// (OpenCode) ignores — so mouse-wheel scroll silently died after a reattach,
+// and the hidden cursor reappeared as a stray block.
+//
+// Read from the emulator's own state (the same `_core` internals the addon
+// itself reads), so resets (RIS/DECSTR) are honoured exactly as xterm
+// applies them — no shadow parser that could drift.
+// ---------------------------------------------------------------------------
+/** Escape sequences restoring the modes the serialize addon does not emit. */
+function extraModes(term) {
+    const core = term?._core;
+    let out = '';
+    const encoding = core?.coreMouseService?.activeEncoding;
+    if (encoding === 'SGR')
+        out += '\x1b[?1006h';
+    else if (encoding === 'SGR_PIXELS')
+        out += '\x1b[?1016h';
+    if (core?.coreService?.isCursorHidden === true)
+        out += '\x1b[?25l';
+    return out;
+}

package/dist/bridge/workGraphPointer.d.ts

@@ -67,3 +67,28 @@ export declare const BROWSER_POINTER: string;
 export declare function browserSection(input: {
     workGraphAvailable?: boolean;
 }): string | null;
+/**
+ * Paste a key → saved to .env (2026-10-17) — keys a pilot pastes into a pane
+ * are saved to the repo's `.env` and the pane types `$NAME` instead. New PTYs
+ * load that file into env (repoEnv.ts); an agent that was already running
+ * needs to be told where the key went. Same gate as the other HiveOp pointers
+ * (a HiveOp-managed agent).
+ */
+export declare const KEYS_POINTER: string;
+/** One function so the hosted and local writers cannot diverge. */
+export declare function keysSection(input: {
+    workGraphAvailable?: boolean;
+}): string | null;
+/**
+ * Secret masking (2026-10-17) — the standing rule every HiveOp agent gets:
+ * pilots stream and screenshot their terminals, so a secret printed there is
+ * a secret leaked. Output masking and the PreToolUse guard are the safety net;
+ * this is the instruction that keeps the agent from needing them.
+ *
+ * Rides the pointer block whenever it is written at all (both lanes), so it
+ * never on its own creates a file or a CLAUDE.md region that would otherwise
+ * not exist.
+ */
+export declare const SECRETS_POINTER: string;
+/** The pointer list with the secrets rule appended — one function so both writers agree. */
+export declare function withSecretsSection(sections: string[]): string[];

package/dist/bridge/workGraphPointer.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BROWSER_POINTER = exports.MATCH_POINTER = exports.WORK_GRAPH_POINTER = void 0;
+exports.SECRETS_POINTER = exports.KEYS_POINTER = exports.BROWSER_POINTER = exports.MATCH_POINTER = exports.WORK_GRAPH_POINTER = void 0;
 exports.workSection = workSection;
 exports.browserSection = browserSection;
+exports.keysSection = keysSection;
+exports.withSecretsSection = withSecretsSection;
 /**
  * wgcp-01 — the one piece of guidance that tells an agent the workspace work
  * graph exists at all. Nothing today does: the MCP tools (`list_ready_issues`,
@@ -84,3 +86,36 @@ exports.BROWSER_POINTER = [
 function browserSection(input) {
     return input.workGraphAvailable ? exports.BROWSER_POINTER : null;
 }
+/**
+ * Paste a key → saved to .env (2026-10-17) — keys a pilot pastes into a pane
+ * are saved to the repo's `.env` and the pane types `$NAME` instead. New PTYs
+ * load that file into env (repoEnv.ts); an agent that was already running
+ * needs to be told where the key went. Same gate as the other HiveOp pointers
+ * (a HiveOp-managed agent).
+ */
+exports.KEYS_POINTER = [
+    '## Keys',
+    'Keys live in the repo .env; use them as env vars.',
+].join('\n');
+/** One function so the hosted and local writers cannot diverge. */
+function keysSection(input) {
+    return input.workGraphAvailable ? exports.KEYS_POINTER : null;
+}
+/**
+ * Secret masking (2026-10-17) — the standing rule every HiveOp agent gets:
+ * pilots stream and screenshot their terminals, so a secret printed there is
+ * a secret leaked. Output masking and the PreToolUse guard are the safety net;
+ * this is the instruction that keeps the agent from needing them.
+ *
+ * Rides the pointer block whenever it is written at all (both lanes), so it
+ * never on its own creates a file or a CLAUDE.md region that would otherwise
+ * not exist.
+ */
+exports.SECRETS_POINTER = [
+    '## Secrets',
+    'Never print, echo or cat secret values (tokens, keys, passwords) or paste them into commands. Keep them in env vars or .env and reference them by name, e.g. `$RAILWAY_TOKEN`.',
+].join('\n');
+/** The pointer list with the secrets rule appended — one function so both writers agree. */
+function withSecretsSection(sections) {
+    return sections.length > 0 ? [...sections, exports.SECRETS_POINTER] : sections;
+}

