crewly 1.0.0

package/dist/backend/backend/src/utils/security.js

@@ -0,0 +1,533 @@
+/**
+ * Security Utilities
+ *
+ * Provides security-related validation and sanitization functions
+ * for protecting against common vulnerabilities like command injection,
+ * path traversal, and dangerous control sequences.
+ *
+ * @module security
+ */
+import * as path from 'path';
+import * as os from 'os';
+/**
+ * Characters that are dangerous in shell commands and should be escaped or removed
+ * from user input that will be used in shell operations.
+ */
+export const SHELL_DANGEROUS_CHARS = [
+    '`', // Command substitution
+    '$', // Variable expansion / command substitution
+    '\\', // Escape character
+    '"', // String delimiter
+    "'", // String delimiter
+    ';', // Command separator
+    '&', // Background execution / AND operator
+    '|', // Pipe operator
+    '>', // Output redirection
+    '<', // Input redirection
+    '\n', // Newline (command separator)
+    '\r', // Carriage return
+    '\0', // Null byte
+];
+/**
+ * Dangerous control sequences that should not be allowed in terminal input.
+ * These can be used for terminal escape attacks or to manipulate terminal state.
+ */
+export const DANGEROUS_CONTROL_SEQUENCES = [
+    '\x1b', // ESC - Start of ANSI escape sequences
+    '\x07', // BEL - Bell character (can trigger actions)
+    '\x08', // BS - Backspace (can manipulate display)
+    '\x7f', // DEL - Delete character
+    '\x9b', // CSI - Control Sequence Introducer (8-bit)
+    '\x90', // DCS - Device Control String
+    '\x9d', // OSC - Operating System Command
+    '\x9e', // PM - Privacy Message
+    '\x9f', // APC - Application Program Command
+];
+/**
+ * Regex pattern to match ANSI escape sequences
+ */
+const ANSI_ESCAPE_PATTERN = /\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07|\x1b[PX^_][^\x1b]*\x1b\\|\x1b[@-Z\\^_]|\x9b[0-9;]*[a-zA-Z]/g;
+/**
+ * Regex pattern to match Operating System Command sequences
+ * These can be used to change terminal title, clipboard, etc.
+ */
+const OSC_PATTERN = /\x1b\](?:[0-9]+;[^\x07\x1b]*)?(?:\x07|\x1b\\)/g;
+/**
+ * Sanitizes a string for safe use in shell commands, specifically for
+ * git commit messages. Removes or escapes characters that could be used
+ * for command injection.
+ *
+ * @param input - The raw input string to sanitize
+ * @param options - Sanitization options
+ * @param options.maxLength - Maximum allowed length (default: 1000)
+ * @param options.allowNewlines - Whether to allow newlines (default: true for commit messages)
+ * @returns SanitizationResult with the sanitized string and metadata
+ *
+ * @example
+ * ```typescript
+ * const result = sanitizeForShell('Fix bug; rm -rf /');
+ * // result.sanitized === 'Fix bug rm -rf /'
+ * // result.wasModified === true
+ * ```
+ */
+export function sanitizeForShell(input, options = {}) {
+    const { maxLength = 1000, allowNewlines = true } = options;
+    const removedPatterns = [];
+    let sanitized = input;
+    let wasModified = false;
+    // Truncate if too long
+    if (sanitized.length > maxLength) {
+        sanitized = sanitized.substring(0, maxLength);
+        wasModified = true;
+        removedPatterns.push(`truncated from ${input.length} to ${maxLength} chars`);
+    }
+    // Remove null bytes
+    if (sanitized.includes('\0')) {
+        sanitized = sanitized.replace(/\0/g, '');
+        wasModified = true;
+        removedPatterns.push('null bytes');
+    }
+    // Handle newlines based on option
+    if (!allowNewlines) {
+        if (sanitized.includes('\n') || sanitized.includes('\r')) {
