crewly 1.20.144 → 1.20.146

package/packages/crewly-agent/src/runtime/interactive-login-guard.ts

@@ -0,0 +1,76 @@
+/**
+ * Interactive harness login guard for the `bash_exec` tool.
+ *
+ * `claude setup-token`, `claude /login`, `claude auth login`, `codex login`
+ * and an Antigravity (`agy`) login print a link and then wait for the user
+ * to paste a code into the same process. `bash_exec` is one-shot: the
+ * process is killed when the tool call returns (or times out), so a code the
+ * owner pastes back later can never be redeemed.
+ *
+ * Incident 2026-09-26: the orchestrator ran `claude setup-token` this way,
+ * sent the owner the link, and every authorization code the owner pasted
+ * back went stale. Crewly's login broker keeps the login alive in its own
+ * terminal; the orchestrator reaches it with the `harness-login` skill.
+ *
+ * Status checks (`claude auth status`, `codex login status`) stay allowed.
+ *
+ * @module runtime/interactive-login-guard
+ */
+
+/** Where a command word may start: line start, a separator, a quote, or a path slash. */
+const CMD_START = String.raw`(?:^|[\s;&|()'"\x60/])`;
+
+/** Flags without values between the command and its subcommand (`codex --verbose login`). */
+const FLAGS = String.raw`(?:-{1,2}[\w-]+\s+)*`;
+
+/** Interactive login commands, each with a label for the refusal message. */
+const INTERACTIVE_LOGIN_PATTERNS: ReadonlyArray<{ pattern: RegExp; label: string }> = [
+	{ pattern: new RegExp(`${CMD_START}claude\\s[^\\n;&|]*?\\bsetup-token\\b`, 'i'), label: 'claude setup-token' },
+	{ pattern: new RegExp(`${CMD_START}claude(?=\\s)[^\\n;&|]*?[\\s'"]/login\\b`, 'i'), label: 'claude /login' },
+	{ pattern: new RegExp(`${CMD_START}claude\\s+${FLAGS}(?:auth\\s+)?login\\b`, 'i'), label: 'claude auth login' },
+	// `/login` typed into claude through a pipe: `echo /login | claude`.
+	{ pattern: new RegExp(`/login\\b[^\\n;&]*\\|\\s*(?:\\S*/)?claude\\b`, 'i'), label: 'claude /login' },
+	{ pattern: new RegExp(`${CMD_START}codex\\s+${FLAGS}login\\b(?!\\s+status\\b)`, 'i'), label: 'codex login' },
+	{ pattern: new RegExp(`${CMD_START}(?:agy|antigravity)\\s+${FLAGS}(?:auth\\s+)?login\\b`, 'i'), label: 'agy login' },
+];
+
+/** Where the orchestrator's login skill lives (relative to the Crewly project root). */
+export const HARNESS_LOGIN_SKILL_PATH = 'config/skills/orchestrator/harness-login/execute.sh';
+
+/**
+ * Which interactive harness login a shell command starts, if any.
+ *
+ * @param command - Raw shell command
+ * @returns A label such as "claude setup-token", or null when the command is not one
+ *
+ * @example
+ * ```ts
+ * detectInteractiveLogin('claude setup-token');   // 'claude setup-token'
+ * detectInteractiveLogin('codex login status');   // null
+ * ```
+ */
+export function detectInteractiveLogin(command: string): string | null {
+	if (typeof command !== 'string' || !command) return null;
+	for (const { pattern, label } of INTERACTIVE_LOGIN_PATTERNS) {
+		if (pattern.test(command)) return label;
+	}
+	return null;
+}
+
+/**
+ * The refusal `bash_exec` returns for an interactive harness login, or null
+ * when the command may run.
+ *
+ * @param command - Raw shell command
+ * @returns Refusal message pointing at the `harness-login` skill, or null
+ */
+export function checkInteractiveLoginCommand(command: string): string | null {
+	const label = detectInteractiveLogin(command);
+	if (!label) return null;
+	return (
+		`Refused: \`${label}\` is an interactive login. It would be killed when this tool call returns, so the code the owner pastes back would be stale. ` +
+		`Use the harness-login skill instead: bash ${HARNESS_LOGIN_SKILL_PATH} --harness claude|codex [--switch-account] ` +
+		'(orchestrator only — any other agent asks the orchestrator). Crewly keeps the login alive, sends the owner the link and types in the code they paste. ' +
+		'Do not retry this command or a variation.'
+	);
+}

