crewly 1.20.307 → 1.20.308

package/dist/backend/backend/src/services/board/canvas/canvas-inbound.service.js

@@ -0,0 +1,339 @@
+/**
+ * CanvasInboundService - the machine side of the owner actions on the Crewly
+ * Canvas (crewly#1247 v2).
+ *
+ * The owner uses the canvas in the Crewly Cloud portal: message an agent, stop
+ * an agent, open / renew / close an agent's terminal. Cloud stores the action
+ * and pushes a `canvas_action` relay message with only ids in it
+ * (`{actionId, instanceId, session, kind}`) - the same secure pattern as Cloud
+ * Talk and "waiting on you". This service:
+ *
+ *  1. checks the push is for this machine and names an agent that exists here;
+ *  2. fetches the action from Cloud with this machine's own token
+ *     (`GET /api/cloud/canvas/actions/:actionId?instanceId=`). Cloud answers
+ *     only for an action stored by the OWNER of the token's account for this
+ *     machine, so a push anybody else dropped in the relay queue (or one from a
+ *     member / guest of the account) is never run; the fetched ids and kind
+ *     must match the push;
+ *  3. runs it: a message is recorded in the agent's DM as an owner message and
+ *     handed to the agent exactly like a Talk / Crewly Chat message (replies
+ *     route as usual); a stop is the dashboard's stop; terminal actions drive
+ *     {@link CanvasTerminalService};
+ *  4. reports the result (`POST .../actions/:actionId/result`).
+ *
+ * Idempotent: an action carried out is not run again when Cloud re-pushes it
+ * (it only re-reports); a message is also keyed by `clientMessageId` in the DM.
+ *
+ * Older OSS versions ignore `canvas_action` (every relay listener filters on
+ * its own `type`), and Cloud only sends it to machines advertising the
+ * `canvas_actions` capability, which this service turns on when it starts.
+ *
+ * @module services/board/canvas/canvas-inbound.service
+ */
+import { CANVAS_CONSTANTS, ORCHESTRATOR_SESSION_NAME, SLACK_AGENT_DM_CONSTANTS } from '../../../constants.js';
+import { LoggerService } from '../../core/logger.service.js';
+import { recordCloudTalkTurn } from '../../chat-v2/owner-inbound.utils.js';
+const C = CANVAS_CONSTANTS;
+/** Session names; `@` only for the orchestrator spelled per machine (`crewly-orc@<instance>`). */
+const SESSION_PATTERN = /^[A-Za-z0-9._@-]{1,128}$/;
+const ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const isKind = (v) => typeof v === 'string' && C.ACTION_KINDS.includes(v);
+/**
+ * Validate the relay push. Never throws.
+ *
+ * @param raw - `msg.payload`
+ * @returns The ids, or null when malformed
+ */
+export function parseCanvasRelayData(raw) {
+    if (!isRecord(raw))
+        return null;
+    const { actionId, instanceId, session, kind } = raw;
+    if (typeof actionId !== 'string' || !ID_PATTERN.test(actionId))
+        return null;
+    if (typeof instanceId !== 'string' || instanceId.length === 0 || instanceId.length > 128)
+        return null;
+    if (typeof session !== 'string' || !SESSION_PATTERN.test(session))
+        return null;
+    if (!isKind(kind))
+        return null;
+    return { actionId, instanceId, session, kind };
+}
+/**
+ * Validate Cloud's answer to the action fetch (`{success, data: {...}}`). Never throws.
+ *
+ * @param raw - Parsed JSON body
+ * @returns The action, or null when unusable
+ */
+export function parseCanvasFetchResponse(raw) {
+    const data = isRecord(raw) && isRecord(raw['data']) ? raw['data'] : null;
+    if (!data)
+        return null;
+    const { actionId, instanceId, session, kind, text, clientMessageId } = data;
+    if (typeof actionId !== 'string' || !ID_PATTERN.test(actionId))
+        return null;
+    if (typeof instanceId !== 'string' || !instanceId)
+        return null;
+    if (typeof session !== 'string' || !SESSION_PATTERN.test(session))
+        return null;
+    if (!isKind(kind))
+        return null;
+    return {
+        actionId,
+        instanceId,
+        session,
+        kind,
+        ...(typeof text === 'string' ? { text } : {}),
+        ...(typeof clientMessageId === 'string' && ID_PATTERN.test(clientMessageId) ? { clientMessageId } : {}),
+    };
+}
+let active = false;
+/**
+ * Capabilities to advertise to Cloud (heartbeat and uploads).
