crewly 1.20.307 → 1.20.309

package/dist/backend/backend/src/services/board/board.types.js

@@ -4,5 +4,13 @@
  *
  * @module services/board/board.types
  */
-export {};
+/**
+ * The identity of a link.
+ *
+ * @param link - Link (or its identity parts)
+ * @returns `kind|from|to`
+ */
+export function linkKey(link) {
+    return `${link.kind}|${link.from}|${link.to}`;
+}
 //# sourceMappingURL=board.types.js.map

package/dist/backend/backend/src/services/board/board.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"board.types.js","sourceRoot":"","sources":["../../../../../../backend/src/services/board/board.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}
+{"version":3,"file":"board.types.js","sourceRoot":"","sources":["../../../../../../backend/src/services/board/board.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2CH;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAA6C;IACpE,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;AAC/C,CAAC"}

package/dist/backend/backend/src/services/board/canvas/canvas-inbound.service.d.ts

@@ -0,0 +1,122 @@
+/**
+ * CanvasInboundService - the machine side of the owner actions on the Crewly
+ * Canvas (crewly#1247 v2).
+ *
+ * The owner uses the canvas in the Crewly Cloud portal: message an agent, stop
+ * an agent, open / renew / close an agent's terminal. Cloud stores the action
+ * and pushes a `canvas_action` relay message with only ids in it
+ * (`{actionId, instanceId, session, kind}`) - the same secure pattern as Cloud
+ * Talk and "waiting on you". This service:
+ *
+ *  1. checks the push is for this machine and names an agent that exists here;
+ *  2. fetches the action from Cloud with this machine's own token
+ *     (`GET /api/cloud/canvas/actions/:actionId?instanceId=`). Cloud answers
+ *     only for an action stored by the OWNER of the token's account for this
+ *     machine, so a push anybody else dropped in the relay queue (or one from a
+ *     member / guest of the account) is never run; the fetched ids and kind
+ *     must match the push;
+ *  3. runs it: a message is recorded in the agent's DM as an owner message and
+ *     handed to the agent exactly like a Talk / Crewly Chat message (replies
+ *     route as usual); a stop is the dashboard's stop; terminal actions drive
+ *     {@link CanvasTerminalService};
+ *  4. reports the result (`POST .../actions/:actionId/result`).
+ *
+ * Idempotent: an action carried out is not run again when Cloud re-pushes it
+ * (it only re-reports); a message is also keyed by `clientMessageId` in the DM.
+ *
+ * Older OSS versions ignore `canvas_action` (every relay listener filters on
+ * its own `type`), and Cloud only sends it to machines advertising the
+ * `canvas_actions` capability, which this service turns on when it starts.
+ *
+ * @module services/board/canvas/canvas-inbound.service
+ */
+import { type ComponentLogger } from '../../core/logger.service.js';
+import type { ChatChannelDTO, ChatMessageDTO } from '../../chat-v2/types.js';
+import type { IncomingMessage } from '../../cloud/cloud-sync.types.js';
+import type { CloudTalkCloud, CloudTalkFetch, CloudTalkInboundChat, CloudTalkSource } from '../../cloud/cloud-talk-inbound.service.js';
+import type { CanvasTerminalService } from './canvas-terminal.service.js';
+import type { CanvasActionFetchResponse, CanvasActionRelayData } from './canvas.types.js';
+/**
+ * Validate the relay push. Never throws.
+ *
+ * @param raw - `msg.payload`
+ * @returns The ids, or null when malformed
+ */
+export declare function parseCanvasRelayData(raw: unknown): CanvasActionRelayData | null;
+/**
+ * Validate Cloud's answer to the action fetch (`{success, data: {...}}`). Never throws.
+ *
+ * @param raw - Parsed JSON body
+ * @returns The action, or null when unusable
+ */
+export declare function parseCanvasFetchResponse(raw: unknown): CanvasActionFetchResponse | null;
+/** Constructor dependencies. */
+export interface CanvasInboundDeps {
+    source: CloudTalkSource;
+    cloud: CloudTalkCloud;
+    chat: CloudTalkInboundChat;
+    identity: () => Promise<{
+        instanceId: string;
+        deviceName?: string;
+    }>;
+    /** Hand the recorded message to the agent (ticket intake + dispatcher), as Cloud Talk does. */
+    deliver: (channel: ChatChannelDTO, message: ChatMessageDTO) => Promise<void>;
+    /** Whether the agent exists on this machine */
+    agentExists: (session: string) => Promise<boolean>;
+    /** Stop the agent (the dashboard's stop). */
+    stopAgent: (session: string) => Promise<{
+        ok: boolean;
+        error?: string;
+    }>;
+    terminal: Pick<CanvasTerminalService, 'open' | 'renew' | 'close'>;
+    /** An owner action arrived: someone is watching */
+    onAction?: () => void;
+    ownerUserId?: string;
+    fetchImpl?: CloudTalkFetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    logger?: ComponentLogger;
+}
+/** What {@link CanvasInboundService.handle} did (tests, logs). */
+export type CanvasActionOutcome = 'done' | 'refused' | 'duplicate' | 'ignored' | 'not_for_this_machine' | 'unverified' | 'fetch_failed';
+/**
+ * Capabilities to advertise to Cloud (heartbeat and uploads).