+            sanitized = sanitized.replace(/[\r\n]+/g, ' ');
+            wasModified = true;
+            removedPatterns.push('newlines');
+        }
+    }
+    // Remove backtick command substitution patterns
+    const backtickPattern = /`[^`]*`/g;
+    if (backtickPattern.test(sanitized)) {
+        sanitized = sanitized.replace(backtickPattern, '');
+        wasModified = true;
+        removedPatterns.push('backtick command substitution');
+    }
+    // Remove $() command substitution
+    const dollarParenPattern = /\$\([^)]*\)/g;
+    if (dollarParenPattern.test(sanitized)) {
+        sanitized = sanitized.replace(dollarParenPattern, '');
+        wasModified = true;
+        removedPatterns.push('$() command substitution');
+    }
+    // Remove shell variable expansion $VAR or ${VAR}
+    const varPattern = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/g;
+    if (varPattern.test(sanitized)) {
+        sanitized = sanitized.replace(varPattern, '');
+        wasModified = true;
+        removedPatterns.push('shell variable expansion');
+    }
+    // Remove dangerous shell operators (but preserve the text around them)
+    const dangerousOps = [';', '&&', '||', '|', '>', '<', '>>', '<<'];
+    for (const op of dangerousOps) {
+        if (sanitized.includes(op)) {
+            // Replace operator with space to preserve word boundaries
+            sanitized = sanitized.split(op).join(' ');
+            wasModified = true;
+            if (!removedPatterns.includes('shell operators')) {
+                removedPatterns.push('shell operators');
+            }
+        }
+    }
+    // Clean up multiple consecutive spaces (but preserve newlines if allowed)
+    if (allowNewlines) {
+        // Only clean up multiple spaces on the same line
+        const cleanedSpaces = sanitized.replace(/[ \t]{2,}/g, ' ');
+        if (cleanedSpaces !== sanitized) {
+            sanitized = cleanedSpaces;
+            // Don't mark as modified just for whitespace cleanup
+        }
+    }
+    else {
+        // Clean up all multiple whitespace
+        const cleanedSpaces = sanitized.replace(/\s{2,}/g, ' ').trim();
+        if (cleanedSpaces !== sanitized) {
+            sanitized = cleanedSpaces;
+            // Don't mark as modified just for whitespace cleanup
+        }
+    }
+    return {
+        sanitized,
+        wasModified,
+        removedPatterns: removedPatterns.length > 0 ? removedPatterns : undefined,
+    };
+}
+/**
+ * Sanitizes a git commit message by removing potentially dangerous characters
+ * while preserving the semantic content of the message.
+ *
+ * @param message - The raw commit message
+ * @param options - Sanitization options
+ * @param options.maxLength - Maximum message length (default: 5000)
+ * @returns SanitizationResult with the sanitized message
+ *
+ * @example
+ * ```typescript
+ * const result = sanitizeGitCommitMessage('feat: add feature $(whoami)');
+ * // result.sanitized === 'feat: add feature'
+ * ```
+ */
+export function sanitizeGitCommitMessage(message, options = {}) {
+    const { maxLength = 5000 } = options;
+    // Use shell sanitization with newlines allowed (for multi-line commit messages)
+    return sanitizeForShell(message, { maxLength, allowNewlines: true });
+}
+/**
+ * Validates that terminal input does not contain dangerous control sequences
+ * that could be used for terminal escape attacks.
+ *
+ * @param input - The terminal input to validate
+ * @param options - Validation options
+ * @param options.allowBasicFormatting - Allow basic ANSI formatting codes (colors, etc.)