+ *
+ * @returns `['canvas_actions']` while the handler runs, else `[]`
+ */
+export function canvasCapabilities() {
+    return active ? [C.CAPABILITY] : [];
+}
+/** Runs the owner's canvas actions pushed from Crewly Cloud - see module docs. */
+export class CanvasInboundService {
+    deps;
+    logger;
+    fetchImpl;
+    sleep;
+    now;
+    ownerUserId;
+    inFlight = new Set();
+    done = new Map();
+    listener = (msg) => {
+        void this.handle(msg);
+    };
+    started = false;
+    constructor(deps) {
+        this.deps = deps;
+        this.logger = deps.logger ?? LoggerService.getInstance().createComponentLogger('CanvasInbound');
+        this.fetchImpl = deps.fetchImpl ?? ((input, init) => fetch(input, init));
+        this.sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        this.now = deps.now ?? Date.now;
+        this.ownerUserId = deps.ownerUserId ?? SLACK_AGENT_DM_CONSTANTS.OWNER_USER_ID;
+    }
+    /** Subscribe to relay messages and advertise the capability. Idempotent. */
+    start() {
+        if (this.started)
+            return;
+        this.started = true;
+        this.deps.source.on('message', this.listener);
+        active = true;
+        this.logger.info('Canvas action handler started');
+    }
+    /** Unsubscribe; the capability is no longer advertised. */
+    stop() {
+        if (!this.started)
+            return;
+        this.started = false;
+        this.deps.source.off('message', this.listener);
+        active = false;
+    }
+    /**
+     * Handle one relay message. Anything but a well-formed `canvas_action` is
+     * ignored. Never throws.
+     *
+     * @param msg - Relay message from CloudSyncService
+     * @returns What was done
+     */
+    async handle(msg) {
+        if (msg?.type !== C.RELAY_MESSAGE_TYPE)
+            return 'ignored';
+        const data = parseCanvasRelayData(msg.payload);
+        if (!data) {
+            this.logger.warn('Ignored a malformed canvas_action relay message');
+            return 'ignored';
+        }
+        if (this.inFlight.has(data.actionId))
+            return 'duplicate';
+        this.inFlight.add(data.actionId);
+        try {
+            return await this.process(data);
+        }
+        catch (error) {
+            this.logger.warn('Canvas action failed', { actionId: data.actionId, error: error instanceof Error ? error.message : String(error) });
+            return 'fetch_failed';
+        }
+        finally {
+            this.inFlight.delete(data.actionId);
+        }
+    }
+    async process(data) {
+        const { instanceId, deviceName } = await this.deps.identity();
+        if (data.instanceId !== instanceId) {
+            this.logger.warn('Ignored a canvas_action addressed to another machine', { target: data.instanceId });
+            return 'not_for_this_machine';
+        }
+        this.pruneDone();
+        const earlier = this.done.get(data.actionId);
+        if (earlier) {
+            await this.report(data.actionId, earlier.result);
+            return 'duplicate';
+        }
+        const fetched = await this.fetchAction(data, instanceId);
+        if (fetched.kind === 'not_found') {
+            // Not an action the account's owner stored for this machine: not from Cloud
+            this.logger.warn('Ignored a canvas_action Crewly Cloud does not know for this machine', { actionId: data.actionId });
+            return 'unverified';
+        }
+        if (fetched.kind === 'expired')
+            return 'duplicate';
+        if (fetched.kind === 'error') {
+            this.logger.warn('Could not fetch a canvas action; Cloud will push it again', { actionId: data.actionId, error: fetched.error });
+            return 'fetch_failed';
+        }
+        const action = fetched.action;
+        if (action.actionId !== data.actionId || action.instanceId !== instanceId || action.session !== data.session || action.kind !== data.kind) {
+            this.logger.warn('Ignored a canvas_action that does not match what Cloud stored', { actionId: data.actionId });
+            return 'unverified';
+        }
+        this.deps.onAction?.();
+        const device = deviceName || 'this machine';
+        const session = action.session.startsWith(`${ORCHESTRATOR_SESSION_NAME}@`) ? ORCHESTRATOR_SESSION_NAME : action.session;
+        let result;
+        if (!(await this.deps.agentExists(session))) {
+            result = { instanceId, ok: false, code: 'no_agent', error: `No agent named "${session}" on ${device}` };
+        }
+        else {
+            result = await this.run(action, session, instanceId, device);
+        }
+        this.done.set(data.actionId, { at: this.now(), result });
+        await this.report(data.actionId, result);
+        return result.ok ? 'done' : 'refused';
+    }
+    async run(action, session, instanceId, device) {
+        const fail = (code, error) => ({ instanceId, ok: false, code, error });
+        switch (action.kind) {
+            case 'message': {
+                const text = (action.text ?? '').trim();
+                if (!text)
+                    return fail('empty', 'The message is empty');
+                if (text.length > C.MESSAGE_MAX)
+                    return fail('too_long', `The message is longer than ${C.MESSAGE_MAX} characters`);
+                let recorded;
+                try {
+                    recorded = recordCloudTalkTurn(this.deps.chat, {
+                        agentSession: session,
+                        text,
+                        clientMessageId: action.clientMessageId ?? `canvas-${action.actionId}`,
+                        ownerUserId: this.ownerUserId,
+                    });
+                }
+                catch (error) {
+                    return fail('record_failed', `Could not record the message on ${device}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                if (recorded.deduped)
