crewly 1.20.280 → 1.20.282

package/dist/cli/backend/src/constants.js

@@ -632,6 +632,8 @@ export const CONTROL_PLANE_GUARD_CONSTANTS = {
         'config/hooks/subagent-guard',
         // The credential guard (specs/2026-10-04-agent-credential-isolation.md).
         'config/hooks/credential-guard',
+        // The live-checkout guard: an agent must not be able to switch it off.
+        'config/hooks/live-checkout-guard',
         'dist',
     ],
     /** Write-protected files under the install root. */
@@ -639,6 +641,23 @@ export const CONTROL_PLANE_GUARD_CONSTANTS = {
     /** Write-protected directories under the agent's project path (whole subtree). */
     PROJECT_DIRS: ['.claude/agents', '.crewly/triggers'],
 };
+/**
+ * Live-checkout guard: agents may not change the checkout the running Crewly
+ * is built from (git state changes or file edits). Incident 2026-10-08/09: an
+ * agent switched branches in it and the next restart refused to start.
+ */
+export const LIVE_CHECKOUT_GUARD_CONSTANTS = {
+    /** Backend env var; `0` turns the guard off for sessions launched by this backend. */
+    KILL_SWITCH_ENV: 'CREWLY_LIVE_CHECKOUT_GUARD',
+    /** Value of KILL_SWITCH_ENV that disables the guard. */
+    KILL_SWITCH_OFF_VALUE: '0',
+    /** The hook script (node), relative to the install root. */
+    HOOK_SCRIPT: 'config/hooks/live-checkout-guard/guard.mjs',
+    /** Claude Code tools the hook is attached to. */
+    CLAUDE_MATCHER: 'Bash|Edit|Write|MultiEdit|NotebookEdit',
+    /** Codex tools the hook is attached to (shell, plus its patch tool). */
+    CODEX_MATCHER: 'Bash|apply_patch|Edit|Write',
+};
 /**
  * Credential guard (specs/2026-10-04-agent-credential-isolation.md, layer 2):
  * a pre-tool hook, on every runtime that has one, that refuses an agent's
@@ -7280,6 +7299,25 @@ export const REMOTE_MCP_CONSTANTS = {
     MAX_TOOL_NAMES: 50,
     /** Catalog presets the add form offers. */
     PROVIDERS: ['zoho', 'custom'],
+    /**
+     * Tools an AGENT may never call through the proxy, per server kind (the
+     * server's provider, or its id when it has none). Compared after
+     * trim + NFKC + lower-casing, so case and width tricks do not bypass it.
+     * Zoho has no draft tool: a draft is a mode of sendEmail, so one missing
+     * field sends mail. Mail is only ever drafted through the backend's
+     * draft-only path (CREW-400). resendVerification* mails an address a
+     * verification link; denied too since an agent has no reason to trigger it.
+     */
+    DENIED_AGENT_TOOLS: {
+        zoho: [
+            'ZohoMail_sendEmail',
+            'ZohoMail_sendReplyEmail',
+            'ZohoMail_resendVerificationReplyToAdmin',
+            'ZohoMail_resendVerificationReplyToSelf',
+        ],
+    },
+    /** Message an agent gets when it calls a denied tool. */
+    DENIED_TOOL_MESSAGE: 'sending mail is not allowed for agents; save a draft instead',
     /**
      * OAuth state (clients, tokens, pending sign-ins) under CREWLY_HOME:
      * AES-256-GCM with the install's master key, mode 0600.