+ * @param options.maxLength - Maximum input length (default: 10000)
+ * @returns Object with isValid flag and optional error message
+ *
+ * @example
+ * ```typescript
+ * const result = validateTerminalInput('echo hello');
+ * // result.isValid === true
+ *
+ * const result2 = validateTerminalInput('\x1b]0;malicious\x07');
+ * // result2.isValid === false
+ * // result2.error === 'Input contains Operating System Command sequences'
+ * ```
+ */
+export function validateTerminalInput(input, options = {}) {
+    const { allowBasicFormatting = false, maxLength = 10000 } = options;
+    // Check length
+    if (input.length > maxLength) {
+        return {
+            isValid: false,
+            error: `Input exceeds maximum length of ${maxLength} characters`,
+        };
+    }
+    // Check for null bytes
+    if (input.includes('\0')) {
+        return {
+            isValid: false,
+            error: 'Input contains null bytes',
+        };
+    }
+    // Check for OSC (Operating System Command) sequences which can:
+    // - Change terminal title
+    // - Access clipboard
+    // - Execute commands on some terminals
+    // Check this BEFORE checking for ESC to give more specific error
+    if (OSC_PATTERN.test(input)) {
+        return {
+            isValid: false,
+            error: 'Input contains Operating System Command sequences',
+        };
+    }
+    // If basic formatting is not allowed, reject any ANSI escape sequences
+    if (!allowBasicFormatting && ANSI_ESCAPE_PATTERN.test(input)) {
+        return {
+            isValid: false,
+            error: 'Input contains ANSI escape sequences',
+        };
+    }
+    // Check for dangerous control characters (check after ANSI patterns for specific errors)
+    for (const seq of DANGEROUS_CONTROL_SEQUENCES) {
+        if (seq === '\x1b' && (allowBasicFormatting || ANSI_ESCAPE_PATTERN.test(input) || OSC_PATTERN.test(input))) {
+            // Skip ESC if we already handled it above
+            continue;
+        }
+        if (input.includes(seq)) {
+            return {
+                isValid: false,
+                error: 'Input contains dangerous control sequences',
+            };
+        }
+    }
+    // If basic formatting is allowed, check for dangerous escape sequences
+    // that go beyond simple color/formatting codes
+    if (allowBasicFormatting) {
+        // DCS (Device Control String) - can be used for Sixel injection
+        if (/\x1bP[^\\]*\x1b\\/.test(input) || /\x90[^\x9c]*\x9c/.test(input)) {
+            return {
+                isValid: false,
+                error: 'Input contains Device Control String sequences',
+            };
+        }
+        // Check for cursor positioning that could be used to overwrite displayed content
+        // to deceive users (allowed: colors, bold, etc. Disallowed: cursor movement)
+        const cursorMovePattern = /\x1b\[[0-9;]*[ABCDEFGHJ]/gi;
+        if (cursorMovePattern.test(input)) {
+            return {
+                isValid: false,
+                error: 'Input contains cursor manipulation sequences',
+            };
+        }
+    }
+    return { isValid: true };
+}
+/**
+ * Sanitizes terminal input by removing dangerous control sequences while
+ * preserving safe content.
+ *
+ * @param input - The terminal input to sanitize
+ * @param options - Sanitization options
+ * @param options.preserveNewlines - Keep newline characters (default: true)
+ * @param options.maxLength - Maximum output length (default: 10000)
+ * @returns SanitizationResult with the sanitized input
+ *
+ * @example
+ * ```typescript
+ * const result = sanitizeTerminalInput('hello\x1b]0;title\x07world');
+ * // result.sanitized === 'helloworld'
+ * ```
+ */
+export function sanitizeTerminalInput(input, options = {}) {
+    const { preserveNewlines = true, maxLength = 10000 } = options;
+    const removedPatterns = [];
+    let sanitized = input;
+    let wasModified = false;
+    // Truncate if too long
+    if (sanitized.length > maxLength) {
+        sanitized = sanitized.substring(0, maxLength);
+        wasModified = true;
+        removedPatterns.push(`truncated from ${input.length} to ${maxLength} chars`);
+    }
+    // Remove null bytes
+    if (sanitized.includes('\0')) {
+        sanitized = sanitized.replace(/\0/g, '');
+        wasModified = true;
+        removedPatterns.push('null bytes');
+    }
+    // Remove OSC sequences
+    if (OSC_PATTERN.test(sanitized)) {
+        sanitized = sanitized.replace(OSC_PATTERN, '');
+        wasModified = true;
+        removedPatterns.push('OSC sequences');
+    }
+    // Remove all ANSI escape sequences
+    if (ANSI_ESCAPE_PATTERN.test(sanitized)) {
+        sanitized = sanitized.replace(ANSI_ESCAPE_PATTERN, '');
+        wasModified = true;
+        removedPatterns.push('ANSI escape sequences');
+    }
+    // Remove other dangerous control characters
+    const controlCharPattern = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\x80-\x9F]/g;
+    if (controlCharPattern.test(sanitized)) {
+        sanitized = sanitized.replace(controlCharPattern, '');
+        wasModified = true;
+        removedPatterns.push('control characters');
+    }
+    // Handle newlines
+    if (!preserveNewlines) {
+        if (sanitized.includes('\n') || sanitized.includes('\r')) {
+            sanitized = sanitized.replace(/[\r\n]+/g, ' ');
+            wasModified = true;
+            removedPatterns.push('newlines');
+        }
+    }
+    return {
+        sanitized,
+        wasModified,
+        removedPatterns: removedPatterns.length > 0 ? removedPatterns : undefined,
+    };
+}
+/**
+ * Validates a file path to prevent path traversal attacks.
