crewly 1.20.157 → 1.20.159

package/dist/backend/backend/src/utils/secret-redactor.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Secret redactor for persisted terminal output.
+ *
+ * Every byte of agent PTY output that Crewly writes to disk
+ * (~/.crewly/logs/sessions/*.log) passes through here, and so do the
+ * one-time scrub of existing logs and shell history files
+ * (`crewly security scrub-logs`). Three layers, applied in this order:
+ *
+ * 1. **Known values** — the exact value of every secret Crewly holds for the
+ *    session (backend env + the session's spawn env, see
+ *    collectSecretEnvValues). Catches secrets no pattern recognises (a Slack
+ *    signing secret is plain hex). Masked as `[REDACTED <NAME>]`.
+ * 2. **Secret-named assignments** — `NAME=value` where NAME is a secret name
+ *    (isSecretEnvKey: `…API_KEY`, `…TOKEN`, `…SECRET`, `…PASSWORD`,
+ *    `…PRIVATE_KEY`, … plus SECRET_REDACTION_CONSTANTS.KNOWN_SECRET_ENV_NAMES).
+ *    The value is masked whatever it looks like. Names are matched on the
+ *    whole identifier, so `TOKEN_COUNT=5` or `MAX_TOKENS=4096` are left alone
+ *    (the name does not END in a secret suffix); `$VAR` references and
+ *    already-masked values are left alone too.
+ * 3. **Token shapes** — well-known raw credential formats wherever they
+ *    appear: Slack `xoxb-/xoxp-/xoxa-/xoxe-/xapp-…`, OpenAI/DeepSeek `sk-…`,
+ *    Anthropic `sk-ant-…`, Google `AIza…`, GitHub `ghp_/gho_/…` and
+ *    `github_pat_…`, plus the wiki confidentiality patterns (JWTs, bearer
+ *    headers, private-key blocks, connection strings).
+ *
+ * Redaction is idempotent: running it over already-redacted text changes
+ * nothing and reports a count of 0.
+ *
+ * Output is streamed in arbitrary chunks, so a secret can be split between
+ * two chunks. StreamingSecretRedactor holds back the tail after the last
+ * whitespace (secrets never contain whitespace) and prepends it to the next
+ * chunk, which keeps the whole thing linear with a small bounded carry.
+ *
+ * @module utils/secret-redactor
+ */
+import { type SecretEnvValue } from './secret-env.js';
+/**
+ * Whether an assignment's name marks its value as secret.
+ *
+ * @param name - Variable name as it appeared (any case)
+ * @returns True for secret names (see module docs)
+ */
+export declare function isSecretAssignmentName(name: string): boolean;
+/** Result of a counted redaction. */
+export interface RedactionResult {
+    /** The masked text */
+    text: string;
+    /** Number of secrets masked (0 when the text was already clean) */
+    count: number;
+}
+/**
+ * Masks every secret in a complete piece of text and counts what was masked.
+ *
+ * @param text - Text to mask
+ * @param knownSecrets - Exact secret values to mask (see collectSecretEnvValues)
+ * @returns Masked text and the number of secrets masked
+ *
+ * @example
+ * ```ts
+ * redactSecretsWithCount('export OPENAI_API_KEY=sk-abc…').count; // 1
+ * redactSecretsWithCount('TOKEN_COUNT=5').count; // 0
+ * ```
+ */
+export declare function redactSecretsWithCount(text: string, knownSecrets?: readonly SecretEnvValue[]): RedactionResult;
+/**
+ * Masks every secret in a complete piece of text.
+ *
+ * @param text - Text to mask
+ * @param knownSecrets - Exact secret values to mask
+ * @returns The masked text
+ */
+export declare function redactSecrets(text: string, knownSecrets?: readonly SecretEnvValue[]): string;
+/**
+ * Chunk-boundary-safe redactor for streamed output.
+ *
+ * `push()` returns the redacted text that is safe to emit now and holds back
+ * the tail after the last whitespace; `flush()` returns whatever is held back
+ * (call it when the stream closes). Only the new chunk is scanned for
+ * whitespace (the carry never contains any), so work is linear in the input.
+ * A run of more than MAX_CARRY_CHARS non-whitespace characters is cut at a
+ * non-token character near its end (or hard-cut when there is none), keeping
+ * the carry bounded.