package/packages/crewly-agent/src/runtime/reply-tool-calls.test.ts

@@ -0,0 +1,53 @@
+/**
+ * Tests for reply tool detection and the empty-text summary fallback rule.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { SUMMARY_FALLBACK_PROMPT, isReplyToolCall, shouldRequestSummaryFallback } from './reply-tool-calls.js';
+
+const REPLY_CHAT = {
+  toolName: 'bash_exec',
+  args: { command: `bash config/skills/orchestrator/reply-chat/execute.sh '{"conversationId":"a721f48d","content":"链接在下面"}'` },
+};
+
+describe('isReplyToolCall', () => {
+  it('recognises reply tools and reply skills run through the shell', () => {
+    expect(isReplyToolCall({ toolName: 'reply_slack' })).toBe(true);
+    expect(isReplyToolCall({ toolName: 'reply-slack' })).toBe(true);
+    expect(isReplyToolCall(REPLY_CHAT)).toBe(true);
+    expect(isReplyToolCall({ toolName: 'bash_exec', args: { command: 'bash config/skills/agent/core/reply-channel/execute.sh --text hi' } })).toBe(true);
+    expect(isReplyToolCall({ toolName: 'Bash', args: { command: 'bash config/skills/orchestrator/reply-slack/execute.sh x' } })).toBe(true);
+  });
+
+  it('ignores other tools and other shell commands', () => {
+    expect(isReplyToolCall({ toolName: 'get_team_status' })).toBe(false);
+    expect(isReplyToolCall({ toolName: 'bash_exec', args: { command: 'claude auth status' } })).toBe(false);
+    expect(isReplyToolCall({ toolName: 'bash_exec', args: {} })).toBe(false);
+    expect(isReplyToolCall({ toolName: 'read_file', args: { command: 'reply-chat' } })).toBe(false);
+  });
+});
+
+describe('shouldRequestSummaryFallback', () => {
+  it('asks for a closing reply when tools ran and nothing was said', () => {
+    expect(shouldRequestSummaryFallback('', [{ toolName: 'bash_exec', args: { command: 'claude --version' } }])).toBe(true);
+  });
+
+  it('stays silent when the reply already went out with a reply tool (2026-09-26 noise)', () => {
+    expect(shouldRequestSummaryFallback('', [{ toolName: 'bash_exec', args: { command: 'claude --version' } }, REPLY_CHAT])).toBe(false);
+  });
+
+  it('never runs when there is text or no tool call', () => {
+    expect(shouldRequestSummaryFallback('Done.', [REPLY_CHAT])).toBe(false);
+    expect(shouldRequestSummaryFallback('', [])).toBe(false);
+  });
+});
+
+describe('SUMMARY_FALLBACK_PROMPT', () => {
+  it('asks for a short user-facing reply in their language, not a status report', () => {
+    expect(SUMMARY_FALLBACK_PROMPT).toMatch(/in their language/);
+    expect(SUMMARY_FALLBACK_PROMPT).toMatch(/No status report/);
+    expect(SUMMARY_FALLBACK_PROMPT).toMatch(/do not say you sent anything unless a tool actually sent it/);
+    expect(SUMMARY_FALLBACK_PROMPT).not.toMatch(/summarize what you just did/i);
+    expect(SUMMARY_FALLBACK_PROMPT).not.toMatch(/report-status/);
+  });
+});