+ * Ensures the resolved path is within the allowed base directory.
+ *
+ * @param inputPath - The path to validate (can be relative or absolute)
+ * @param baseDirectory - The allowed base directory (must be absolute)
+ * @param options - Validation options
+ * @param options.allowSymlinks - Whether to allow symlinks (default: false for security)
+ * @returns PathValidationResult with validation status and normalized path
+ *
+ * @example
+ * ```typescript
+ * const result = validatePath('../../../etc/passwd', '/home/user/projects');
+ * // result.isValid === false
+ * // result.error === 'Path traversal detected'
+ *
+ * const result2 = validatePath('src/index.ts', '/home/user/projects');
+ * // result2.isValid === true
+ * // result2.normalizedPath === '/home/user/projects/src/index.ts'
+ * ```
+ */
+export function validatePath(inputPath, baseDirectory, options = {}) {
+    const { allowSymlinks = false } = options;
+    // Input validation
+    if (!inputPath || typeof inputPath !== 'string') {
+        return {
+            isValid: false,
+            error: 'Path is required and must be a string',
+        };
+    }
+    if (!baseDirectory || typeof baseDirectory !== 'string') {
+        return {
+            isValid: false,
+            error: 'Base directory is required and must be a string',
+        };
+    }
+    // Base directory must be absolute
+    if (!path.isAbsolute(baseDirectory)) {
+        return {
+            isValid: false,
+            error: 'Base directory must be an absolute path',
+        };
+    }
+    // Check for null bytes (can bypass path checks in some systems)
+    if (inputPath.includes('\0') || baseDirectory.includes('\0')) {
+        return {
+            isValid: false,
+            error: 'Path contains null bytes',
+        };
+    }
+    // Normalize the base directory
+    const normalizedBase = path.normalize(baseDirectory);
+    // Resolve the input path relative to the base directory
+    let resolvedPath;
+    if (path.isAbsolute(inputPath)) {
+        resolvedPath = path.normalize(inputPath);
+    }
+    else {
+        resolvedPath = path.normalize(path.join(normalizedBase, inputPath));
+    }
+    // Check if the resolved path starts with the base directory
+    // Add trailing separator to prevent partial directory name matches
+    // e.g., /home/user matching /home/username
+    const baseWithSep = normalizedBase.endsWith(path.sep)
+        ? normalizedBase
+        : normalizedBase + path.sep;
+    const resolvedWithSep = resolvedPath.endsWith(path.sep)
+        ? resolvedPath
+        : resolvedPath + path.sep;
+    // The resolved path must either equal the base or be a subdirectory of it
+    const isWithinBase = resolvedPath === normalizedBase || resolvedWithSep.startsWith(baseWithSep);
+    if (!isWithinBase) {
+        return {
+            isValid: false,
+            error: 'Path traversal detected: path resolves outside the allowed directory',
+        };
+    }
+    // Check for common path traversal patterns in the original input
+    // This catches attempts that might not be caught by normalization alone
+    const traversalPatterns = [
+        /\.\.[\/\\]/, // ../
+        /[\/\\]\.\./, // /..
+        /^\.\.$/, // just ..
+        /%2e%2e/i, // URL encoded ..
+        /%252e%252e/i, // Double URL encoded ..
+        /\.%2e/i, // Mixed encoding
+        /%2e\./i, // Mixed encoding
+    ];
+    for (const pattern of traversalPatterns) {
+        if (pattern.test(inputPath)) {
+            return {
+                isValid: false,
+                error: 'Path traversal pattern detected in input',
+            };
+        }
+    }
+    // Note: Symlink checking should be done at the filesystem level
+    // when actually accessing the file, as the symlink might not exist yet
+    // or the check could be subject to TOCTOU (time-of-check-time-of-use) issues
+    return {
+        isValid: true,
+        normalizedPath: resolvedPath,
+    };
+}
+/**
+ * Validates a project path ensuring it is within allowed directories
+ * (user's home directory or explicitly allowed paths).