+ *
+ * @example
+ * ```ts
+ * const r = new StreamingSecretRedactor();
+ * log.write(r.push('export GEMINI_API_KEY=AIzaSy'));
+ * log.write(r.push('…rest of key\n'));
+ * log.write(r.flush());
+ * ```
+ */
+export declare class StreamingSecretRedactor {
+    private carry;
+    private knownSecrets;
+    private readonly maxCarry;
+    private readonly minCarry;
+    /**
+     * @param knownSecrets - Exact secret values to mask
+     * @param maxCarry - Longest whitespace-free tail held back before forcing a cut
+     */
+    constructor(knownSecrets?: readonly SecretEnvValue[], maxCarry?: number);
+    /**
+     * Replaces the exact-value secret set (e.g. after the session's env changes).
+     *
+     * @param knownSecrets - Exact secret values to mask
+     */
+    setKnownSecrets(knownSecrets: readonly SecretEnvValue[]): void;
+    /**
+     * Feeds one chunk and returns the redacted text that can be emitted now.
+     *
+     * @param chunk - Next piece of output
+     * @returns Redacted text (possibly empty while a word is still arriving)
+     */
+    push(chunk: string): string;
+    /**
+     * Returns (redacted) whatever is still held back and resets the carry.
+     *
+     * @returns Remaining redacted text
+     */
+    flush(): string;
+    /**
+     * Picks a cut point for a whitespace-free run that outgrew the carry: the
+     * last non-token character before the final minCarry characters, so a
+     * credential near the end is not split; hard cut when there is none.
+     *
+     * @param buf - Buffered text whose tail has no whitespace
+     * @returns Index to cut at
+     */
+    private forcedCut;
+}
+//# sourceMappingURL=secret-redactor.d.ts.map

package/dist/backend/backend/src/utils/secret-redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redactor.d.ts","sourceRoot":"","sources":["../../../../../backend/src/utils/secret-redactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA6CtE;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAO5D;AAED,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC/B,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,SAAS,cAAc,EAAO,GAAG,eAAe,CA2BlH;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,SAAS,cAAc,EAAO,GAAG,MAAM,CAEhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,uBAAuB;IACnC,OAAO,CAAC,KAAK,CAAM;IACnB,OAAO,CAAC,YAAY,CAA4B;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC;;;OAGG;gBAEF,YAAY,GAAE,SAAS,cAAc,EAAO,EAC5C,QAAQ,GAAE,MAAmD;IAO9D;;;;OAIG;IACH,eAAe,CAAC,YAAY,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;IAI9D;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAyB3B;;;;OAIG;IACH,KAAK,IAAI,MAAM;IAMf;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS;CAQjB"}

package/dist/backend/backend/src/utils/secret-redactor.js

@@ -0,0 +1,233 @@
+/**
+ * Secret redactor for persisted terminal output.
+ *
+ * Every byte of agent PTY output that Crewly writes to disk
+ * (~/.crewly/logs/sessions/*.log) passes through here, and so do the
+ * one-time scrub of existing logs and shell history files
+ * (`crewly security scrub-logs`). Three layers, applied in this order:
+ *
+ * 1. **Known values** — the exact value of every secret Crewly holds for the
+ *    session (backend env + the session's spawn env, see
+ *    collectSecretEnvValues). Catches secrets no pattern recognises (a Slack
+ *    signing secret is plain hex). Masked as `[REDACTED <NAME>]`.
+ * 2. **Secret-named assignments** — `NAME=value` where NAME is a secret name
+ *    (isSecretEnvKey: `…API_KEY`, `…TOKEN`, `…SECRET`, `…PASSWORD`,
+ *    `…PRIVATE_KEY`, … plus SECRET_REDACTION_CONSTANTS.KNOWN_SECRET_ENV_NAMES).
+ *    The value is masked whatever it looks like. Names are matched on the
+ *    whole identifier, so `TOKEN_COUNT=5` or `MAX_TOKENS=4096` are left alone
+ *    (the name does not END in a secret suffix); `$VAR` references and
+ *    already-masked values are left alone too.
+ * 3. **Token shapes** — well-known raw credential formats wherever they
+ *    appear: Slack `xoxb-/xoxp-/xoxa-/xoxe-/xapp-…`, OpenAI/DeepSeek `sk-…`,
+ *    Anthropic `sk-ant-…`, Google `AIza…`, GitHub `ghp_/gho_/…` and
+ *    `github_pat_…`, plus the wiki confidentiality patterns (JWTs, bearer
+ *    headers, private-key blocks, connection strings).
+ *
+ * Redaction is idempotent: running it over already-redacted text changes
+ * nothing and reports a count of 0.
+ *
+ * Output is streamed in arbitrary chunks, so a secret can be split between
+ * two chunks. StreamingSecretRedactor holds back the tail after the last
+ * whitespace (secrets never contain whitespace) and prepends it to the next
+ * chunk, which keeps the whole thing linear with a small bounded carry.