+                    return { instanceId, ok: true };
+                try {
+                    const channel = this.deps.chat.getChannel(recorded.channelId, { userId: this.ownerUserId, source: 'oss' });
+                    await this.deps.deliver(channel, recorded.message);
+                }
+                catch (error) {
+                    // Recorded, but the agent was not paged: it reads the DM when it next looks
+                    this.logger.warn('Canvas message recorded but not handed to the agent', { session, error: error instanceof Error ? error.message : String(error) });
+                }
+                this.logger.info('Canvas message received', { session });
+                return { instanceId, ok: true };
+            }
+            case 'stop': {
+                if (session === ORCHESTRATOR_SESSION_NAME)
+                    return fail('not_allowed', 'The orchestrator is stopped on the machine itself');
+                const r = await this.deps.stopAgent(session);
+                this.logger.info('Canvas stop', { session, ok: r.ok });
+                return r.ok ? { instanceId, ok: true } : fail('stop_failed', r.error ?? 'Could not stop the agent');
+            }
+            case 'terminal_open':
+            case 'terminal_renew': {
+                if (action.kind === 'terminal_renew' && this.deps.terminal.renew(session))
+                    return { instanceId, ok: true };
+                // A renew after a restart opens again: the viewer is still there
+                const r = this.deps.terminal.open(session);
+                return r.ok ? { instanceId, ok: true } : fail(r.code, r.code === 'too_many_streams' ? 'Too many terminals are open' : r.code === 'no_session' ? 'The agent has no terminal right now' : 'Not signed in to Crewly Cloud');
+            }
+            case 'terminal_close':
+                this.deps.terminal.close(session, 'closed');
+                return { instanceId, ok: true };
+        }
+    }
+    pruneDone() {
+        const cutoff = this.now() - C.DONE_ACTIONS_TTL_MS;
+        for (const [id, entry] of this.done)
+            if (entry.at < cutoff)
+                this.done.delete(id);
+        while (this.done.size > C.DONE_ACTIONS_MAX)
+            this.done.delete(this.done.keys().next().value);
+    }
+    url(suffix) {
+        const base = this.deps.cloud.getCloudUrl();
+        return base ? `${base.replace(/\/$/, '')}${C.ACTIONS_PATH}${suffix}` : null;
+    }
+    /** Fetch the action from Cloud with this machine's token; one refresh on 401, a few retries on network / 5xx. */
+    async fetchAction(data, instanceId) {
+        const url = this.url(`/${encodeURIComponent(data.actionId)}?instanceId=${encodeURIComponent(instanceId)}`);
+        if (!url)
+            return { kind: 'error', error: 'not signed in to Crewly Cloud' };
+        const delays = C.FETCH_RETRY_DELAYS_MS;
+        let refreshed = false;
+        let lastError = 'unknown';
+        for (let attempt = 0; attempt <= delays.length; attempt++) {
+            if (attempt > 0)
+                await this.sleep(delays[attempt - 1] ?? 0);
+            const token = this.deps.cloud.getToken();
+            if (!token)
+                return { kind: 'error', error: 'not signed in to Crewly Cloud' };
+            let response;
+            try {
+                response = await this.fetchImpl(url, { method: 'GET', headers: { Authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(C.REQUEST_TIMEOUT_MS) });
+            }
+            catch (error) {
+                lastError = error instanceof Error ? error.message : String(error);
+                continue;
+            }
+            if (response.status === 401 && !refreshed && this.deps.cloud.tryRefreshToken) {
+                refreshed = true;
+                if (await this.deps.cloud.tryRefreshToken().catch(() => false)) {
+                    attempt--;
+                    continue;
+                }
+            }
+            // 403: the token's account is not the owner of this action (a member / guest)
+            if (response.status === 404 || response.status === 403)
+                return { kind: 'not_found' };
+            if (response.status === 410)
+                return { kind: 'expired' };
+            if (response.ok) {
+                const parsed = parseCanvasFetchResponse(await response.json().catch(() => null));
+                return parsed ? { kind: 'ok', action: parsed } : { kind: 'error', error: 'unusable response from Crewly Cloud' };
+            }
+            lastError = `HTTP ${response.status}`;
+            if (response.status >= 400 && response.status < 500 && response.status !== 429)
+                break;
+        }
+        return { kind: 'error', error: lastError };
+    }
+    /** Report the result to Cloud (best effort; a re-push re-reports). */
+    async report(actionId, body) {
+        const url = this.url(`/${encodeURIComponent(actionId)}/result`);
+        const token = this.deps.cloud.getToken();
+        if (!url || !token)
+            return;
+        try {
+            await this.fetchImpl(url, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(C.REQUEST_TIMEOUT_MS),
+            });
+        }
+        catch (error) {
+            this.logger.debug('Could not report a canvas action result', { actionId, error: error instanceof Error ? error.message : String(error) });
+        }
+    }
+}
+//# sourceMappingURL=canvas-inbound.service.js.map

