crewly 1.20.206 → 1.20.208

package/packages/crewly-agent/src/runtime/tool-registry.ts

@@ -52,6 +52,7 @@ function completionResult(summary: string, evidence: CompletionEvidenceInput | u
   return { summary, ...(evidence && evidence.length > 0 ? { evidence } : {}) };
 }
 import { createWebSearchTool } from './web-search.tool.js';
+import { checkCredentialAccess } from './credential-guard.js';
 import { createComputerTool } from './computer.tool.js';
 import { createDesktopTaskTool } from './desktop-task.tool.js';
 import { checkInteractiveLoginCommand } from './interactive-login-guard.js';
@@ -1455,6 +1456,9 @@ export function createTools(client: CrewlyApiClient, sessionName: string, projec
       }),
       execute: async ({ file_path, offset, limit }) => {
         const fp = expandPath(file_path as string, projectPath);
+        // specs/2026-10-04-agent-credential-isolation.md: never Crewly's own credentials.
+        const credentialRefusal = checkCredentialAccess('Read', { file_path: fp }, projectPath || process.cwd());
+        if (credentialRefusal) return { success: false, error: credentialRefusal };
         try {
           // Check if this is an image file
           const ext = fp.split('.').pop()?.toLowerCase() || '';
@@ -1543,6 +1547,8 @@ export function createTools(client: CrewlyApiClient, sessionName: string, projec
         ignore: z.array(z.string()).optional().describe('Additional directory names to ignore (node_modules, .git, dist are always ignored)'),
       }),
       execute: async ({ pattern, path: searchPath, ignore }) => {
+        const globRefusal = checkCredentialAccess('Glob', { pattern, path: searchPath ?? '' }, projectPath || process.cwd());
+        if (globRefusal) return { success: false, error: globRefusal };
         try {
           const rootDir = expandPath((searchPath as string | undefined) || projectPath || process.cwd());
           const stat = await fsPromises.stat(rootDir);
@@ -1589,6 +1595,8 @@ export function createTools(client: CrewlyApiClient, sessionName: string, projec
         ignore: z.array(z.string()).optional().describe('Additional directory names to ignore'),
       }),
       execute: async ({ pattern: searchPattern, path: searchPath, file_pattern, context_lines, case_insensitive, max_matches, ignore }) => {
+        const grepRefusal = checkCredentialAccess('Grep', { path: searchPath ?? '', glob: file_pattern ?? '' }, projectPath || process.cwd());
+        if (grepRefusal) return { success: false, error: grepRefusal };
         try {
           const patternStr = searchPattern as string;
           const flags = (case_insensitive as boolean) ? 'gi' : 'g';
@@ -1857,6 +1865,13 @@ export function createTools(client: CrewlyApiClient, sessionName: string, projec
       execute: async ({ command, cwd, timeout }) => {
         const cmd = command as string;
 
+        // Crewly's own credentials are not available to agents
+        // (specs/2026-10-04-agent-credential-isolation.md).
+        const credentialRefusal = checkCredentialAccess('Bash', { command: cmd }, (cwd as string | undefined) || projectPath || process.cwd());
+        if (credentialRefusal) {
+          return { success: false, exitCode: 126, stdout: '', stderr: credentialRefusal, error: credentialRefusal };
+        }
+
         // Interactive harness logins die with this one-shot call; the owner's
         // pasted code would go stale (2026-09-26). Point at harness-login.
         const loginRefusal = checkInteractiveLoginCommand(cmd);

package/packages/crewly-agent/src/runtime/web-search.tool.test.ts

@@ -51,6 +51,24 @@ describe('createWebSearchTool', () => {
     expect(result.error).toMatch(/Crewly Cloud is not connected/);
   });
 