+ *
+ * @module utils/secret-redactor
+ */
+import { SECRET_REDACTION_CONSTANTS } from '../constants.js';
+import { SECRET_PATTERNS } from '../services/wiki/wiki-redaction.js';
+import { isSecretEnvKey } from './secret-env.js';
+/**
+ * Raw token shapes beyond the wiki SECRET_PATTERNS (which require a numeric
+ * team segment for Slack tokens and do not know `xapp-` or `github_pat_`).
+ */
+const EXTRA_TOKEN_PATTERNS = [
+    { name: 'slack_token', regex: /\bxox[abposre]-[A-Za-z0-9-]{10,}/g, mask: '[REDACTED slack_token]' },
+    { name: 'slack_app_token', regex: /\bxapp-[A-Za-z0-9-]{10,}/g, mask: '[REDACTED slack_app_token]' },
+    { name: 'anthropic_key', regex: /\bsk-ant-[A-Za-z0-9_-]{20,}/g, mask: '[REDACTED api_key]' },
+    { name: 'github_pat', regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, mask: '[REDACTED github_token]' },
+];
+/** Every token-shape detector, most specific first. */
+const TOKEN_PATTERNS = [...EXTRA_TOKEN_PATTERNS, ...SECRET_PATTERNS];
+/**
+ * `NAME=value` (optionally quoted value). The value stops at whitespace,
+ * quotes, backticks and shell separators. The identifier must start at a
+ * word boundary so it is matched whole.
+ */
+const ASSIGNMENT_RE = /\b([A-Za-z_][A-Za-z0-9_]*)=(["']?)([^\s"'`;&|]+)/g;
+/** Prefix every mask this module emits starts with. */
+const REDACTED_PREFIX = '[REDACTED';
+/** Mask written in place of a secret-named assignment's value. */
+const ASSIGNMENT_MASK = '[REDACTED]';
+/** Characters that can appear inside a credential or a `NAME=value` pair. */
+const TOKEN_CHAR_RE = /[A-Za-z0-9_\-=.:/+"'[\]]/;
+/** Known secret names, upper-cased, for O(1) lookup. */
+const KNOWN_SECRET_NAMES = new Set(SECRET_REDACTION_CONSTANTS.KNOWN_SECRET_ENV_NAMES);
+/**
+ * Whether an assignment's name marks its value as secret.
+ *
+ * @param name - Variable name as it appeared (any case)
+ * @returns True for secret names (see module docs)
+ */
+export function isSecretAssignmentName(name) {
+    const upper = name.toUpperCase();
+    return (KNOWN_SECRET_NAMES.has(upper) ||
+        isSecretEnvKey(name) ||
+        SECRET_REDACTION_CONSTANTS.SECRET_NAME_PATTERNS.some((re) => re.test(upper)));
+}
+/**
+ * Masks every secret in a complete piece of text and counts what was masked.
+ *
+ * @param text - Text to mask
+ * @param knownSecrets - Exact secret values to mask (see collectSecretEnvValues)
+ * @returns Masked text and the number of secrets masked
+ *
+ * @example
+ * ```ts
+ * redactSecretsWithCount('export OPENAI_API_KEY=sk-abc…').count; // 1
+ * redactSecretsWithCount('TOKEN_COUNT=5').count; // 0
+ * ```
+ */
+export function redactSecretsWithCount(text, knownSecrets = []) {
+    let out = text;
+    let count = 0;
+    for (const { name, value } of knownSecrets) {
+        if (!value || !out.includes(value))
+            continue;
+        const parts = out.split(value);
+        count += parts.length - 1;
+        out = parts.join(`${REDACTED_PREFIX} ${name}]`);
+    }
+    out = out.replace(ASSIGNMENT_RE, (match, name, quote, value) => {
+        if (!isSecretAssignmentName(name) || value.startsWith('$') || value.startsWith(REDACTED_PREFIX))
+            return match;
+        count++;
+        return `${name}=${quote}${ASSIGNMENT_MASK}`;
+    });
+    for (const p of TOKEN_PATTERNS) {
+        p.regex.lastIndex = 0;
+        out = out.replace(p.regex, (match) => {
+            if (match === p.mask)
+                return match;
+            count++;
+            return p.mask;
+        });
+    }
+    return { text: out, count };
+}
+/**
+ * Masks every secret in a complete piece of text.
