crewly 1.20.156 → 1.20.158

package/dist/backend/backend/src/utils/secret-redactor.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Secret redactor for persisted terminal output.
+ *
+ * Every byte of agent PTY output that Crewly writes to disk
+ * (~/.crewly/logs/sessions/*.log) passes through here, and so do the
+ * one-time scrub of existing logs and shell history files
+ * (`crewly security scrub-logs`). Three layers, applied in this order:
+ *
+ * 1. **Known values** — the exact value of every secret Crewly holds for the
+ *    session (backend env + the session's spawn env, see
+ *    collectSecretEnvValues). Catches secrets no pattern recognises (a Slack
+ *    signing secret is plain hex). Masked as `[REDACTED <NAME>]`.
+ * 2. **Secret-named assignments** — `NAME=value` where NAME is a secret name
+ *    (isSecretEnvKey: `…API_KEY`, `…TOKEN`, `…SECRET`, `…PASSWORD`,
+ *    `…PRIVATE_KEY`, … plus SECRET_REDACTION_CONSTANTS.KNOWN_SECRET_ENV_NAMES).
+ *    The value is masked whatever it looks like. Names are matched on the
+ *    whole identifier, so `TOKEN_COUNT=5` or `MAX_TOKENS=4096` are left alone
+ *    (the name does not END in a secret suffix); `$VAR` references and
+ *    already-masked values are left alone too.
+ * 3. **Token shapes** — well-known raw credential formats wherever they
+ *    appear: Slack `xoxb-/xoxp-/xoxa-/xoxe-/xapp-…`, OpenAI/DeepSeek `sk-…`,
+ *    Anthropic `sk-ant-…`, Google `AIza…`, GitHub `ghp_/gho_/…` and
+ *    `github_pat_…`, plus the wiki confidentiality patterns (JWTs, bearer
+ *    headers, private-key blocks, connection strings).
+ *
+ * Redaction is idempotent: running it over already-redacted text changes
+ * nothing and reports a count of 0.
+ *
+ * Output is streamed in arbitrary chunks, so a secret can be split between
+ * two chunks. StreamingSecretRedactor holds back the tail after the last
+ * whitespace (secrets never contain whitespace) and prepends it to the next
+ * chunk, which keeps the whole thing linear with a small bounded carry.
+ *
+ * @module utils/secret-redactor
+ */
+import { type SecretEnvValue } from './secret-env.js';
+/**
+ * Whether an assignment's name marks its value as secret.
+ *
+ * @param name - Variable name as it appeared (any case)
+ * @returns True for secret names (see module docs)
+ */
+export declare function isSecretAssignmentName(name: string): boolean;
+/** Result of a counted redaction. */
+export interface RedactionResult {
+    /** The masked text */
+    text: string;
+    /** Number of secrets masked (0 when the text was already clean) */
+    count: number;
+}
+/**
+ * Masks every secret in a complete piece of text and counts what was masked.
+ *
+ * @param text - Text to mask
+ * @param knownSecrets - Exact secret values to mask (see collectSecretEnvValues)
+ * @returns Masked text and the number of secrets masked
+ *
+ * @example
+ * ```ts
+ * redactSecretsWithCount('export OPENAI_API_KEY=sk-abc…').count; // 1
+ * redactSecretsWithCount('TOKEN_COUNT=5').count; // 0
+ * ```
+ */
+export declare function redactSecretsWithCount(text: string, knownSecrets?: readonly SecretEnvValue[]): RedactionResult;
+/**
+ * Masks every secret in a complete piece of text.
+ *
+ * @param text - Text to mask
+ * @param knownSecrets - Exact secret values to mask
+ * @returns The masked text
+ */
+export declare function redactSecrets(text: string, knownSecrets?: readonly SecretEnvValue[]): string;
+/**
+ * Chunk-boundary-safe redactor for streamed output.
+ *
+ * `push()` returns the redacted text that is safe to emit now and holds back
+ * the tail after the last whitespace; `flush()` returns whatever is held back
+ * (call it when the stream closes). Only the new chunk is scanned for
+ * whitespace (the carry never contains any), so work is linear in the input.
+ * A run of more than MAX_CARRY_CHARS non-whitespace characters is cut at a
+ * non-token character near its end (or hard-cut when there is none), keeping
+ * the carry bounded.
+ *
+ * @example
+ * ```ts
+ * const r = new StreamingSecretRedactor();
+ * log.write(r.push('export GEMINI_API_KEY=AIzaSy'));
+ * log.write(r.push('…rest of key\n'));
+ * log.write(r.flush());
+ * ```
+ */
+export declare class StreamingSecretRedactor {
+    private carry;
+    private knownSecrets;
+    private readonly maxCarry;
+    private readonly minCarry;
+    /**
+     * @param knownSecrets - Exact secret values to mask
+     * @param maxCarry - Longest whitespace-free tail held back before forcing a cut
+     */
+    constructor(knownSecrets?: readonly SecretEnvValue[], maxCarry?: number);
+    /**
+     * Replaces the exact-value secret set (e.g. after the session's env changes).
+     *
+     * @param knownSecrets - Exact secret values to mask
+     */
+    setKnownSecrets(knownSecrets: readonly SecretEnvValue[]): void;
+    /**
+     * Feeds one chunk and returns the redacted text that can be emitted now.
+     *
+     * @param chunk - Next piece of output
+     * @returns Redacted text (possibly empty while a word is still arriving)
+     */
+    push(chunk: string): string;
+    /**
+     * Returns (redacted) whatever is still held back and resets the carry.
+     *
+     * @returns Remaining redacted text
+     */
+    flush(): string;
+    /**
+     * Picks a cut point for a whitespace-free run that outgrew the carry: the
+     * last non-token character before the final minCarry characters, so a
+     * credential near the end is not split; hard cut when there is none.
+     *
+     * @param buf - Buffered text whose tail has no whitespace
+     * @returns Index to cut at
+     */
+    private forcedCut;
+}
+//# sourceMappingURL=secret-redactor.d.ts.map