package/dist/commands/bridge.js

@@ -80,6 +80,7 @@ const contextWriter_1 = require("../bridge/contextWriter");
 const memoryBrief_1 = require("../bridge/memoryBrief");
 const containerFileRelay_1 = require("../bridge/containerFileRelay");
 const claudeTranscriptReader_1 = require("../bridge/claudeTranscriptReader");
+const console_1 = require("../secrets/console");
 const config_2 = require("../utils/config");
 const deviceRegistration_1 = require("../bridge/deviceRegistration");
 const pair_1 = require("./pair");
@@ -524,6 +525,9 @@ exports.bridgeCommand = new commander_1.Command('bridge')
     // mode is a long-lived user process too, and deserves the same loud,
     // deliberate crash instead of a silent Node kill).
     installBridgeCrashHandlers();
+    // Secret masking (2026-10-17): every console line this process writes is
+    // bridge.log (launchd) or `fly logs` (container) — mask it at the source.
+    (0, console_1.installConsoleRedaction)();
     // ht-05: relay mode dials OUT to the platform relay instead of listening
     // on localhost. It skips the Connect Token / MCP registration / discovery
     // file entirely — the container image handles claude/MCP config (ht-06).

package/dist/secrets/console.d.ts

@@ -0,0 +1,4 @@
+declare const METHODS: readonly ["log", "info", "warn", "error", "debug"];
+type ConsoleLike = Pick<Console, (typeof METHODS)[number]>;
+export declare function installConsoleRedaction(target?: ConsoleLike): void;
+export {};

package/dist/secrets/console.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installConsoleRedaction = installConsoleRedaction;
+/**
+ * Secret masking for the bridge's own logs (2026-10-17). The bridge's stdout
+ * and stderr ARE ~/.wen-market/bridge.log on a laptop (launchd) and `fly
+ * logs` in a container, so every console line is passed through redact()
+ * before it is written. Installed once, at bridge start.
+ */
+const util_1 = require("util");
+const redact_1 = require("./redact");
+const INSTALLED = Symbol.for('hiveop.consoleRedaction');
+const METHODS = ['log', 'info', 'warn', 'error', 'debug'];
+function installConsoleRedaction(target = console) {
+    const flagged = target;
+    if (flagged[INSTALLED])
+        return;
+    flagged[INSTALLED] = true;
+    for (const m of METHODS) {
+        const original = target[m].bind(target);
+        target[m] = (...args) => {
+            let line;
+            try {
+                line = (0, redact_1.redact)((0, util_1.format)(...args));
+            }
+            catch {
+                // Fail closed: an unmasked line could carry the very secret.
+                original('[log line withheld: secret masking failed]');
+                return;
+            }
+            original(line);
+        };
+    }
+}