package/dist/backend/backend/src/services/board/canvas/canvas-inbound.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-inbound.service.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/board/canvas/canvas-inbound.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAwB,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAY3E,MAAM,CAAC,GAAG,gBAAgB,CAAC;AAE3B,kGAAkG;AAClG,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxH,MAAM,MAAM,GAAG,CAAC,CAAU,EAAyB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAEjI;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACtG,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO;QACN,QAAQ;QACR,UAAU;QACV,OAAO;QACP,IAAI;QACJ,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,eAAe,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvG,CAAC;AACH,CAAC;AAoCD,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IACjC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,kFAAkF;AAClF,MAAM,OAAO,oBAAoB;IAaH;IAZZ,MAAM,CAAkB;IACxB,SAAS,CAAiB;IAC1B,KAAK,CAAgC;IACrC,GAAG,CAAe;IAClB,WAAW,CAAS;IACpB,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,IAAI,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC5E,QAAQ,GAAG,CAAC,GAAoB,EAAQ,EAAE;QAC1D,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC;IACM,OAAO,GAAG,KAAK,CAAC;IAExB,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;QAChG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,wBAAwB,CAAC,aAAa,CAAC;IAC/E,CAAC;IAED,4EAA4E;IAC5E,KAAK;QACJ,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,2DAA2D;IAC3D,IAAI;QACH,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,GAAG,KAAK,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,GAAoB;QAChC,IAAI,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,kBAAkB;YAAE,OAAO,SAAS,CAAC;QACzD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,WAAW,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrI,OAAO,cAAc,CAAC;QACvB,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAA2B;QAChD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACtG,OAAO,sBAAsB,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO,WAAW,CAAC;QACpB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qEAAqE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrH,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YACjI,OAAO,cAAc,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3I,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/G,OAAO,YAAY,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,UAAU,IAAI,cAAc,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,yBAAyB,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACxH,IAAI,MAAiC,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,OAAO,QAAQ,MAAM,EAAE,EAAE,CAAC;QACzG,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,MAAiC,EAAE,OAAe,EAAE,UAAkB,EAAE,MAAc;QACvG,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAa,EAA6B,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClH,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,SAAS,CAAC,CAAC,CAAC;gBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;gBACxD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW;oBAAE,OAAO,IAAI,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC,WAAW,aAAa,CAAC,CAAC;gBACnH,IAAI,QAAgD,CAAC;gBACrD,IAAI,CAAC;oBACJ,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;wBAC9C,YAAY,EAAE,OAAO;wBACrB,IAAI;wBACJ,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,UAAU,MAAM,CAAC,QAAQ,EAAE;wBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;qBAC7B,CAAC,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,OAAO,IAAI,CAAC,eAAe,EAAE,mCAAmC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtI,CAAC;gBACD,IAAI,QAAQ,CAAC,OAAO;oBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACtD,IAAI,CAAC;oBACJ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC3G,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,4EAA4E;oBAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACrJ,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACb,IAAI,OAAO,KAAK,yBAAyB;oBAAE,OAAO,IAAI,CAAC,aAAa,EAAE,mDAAmD,CAAC,CAAC;gBAC3H,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,IAAI,0BAA0B,CAAC,CAAC;YACrG,CAAC;YACD,KAAK,eAAe,CAAC;YACrB,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACvB,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBAC3G,iEAAiE;gBACjE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3C,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC;YAC1N,CAAC;YACD,KAAK,gBAAgB;gBACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC5C,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAClC,CAAC;IACF,CAAC;IAEO,SAAS;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,mBAAmB,CAAC;QAClD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;IACvG,CAAC;IAEO,GAAG,CAAC,MAAc;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED,iHAAiH;IACzG,KAAK,CAAC,WAAW,CAAC,IAA2B,EAAE,UAAkB;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,qBAAqB,CAAC;QACvC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,SAAS,GAAG,SAAS,CAAC;QAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YAC3D,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YAC7E,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACJ,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAC3J,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,SAAS;YACV,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC9E,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChE,OAAO,EAAE,CAAC;oBACV,SAAS;gBACV,CAAC;YACF,CAAC;YACD,8EAA8E;YAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACrF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACxD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;YAClH,CAAC;YACD,SAAS,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM;QACvF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAA+B;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;YAAE,OAAO;QAC3B,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;aACjD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3I,CAAC;IACF,CAAC;CACD"}

package/dist/backend/backend/src/services/board/canvas/canvas-redact.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Redaction for what the canvas shows (crewly#1247 v2), on the machine, before
+ * anything leaves it:
+ *
+ * - {@link shortAgentLine}: the agent's own words from a transcript, reduced
+ *   to one short line (at most 280 characters), no code blocks, no secrets;
+ * - {@link maskTerminalText}: a terminal tail with every secret, token, email
+ *   and URL query masked.