+ *
+ * @param text - Text to mask
+ * @param knownSecrets - Exact secret values to mask
+ * @returns The masked text
+ */
+export function redactSecrets(text, knownSecrets = []) {
+    return redactSecretsWithCount(text, knownSecrets).text;
+}
+/**
+ * Chunk-boundary-safe redactor for streamed output.
+ *
+ * `push()` returns the redacted text that is safe to emit now and holds back
+ * the tail after the last whitespace; `flush()` returns whatever is held back
+ * (call it when the stream closes). Only the new chunk is scanned for
+ * whitespace (the carry never contains any), so work is linear in the input.
+ * A run of more than MAX_CARRY_CHARS non-whitespace characters is cut at a
+ * non-token character near its end (or hard-cut when there is none), keeping
+ * the carry bounded.
+ *
+ * @example
+ * ```ts
+ * const r = new StreamingSecretRedactor();
+ * log.write(r.push('export GEMINI_API_KEY=AIzaSy'));
+ * log.write(r.push('…rest of key\n'));
+ * log.write(r.flush());
+ * ```
+ */
+export class StreamingSecretRedactor {
+    carry = '';
+    knownSecrets;
+    maxCarry;
+    minCarry;
+    /**
+     * @param knownSecrets - Exact secret values to mask
+     * @param maxCarry - Longest whitespace-free tail held back before forcing a cut
+     */
+    constructor(knownSecrets = [], maxCarry = SECRET_REDACTION_CONSTANTS.MAX_CARRY_CHARS) {
+        this.knownSecrets = knownSecrets;
+        this.maxCarry = Math.max(maxCarry, 2);
+        this.minCarry = Math.max(1, Math.min(SECRET_REDACTION_CONSTANTS.MIN_FORCED_CARRY_CHARS, Math.floor(this.maxCarry / 2)));
+    }
+    /**
+     * Replaces the exact-value secret set (e.g. after the session's env changes).
+     *
+     * @param knownSecrets - Exact secret values to mask
+     */
+    setKnownSecrets(knownSecrets) {
+        this.knownSecrets = knownSecrets;
+    }
+    /**
+     * Feeds one chunk and returns the redacted text that can be emitted now.
+     *
+     * @param chunk - Next piece of output
+     * @returns Redacted text (possibly empty while a word is still arriving)
+     */
+    push(chunk) {
+        if (!chunk)
+            return '';
+        const carryLength = this.carry.length;
+        const buf = this.carry + chunk;
+        let cut = -1;
+        for (let i = buf.length - 1; i >= carryLength; i--) {
+            if (isWhitespace(buf.charCodeAt(i))) {
+                cut = i + 1;
+                break;
+            }
+        }
+        if (cut === -1 || buf.length - cut > this.maxCarry) {
+            if (buf.length <= this.maxCarry) {
+                this.carry = buf;
+                return '';
+            }
+            cut = this.forcedCut(buf);
+        }
+        this.carry = buf.slice(cut);
+        return cut > 0 ? redactSecrets(buf.slice(0, cut), this.knownSecrets) : '';
+    }
+    /**
+     * Returns (redacted) whatever is still held back and resets the carry.
+     *
+     * @returns Remaining redacted text
+     */
+    flush() {
+        const rest = this.carry;
+        this.carry = '';
+        return rest ? redactSecrets(rest, this.knownSecrets) : '';
+    }
+    /**
+     * Picks a cut point for a whitespace-free run that outgrew the carry: the
+     * last non-token character before the final minCarry characters, so a
+     * credential near the end is not split; hard cut when there is none.
+     *
+     * @param buf - Buffered text whose tail has no whitespace
+     * @returns Index to cut at
+     */
+    forcedCut(buf) {
+        const target = buf.length - this.minCarry;
+        const floor = Math.max(0, target - this.minCarry);
+        for (let i = target; i > floor; i--) {
+            if (!TOKEN_CHAR_RE.test(buf[i - 1]))
+                return i;
+        }
+        return target;
+    }
+}
+/**
+ * Whitespace test on a UTF-16 code unit (space, tab, CR, LF, VT, FF).