+ *
+ * @param projectPath - The project path to validate
+ * @param allowedBasePaths - Additional allowed base paths (default: [os.homedir()])
+ * @returns PathValidationResult with validation status
+ *
+ * @example
+ * ```typescript
+ * const result = validateProjectPath('/home/user/projects/myapp');
+ * // result.isValid === true
+ *
+ * const result2 = validateProjectPath('/etc/passwd');
+ * // result2.isValid === false
+ * ```
+ */
+export function validateProjectPath(projectPath, allowedBasePaths) {
+    // Default to home directory if no allowed paths specified
+    const basePaths = allowedBasePaths ?? [os.homedir()];
+    // Input validation
+    if (!projectPath || typeof projectPath !== 'string') {
+        return {
+            isValid: false,
+            error: 'Project path is required and must be a string',
+        };
+    }
+    // Check for null bytes
+    if (projectPath.includes('\0')) {
+        return {
+            isValid: false,
+            error: 'Path contains null bytes',
+        };
+    }
+    // Normalize the project path
+    const normalizedProjectPath = path.normalize(path.isAbsolute(projectPath) ? projectPath : path.resolve(projectPath));
+    // Check if the path is within any of the allowed base paths
+    for (const basePath of basePaths) {
+        const result = validatePath(normalizedProjectPath, basePath);
+        if (result.isValid) {
+            return {
+                isValid: true,
+                normalizedPath: result.normalizedPath,
+            };
+        }
+    }
+    // Also allow the current working directory
+    const cwdResult = validatePath(normalizedProjectPath, process.cwd());
+    if (cwdResult.isValid) {
+        return {
+            isValid: true,
+            normalizedPath: cwdResult.normalizedPath,
+        };
+    }
+    return {
+        isValid: false,
+        error: 'Project path is outside allowed directories',
+    };
+}
+/**
+ * Validates a session name to ensure it contains only safe characters.
+ *
+ * @param sessionName - The session name to validate
+ * @param options - Validation options
+ * @param options.maxLength - Maximum session name length (default: 100)
+ * @returns Object with isValid flag and optional error message
+ *
+ * @example
+ * ```typescript
+ * const result = validateSessionName('my-session_123');
+ * // result.isValid === true
+ *
+ * const result2 = validateSessionName('session; rm -rf /');
+ * // result2.isValid === false
+ * ```
+ */
+export function validateSessionName(sessionName, options = {}) {
+    const { maxLength = 100 } = options;
+    if (!sessionName || typeof sessionName !== 'string') {
+        return {
+            isValid: false,
+            error: 'Session name is required and must be a string',
+        };
+    }
+    if (sessionName.length > maxLength) {
+        return {
+            isValid: false,
+            error: `Session name exceeds maximum length of ${maxLength} characters`,
+        };
+    }
+    // Only allow alphanumeric characters, hyphens, and underscores
+    const validPattern = /^[a-zA-Z0-9_-]+$/;
+    if (!validPattern.test(sessionName)) {
+        return {
+            isValid: false,
+            error: 'Session name contains invalid characters. Only alphanumeric characters, hyphens, and underscores are allowed.',
+        };
+    }
+    return { isValid: true };
+}
+//# sourceMappingURL=security.js.map

package/dist/backend/backend/src/utils/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../../../backend/src/utils/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AA0BzB;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,GAAG,EAAG,uBAAuB;IAC7B,GAAG,EAAG,4CAA4C;IAClD,IAAI,EAAE,mBAAmB;IACzB,GAAG,EAAG,mBAAmB;IACzB,GAAG,EAAG,mBAAmB;IACzB,GAAG,EAAG,oBAAoB;IAC1B,GAAG,EAAG,sCAAsC;IAC5C,GAAG,EAAG,gBAAgB;IACtB,GAAG,EAAG,qBAAqB;IAC3B,GAAG,EAAG,oBAAoB;IAC1B,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,YAAY;CACT,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IAC1C,MAAM,EAAQ,uCAAuC;IACrD,MAAM,EAAQ,6CAA6C;IAC3D,MAAM,EAAQ,0CAA0C;IACxD,MAAM,EAAQ,yBAAyB;IACvC,MAAM,EAAQ,4CAA4C;IAC1D,MAAM,EAAQ,8BAA8B;IAC5C,MAAM,EAAQ,iCAAiC;IAC/C,MAAM,EAAQ,uBAAuB;IACrC,MAAM,EAAQ,oCAAoC;CACzC,CAAC;AAEX;;GAEG;AACH,MAAM,mBAAmB,GAAG,sGAAsG,CAAC;AAEnI;;;GAGG;AACH,MAAM,WAAW,GAAG,gDAAgD,CAAC;AAErE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC/B,KAAa,EACb,UAA2D,EAAE;IAE7D,MAAM,EAAE,SAAS,GAAG,IAAI,EAAE,aAAa,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,uBAAuB;IACvB,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAClC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC9C,WAAW,GAAG,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,MAAM,OAAO,SAAS,QAAQ,CAAC,CAAC;IAC9E,CAAC;IAED,oBAAoB;IACpB,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzC,WAAW,GAAG,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC/C,WAAW,GAAG,IAAI,CAAC;YACnB,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACF,CAAC;IAED,gDAAgD;IAChD,MAAM,eAAe,GAAG,UAAU,CAAC;IACnC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACnD,WAAW,GAAG,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACvD,CAAC;IAED,kCAAkC;IAClC,MAAM,kBAAkB,GAAG,cAAc,CAAC;IAC1C,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACtD,WAAW,GAAG,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC;IAED,iDAAiD;IACjD,MAAM,UAAU,GAAG,uCAAuC,CAAC;IAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9C,WAAW,GAAG,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC;IAED,uEAAuE;IACvE,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClE,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5B,0DAA0D;YAC1D,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1C,WAAW,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAClD,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzC,CAAC;QACF,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,IAAI,aAAa,EAAE,CAAC;QACnB,iDAAiD;QACjD,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjC,SAAS,GAAG,aAAa,CAAC;YAC1B,qDAAqD;QACtD,CAAC;IACF,CAAC;SAAM,CAAC;QACP,mCAAmC;QACnC,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjC,SAAS,GAAG,aAAa,CAAC;YAC1B,qDAAqD;QACtD,CAAC;IACF,CAAC;IAED,OAAO;QACN,SAAS;QACT,WAAW;QACX,eAAe,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;KACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CACvC,OAAe,EACf,UAAkC,EAAE;IAEpC,MAAM,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAErC,gFAAgF;IAChF,OAAO,gBAAgB,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CACpC,KAAa,EACb,UAAkE,EAAE;IAEpE,MAAM,EAAE,oBAAoB,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAEpE,eAAe;IACf,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mCAAmC,SAAS,aAAa;SAChE,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;SAClC,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,0BAA0B;IAC1B,qBAAqB;IACrB,uCAAuC;IACvC,iEAAiE;IACjE,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mDAAmD;SAC1D,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC,oBAAoB,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sCAAsC;SAC7C,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,KAAK,MAAM,GAAG,IAAI,2BAA2B,EAAE,CAAC;QAC/C,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,oBAAoB,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5G,0CAA0C;YAC1C,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4CAA4C;aACnD,CAAC;QACH,CAAC;IACF,CAAC;IAED,uEAAuE;IACvE,+CAA+C;IAC/C,IAAI,oBAAoB,EAAE,CAAC;QAC1B,gEAAgE;QAChE,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,gDAAgD;aACvD,CAAC;QACH,CAAC;QAED,iFAAiF;QACjF,6EAA6E;QAC7E,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;QACvD,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8CAA8C;aACrD,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACpC,KAAa,EACb,UAA8D,EAAE;IAEhE,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAC/D,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,uBAAuB;IACvB,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAClC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC9C,WAAW,GAAG,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,MAAM,OAAO,SAAS,QAAQ,CAAC,CAAC;IAC9E,CAAC;IAED,oBAAoB;IACpB,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzC,WAAW,GAAG,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED,uBAAuB;IACvB,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/C,WAAW,GAAG,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC;IAED,mCAAmC;IACnC,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACvD,WAAW,GAAG,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC/C,CAAC;IAED,4CAA4C;IAC5C,MAAM,kBAAkB,GAAG,4CAA4C,CAAC;IACxE,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACtD,WAAW,GAAG,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAED,kBAAkB;IAClB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC/C,WAAW,GAAG,IAAI,CAAC;YACnB,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACF,CAAC;IAED,OAAO;QACN,SAAS;QACT,WAAW;QACX,eAAe,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;KACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAC3B,SAAiB,EACjB,aAAqB,EACrB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAE1C,mBAAmB;IACnB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uCAAuC;SAC9C,CAAC;IACH,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACzD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,iDAAiD;SACxD,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,yCAAyC;SAChD,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0BAA0B;SACjC,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAErD,wDAAwD;IACxD,IAAI,YAAoB,CAAC;IACzB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACP,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,4DAA4D;IAC5D,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QACpD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;IAE7B,MAAM,