+ *
+ * Both reuse the board's {@link scrubText} and the secret redactor that guards
+ * the session logs; this file only adds what those do not cover (zero-width
+ * characters, base64 blobs, spaced `key = value` secrets, ANSI).
+ *
+ * Pure (no I/O).
+ *
+ * @module services/board/canvas/canvas-redact
+ */
+import type { SecretEnvValue } from '../../../utils/secret-env.js';
+/**
+ * Reduce an assistant message block to one short, safe line.
+ *
+ * Takes the first paragraph outside code fences (a list item or heading loses
+ * its marker), removes markdown emphasis, masks secrets / emails / URL
+ * queries / phone numbers, and cuts at 280 characters. Anything that is
+ * markup (`<system-reminder>`), an interrupt notice, or empty after masking
+ * gives null.
+ *
+ * @param raw - Text of a `text` block
+ * @param secrets - Exact secret values to mask (backend env)
+ * @returns The line, or null when nothing worth showing is left
+ */
+export declare function shortAgentLine(raw: unknown, secrets?: readonly SecretEnvValue[]): string | null;
+/**
+ * Mask a terminal tail for the canvas: ANSI and control characters removed,
+ * then secrets (by value, by `NAME=value`, by shape), emails, URL queries and
+ * credentials, bearer tokens, password prompts and long token-like words.
+ *
+ * @param text - Raw tail (the PTY capture)
+ * @param secrets - Exact secret values to mask (backend env)
+ * @param maxLines - Keep this many lines from the end
+ * @returns Lines, oldest first, each at most {@link CANVAS_CONSTANTS.TERMINAL_MAX_LINE_CHARS} characters
+ */
+export declare function maskTerminalText(text: string, secrets?: readonly SecretEnvValue[], maxLines?: number): string[];
+//# sourceMappingURL=canvas-redact.d.ts.map

package/dist/backend/backend/src/services/board/canvas/canvas-redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-redact.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/board/canvas/canvas-redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAgEnE;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,SAAS,cAAc,EAAO,GAAG,MAAM,GAAG,IAAI,CAsBnG;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,SAAS,cAAc,EAAO,EAAE,QAAQ,GAAE,MAA8B,GAAG,MAAM,EAAE,CA6B1I"}

package/dist/backend/backend/src/services/board/canvas/canvas-redact.js

@@ -0,0 +1,161 @@
+/**
+ * Redaction for what the canvas shows (crewly#1247 v2), on the machine, before
+ * anything leaves it:
+ *
+ * - {@link shortAgentLine}: the agent's own words from a transcript, reduced
+ *   to one short line (at most 280 characters), no code blocks, no secrets;
+ * - {@link maskTerminalText}: a terminal tail with every secret, token, email
+ *   and URL query masked.
+ *
+ * Both reuse the board's {@link scrubText} and the secret redactor that guards
+ * the session logs; this file only adds what those do not cover (zero-width
+ * characters, base64 blobs, spaced `key = value` secrets, ANSI).
+ *
+ * Pure (no I/O).