+ *
+ * @param code - Character code
+ * @returns True for ASCII whitespace
+ */
+function isWhitespace(code) {
+    return code === 32 || (code >= 9 && code <= 13);
+}
+//# sourceMappingURL=secret-redactor.js.map

package/dist/backend/backend/src/utils/secret-redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redactor.js","sourceRoot":"","sources":["../../../../../backend/src/utils/secret-redactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAuB,MAAM,iBAAiB,CAAC;AAYtE;;;GAGG;AACH,MAAM,oBAAoB,GAA4B;IACrD,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,mCAAmC,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACnG,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACnG,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC5F,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,yBAAyB,EAAE;CACjG,CAAC;AAEF,uDAAuD;AACvD,MAAM,cAAc,GAA4B,CAAC,GAAG,oBAAoB,EAAE,GAAG,eAAe,CAAC,CAAC;AAE9F;;;;GAIG;AACH,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAE1E,uDAAuD;AACvD,MAAM,eAAe,GAAG,WAAW,CAAC;AAEpC,kEAAkE;AAClE,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,6EAA6E;AAC7E,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,wDAAwD;AACxD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CACN,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC;QAC7B,cAAc,CAAC,IAAI,CAAC;QACpB,0BAA0B,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAC5E,CAAC;AACH,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,eAA0C,EAAE;IAChG,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,YAAY,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1B,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,IAAI,IAAI,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,KAAa,EAAE,IAAY,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE;QAC9F,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9G,KAAK,EAAE,CAAC;QACR,OAAO,GAAG,IAAI,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE;YAC5C,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACnC,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,eAA0C,EAAE;IACvF,OAAO,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,uBAAuB;IAC3B,KAAK,GAAG,EAAE,CAAC;IACX,YAAY,CAA4B;IAC/B,QAAQ,CAAS;IACjB,QAAQ,CAAS;IAElC;;;OAGG;IACH,YACC,eAA0C,EAAE,EAC5C,WAAmB,0BAA0B,CAAC,eAAe;QAE7D,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzH,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,YAAuC;QACtD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,KAAa;QACjB,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAE/B,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBACZ,MAAM;YACP,CAAC;QACF,CAAC;QAED,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpD,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;gBACjB,OAAO,EAAE,CAAC;YACX,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IAED;;;;;;;OAOG;IACK,SAAS,CAAC,GAAW;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;CACD;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC"}

package/dist/backend/backend/src/utils/shell-history.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Keeps agent shells out of the user's shell history.
+ *
+ * Crewly used to type `export GEMINI_API_KEY=…` into agent shells, and bash
+ * wrote those lines to ~/.bash_history hundreds of times. Secrets now travel
+ * only in the spawn env (utils/secret-env), and on top of that agent shells
+ * never write a history file at all:
+ *
+ * - historyOffSpawnEnv() goes into every PTY's spawn environment;
+ * - shellHistoryDisableLine() is typed first by the runtime init sequence,
+ *   after the rc files ran (they may set HISTFILE themselves);
+ * - quietShellLine() prefixes every other typed line with a space, which
+ *   bash (HISTCONTROL=ignorespace) and zsh (HIST_IGNORE_SPACE) skip.
+ *
+ * See SHELL_HISTORY_CONSTANTS for why HISTSIZE/HISTFILESIZE are not touched.
+ *
+ * @module utils/shell-history
+ */
+/**
+ * Env vars that keep a freshly spawned bash/zsh from writing history.
+ *
+ * @returns A fresh copy (callers may spread or mutate it)
+ */
+export declare function historyOffSpawnEnv(): Record<string, string>;
+/**
+ * Prefixes a line typed into a shell with a space so it is not recorded.
+ * Already-prefixed lines are returned unchanged.
+ *
+ * @param line - Shell command line
+ * @returns The line, space-prefixed
+ */
+export declare function quietShellLine(line: string): string;
+/**
+ * The (space-prefixed) line that turns history off inside a running shell.
+ *
+ * @param shell - Shell binary path (defaults to $SHELL, then /bin/bash — what
+ *   agent PTYs are spawned with)
+ * @returns The line to type, or null for a shell we do not know how to quiet
+ */
+export declare function shellHistoryDisableLine(shell?: string | undefined): string | null;
+/**
+ * Quotes a value for a POSIX shell word (single quotes).
+ *
+ * @param value - Raw value
+ * @returns Single-quoted value safe for `sh -c`
+ */
+export declare function shellQuote(value: string): string;
+//# sourceMappingURL=shell-history.d.ts.map

package/dist/backend/backend/src/utils/shell-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-history.d.ts","sourceRoot":"","sources":["../../../../../backend/src/utils/shell-history.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE3D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,GAAE,MAAM,GAAG,SAA4C,GAAG,MAAM,GAAG,IAAI,CAOnH;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD"}

package/dist/backend/backend/src/utils/shell-history.js

@@ -0,0 +1,65 @@
+/**
+ * Keeps agent shells out of the user's shell history.