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QACtD,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC;IAE3B,0EAA0E;IAC1E,MAAM,YAAY,GACjB,YAAY,KAAK,cAAc,IAAI,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAE5E,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sEAAsE;SAC7E,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,iBAAiB,GAAG;QACzB,YAAY,EAAO,MAAM;QACzB,YAAY,EAAQ,MAAM;QAC1B,QAAQ,EAAW,UAAU;QAC7B,SAAS,EAAU,iBAAiB;QACpC,aAAa,EAAM,wBAAwB;QAC3C,QAAQ,EAAW,iBAAiB;QACpC,QAAQ,EAAW,iBAAiB;KACpC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,0CAA0C;aACjD,CAAC;QACH,CAAC;IACF,CAAC;IAED,gEAAgE;IAChE,uEAAuE;IACvE,6EAA6E;IAE7E,OAAO;QACN,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,YAAY;KAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAClC,WAAmB,EACnB,gBAA2B;IAE3B,0DAA0D;IAC1D,MAAM,SAAS,GAAG,gBAAgB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAErD,mBAAmB;IACnB,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+CAA+C;SACtD,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0BAA0B;SACjC,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,MAAM,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAC3C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CACtE,CAAC;IAEF,4DAA4D;IAC5D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,YAAY,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,MAAM,CAAC,cAAc;aACrC,CAAC;QACH,CAAC;IACF,CAAC;IAED,2CAA2C;IAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO;YACN,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,SAAS,CAAC,cAAc;SACxC,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,6CAA6C;KACpD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAClC,WAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,EAAE,SAAS,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC;IAEpC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+CAA+C;SACtD,CAAC;IACH,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACpC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0CAA0C,SAAS,aAAa;SACvE,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,MAAM,YAAY,GAAG,kBAAkB,CAAC;IACxC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+GAA+G;SACtH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/dist/backend/backend/src/utils/terminal-output.utils.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Terminal output utilities for processing PTY output.
+ *
+ * Provides functions for stripping ANSI escape codes and deduplicating
+ * chat responses from orchestrator terminal output.
+ *
+ * @module terminal-output-utils
+ */
+/**
+ * Strip ANSI escape codes from PTY output for reliable pattern matching.
+ *
+ * Handles color codes, cursor movements, OSC sequences, and other control
+ * characters. Cursor forward movements are replaced with spaces to preserve
+ * word boundaries in rendered output.
+ *
+ * @param content - Raw PTY output containing ANSI codes
+ * @returns Clean text with ANSI codes removed
+ */
+export declare function stripAnsiCodes(content: string): string;
+/**
+ * Generate a hash key for a chat response to detect duplicates.
+ *
+ * Normalizes whitespace and truncates to create a consistent key
+ * for the same logical response content.
+ *
+ * @param conversationId - The conversation this response belongs to
+ * @param content - The response content to hash
+ * @returns A string key for deduplication
+ */
+export declare function generateResponseHash(conversationId: string, content: string): string;
+/**
+ * Manages a set of recent response hashes for deduplication.
+ * Uses a circular eviction strategy to bound memory usage.
+ */
+export declare class ResponseDeduplicator {
+    private recentHashes;
+    private readonly maxSize;
+    /**
+     * @param maxSize - Maximum number of hashes to track before evicting oldest
+     */
+    constructor(maxSize?: number);
+    /**
+     * Check if a response is a duplicate and track it if not.
+     *
+     * @param hash - The response hash to check
+     * @returns true if the response is a duplicate, false if it's new
+     */
+    isDuplicate(hash: string): boolean;
+    /** Clear all tracked hashes */
+    clear(): void;
+    /** Current number of tracked hashes */
+    get size(): number;
+}
+//# sourceMappingURL=terminal-output.utils.d.ts.map

package/dist/backend/backend/src/utils/terminal-output.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-output.utils.d.ts","sourceRoot":"","sources":["../../../../../backend/src/utils/terminal-output.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAsBtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGpF;AAED;;;GAGG;AACH,qBAAa,oBAAoB;IAChC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC;;OAEG;gBACS,OAAO,GAAE,MAAW;IAIhC;;;;;OAKG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAclC,+BAA+B;IAC/B,KAAK,IAAI,IAAI;IAIb,uCAAuC;IACvC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACD"}