+ *
+ * @module services/board/canvas/canvas-redact
+ */
+import { CANVAS_CONSTANTS } from '../../../constants.js';
+import { redactSecrets } from '../../../utils/secret-redactor.js';
+import { clip, looksLikeToken, REDACTED, scrubText } from '../board-redact.js';
+const C = CANVAS_CONSTANTS;
+/** A terminal capture is cut to this many characters from the end before any pattern runs. */
+const MAX_RAW_CHARS = 400_000;
+/** A raw line is cut to this many characters (an escape-heavy line shrinks after ANSI removal). */
+const MAX_RAW_LINE = 6_000;
+/** A line is masked over its first this many characters (the displayed 400 plus room for a secret that straddles the cut; the cost is quadratic in it). */
+const MASK_LINE_CHARS = 600;
+// eslint-disable-next-line no-control-regex
+const ANSI = /\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[PX^_][^\x1b]*\x1b\\|\x1b[@-Z\\^_=>]|\x9b[0-9;?]*[ -/]*[@-~]/g;
+/** Characters that hide text or reorder it. */
+const INVISIBLE = /[\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g;
+/** A long run of base64 / base64url, or a data: URI payload. */
+const BASE64_BLOB = /data:[\w/+.-]+;base64,[A-Za-z0-9+/_=-]+|[A-Za-z0-9+_]{40,}={0,2}/g;
+/** `secret_key = value` with spaces around the separator (the shared redactor wants `NAME=value`). */
+const SPACED_SECRET = /((?:api[_ -]?key|secret|token|passw(?:or)?d|passphrase|private[_ -]?key|credential|auth)[\w-]*\s*(?:[:=]|is)\s+)["']?[^\s"',;]{4,}/gi;
+const PROMPT_SECRET = /((?:password|passphrase|pin|otp|verification code|2fa code)(?:\s+for\s+\S+)?\s*(?:\([^)]*\))?\s*[:?]\s*)\S.*$/gim;
+/** `[REDACTED NAME]` from the shared redactor, without the name (which env var it was is not Cloud's business). */
+const REDACTED_MASK = /\[REDACTED[^\]]*\]/g;
+const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}/g;
+const URL_QUERY = /(\bhttps?:\/\/[^\s?#"'<>]+)\?[^\s"'<>]*/gi;
+const URL_CREDENTIALS = /(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi;
+const BEARER = /\b(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{6,}/gi;
+const HEX_LONG = /\b[0-9a-fA-F]{32,}\b/g;
+/** A phone number: international (`+...`) or three-three-four groups. Dates, versions and model ids are not. */
+const PHONE = /(?<![\w.-])(?:\+\d[\d\s().-]{8,}\d|\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4})(?![\w-])/g;
+/**
+ * Whether a word of a terminal line looks like a credential. Slugs such as
+ * `claude-opus-4-5-20251101` (lowercase words joined by dashes) are not.
+ *
+ * @param word - Word without surrounding punctuation
+ * @returns True when it should be masked
+ */
+function looksSecretWord(word) {
+    if (word.length < 24 || !/^[A-Za-z0-9_+=/-]+$/.test(word))
+        return false;
+    if (!/\d/.test(word) || !/[A-Za-z]/.test(word))
+        return false;
+    if (/^[a-z0-9]+(?:-[a-z0-9.]+)+$/.test(word))
+        return false;
+    if (word.includes('/'))
+        return false; // a path
+    return looksLikeToken(word) || (/[A-Z]/.test(word) && /[a-z]/.test(word));
+}
+/**
+ * Mask what must not be shown in either surface.
+ *
+ * @param text - One line or a whole text
+ * @returns Text with emails, URL queries / credentials, bearer tokens, long hex, blobs and spaced secrets masked
+ */
+function maskCommon(text) {
+    let s = text;
+    s = s.replace(URL_CREDENTIALS, `$1${REDACTED}@`);
+    s = s.replace(URL_QUERY, '$1?[query]');
+    s = s.replace(EMAIL, '[email]');
+    s = s.replace(BEARER, REDACTED);
+    s = s.replace(SPACED_SECRET, `$1${REDACTED}`);
+    s = s.replace(HEX_LONG, REDACTED);
+    s = s.replace(BASE64_BLOB, (m) => (m.startsWith('data:') || m.endsWith('=') || (/\d/.test(m) && /[A-Z]/.test(m) && /[a-z]/.test(m)) ? REDACTED : m));
+    return s;
+}
+/**
+ * Reduce an assistant message block to one short, safe line.
+ *
+ * Takes the first paragraph outside code fences (a list item or heading loses
+ * its marker), removes markdown emphasis, masks secrets / emails / URL
+ * queries / phone numbers, and cuts at 280 characters. Anything that is
+ * markup (`<system-reminder>`), an interrupt notice, or empty after masking
+ * gives null.