+ *
+ * @returns `['canvas_actions']` while the handler runs, else `[]`
+ */
+export declare function canvasCapabilities(): string[];
+/** Runs the owner's canvas actions pushed from Crewly Cloud - see module docs. */
+export declare class CanvasInboundService {
+    private readonly deps;
+    private readonly logger;
+    private readonly fetchImpl;
+    private readonly sleep;
+    private readonly now;
+    private readonly ownerUserId;
+    private readonly inFlight;
+    private readonly done;
+    private readonly listener;
+    private started;
+    constructor(deps: CanvasInboundDeps);
+    /** Subscribe to relay messages and advertise the capability. Idempotent. */
+    start(): void;
+    /** Unsubscribe; the capability is no longer advertised. */
+    stop(): void;
+    /**
+     * Handle one relay message. Anything but a well-formed `canvas_action` is
+     * ignored. Never throws.
+     *
+     * @param msg - Relay message from CloudSyncService
+     * @returns What was done
+     */
+    handle(msg: IncomingMessage): Promise<CanvasActionOutcome>;
+    private process;
+    private run;
+    private pruneDone;
+    private url;
+    /** Fetch the action from Cloud with this machine's token; one refresh on 401, a few retries on network / 5xx. */
+    private fetchAction;
+    /** Report the result to Cloud (best effort; a re-push re-reports). */
+    private report;
+}
+//# sourceMappingURL=canvas-inbound.service.d.ts.map

package/dist/backend/backend/src/services/board/canvas/canvas-inbound.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-inbound.service.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/board/canvas/canvas-inbound.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEnF,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AACvI,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EACX,yBAAyB,EAEzB,qBAAqB,EAErB,MAAM,mBAAmB,CAAC;AAW3B;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAQ/E;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,GAAG,IAAI,CAgBvF;AAED,gCAAgC;AAChC,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,QAAQ,EAAE,MAAM,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,+FAA+F;IAC/F,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,+CAA+C;IAC/C,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,6CAA6C;IAC7C,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC;IAClE,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,kEAAkE;AAClE,MAAM,MAAM,mBAAmB,GAC5B,MAAM,GACN,SAAS,GACT,WAAW,GACX,SAAS,GACT,sBAAsB,GACtB,YAAY,GACZ,cAAc,CAAC;AAMlB;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED,kFAAkF;AAClF,qBAAa,oBAAoB;IAapB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwE;IAC7F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IACF,OAAO,CAAC,OAAO,CAAS;gBAEK,IAAI,EAAE,iBAAiB;IAQpD,4EAA4E;IAC5E,KAAK,IAAI,IAAI;IAQb,2DAA2D;IAC3D,IAAI,IAAI,IAAI;IAOZ;;;;;;OAMG;IACG,MAAM,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAmBlD,OAAO;YA4CP,GAAG;IAgDjB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,GAAG;IAKX,iHAAiH;YACnG,WAAW;IAqCzB,sEAAsE;YACxD,MAAM;CAepB"}

package/dist/backend/backend/src/services/board/canvas/canvas-inbound.service.js

@@ -0,0 +1,339 @@
+/**
+ * CanvasInboundService - the machine side of the owner actions on the Crewly
+ * Canvas (crewly#1247 v2).
+ *
+ * The owner uses the canvas in the Crewly Cloud portal: message an agent, stop
+ * an agent, open / renew / close an agent's terminal. Cloud stores the action
+ * and pushes a `canvas_action` relay message with only ids in it
+ * (`{actionId, instanceId, session, kind}`) - the same secure pattern as Cloud
+ * Talk and "waiting on you". This service:
+ *
+ *  1. checks the push is for this machine and names an agent that exists here;
+ *  2. fetches the action from Cloud with this machine's own token
+ *     (`GET /api/cloud/canvas/actions/:actionId?instanceId=`). Cloud answers
+ *     only for an action stored by the OWNER of the token's account for this
+ *     machine, so a push anybody else dropped in the relay queue (or one from a
+ *     member / guest of the account) is never run; the fetched ids and kind
+ *     must match the push;
+ *  3. runs it: a message is recorded in the agent's DM as an owner message and
+ *     handed to the agent exactly like a Talk / Crewly Chat message (replies
+ *     route as usual); a stop is the dashboard's stop; terminal actions drive
+ *     {@link CanvasTerminalService};
+ *  4. reports the result (`POST .../actions/:actionId/result`).