+ *
+ * Crewly used to type `export GEMINI_API_KEY=…` into agent shells, and bash
+ * wrote those lines to ~/.bash_history hundreds of times. Secrets now travel
+ * only in the spawn env (utils/secret-env), and on top of that agent shells
+ * never write a history file at all:
+ *
+ * - historyOffSpawnEnv() goes into every PTY's spawn environment;
+ * - shellHistoryDisableLine() is typed first by the runtime init sequence,
+ *   after the rc files ran (they may set HISTFILE themselves);
+ * - quietShellLine() prefixes every other typed line with a space, which
+ *   bash (HISTCONTROL=ignorespace) and zsh (HIST_IGNORE_SPACE) skip.
+ *
+ * See SHELL_HISTORY_CONSTANTS for why HISTSIZE/HISTFILESIZE are not touched.
+ *
+ * @module utils/shell-history
+ */
+import * as path from 'path';
+import { SHELL_HISTORY_CONSTANTS } from '../constants.js';
+/**
+ * Env vars that keep a freshly spawned bash/zsh from writing history.
+ *
+ * @returns A fresh copy (callers may spread or mutate it)
+ */
+export function historyOffSpawnEnv() {
+    return { ...SHELL_HISTORY_CONSTANTS.SPAWN_ENV };
+}
+/**
+ * Prefixes a line typed into a shell with a space so it is not recorded.
+ * Already-prefixed lines are returned unchanged.
+ *
+ * @param line - Shell command line
+ * @returns The line, space-prefixed
+ */
+export function quietShellLine(line) {
+    const prefix = SHELL_HISTORY_CONSTANTS.TYPED_LINE_PREFIX;
+    return line.startsWith(prefix) ? line : `${prefix}${line}`;
+}
+/**
+ * The (space-prefixed) line that turns history off inside a running shell.
+ *
+ * @param shell - Shell binary path (defaults to $SHELL, then /bin/bash — what
+ *   agent PTYs are spawned with)
+ * @returns The line to type, or null for a shell we do not know how to quiet
+ */
+export function shellHistoryDisableLine(shell = process.env.SHELL || '/bin/bash') {
+    const name = path.basename(shell || '').toLowerCase();
+    if (SHELL_HISTORY_CONSTANTS.POSIX_SHELLS.includes(name)) {
+        return quietShellLine(SHELL_HISTORY_CONSTANTS.DISABLE_COMMAND);
+    }
+    if (name === 'fish')
+        return quietShellLine(SHELL_HISTORY_CONSTANTS.FISH_DISABLE_COMMAND);
+    return null;
+}
+/**
+ * Quotes a value for a POSIX shell word (single quotes).
+ *
+ * @param value - Raw value
+ * @returns Single-quoted value safe for `sh -c`
+ */
+export function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+//# sourceMappingURL=shell-history.js.map

package/dist/backend/backend/src/utils/shell-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-history.js","sourceRoot":"","sources":["../../../../../backend/src/utils/shell-history.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IACjC,OAAO,EAAE,GAAG,uBAAuB,CAAC,SAAS,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,uBAAuB,CAAC,iBAAiB,CAAC;IACzD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAA4B,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,WAAW;IACnG,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,uBAAuB,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,cAAc,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACvC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC"}

package/dist/backend/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "f478a3caf3d69d304efb7f0c925950a86e7655ec",
-  "builtAt": "2026-09-29T02:10:11.614Z"
+  "commit": "c6b0dd7b2bd2a6ad66251af5dd1e6cf085304e75",
+  "builtAt": "2026-09-29T18:49:45.817Z"
 }

package/dist/cli/backend/src/constants.d.ts

@@ -1654,8 +1654,59 @@ export declare const WORKTREE_JANITOR_CONSTANTS: {
     readonly INTERVAL_MS: number;
     /** Delay before the first automatic run after startup (10 minutes). */
     readonly FIRST_RUN_DELAY_MS: number;
-    /** A worktree touched more recently than this is kept (2 hours). */
+    /**
+     * A worktree in a known agent location (`<repo>/.claude/worktrees/`,
+     * `<tmp>/crewly-worktrees/`, or a `worktree-agent-*` branch) touched more
+     * recently than this is kept (2 hours).
+     */
     readonly MIN_IDLE_MS: number;
+    /** Any other linked worktree touched more recently than this is kept (24 hours). */
+    readonly MIN_IDLE_OTHER_MS: number;
+    /**
+     * A Claude Code session scratch dir (`<tmp>/claude-<uid>/<slug>/<uuid>/`)
+     * touched more recently than this is kept (3 days).
