@yemi33/minions 0.1.1127 → 0.1.1128

package/CHANGELOG.md

@@ -1,12 +1,15 @@
 # Changelog
 
-## 0.1.1127 (2026-04-18)
+## 0.1.1128 (2026-04-18)
 
 ### Features
+- redact ADO tokens and JWTs from engine/log.json writes (#1297)
+- SEC-02 — replace curl shell-out in ado.js with adoFetch (#1296)
 - validate project name and path on POST /api/projects/add (SEC-04, SEC-05) (#1298)
 - seed realActivityMap at spawn time, stamp pid in live-output (#1200)
 
 ### Fixes
+- preserve buildErrorLog through transient states, persist poll time (#1273)
 -  auto-fetch PR title on link-pr (closes #1283) (#1299)
 - scheduler double-fire within same cron minute (#1277)
 -  gate auto-fix dispatch on throttle state to prevent stale-data spurious fixes

package/engine/ado.js

@@ -104,11 +104,12 @@ async function adoFetch(url, token, opts = {}) {
   const _retryCount = typeof opts === 'number' ? opts : (opts._retryCount || 0); // backward compat
   const method = (typeof opts === 'object' && opts.method) || 'GET';
   const body = (typeof opts === 'object' && opts.body) || undefined;
+  const timeout = (typeof opts === 'object' && Number.isFinite(opts.timeout)) ? opts.timeout : 30000;
   const MAX_RETRIES = 1;
   const res = await fetch(url, {
     method,
     headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' },
-    signal: AbortSignal.timeout(30000),
+    signal: AbortSignal.timeout(timeout),
     body,
   });
   // ── Throttle detection: intercept 429/503 BEFORE generic !res.ok ──
@@ -811,8 +812,11 @@ async function checkLiveReviewStatus(pr, project) {
     const prNum = shared.getPrNumber(pr);
     if (!prNum) return null;
     const url = `${orgBase}/${project.adoProject}/_apis/git/repositories/${project.repositoryId}/pullrequests/${prNum}?api-version=7.1`;
-    const result = await execAsync(`curl -s --max-time 4 -H "Authorization: Bearer ${token}" "${url}"`, { encoding: 'utf-8', timeout: 5000, windowsHide: true });
-    const prData = JSON.parse(result);
+    // SEC-02: use in-process adoFetch rather than a shell-out — keeps the bearer
+    // token out of the process argv list where any local process could read it.
+    // 4s timeout preserves the original request-cancellation semantics via AbortSignal.
+    const prData = await adoFetch(url, token, { timeout: 4000 });
+    if (!prData) return null;
     const votes = (prData.reviewers || []).map(r => r.vote).filter(v => v !== undefined);
     if (votes.length === 0) return 'pending';
     return votesToReviewStatus(votes);

package/engine/shared.js

@@ -20,6 +20,46 @@ function ts() { return new Date().toISOString(); }
 function logTs() { return new Date().toLocaleTimeString(); }
 function dateStamp() { return new Date().toISOString().slice(0, 10); }
 
+// ── Secret Redaction (SEC-09) ──────────────────────────────────────────────
+// Pure, side-effect-free redactor applied to every entry on the log write path
+// so ADO tokens, JWTs, and azureauth stdout dumps never land in engine/log.json
+// (2500-entry ring buffer readable by any local process).
+//
+// Replacements (order matters — azureauth first, then Bearer, then bare JWT):
+//   1. `"token":"<20+ char base64-ish>"` → `"token":"[REDACTED_AZUREAUTH]"`
+//      Redacts the value only, not the whole line, so surrounding JSON
+//      context (e.g. expiresOn) remains debuggable.
+//   2. `Bearer <20+ char base64-ish>`   → `Bearer [REDACTED]`
+//   3. `ey<b64url>.<b64url>[.<b64url>]` → `[REDACTED_JWT]`
+//      Catches bare JWTs in error messages or stack traces (anything left
+//      after Bearer replacement has consumed its tokens).
+//
+// `redactSecrets` also recurses into objects and arrays — used by `log()` to
+// sanitize both the message and the meta payload before persistence.
+const _BEARER_RE = /Bearer\s+[A-Za-z0-9+/=._\-]{20,}/g;
+const _JWT_RE = /ey[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}(?:\.[A-Za-z0-9_\-]{10,})?/g;
+const _AZUREAUTH_RE = /"token"\s*:\s*"[A-Za-z0-9+/=._\-]{20,}"/g;
+
+function _redactString(s) {
+  if (typeof s !== 'string' || s.length === 0) return s;
+  return s
+    .replace(_AZUREAUTH_RE, '"token":"[REDACTED_AZUREAUTH]"')
+    .replace(_BEARER_RE, 'Bearer [REDACTED]')
+    .replace(_JWT_RE, '[REDACTED_JWT]');
+}
+
+function redactSecrets(value) {
+  if (value == null) return value;
+  if (typeof value === 'string') return _redactString(value);
+  if (Array.isArray(value)) return value.map(redactSecrets);
+  if (typeof value === 'object') {
+    const out = {};
+    for (const k of Object.keys(value)) out[k] = redactSecrets(value[k]);
+    return out;
+  }
+  return value;
+}
+
 // ── Log Buffering ──────────────────────────────────────────────────────────
 // Buffer log entries in memory and flush to disk periodically to reduce lock
 // contention (~139 calls/tick → 1 lock acquisition per flush).
@@ -27,9 +67,14 @@ const _logBuffer = [];
 let _logFlushTimer = null;
 
 function log(level, msg, meta = {}) {
-  const entry = { timestamp: ts(), level, message: msg, ...meta };
-  // Console output remains immediate
-  console.log(`[${logTs()}] [${level}] ${msg}`);
+  // SEC-09: redact sensitive patterns (ADO tokens, JWTs, azureauth stdout)
+  // before both the in-memory buffer push and the console echo — ensures
+  // nothing sensitive is persisted to engine/log.json or engine stdout logs.
+  const safeMsg = typeof msg === 'string' ? _redactString(msg) : msg;
+  const safeMeta = redactSecrets(meta) || {};
+  const entry = { timestamp: ts(), level, message: safeMsg, ...safeMeta };
+  // Console output remains immediate (also redacted)
+  console.log(`[${logTs()}] [${level}] ${safeMsg}`);
 
   _logBuffer.push(entry);
 
@@ -50,7 +95,9 @@ function log(level, msg, meta = {}) {
 
 function _flushLogBuffer() {
   if (_logBuffer.length === 0) return;
-  const entries = _logBuffer.splice(0);
+  // SEC-09 defense-in-depth: redact again at flush time so any direct
+  // `_logBuffer.push(entry)` callers (tests, future paths) can't leak secrets.
+  const entries = _logBuffer.splice(0).map(redactSecrets);
   try {
     mutateJsonFileLocked(LOG_PATH, (logData) => {
       if (!Array.isArray(logData)) logData = logData?.entries || [];
@@ -1719,6 +1766,7 @@ module.exports = {
   _WIN_RESERVED_NAMES, // exported for testing
   LOCK_STALE_MS,
   flushLogs,
+  redactSecrets,
   slugify,
   safeSlugComponent,
   formatTranscriptEntry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.1127",
+  "version": "0.1.1128",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"