+ *
+ * Idempotent: an action carried out is not run again when Cloud re-pushes it
+ * (it only re-reports); a message is also keyed by `clientMessageId` in the DM.
+ *
+ * Older OSS versions ignore `canvas_action` (every relay listener filters on
+ * its own `type`), and Cloud only sends it to machines advertising the
+ * `canvas_actions` capability, which this service turns on when it starts.
+ *
+ * @module services/board/canvas/canvas-inbound.service
+ */
+import { CANVAS_CONSTANTS, ORCHESTRATOR_SESSION_NAME, SLACK_AGENT_DM_CONSTANTS } from '../../../constants.js';
+import { LoggerService } from '../../core/logger.service.js';
+import { recordCloudTalkTurn } from '../../chat-v2/owner-inbound.utils.js';
+const C = CANVAS_CONSTANTS;
+/** Session names; `@` only for the orchestrator spelled per machine (`crewly-orc@<instance>`). */
+const SESSION_PATTERN = /^[A-Za-z0-9._@-]{1,128}$/;
+const ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const isKind = (v) => typeof v === 'string' && C.ACTION_KINDS.includes(v);
+/**
+ * Validate the relay push. Never throws.
+ *
+ * @param raw - `msg.payload`
+ * @returns The ids, or null when malformed
+ */
+export function parseCanvasRelayData(raw) {
+    if (!isRecord(raw))
+        return null;
+    const { actionId, instanceId, session, kind } = raw;
+    if (typeof actionId !== 'string' || !ID_PATTERN.test(actionId))
+        return null;
+    if (typeof instanceId !== 'string' || instanceId.length === 0 || instanceId.length > 128)
+        return null;
+    if (typeof session !== 'string' || !SESSION_PATTERN.test(session))
+        return null;
+    if (!isKind(kind))
+        return null;
+    return { actionId, instanceId, session, kind };
+}
+/**
+ * Validate Cloud's answer to the action fetch (`{success, data: {...}}`). Never throws.
+ *
+ * @param raw - Parsed JSON body
+ * @returns The action, or null when unusable
+ */
+export function parseCanvasFetchResponse(raw) {
+    const data = isRecord(raw) && isRecord(raw['data']) ? raw['data'] : null;
+    if (!data)
+        return null;
+    const { actionId, instanceId, session, kind, text, clientMessageId } = data;
+    if (typeof actionId !== 'string' || !ID_PATTERN.test(actionId))
+        return null;
+    if (typeof instanceId !== 'string' || !instanceId)
+        return null;
+    if (typeof session !== 'string' || !SESSION_PATTERN.test(session))
+        return null;
+    if (!isKind(kind))
+        return null;
+    return {
+        actionId,
+        instanceId,
+        session,
+        kind,
+        ...(typeof text === 'string' ? { text } : {}),
+        ...(typeof clientMessageId === 'string' && ID_PATTERN.test(clientMessageId) ? { clientMessageId } : {}),
+    };
+}
+let active = false;
+/**
+ * Capabilities to advertise to Cloud (heartbeat and uploads).
+ *
+ * @returns `['canvas_actions']` while the handler runs, else `[]`
+ */
+export function canvasCapabilities() {
+    return active ? [C.CAPABILITY] : [];
+}
+/** Runs the owner's canvas actions pushed from Crewly Cloud - see module docs. */
+export class CanvasInboundService {
+    deps;
+    logger;
+    fetchImpl;
+    sleep;
+    now;
+    ownerUserId;
+    inFlight = new Set();
+    done = new Map();
+    listener = (msg) => {
+        void this.handle(msg);
+    };
+    started = false;
+    constructor(deps) {
+        this.deps = deps;
+        this.logger = deps.logger ?? LoggerService.getInstance().createComponentLogger('CanvasInbound');
+        this.fetchImpl = deps.fetchImpl ?? ((input, init) => fetch(input, init));
+        this.sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        this.now = deps.now ?? Date.now;
+        this.ownerUserId = deps.ownerUserId ?? SLACK_AGENT_DM_CONSTANTS.OWNER_USER_ID;
+    }
+    /** Subscribe to relay messages and advertise the capability. Idempotent. */
+    start() {
+        if (this.started)
+            return;
+        this.started = true;
+        this.deps.source.on('message', this.listener);
+        active = true;
+        this.logger.info('Canvas action handler started');
+    }
+    /** Unsubscribe; the capability is no longer advertised. */
+    stop() {
+        if (!this.started)
+            return;
+        this.started = false;
+        this.deps.source.off('message', this.listener);
+        active = false;
+    }
+    /**
+     * Handle one relay message. Anything but a well-formed `canvas_action` is
+     * ignored. Never throws.