+     */
+    readonly SCRATCH_MIN_IDLE_MS: number;
+    /** In low-disk mode every idle threshold is divided by this factor… */
+    readonly LOW_DISK_IDLE_DIVISOR: 2;
+    /** …but never drops below this (2 hours). */
+    readonly LOW_DISK_MIN_IDLE_FLOOR_MS: number;
+    /** Prefix of Claude Code's per-user temp root under the temp dir (`claude-<uid>`). */
+    readonly SCRATCH_ROOT_PREFIX: "claude-";
+    /** Extra temp dirs where the per-user Claude root may live besides os.tmpdir(). */
+    readonly SCRATCH_TMP_DIRS: readonly string[];
+    /** Session dir name pattern under `<root>/<project-slug>/` (a UUID). */
+    readonly SCRATCH_SESSION_DIR_PATTERN: RegExp;
+    /** How deep under a session dir git repos are searched for. */
+    readonly SCRATCH_REPO_SEARCH_DEPTH: 3;
+    /** How many levels of a session dir count for its "last touched" time. */
+    readonly SCRATCH_MTIME_DEPTH: 2;
+    /** Directory names never descended into while searching for repos. */
+    readonly SEARCH_SKIP_DIRS: readonly string[];
+    /** How deep under each temp root linked worktrees are searched for (repo discovery). */
+    readonly DISCOVERY_DEPTH: 4;
+    /** Cap on directories visited per temp root during repo discovery. */
+    readonly DISCOVERY_MAX_DIRS: 20000;
+    /** Filesystem walks yield to the event loop (one setImmediate) after this many entries. */
+    readonly YIELD_EVERY_ENTRIES: 50;
+    /** Interval of the low-disk check (10 minutes). */
+    readonly LOW_DISK_CHECK_INTERVAL_MS: number;
+    /** Free space below this on the CREWLY_HOME volume triggers a low-disk pass (15 GB). */
+    readonly LOW_DISK_BYTES: number;
+    /** Free space below this is urgent (5 GB). */
+    readonly CRITICAL_DISK_BYTES: number;
+    /** A low-disk check does not start another pass within this time of the last one (30 minutes). */
+    readonly LOW_DISK_PASS_GAP_MS: number;
+    /** Owner notice about low disk at most this often (24 hours). */
+    readonly LOW_DISK_NOTIFY_INTERVAL_MS: number;
+    /** Urgent owner notice (below CRITICAL_DISK_BYTES) at most this often (6 hours). */
+    readonly CRITICAL_DISK_NOTIFY_INTERVAL_MS: number;
+    /** How many of the biggest kept items the owner notice lists. */
+    readonly LOW_DISK_REPORT_ITEMS: 5;
+    /** Timeout of one `du -sk` size probe (ms). */
+    readonly DU_TIMEOUT_MS: 60000;
+    /** State file under CREWLY_HOME remembering when the owner was last told about low disk. */
+    readonly STATE_FILENAME: "disk-janitor-state.json";
     /**
      * Directory, relative to the repo's main worktree, where agent tools
      * (Claude Code subagents, Crewly agents) create per-task worktrees.
@@ -1673,8 +1724,8 @@ export declare const WORKTREE_JANITOR_CONSTANTS: {
     readonly MANAGED_WORKTREE_DIR: ".crewly/worktrees";
     /**
      * Branch-name prefixes that only agents create. A worktree elsewhere on
-     * disk is eligible only when its branch starts with one of these.
-     * `worktree-agent-` is Claude Code's automatic subagent branch.
+     * disk with such a branch counts as an agent location (2 h idle threshold
+     * instead of 24 h). `worktree-agent-` is Claude Code's automatic subagent branch.
      */
     readonly AGENT_BRANCH_PREFIXES: readonly string[];
     /** Branches that are never deleted, whatever the verdict. */
@@ -2308,6 +2359,13 @@ export declare const OAUTH_ERROR_PATTERN_SETS: string[][];
  * regex — to stay ReDoS-free.
  */
 export declare const LOGIN_REQUIRED_PATTERN_SETS: string[][];
+/**
+ * Screen text that means the runtime has just *finished* signing in. The
+ * capture window can still hold the earlier sign-in screen above it, so
+ * these veto a {@link LOGIN_REQUIRED_PATTERN_SETS} match and let the
+ * "Sign-in needed" flag clear. Lower-case substrings.
+ */
+export declare const LOGIN_COMPLETED_MARKERS: readonly string[];
 /**
  * Constants for first-run / device-code login detection and notification
  * in `OAuthReloginMonitorService`.