package/dist/secrets/redact.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Secret masking for terminal output (owner-approved 2026-10-17).
+ *
+ * A secret pasted or printed in any HiveOp terminal must never reach anyone's
+ * screen — the owner's own view included (they stream and screenshot). The PTY
+ * child still gets the real bytes; only what is DISPLAYED or SENT is masked.
+ *
+ * ONE SOURCE OF TRUTH. backend/src/lib/secrets/redact.ts is a byte-identical
+ * copy (the backend cannot import from cli/), and a backend test fails the
+ * moment the two differ. Edit this file, then copy it over.
+ *
+ * Exports:
+ *   - findSecrets(text)           spans a plain string would mask
+ *   - containsSecret(text)        true when findSecrets finds anything
+ *   - redact(text)                one-shot, ANSI-aware masking of a whole string
+ *   - createStreamRedactor(opts)  the same for a chunked PTY stream
+ *
+ * Masking is LENGTH-PRESERVING: every hidden character becomes one '*'. That
+ * keeps every column a TUI drew where it drew it (a shorter line would leave
+ * stale cells behind a cursor-addressed repaint), keeps patch byte sizes, and
+ * lets a value that arrives in two pieces be masked piece by piece. Prefixed
+ * tokens keep their first 4 characters (`npm_****…`); a NAME=value keeps the
+ * name (`RAILWAY_API_TOKEN=****…`). '*' is ASCII, so it is one cell wide in
+ * every terminal, and a re-scan of masked text finds nothing (idempotent).
+ *
+ * Streaming: output arrives in arbitrary chunks, interleaved with escape
+ * sequences. Escapes pass through untouched (OSC titles are masked inside);
+ * text is matched on a "visible" view with SGR colour codes removed, so a
+ * token painted in two colours is still one token. A tail that could still be
+ * the start of a secret is held back (bounded) and released on the next chunk
+ * or after a short idle, so interactive echo stays snappy.
+ */
+export declare const MASK_CHAR = "*";
+export type SecretKind = 'prefixed' | 'assignment' | 'bearer' | 'url-credential' | 'private-key';
+export interface SecretSpan {
+    /** Index of the first character that is masked. */
+    start: number;
+    /** One past the last masked character. */
+    end: number;
+    kind: SecretKind;
+}
+/** True when an identifier names a secret: RAILWAY_API_TOKEN, apiKey, --password, x-api-key. */
+export declare function isSecretName(name: string): boolean;
+/** Spans a plain (escape-free) string would mask, sorted and merged. */
+export declare function findSecrets(text: string): SecretSpan[];
+/** True when `text` holds anything findSecrets would mask. */
+export declare function containsSecret(text: string): boolean;
+export interface StreamRedactorOptions {
+    /** Receives masked output, in order. Never called with an empty string. */
+    emit: (masked: string) => void;
+    /** Idle time before a held tail is released (default 30ms; keep ≤50). */
+    idleMs?: number;
+    /** Most visible characters ever held back (default 512). */
+    maxHold?: number;
+    /** On an idle flush, also mask a value still being typed after a secret
+     *  name (`export API_TOKEN=ab12…` with no newline yet). Default true; the
+     *  one-shot redact() turns it off, since its input is complete. */
+    maskTrailing?: boolean;
+    /** Injectable timers (tests). */
+    setTimer?: (cb: () => void, ms: number) => unknown;
+    clearTimer?: (handle: unknown) => void;
+}
+export interface StreamRedactor {
+    /** Feed one chunk of raw output. */
+    push(chunk: string): void;
+    /** Release everything held, masking what is complete. */
+    flush(): void;
+    /** Flush and stop the idle timer. */
+    dispose(): void;
+}
+export declare function createStreamRedactor(opts: StreamRedactorOptions): StreamRedactor;
+/** One-shot, ANSI-aware masking of a complete string (logs, replays, screens, files). */
+export declare function redact(text: string): string;
+/**
+ * redact() for large text (a multi-MB transcript) without blocking the event
+ * loop: the same stream redactor fed in slices, yielding between them so live
+ * terminal frames keep flowing. Same result as redact(text).
+ */
+export declare function redactInSlices(text: string, sliceChars?: number): Promise<string>;