+     *
+     * @param msg - Relay message from CloudSyncService
+     * @returns What was done
+     */
+    async handle(msg) {
+        if (msg?.type !== C.RELAY_MESSAGE_TYPE)
+            return 'ignored';
+        const data = parseCanvasRelayData(msg.payload);
+        if (!data) {
+            this.logger.warn('Ignored a malformed canvas_action relay message');
+            return 'ignored';
+        }
+        if (this.inFlight.has(data.actionId))
+            return 'duplicate';
+        this.inFlight.add(data.actionId);
+        try {
+            return await this.process(data);
+        }
+        catch (error) {
+            this.logger.warn('Canvas action failed', { actionId: data.actionId, error: error instanceof Error ? error.message : String(error) });
+            return 'fetch_failed';
+        }
+        finally {
+            this.inFlight.delete(data.actionId);
+        }
+    }
+    async process(data) {
+        const { instanceId, deviceName } = await this.deps.identity();
+        if (data.instanceId !== instanceId) {
+            this.logger.warn('Ignored a canvas_action addressed to another machine', { target: data.instanceId });
+            return 'not_for_this_machine';
+        }
+        this.pruneDone();
+        const earlier = this.done.get(data.actionId);
+        if (earlier) {
+            await this.report(data.actionId, earlier.result);
+            return 'duplicate';
+        }
+        const fetched = await this.fetchAction(data, instanceId);
+        if (fetched.kind === 'not_found') {
+            // Not an action the account's owner stored for this machine: not from Cloud
+            this.logger.warn('Ignored a canvas_action Crewly Cloud does not know for this machine', { actionId: data.actionId });
+            return 'unverified';
+        }
+        if (fetched.kind === 'expired')
+            return 'duplicate';
+        if (fetched.kind === 'error') {
+            this.logger.warn('Could not fetch a canvas action; Cloud will push it again', { actionId: data.actionId, error: fetched.error });
+            return 'fetch_failed';
+        }
+        const action = fetched.action;
+        if (action.actionId !== data.actionId || action.instanceId !== instanceId || action.session !== data.session || action.kind !== data.kind) {
+            this.logger.warn('Ignored a canvas_action that does not match what Cloud stored', { actionId: data.actionId });
+            return 'unverified';
+        }
+        this.deps.onAction?.();
+        const device = deviceName || 'this machine';
+        const session = action.session.startsWith(`${ORCHESTRATOR_SESSION_NAME}@`) ? ORCHESTRATOR_SESSION_NAME : action.session;
+        let result;
+        if (!(await this.deps.agentExists(session))) {
+            result = { instanceId, ok: false, code: 'no_agent', error: `No agent named "${session}" on ${device}` };
+        }
+        else {
+            result = await this.run(action, session, instanceId, device);
+        }
+        this.done.set(data.actionId, { at: this.now(), result });
+        await this.report(data.actionId, result);
+        return result.ok ? 'done' : 'refused';
+    }
+    async run(action, session, instanceId, device) {
+        const fail = (code, error) => ({ instanceId, ok: false, code, error });
+        switch (action.kind) {
+            case 'message': {
+                const text = (action.text ?? '').trim();
+                if (!text)
+                    return fail('empty', 'The message is empty');
+                if (text.length > C.MESSAGE_MAX)
+                    return fail('too_long', `The message is longer than ${C.MESSAGE_MAX} characters`);
+                let recorded;
+                try {
+                    recorded = recordCloudTalkTurn(this.deps.chat, {
+                        agentSession: session,
+                        text,
+                        clientMessageId: action.clientMessageId ?? `canvas-${action.actionId}`,
+                        ownerUserId: this.ownerUserId,
+                    });
+                }
+                catch (error) {
+                    return fail('record_failed', `Could not record the message on ${device}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                if (recorded.deduped)
+                    return { instanceId, ok: true };
+                try {
+                    const channel = this.deps.chat.getChannel(recorded.channelId, { userId: this.ownerUserId, source: 'oss' });
+                    await this.deps.deliver(channel, recorded.message);
+                }
+                catch (error) {
+                    // Recorded, but the agent was not paged: it reads the DM when it next looks