package/dist/backend/backend/src/utils/secret-redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redactor.d.ts","sourceRoot":"","sources":["../../../../../backend/src/utils/secret-redactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA6CtE;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAO5D;AAED,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC/B,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,SAAS,cAAc,EAAO,GAAG,eAAe,CA2BlH;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,SAAS,cAAc,EAAO,GAAG,MAAM,CAEhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,uBAAuB;IACnC,OAAO,CAAC,KAAK,CAAM;IACnB,OAAO,CAAC,YAAY,CAA4B;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC;;;OAGG;gBAEF,YAAY,GAAE,SAAS,cAAc,EAAO,EAC5C,QAAQ,GAAE,MAAmD;IAO9D;;;;OAIG;IACH,eAAe,CAAC,YAAY,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;IAI9D;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAyB3B;;;;OAIG;IACH,KAAK,IAAI,MAAM;IAMf;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS;CAQjB"}

package/dist/backend/backend/src/utils/secret-redactor.js

@@ -0,0 +1,233 @@
+/**
+ * Secret redactor for persisted terminal output.
+ *
+ * Every byte of agent PTY output that Crewly writes to disk
+ * (~/.crewly/logs/sessions/*.log) passes through here, and so do the
+ * one-time scrub of existing logs and shell history files
+ * (`crewly security scrub-logs`). Three layers, applied in this order:
+ *
+ * 1. **Known values** — the exact value of every secret Crewly holds for the
+ *    session (backend env + the session's spawn env, see
+ *    collectSecretEnvValues). Catches secrets no pattern recognises (a Slack
+ *    signing secret is plain hex). Masked as `[REDACTED <NAME>]`.
+ * 2. **Secret-named assignments** — `NAME=value` where NAME is a secret name
+ *    (isSecretEnvKey: `…API_KEY`, `…TOKEN`, `…SECRET`, `…PASSWORD`,
+ *    `…PRIVATE_KEY`, … plus SECRET_REDACTION_CONSTANTS.KNOWN_SECRET_ENV_NAMES).
+ *    The value is masked whatever it looks like. Names are matched on the
+ *    whole identifier, so `TOKEN_COUNT=5` or `MAX_TOKENS=4096` are left alone
+ *    (the name does not END in a secret suffix); `$VAR` references and
+ *    already-masked values are left alone too.
+ * 3. **Token shapes** — well-known raw credential formats wherever they
+ *    appear: Slack `xoxb-/xoxp-/xoxa-/xoxe-/xapp-…`, OpenAI/DeepSeek `sk-…`,
+ *    Anthropic `sk-ant-…`, Google `AIza…`, GitHub `ghp_/gho_/…` and
+ *    `github_pat_…`, plus the wiki confidentiality patterns (JWTs, bearer
+ *    headers, private-key blocks, connection strings).
+ *
+ * Redaction is idempotent: running it over already-redacted text changes
+ * nothing and reports a count of 0.
+ *
+ * Output is streamed in arbitrary chunks, so a secret can be split between
+ * two chunks. StreamingSecretRedactor holds back the tail after the last
+ * whitespace (secrets never contain whitespace) and prepends it to the next
+ * chunk, which keeps the whole thing linear with a small bounded carry.
+ *
+ * @module utils/secret-redactor
+ */
+import { SECRET_REDACTION_CONSTANTS } from '../constants.js';
+import { SECRET_PATTERNS } from '../services/wiki/wiki-redaction.js';
+import { isSecretEnvKey } from './secret-env.js';
+/**
+ * Raw token shapes beyond the wiki SECRET_PATTERNS (which require a numeric
+ * team segment for Slack tokens and do not know `xapp-` or `github_pat_`).
+ */
+const EXTRA_TOKEN_PATTERNS = [
+    { name: 'slack_token', regex: /\bxox[abposre]-[A-Za-z0-9-]{10,}/g, mask: '[REDACTED slack_token]' },
+    { name: 'slack_app_token', regex: /\bxapp-[A-Za-z0-9-]{10,}/g, mask: '[REDACTED slack_app_token]' },
+    { name: 'anthropic_key', regex: /\bsk-ant-[A-Za-z0-9_-]{20,}/g, mask: '[REDACTED api_key]' },
+    { name: 'github_pat', regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, mask: '[REDACTED github_token]' },
+];
+/** Every token-shape detector, most specific first. */
+const TOKEN_PATTERNS = [...EXTRA_TOKEN_PATTERNS, ...SECRET_PATTERNS];
+/**
+ * `NAME=value` (optionally quoted value). The value stops at whitespace,
+ * quotes, backticks and shell separators. The identifier must start at a
+ * word boundary so it is matched whole.
+ */
+const ASSIGNMENT_RE = /\b([A-Za-z_][A-Za-z0-9_]*)=(["']?)([^\s"'`;&|]+)/g;
+/** Prefix every mask this module emits starts with. */
+const REDACTED_PREFIX = '[REDACTED';
+/** Mask written in place of a secret-named assignment's value. */
+const ASSIGNMENT_MASK = '[REDACTED]';
+/** Characters that can appear inside a credential or a `NAME=value` pair. */
+const TOKEN_CHAR_RE = /[A-Za-z0-9_\-=.:/+"'[\]]/;
+/** Known secret names, upper-cased, for O(1) lookup. */
+const KNOWN_SECRET_NAMES = new Set(SECRET_REDACTION_CONSTANTS.KNOWN_SECRET_ENV_NAMES);
+/**
+ * Whether an assignment's name marks its value as secret.
+ *
+ * @param name - Variable name as it appeared (any case)
+ * @returns True for secret names (see module docs)
+ */
+export function isSecretAssignmentName(name) {
+    const upper = name.toUpperCase();
+    return (KNOWN_SECRET_NAMES.has(upper) ||
+        isSecretEnvKey(name) ||
+        SECRET_REDACTION_CONSTANTS.SECRET_NAME_PATTERNS.some((re) => re.test(upper)));
+}
+/**
+ * Masks every secret in a complete piece of text and counts what was masked.
+ *
+ * @param text - Text to mask
