create-egregore 0.19.2 → 0.19.3

package/bin/cli.js

@@ -36,6 +36,7 @@ const {
   registerInstance,
   installLauncherBinary,
   normalizeRuntime,
+  redactToken,
 } = require("../lib/setup");
 const { detectContext, isWritable, isSystemDir } = require("../lib/context");
 
@@ -888,6 +889,8 @@ async function joinFlow(api, githubToken, choice, ctx) {
 }
 
 main().catch((err) => {
-  ui.error(err.message);
+  // Last-resort net: never let a credential reach the terminal via an
+  // unhandled error message (cloneRepo already redacts at the source).
+  ui.error(redactToken(err && err.message));
   process.exit(1);
 });

package/lib/local.js

@@ -25,6 +25,7 @@ const {
   installLauncherBinary,
   launchOrInstruct,
   embedToken,
+  redactToken,
   configureGitCredentials,
   gitCloneEnv,
   initMemoryDirs,
@@ -342,12 +343,20 @@ function cloneRepo(url, dir, token, ui, label) {
     ui.warn(`${path.basename(dir)}/ already exists — pulling latest`);
     run("git pull", { cwd: dir });
   } else {
-    execFileSync("git", ["clone", embedToken(url, token), dir], {
-      stdio: "pipe",
-      encoding: "utf-8",
-      timeout: 60000,
-      env: gitCloneEnv(),
-    });
+    try {
+      execFileSync("git", ["clone", embedToken(url, token), dir], {
+        stdio: "pipe",
+        encoding: "utf-8",
+        timeout: 60000,
+        env: gitCloneEnv(),
+      });
+    } catch (err) {
+      // execFileSync puts the full command — including the embedded token — in
+      // err.message. Rethrow a redacted error that keeps git's stderr (the
+      // useful "remote: ..." lines) but never the credential.
+      const detail = [err.message, err.stderr].filter(Boolean).join("\n");
+      throw new Error(redactToken(detail, token));
+    }
     try {
       run(`git remote set-url origin ${url}`, { cwd: dir });
     } catch {}

package/lib/setup.js

@@ -596,6 +596,20 @@ function embedToken(url, token) {
   }
 }
 
+// Strip credentials from any text before it reaches the terminal. execFileSync
+// bakes the full argv into its thrown error message, so an authenticated
+// `git clone https://x-access-token:<pat>@github.com/...` leaks the token
+// verbatim if that error is printed. Redacts the known token, any userinfo in
+// an https URL, and bare GitHub token shapes as a backstop.
+function redactToken(text, token) {
+  let s = text == null ? "" : String(text);
+  if (token) s = s.split(token).join("***");
+  s = s.replace(/(https:\/\/)[^@/\s]+@/g, "$1***@"); // https://user:secret@host → https://***@host
+  s = s.replace(/gh[posru]_[A-Za-z0-9_]+/g, "***");  // ghp_/gho_/ghs_/ghu_/ghr_
+  s = s.replace(/github_pat_[A-Za-z0-9_]+/g, "***");
+  return s;
+}
+
 function toSSH(url) {
   const m = url.match(/https:\/\/github\.com\/(.+?)(?:\.git)?$/);
   return m ? `git@github.com:${m[1]}.git` : null;
@@ -1255,6 +1269,7 @@ module.exports = {
   ensurePersonOnboardingWitness,
   ensureInstallerMemberRole,
   embedToken,
+  redactToken,
   configureGitCredentials,
   gitCloneEnv,
   assistantInstallCommand,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.2",
+  "version": "0.19.3",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code or Codex.",
   "license": "MIT",
   "bin": {