+  it('by default goes through the local backend with the agent badge, never a Cloud token', async () => {
+    const fetchSpy = vi.fn().mockResolvedValue(
+      jsonResponse({ success: true, answer: 'via backend', sources: [] }),
+    );
+    const tool = createWebSearchTool({
+      fetchImpl: fetchSpy as unknown as typeof fetch,
+      env: { CREWLY_SESSION_NAME: 'ruth', CREWLY_AGENT_BADGE: 'badge-1', CREWLY_API_URL: 'http://127.0.0.1:9999/' },
+    });
+    const result = (await tool.execute({ query: 'q' })) as { success: boolean; result?: string };
+    expect(result.success).toBe(true);
+    const [url, init] = fetchSpy.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe('http://127.0.0.1:9999/api/cloud/search');
+    const headers = init.headers as Record<string, string>;
+    expect(headers['X-Agent-Session']).toBe('ruth');
+    expect(headers['X-Agent-Badge']).toBe('badge-1');
+    expect(headers.Authorization).toBeUndefined();
+  });
+
   it('sends the query + bearer token to the configured endpoint', async () => {
     const fetchSpy = vi.fn().mockResolvedValue(
       jsonResponse({

package/packages/crewly-agent/src/runtime/web-search.tool.ts

@@ -15,9 +15,11 @@
 
 import { z } from 'zod';
 import type { ToolDefinition } from './types.js';
-import { loadCloudConfig, CloudNotLoggedInError, type CloudConfig } from './cloud-config.js';
+import { CloudNotLoggedInError, type CloudConfig } from './cloud-config.js';
 
 const SEARCH_PATH = '/api/v1/search';
+/** The local backend's proxy for Cloud search (it holds the Cloud token; agents never see it). */
+const BACKEND_SEARCH_PATH = '/api/cloud/search';
 const DEFAULT_TIMEOUT_MS = 30_000;
 
 interface SearchSource {
@@ -35,13 +37,25 @@ interface SearchResponse {
 
 /** Injectable IO for tests. */
 export interface WebSearchDeps {
+  /**
+   * Direct mode: read the Cloud token and call Cloud. Only for tests and
+   * tools outside an agent. Without it the tool goes through the local
+   * backend (specs/2026-10-04-agent-credential-isolation.md): the Cloud
+   * credentials are sealed and are not available to agents.
+   */
   loadConfig?: () => Promise<CloudConfig>;
+  /** Backend base URL for the default mode (default CREWLY_API_URL or http://localhost:8787). */
+  apiBaseUrl?: string;
+  /** Environment for the agent's session + badge headers (default process.env). */
+  env?: NodeJS.ProcessEnv;
   fetchImpl?: typeof fetch;
   timeoutMs?: number;
 }
 
 export function createWebSearchTool(deps: WebSearchDeps = {}): ToolDefinition {
-  const loadConfig = deps.loadConfig ?? (() => loadCloudConfig());
+  const loadConfig = deps.loadConfig;
+  const env = deps.env ?? process.env;
+  const apiBaseUrl = (deps.apiBaseUrl ?? env.CREWLY_API_URL ?? 'http://localhost:8787').replace(/\/$/, '');
   const fetchImpl = deps.fetchImpl ?? fetch;
   const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
 
@@ -61,26 +75,34 @@ export function createWebSearchTool(deps: WebSearchDeps = {}): ToolDefinition {
     execute: async (args) => {
       const { query, max_results } = args as { query: string; max_results?: number };
 
-      let config: CloudConfig;
-      try {
-        config = await loadConfig();
-      } catch (err) {
-        if (err instanceof CloudNotLoggedInError) {
-          return { success: false, error: err.message };
+      let url: string;
+      const headers: Record<string, string> = { 'Content-Type': 'application/json' };
+      if (loadConfig) {
+        let config: CloudConfig;
+        try {
+          config = await loadConfig();
+        } catch (err) {
+          if (err instanceof CloudNotLoggedInError) {
+            return { success: false, error: err.message };
+          }
+          throw err;
         }
-        throw err;
+        url = `${config.cloudUrl}${SEARCH_PATH}`;
+        headers.Authorization = `Bearer ${config.token}`;
+      } else {
+        // Through the backend, identified by this agent's session + badge.
+        url = `${apiBaseUrl}${BACKEND_SEARCH_PATH}`;
+        if (env.CREWLY_SESSION_NAME) headers['X-Agent-Session'] = env.CREWLY_SESSION_NAME;
+        if (env.CREWLY_AGENT_BADGE) headers['X-Agent-Badge'] = env.CREWLY_AGENT_BADGE;
       }
 
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), timeoutMs);
       let resp: Response;
       try {
-        resp = await fetchImpl(`${config.cloudUrl}${SEARCH_PATH}`, {
+        resp = await fetchImpl(url, {
           method: 'POST',
-          headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${config.token}`,
-          },
+          headers,
           body: JSON.stringify(
             max_results !== undefined ? { query, max_results } : { query },
           ),