+ * @param knownSecrets - Exact secret values to mask (see collectSecretEnvValues)
+ * @returns Masked text and the number of secrets masked
+ *
+ * @example
+ * ```ts
+ * redactSecretsWithCount('export OPENAI_API_KEY=sk-abc…').count; // 1
+ * redactSecretsWithCount('TOKEN_COUNT=5').count; // 0
+ * ```
+ */
+export function redactSecretsWithCount(text, knownSecrets = []) {
+    let out = text;
+    let count = 0;
+    for (const { name, value } of knownSecrets) {
+        if (!value || !out.includes(value))
+            continue;
+        const parts = out.split(value);
+        count += parts.length - 1;
+        out = parts.join(`${REDACTED_PREFIX} ${name}]`);
+    }
+    out = out.replace(ASSIGNMENT_RE, (match, name, quote, value) => {
+        if (!isSecretAssignmentName(name) || value.startsWith('$') || value.startsWith(REDACTED_PREFIX))
+            return match;
+        count++;
+        return `${name}=${quote}${ASSIGNMENT_MASK}`;
+    });
+    for (const p of TOKEN_PATTERNS) {
+        p.regex.lastIndex = 0;
+        out = out.replace(p.regex, (match) => {
+            if (match === p.mask)
+                return match;
+            count++;
+            return p.mask;
+        });
+    }
+    return { text: out, count };
+}
+/**
+ * Masks every secret in a complete piece of text.
+ *
+ * @param text - Text to mask
+ * @param knownSecrets - Exact secret values to mask
+ * @returns The masked text
+ */
+export function redactSecrets(text, knownSecrets = []) {
+    return redactSecretsWithCount(text, knownSecrets).text;
+}
+/**
+ * Chunk-boundary-safe redactor for streamed output.
+ *
+ * `push()` returns the redacted text that is safe to emit now and holds back
+ * the tail after the last whitespace; `flush()` returns whatever is held back
+ * (call it when the stream closes). Only the new chunk is scanned for
+ * whitespace (the carry never contains any), so work is linear in the input.
+ * A run of more than MAX_CARRY_CHARS non-whitespace characters is cut at a
+ * non-token character near its end (or hard-cut when there is none), keeping
+ * the carry bounded.
+ *
+ * @example
+ * ```ts
+ * const r = new StreamingSecretRedactor();
+ * log.write(r.push('export GEMINI_API_KEY=AIzaSy'));
+ * log.write(r.push('…rest of key\n'));
+ * log.write(r.flush());
+ * ```
+ */
+export class StreamingSecretRedactor {
+    carry = '';
+    knownSecrets;
+    maxCarry;
+    minCarry;
+    /**
+     * @param knownSecrets - Exact secret values to mask
+     * @param maxCarry - Longest whitespace-free tail held back before forcing a cut
+     */
+    constructor(knownSecrets = [], maxCarry = SECRET_REDACTION_CONSTANTS.MAX_CARRY_CHARS) {
+        this.knownSecrets = knownSecrets;
+        this.maxCarry = Math.max(maxCarry, 2);
+        this.minCarry = Math.max(1, Math.min(SECRET_REDACTION_CONSTANTS.MIN_FORCED_CARRY_CHARS, Math.floor(this.maxCarry / 2)));
+    }
+    /**
+     * Replaces the exact-value secret set (e.g. after the session's env changes).
+     *
+     * @param knownSecrets - Exact secret values to mask
+     */
+    setKnownSecrets(knownSecrets) {
+        this.knownSecrets = knownSecrets;
+    }
+    /**
+     * Feeds one chunk and returns the redacted text that can be emitted now.
+     *
+     * @param chunk - Next piece of output
+     * @returns Redacted text (possibly empty while a word is still arriving)
+     */
+    push(chunk) {
+        if (!chunk)
+            return '';
+        const carryLength = this.carry.length;
+        const buf = this.carry + chunk;
+        let cut = -1;
+        for (let i = buf.length - 1; i >= carryLength; i--) {
+            if (isWhitespace(buf.charCodeAt(i))) {
+                cut = i + 1;
+                break;
+            }
+        }
+        if (cut === -1 || buf.length - cut > this.maxCarry) {
+            if (buf.length <= this.maxCarry) {
+                this.carry = buf;
+                return '';
+            }
+            cut = this.forcedCut(buf);
+        }
+        this.carry = buf.slice(cut);
+        return cut > 0 ? redactSecrets(buf.slice(0, cut), this.knownSecrets) : '';
+    }
+    /**
+     * Returns (redacted) whatever is still held back and resets the carry.
+     *
+     * @returns Remaining redacted text
+     */
+    flush() {
+        const rest = this.carry;
+        this.carry = '';
+        return rest ? redactSecrets(rest, this.knownSecrets) : '';
+    }
+    /**
+     * Picks a cut point for a whitespace-free run that outgrew the carry: the
+     * last non-token character before the final minCarry characters, so a
+     * credential near the end is not split; hard cut when there is none.
+     *
+     * @param buf - Buffered text whose tail has no whitespace
+     * @returns Index to cut at
+     */
+    forcedCut(buf) {
+        const target = buf.length - this.minCarry;
+        const floor = Math.max(0, target - this.minCarry);
+        for (let i = target; i > floor; i--) {
+            if (!TOKEN_CHAR_RE.test(buf[i - 1]))
+                return i;
+        }
+        return target;
+    }
+}
+/**
+ * Whitespace test on a UTF-16 code unit (space, tab, CR, LF, VT, FF).
+ *
+ * @param code - Character code
+ * @returns True for ASCII whitespace
+ */
+function isWhitespace(code) {
+    return code === 32 || (code >= 9 && code <= 13);
+}
+//# sourceMappingURL=secret-redactor.js.map