package/packages/crewly-agent/src/runtime/reply-tool-calls.ts

@@ -0,0 +1,76 @@
+/**
+ * Reply tool calls and the empty-text summary fallback.
+ *
+ * When a turn ends with tool calls but no text, the runner used to ask the
+ * model to "summarize what you just did, what you found, and any issues".
+ * For an agent answering a person, that summary is what reaches them: the
+ * owner's Slack DM got several English meta reports in a row — "I've sent the
+ * reply. Here's my status: *What the user asked* … *What I did* … *Next step*
+ * … *Note on the ticket instruction*" (2026-09-26). The status-report shape
+ * then stayed in the conversation history and the model kept repeating it.
+ *
+ * Two changes live here:
+ * - {@link shouldRequestSummaryFallback}: no fallback when the turn already
+ *   sent its reply with a reply tool — the answer is out; anything more is
+ *   noise.
+ * - {@link SUMMARY_FALLBACK_PROMPT}: the fallback asks for a short reply to
+ *   the person, in their language, not a status report.
+ *
+ * @module runtime/reply-tool-calls
+ */
+
+/** The slice of a tool call record these helpers read. */
+export interface ToolCallLike {
+  toolName: string;
+  args?: Record<string, unknown>;
+}
+
+/** Tools that post a reply to a person by themselves. */
+const REPLY_TOOL_NAMES: ReadonlySet<string> = new Set(['reply_slack', 'reply-slack', 'reply_chat', 'reply-chat', 'send_chat_response']);
+
+/** Shell tools whose command can run a reply skill. */
+const SHELL_TOOL_NAMES: ReadonlySet<string> = new Set(['bash_exec', 'bash', 'Bash', 'shell']);
+
+/** Reply skills run through the shell (`bash config/skills/…/reply-chat/execute.sh …`). */
+const REPLY_SKILL_PATTERN = /\b(?:reply-chat|reply-slack|reply-gchat|reply-remote|reply-channel|send-chat-response)\b/;
+
+/**
+ * Whether a tool call sent a reply to a person.
+ *
+ * @param call - Tool call record
+ * @returns True for a reply tool, or a shell call that runs a reply skill
+ */
+export function isReplyToolCall(call: ToolCallLike): boolean {
+  if (REPLY_TOOL_NAMES.has(call.toolName)) return true;
+  if (!SHELL_TOOL_NAMES.has(call.toolName)) return false;
+  const command = call.args?.command;
+  return typeof command === 'string' && REPLY_SKILL_PATTERN.test(command);
+}
+
+/**
+ * Whether the runner should ask the model for a closing text.
+ *
+ * Only when the turn produced no text, made tool calls, and none of them
+ * sent the reply already.
+ *
+ * @param text - The turn's final text
+ * @param toolCalls - The turn's tool calls
+ * @returns True when the fallback should run
+ */
+export function shouldRequestSummaryFallback(text: string, toolCalls: readonly ToolCallLike[]): boolean {
+  if (text || toolCalls.length === 0) return false;
+  return !toolCalls.some(isReplyToolCall);
+}
+
+/**
+ * Follow-up prompt when a turn ended with tool calls and no text: a short
+ * answer to whoever wrote, in their language — never a status report, never
+ * a claim of having sent something.
+ */
+export const SUMMARY_FALLBACK_PROMPT =
+  '请直接回复给你发消息的人：用对方的语言，简短（1-3 句），只写答案或结果本身。' +
+  '不要写状态汇报（不要"用户问了什么 / 我做了什么 / 下一步"之类的小标题），不要描述你调用了哪些工具，' +
+  '也不要说你已经发送了什么——除非这一轮真的用工具发出去了。\n' +
+  'Reply directly to the person who wrote to you: in their language, short (1-3 sentences), only the answer or result itself. ' +
+  'No status report (no "What the user asked / What I did / Next step" sections), do not describe your tool calls, ' +
+  'and do not say you sent anything unless a tool actually sent it in this turn.';

package/packages/crewly-agent/src/runtime/tool-registry.test.ts

@@ -2245,6 +2245,14 @@ describe('Tool Registry', () => {
       expect(result.error).toContain('blocked');
     });
 
+    it('refuses interactive harness logins and points at harness-login (2026-09-26)', async () => {
+      const result = await bashTools.bash_exec.execute({ command: 'claude setup-token' }) as any;
+      expect(result.success).toBe(false);
+      expect(result.exitCode).toBe(126);
+      expect(result.error).toContain('harness-login');
+      expect(result.stdout).toBe('');
+    });
+
     it('should handle command failure gracefully', async () => {
       const result = await bashTools.bash_exec.execute({ command: 'false' }) as any;
       expect(result.success).toBe(false);

package/packages/crewly-agent/src/runtime/tool-registry.ts

@@ -21,6 +21,7 @@ import { OutputFilterService } from './output-filter.service.js';
 import { createWebSearchTool } from './web-search.tool.js';
 import { createComputerTool } from './computer.tool.js';
 import { createDesktopTaskTool } from './desktop-task.tool.js';
+import { checkInteractiveLoginCommand } from './interactive-login-guard.js';
 
 /** TTL for delegation idle event subscriptions (minutes) */
 const DELEGATION_SUBSCRIPTION_TTL_MINUTES = 120;
@@ -1821,6 +1822,19 @@ export function createTools(client: CrewlyApiClient, sessionName: string, projec
       execute: async ({ command, cwd, timeout }) => {
         const cmd = command as string;
 
+        // Interactive harness logins die with this one-shot call; the owner's
+        // pasted code would go stale (2026-09-26). Point at harness-login.
+        const loginRefusal = checkInteractiveLoginCommand(cmd);
+        if (loginRefusal) {
+          return {
+            success: false,
+            exitCode: 126,
+            stdout: '',
+            stderr: loginRefusal,
+            error: loginRefusal,
+          };
+        }
+
         // Check command against blocklist before execution
         const blockReason = validateBashCommand(cmd);
         if (blockReason) {