+ *
+ * @param raw - Text of a `text` block
+ * @param secrets - Exact secret values to mask (backend env)
+ * @returns The line, or null when nothing worth showing is left
+ */
+export function shortAgentLine(raw, secrets = []) {
+    if (typeof raw !== 'string')
+        return null;
+    let s = raw.length > 6000 ? raw.slice(0, 6000) : raw;
+    s = s.replace(INVISIBLE, '').replace(ANSI, '');
+    // Code is never a "short line": drop fenced blocks (an unclosed fence runs to the end)
+    s = s.replace(/```[\s\S]*?(?:```|$)/g, '\n\n').replace(/~~~[\s\S]*?(?:~~~|$)/g, '\n\n');
+    const paragraphs = s
+        .split(/\n\s*\n/)
+        .map((p) => p.trim())
+        .filter(Boolean);
+    let first = paragraphs.find((p) => !/^(?:\||<|\[Request interrupted|No response requested|API Error)/i.test(p)) ?? '';
+    // Soft-wrapped lines are one sentence; a list shows its first item
+    const lines = first.split('\n').map((l) => l.trim()).filter(Boolean);
+    first = /^(?:[-*+]|\d+[.)])\s/.test(lines[0] ?? '') ? (lines[0] ?? '') : lines.join(' ');
+    first = first
+        .replace(/^(?:#{1,6}|[-*+]|\d+[.)]|>)\s+/, '')
+        .replace(/\[([^\]]{1,120})\]\(([^)\s]*)\)/g, '$1')
+        .replace(/(\*\*|__|\*|_|`)/g, '');
+    if (first.length < 2 || /^<[a-z/!]/i.test(first))
+        return null;
+    const out = scrubText(maskCommon(redactSecrets(first, secrets).replace(REDACTED_MASK, REDACTED)).replace(PHONE, '[number]'), C.TEXT_MAX);
+    if (!/[\p{L}\p{N}]/u.test(out.replace(/\[(?:redacted|email|number|query)\]/gi, '')))
+        return null;
+    return out;
+}
+/**
+ * Mask a terminal tail for the canvas: ANSI and control characters removed,
+ * then secrets (by value, by `NAME=value`, by shape), emails, URL queries and
+ * credentials, bearer tokens, password prompts and long token-like words.
+ *
+ * @param text - Raw tail (the PTY capture)
+ * @param secrets - Exact secret values to mask (backend env)
+ * @param maxLines - Keep this many lines from the end
+ * @returns Lines, oldest first, each at most {@link CANVAS_CONSTANTS.TERMINAL_MAX_LINE_CHARS} characters
+ */
+export function maskTerminalText(text, secrets = [], maxLines = C.TERMINAL_TAIL_LINES) {
+    // Bound the work first: the patterns below are linear per line, but a single
+    // megabyte-long line of letters would still cost seconds in the email pattern
+    const bounded = (text.length > MAX_RAW_CHARS ? text.slice(-MAX_RAW_CHARS) : text)
+        .split('\n')
+        .slice(-(maxLines + 20))
+        .map((l) => (l.length > MAX_RAW_LINE ? l.slice(0, MAX_RAW_LINE) : l));
+    let s = bounded.join('\n').replace(/\r\n/g, '\n').replace(ANSI, '').replace(INVISIBLE, '');
+    // A carriage return redraws the line: keep what was drawn last
+    s = s
+        .split('\n')
+        .map((l) => {
+        const drawn = l.includes('\r') ? (l.split('\r').filter(Boolean).pop() ?? '') : l;
+        return drawn.length > MASK_LINE_CHARS ? drawn.slice(0, MASK_LINE_CHARS) : drawn;
+    })
+        .join('\n');
+    // eslint-disable-next-line no-control-regex
+    s = s.replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, '');
+    // Whole-text passes first: a private key block spans lines
+    s = redactSecrets(s, secrets).replace(REDACTED_MASK, REDACTED);
+    s = s.replace(PROMPT_SECRET, `$1${REDACTED}`);
+    const lines = s.split('\n').map((line) => {
+        let l = maskCommon(line);
+        l = l.replace(PHONE, '[number]');
+        l = l.replace(/[A-Za-z0-9_+=/-]{24,}/g, (w) => (looksSecretWord(w) ? REDACTED : w));
+        return clip(l.replace(/\s+$/, ''), C.TERMINAL_MAX_LINE_CHARS);
+    });
+    while (lines.length > 0 && lines[lines.length - 1] === '')
+        lines.pop();
+    return lines.slice(-maxLines);
+}
+//# sourceMappingURL=canvas-redact.js.map

package/dist/backend/backend/src/services/board/canvas/canvas-redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-redact.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/board/canvas/canvas-redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/E,MAAM,CAAC,GAAG,gBAAgB,CAAC;AAE3B,8FAA8F;AAC9F,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,mGAAmG;AACnG,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,2JAA2J;AAC3J,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,4CAA4C;AAC5C,MAAM,IAAI,GAAG,+HAA+H,CAAC;AAC7I,+CAA+C;AAC/C,MAAM,SAAS,GAAG,kDAAkD,CAAC;AACrE,gEAAgE;AAChE,MAAM,WAAW,GAAG,mEAAmE,CAAC;AACxF,sGAAsG;AACtG,MAAM,aAAa,GAAG,sIAAsI,CAAC;AAC7J,MAAM,aAAa,GAAG,kHAAkH,CAAC;AACzI,mHAAmH;AACnH,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAC5C,MAAM,KAAK,GAAG,oEAAoE,CAAC;AACnF,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAC9D,MAAM,eAAe,GAAG,iDAAiD,CAAC;AAC1E,MAAM,MAAM,GAAG,+CAA+C,CAAC;AAC/D,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AACzC,gHAAgH;AAChH,MAAM,KAAK,GAAG,iFAAiF,CAAC;AAEhG;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAAY;IACpC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,SAAS;IAC/C,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,IAAY;IAC/B,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,QAAQ,GAAG,CAAC,CAAC;IACjD,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAChC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrJ,OAAO,CAAC,CAAC;AACV,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,UAAqC,EAAE;IACnF,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,uFAAuF;IACvF,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACxF,MAAM,UAAU,GAAG,CAAC;SAClB,KAAK,CAAC,SAAS,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,IAAI,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kEAAkE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtH,mEAAmE;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrE,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzF,KAAK,GAAG,KAAK;SACX,OAAO,CAAC,gCAAgC,EAAE,EAAE,CAAC;SAC7C,OAAO,CAAC,kCAAkC,EAAE,IAAI,CAAC;SACjD,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,UAAqC,EAAE,EAAE,WAAmB,CAAC,CAAC,mBAAmB;IAC/H,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;SAC/E,KAAK,CAAC,IAAI,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3F,+DAA+D;IAC/D,CAAC,GAAG,CAAC;SACH,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACV,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,4CAA4C;IAC5C,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;IACzD,2DAA2D;IAC3D,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACvE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC"}

package/dist/backend/backend/src/services/board/canvas/canvas-step.normalizer.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Step normalizer (crewly#1247 v2): maps a runtime tool call, a browser action,
+ * a chat reply or a wait on the owner to one canvas step: a kind, a verb
+ * (`label`) and a redacted `target`. Same redaction rules as the board
+ * ({@link scrubText}, repo-relative paths, host + path, executable +
+ * subcommand); the raw tool input is read here and dropped.
+ *
+ * Pure (no I/O).
+ *
+ * @module services/board/canvas/canvas-step.normalizer
+ */
+import { type NormalizeContext, type ToolInput } from '../board-activity.normalizer.js';
+import type { StepKind } from './canvas.types.js';
+/** What a step says before it gets an id and a time. */
+export interface StepShape {
+    kind: StepKind;
+    label: string;
+    target?: string;
+}
+/**
+ * One tool call as a step.
+ *
+ * @param toolName - Runtime tool name (`Edit`, `Bash`, `mcp__x__y`, ...)
+ * @param input - Validated input slice (see {@link parseToolInput})
+ * @param ctx - Project roots for relative paths
+ * @returns Kind, verb and redacted target
+ *
+ * @example
+ * ```typescript
+ * stepOfTool('Bash', { command: 'cd app && npm test -- --ci' }); // { kind: 'command', label: 'Ran', target: 'npm test' }
+ * stepOfTool('WebSearch', { query: 'open swarm rivals' }); // { kind: 'search', label: 'Searched', target: '"open swarm rivals"' }
+ * ```
+ */
+export declare function stepOfTool(toolName: string, input?: ToolInput, ctx?: NormalizeContext): StepShape;
+/**
+ * A browser action by an agent (the Chrome extension path).
+ *
+ * @param tool - Extension tool name (`navigate`, `click`, ...)
+ * @param url - The page the agent is on, if known
+ * @returns Step shape
+ */
+export declare function stepOfBrowserAction(tool: string, url?: string): StepShape;
+/**
+ * An agent message to the owner or a channel.
+ *
+ * @param channel - Channel or chat name (`#general`, `owner chat`, `Slack`)
+ * @returns Step shape
+ */
+export declare function stepOfMessage(channel: string): StepShape;
+/**
+ * The agent waits for the owner.
+ *
+ * @param what - Short plain-words description
+ * @returns Step shape
+ */
+export declare function stepOfOwnerWait(what: string): StepShape;
+//# sourceMappingURL=canvas-step.normalizer.d.ts.map

package/dist/backend/backend/src/services/board/canvas/canvas-step.normalizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-step.normalizer.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/board/canvas/canvas-step.normalizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAMN,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,wDAAwD;AACxD,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAoDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,SAAc,EAAE,GAAG,GAAE,gBAAqB,GAAG,SAAS,CAyCzG;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAYzE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAGxD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAEvD"}