package/dist/backend/backend/src/utils/secret-redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redactor.js","sourceRoot":"","sources":["../../../../../backend/src/utils/secret-redactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAuB,MAAM,iBAAiB,CAAC;AAYtE;;;GAGG;AACH,MAAM,oBAAoB,GAA4B;IACrD,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,mCAAmC,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACnG,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACnG,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC5F,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,yBAAyB,EAAE;CACjG,CAAC;AAEF,uDAAuD;AACvD,MAAM,cAAc,GAA4B,CAAC,GAAG,oBAAoB,EAAE,GAAG,eAAe,CAAC,CAAC;AAE9F;;;;GAIG;AACH,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAE1E,uDAAuD;AACvD,MAAM,eAAe,GAAG,WAAW,CAAC;AAEpC,kEAAkE;AAClE,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,6EAA6E;AAC7E,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,wDAAwD;AACxD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CACN,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC;QAC7B,cAAc,CAAC,IAAI,CAAC;QACpB,0BAA0B,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAC5E,CAAC;AACH,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,eAA0C,EAAE;IAChG,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,YAAY,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1B,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,IAAI,IAAI,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,KAAa,EAAE,IAAY,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE;QAC9F,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9G,KAAK,EAAE,CAAC;QACR,OAAO,GAAG,IAAI,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE;YAC5C,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACnC,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,eAA0C,EAAE;IACvF,OAAO,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,uBAAuB;IAC3B,KAAK,GAAG,EAAE,CAAC;IACX,YAAY,CAA4B;IAC/B,QAAQ,CAAS;IACjB,QAAQ,CAAS;IAElC;;;OAGG;IACH,YACC,eAA0C,EAAE,EAC5C,WAAmB,0BAA0B,CAAC,eAAe;QAE7D,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzH,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,YAAuC;QACtD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,KAAa;QACjB,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAE/B,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBACZ,MAAM;YACP,CAAC;QACF,CAAC;QAED,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpD,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;gBACjB,OAAO,EAAE,CAAC;YACX,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IAED;;;;;;;OAOG;IACK,SAAS,CAAC,GAAW;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;CACD;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC"}