@@ -4025,8 +4083,8 @@ export declare const ONBOARDING_CONSTANTS: {
     /** Display copy for the Blank starter (templates carry their own) */
     readonly BLANK_STARTER: {
         readonly NAME: "Blank";
-        readonly LABEL: "空白";
-        readonly TAGLINE: "只有 Orc（总调度），先不建团队。需要时让 Orc 帮你组队。";
+        readonly LABEL: "Blank";
+        readonly TAGLINE: "Just the Orc (the orchestrator), no team yet. Ask the Orc to put a team together when you need one.";
         readonly SUGGESTIONS: readonly string[];
     };
     /** Longest first task accepted */
@@ -4345,4 +4403,61 @@ export type AgentStatus = (typeof CREWLY_CONSTANTS.AGENT_STATUSES)[keyof typeof
 export type WorkingStatus = (typeof CREWLY_CONSTANTS.WORKING_STATUSES)[keyof typeof CREWLY_CONSTANTS.WORKING_STATUSES];
 export type RuntimeType = (typeof RUNTIME_TYPES)[keyof typeof RUNTIME_TYPES];
 export type AgentId = string;
+/**
+ * Secret redaction for persisted terminal output (session logs, scrub of old
+ * logs and shell history). See utils/secret-redactor.
+ */
+export declare const SECRET_REDACTION_CONSTANTS: {
+    /**
+     * Secret variable names masked in `NAME=value` even if the generic suffix
+     * rule (utils/secret-env isSecretEnvKey) ever changed. Upper-case.
+     */
+    readonly KNOWN_SECRET_ENV_NAMES: readonly string[];
+    /** Name families masked in `NAME=value` (tested against the upper-cased name). */
+    readonly SECRET_NAME_PATTERNS: readonly RegExp[];
+    /**
+     * Longest whitespace-free tail the streaming redactor holds back between
+     * chunks before it forces a cut. Far above any credential's length.
+     */
+    readonly MAX_CARRY_CHARS: 4096;
+    /** Tail kept after a forced cut — above any credential's length (≈250 chars). */
+    readonly MIN_FORCED_CARRY_CHARS: 512;
+};
+/**
+ * Shell history is kept off in agent PTYs: whatever an agent shell runs
+ * (and anything Crewly types into it) must never land in ~/.bash_history or
+ * ~/.zsh_history. Two layers:
+ *
+ * - SPAWN_ENV is merged into every PTY's spawn environment. It works for a
+ *   shell whose rc files leave these alone.
+ * - DISABLE_COMMAND is typed (space-prefixed) as the first line of the
+ *   runtime init sequence, after the rc files ran — macOS /etc/zshrc
+ *   unconditionally sets HISTFILE, which beats the spawn env. `unset HISTFILE`
+ *   stops bash and zsh from ever writing a history file; bash additionally
+ *   turns history recording off.
+ *
+ * HISTSIZE / HISTFILESIZE are deliberately NOT set to 0: when a user's
+ * ~/.bashrc re-points HISTFILE at ~/.bash_history but leaves HISTFILESIZE
+ * alone, bash truncates that file to HISTFILESIZE (defaulting to HISTSIZE)
+ * lines — an inherited 0 would wipe the user's own history.
+ */
+export declare const SHELL_HISTORY_CONSTANTS: {
+    /** Env merged into every PTY spawn (callers' own env still wins). */
+    readonly SPAWN_ENV: Readonly<Record<string, string>>;
+    /** POSIX-shell line typed first into an agent shell (bash, zsh, sh, dash, ksh). */
+    readonly DISABLE_COMMAND: "unset HISTFILE; if [ -n \"$ZSH_VERSION\" ]; then setopt HIST_IGNORE_SPACE; SAVEHIST=0; elif [ -n \"$BASH_VERSION\" ]; then set +o history; fi";
+    /** fish: an empty fish_history keeps history in memory only. */
+    readonly FISH_DISABLE_COMMAND: "set -g fish_history ''";
+    /** Shells that understand DISABLE_COMMAND (basename of $SHELL). */
+    readonly POSIX_SHELLS: readonly string[];
+    /** Prefix for every line Crewly types into a shell (kept out of history by ignorespace / HIST_IGNORE_SPACE). */
+    readonly TYPED_LINE_PREFIX: " ";
+};
+/** One-time scrub of secrets already on disk (`crewly security scrub-logs`). */
+export declare const SECRET_SCRUB_CONSTANTS: {
+    /** Shell history files (relative to the user's home) that are scrubbed */
+    readonly SHELL_HISTORY_FILES: readonly string[];
+    /** settings.json under CREWLY_HOME, whose apiKeys are masked by exact value */
+    readonly SETTINGS_FILE: "settings.json";
+};
 //# sourceMappingURL=constants.d.ts.map