cookbook-bridge 0.1.6 → 0.1.7

package/bridge.mjs

@@ -30,6 +30,7 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
+import { callsFromStreamLine, foldCallEvent, wireCalls } from "./live.mjs";
 
 // LOCAL modules load LAZILY (loadRuntime below), not statically: a Bridge with a
 // missing/corrupt module file must still be able to run `node bridge.mjs update` and
@@ -48,14 +49,12 @@ let createLocalServer, toolsForMode, modeForTools, vendorOf;
 let connectAgentsProgrammatic, detectClis;
 let serveCalls, describeCall, hostingMode;
 let fetchHands, claimHandsCall, reportHandsResult;
-let callsFromStreamLine, foldCallEvent, wireCalls;
 
 async function loadRuntime() {
   ({ createLocalServer, toolsForMode, modeForTools, vendorOf } = await import("./local.mjs"));
   ({ connectAgentsProgrammatic, detectClis } = await import("./device.mjs"));
   ({ listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings, fetchHands, claimHandsCall, reportHandsResult, agentsQuery } = await import("./cookbook.mjs"));
   ({ serveCalls, describeCall, hostingMode } = await import("./hands.mjs"));
-  ({ callsFromStreamLine, foldCallEvent, wireCalls } = await import("./live.mjs"));
   ({ agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION, withCookbookMcp, isClaudeCommand } = await import("./harden.mjs"));
   ({ extractUsage, displayText } = await import("./usage.mjs"));
   ({ volunteeringEnabled, volunteerCandidates, decisionPrompt, parseDecision, MAX_DECISIONS_PER_POLL, mergeVolunteerSettings, effectiveCapabilities } = await import("./volunteer.mjs"));

package/live.mjs

@@ -17,6 +17,9 @@
  * The server re-validates every field (src/lib/workspaces/live-calls.ts).
  */
 
+import os from "node:os";
+import { redact } from "./hands.mjs";
+
 export const LIVE_CALLS_CAP = 12;
 const NAME_CAP = 60;
 const ARG_CAP = 120;
@@ -71,7 +74,9 @@ export function argFor(input) {
 }
 
 function clip(s) {
-  const one = String(s).replace(/\s+/g, " ").trim();
+  // Redact FIRST: a `curl -H "Authorization: Bearer …"` or an exported key must never
+  // reach the work log (every viewer of the thread sees it, and it persists).
+  const one = redact(String(s).replace(/\s+/g, " ").trim(), { home: os.homedir() });
   return one.length > ARG_CAP ? one.slice(0, ARG_CAP - 1) + "…" : one;
 }
 
@@ -151,6 +156,7 @@ export function foldCallEvent(list, ev, now = Date.now()) {
   const cur = Array.isArray(list) ? list : [];
   if (!ev) return cur;
   if (ev.kind === "call") {
+    if (ev.id && cur.some((c) => c.id === ev.id)) return cur; // vendor re-emitted the same call
     const next = [...cur, { id: ev.id || "", n: ev.name, a: ev.arg || "", s: "run", at: now }];
     return next.length > LIVE_CALLS_CAP ? next.slice(next.length - LIVE_CALLS_CAP) : next;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cookbook-bridge",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Run your own Claude, Codex and Gemini subscriptions against your Cookbook workspaces. One approval connects every agent CLI on your machine, with a receipt for every run.",
   "type": "module",
   "bin": {