package/dist/backend/backend/src/utils/shell-history.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Keeps agent shells out of the user's shell history.
+ *
+ * Crewly used to type `export GEMINI_API_KEY=…` into agent shells, and bash
+ * wrote those lines to ~/.bash_history hundreds of times. Secrets now travel
+ * only in the spawn env (utils/secret-env), and on top of that agent shells
+ * never write a history file at all:
+ *
+ * - historyOffSpawnEnv() goes into every PTY's spawn environment;
+ * - shellHistoryDisableLine() is typed first by the runtime init sequence,
+ *   after the rc files ran (they may set HISTFILE themselves);
+ * - quietShellLine() prefixes every other typed line with a space, which
+ *   bash (HISTCONTROL=ignorespace) and zsh (HIST_IGNORE_SPACE) skip.
+ *
+ * See SHELL_HISTORY_CONSTANTS for why HISTSIZE/HISTFILESIZE are not touched.
+ *
+ * @module utils/shell-history
+ */
+/**
+ * Env vars that keep a freshly spawned bash/zsh from writing history.
+ *
+ * @returns A fresh copy (callers may spread or mutate it)
+ */
+export declare function historyOffSpawnEnv(): Record<string, string>;
+/**
+ * Prefixes a line typed into a shell with a space so it is not recorded.
+ * Already-prefixed lines are returned unchanged.
+ *
+ * @param line - Shell command line
+ * @returns The line, space-prefixed
+ */
+export declare function quietShellLine(line: string): string;
+/**
+ * The (space-prefixed) line that turns history off inside a running shell.
+ *
+ * @param shell - Shell binary path (defaults to $SHELL, then /bin/bash — what
+ *   agent PTYs are spawned with)
+ * @returns The line to type, or null for a shell we do not know how to quiet
+ */
+export declare function shellHistoryDisableLine(shell?: string | undefined): string | null;
+/**
+ * Quotes a value for a POSIX shell word (single quotes).
+ *
+ * @param value - Raw value
+ * @returns Single-quoted value safe for `sh -c`
+ */
+export declare function shellQuote(value: string): string;
+//# sourceMappingURL=shell-history.d.ts.map

package/dist/backend/backend/src/utils/shell-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-history.d.ts","sourceRoot":"","sources":["../../../../../backend/src/utils/shell-history.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE3D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,GAAE,MAAM,GAAG,SAA4C,GAAG,MAAM,GAAG,IAAI,CAOnH;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD"}

package/dist/backend/backend/src/utils/shell-history.js

@@ -0,0 +1,65 @@
+/**
+ * Keeps agent shells out of the user's shell history.
+ *
+ * Crewly used to type `export GEMINI_API_KEY=…` into agent shells, and bash
+ * wrote those lines to ~/.bash_history hundreds of times. Secrets now travel
+ * only in the spawn env (utils/secret-env), and on top of that agent shells
+ * never write a history file at all:
+ *
+ * - historyOffSpawnEnv() goes into every PTY's spawn environment;
+ * - shellHistoryDisableLine() is typed first by the runtime init sequence,
+ *   after the rc files ran (they may set HISTFILE themselves);
+ * - quietShellLine() prefixes every other typed line with a space, which
+ *   bash (HISTCONTROL=ignorespace) and zsh (HIST_IGNORE_SPACE) skip.
+ *
+ * See SHELL_HISTORY_CONSTANTS for why HISTSIZE/HISTFILESIZE are not touched.
+ *
+ * @module utils/shell-history
+ */
+import * as path from 'path';
+import { SHELL_HISTORY_CONSTANTS } from '../constants.js';
+/**
+ * Env vars that keep a freshly spawned bash/zsh from writing history.
+ *
+ * @returns A fresh copy (callers may spread or mutate it)
+ */
+export function historyOffSpawnEnv() {
+    return { ...SHELL_HISTORY_CONSTANTS.SPAWN_ENV };
+}
+/**
+ * Prefixes a line typed into a shell with a space so it is not recorded.
+ * Already-prefixed lines are returned unchanged.
+ *
+ * @param line - Shell command line
+ * @returns The line, space-prefixed
+ */
+export function quietShellLine(line) {
+    const prefix = SHELL_HISTORY_CONSTANTS.TYPED_LINE_PREFIX;
+    return line.startsWith(prefix) ? line : `${prefix}${line}`;
+}
+/**
+ * The (space-prefixed) line that turns history off inside a running shell.
+ *
+ * @param shell - Shell binary path (defaults to $SHELL, then /bin/bash — what
+ *   agent PTYs are spawned with)
+ * @returns The line to type, or null for a shell we do not know how to quiet
+ */
+export function shellHistoryDisableLine(shell = process.env.SHELL || '/bin/bash') {
+    const name = path.basename(shell || '').toLowerCase();
+    if (SHELL_HISTORY_CONSTANTS.POSIX_SHELLS.includes(name)) {
+        return quietShellLine(SHELL_HISTORY_CONSTANTS.DISABLE_COMMAND);
+    }
+    if (name === 'fish')
+        return quietShellLine(SHELL_HISTORY_CONSTANTS.FISH_DISABLE_COMMAND);
+    return null;
+}
+/**
+ * Quotes a value for a POSIX shell word (single quotes).
+ *
+ * @param value - Raw value
+ * @returns Single-quoted value safe for `sh -c`
+ */
+export function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+//# sourceMappingURL=shell-history.js.map

package/dist/backend/backend/src/utils/shell-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-history.js","sourceRoot":"","sources":["../../../../../backend/src/utils/shell-history.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IACjC,OAAO,EAAE,GAAG,uBAAuB,CAAC,SAAS,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,uBAAuB,CAAC,iBAAiB,CAAC;IACzD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAA4B,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,WAAW;IACnG,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,uBAAuB,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,cAAc,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACvC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC"}

package/dist/backend/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "5233785771aa0a83f6d21cb505b71ed364400071",
-  "builtAt": "2026-09-28T23:47:02.182Z"
+  "commit": "3559f14554ede3b919f8d8650ced719af929e1a1",
+  "builtAt": "2026-09-29T05:28:20.365Z"
 }