+                    this.logger.warn('Canvas message recorded but not handed to the agent', { session, error: error instanceof Error ? error.message : String(error) });
+                }
+                this.logger.info('Canvas message received', { session });
+                return { instanceId, ok: true };
+            }
+            case 'stop': {
+                if (session === ORCHESTRATOR_SESSION_NAME)
+                    return fail('not_allowed', 'The orchestrator is stopped on the machine itself');
+                const r = await this.deps.stopAgent(session);
+                this.logger.info('Canvas stop', { session, ok: r.ok });
+                return r.ok ? { instanceId, ok: true } : fail('stop_failed', r.error ?? 'Could not stop the agent');
+            }
+            case 'terminal_open':
+            case 'terminal_renew': {
+                if (action.kind === 'terminal_renew' && this.deps.terminal.renew(session))
+                    return { instanceId, ok: true };
+                // A renew after a restart opens again: the viewer is still there
+                const r = this.deps.terminal.open(session);
+                return r.ok ? { instanceId, ok: true } : fail(r.code, r.code === 'too_many_streams' ? 'Too many terminals are open' : r.code === 'no_session' ? 'The agent has no terminal right now' : 'Not signed in to Crewly Cloud');
+            }
+            case 'terminal_close':
+                this.deps.terminal.close(session, 'closed');
+                return { instanceId, ok: true };
+        }
+    }
+    pruneDone() {
+        const cutoff = this.now() - C.DONE_ACTIONS_TTL_MS;
+        for (const [id, entry] of this.done)
+            if (entry.at < cutoff)
+                this.done.delete(id);
+        while (this.done.size > C.DONE_ACTIONS_MAX)
+            this.done.delete(this.done.keys().next().value);
+    }
+    url(suffix) {
+        const base = this.deps.cloud.getCloudUrl();
+        return base ? `${base.replace(/\/$/, '')}${C.ACTIONS_PATH}${suffix}` : null;
+    }
+    /** Fetch the action from Cloud with this machine's token; one refresh on 401, a few retries on network / 5xx. */
+    async fetchAction(data, instanceId) {
+        const url = this.url(`/${encodeURIComponent(data.actionId)}?instanceId=${encodeURIComponent(instanceId)}`);
+        if (!url)
+            return { kind: 'error', error: 'not signed in to Crewly Cloud' };
+        const delays = C.FETCH_RETRY_DELAYS_MS;
+        let refreshed = false;
+        let lastError = 'unknown';
+        for (let attempt = 0; attempt <= delays.length; attempt++) {
+            if (attempt > 0)
+                await this.sleep(delays[attempt - 1] ?? 0);
+            const token = this.deps.cloud.getToken();
+            if (!token)
+                return { kind: 'error', error: 'not signed in to Crewly Cloud' };
+            let response;
+            try {
+                response = await this.fetchImpl(url, { method: 'GET', headers: { Authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(C.REQUEST_TIMEOUT_MS) });
+            }
+            catch (error) {
+                lastError = error instanceof Error ? error.message : String(error);
+                continue;
+            }
+            if (response.status === 401 && !refreshed && this.deps.cloud.tryRefreshToken) {
+                refreshed = true;
+                if (await this.deps.cloud.tryRefreshToken().catch(() => false)) {
+                    attempt--;
+                    continue;
+                }
+            }
+            // 403: the token's account is not the owner of this action (a member / guest)
+            if (response.status === 404 || response.status === 403)
+                return { kind: 'not_found' };
+            if (response.status === 410)
+                return { kind: 'expired' };
+            if (response.ok) {
+                const parsed = parseCanvasFetchResponse(await response.json().catch(() => null));
+                return parsed ? { kind: 'ok', action: parsed } : { kind: 'error', error: 'unusable response from Crewly Cloud' };
+            }
+            lastError = `HTTP ${response.status}`;
+            if (response.status >= 400 && response.status < 500 && response.status !== 429)
+                break;
+        }
+        return { kind: 'error', error: lastError };
+    }
+    /** Report the result to Cloud (best effort; a re-push re-reports). */
+    async report(actionId, body) {
+        const url = this.url(`/${encodeURIComponent(actionId)}/result`);
+        const token = this.deps.cloud.getToken();
+        if (!url || !token)
+            return;
+        try {
+            await this.fetchImpl(url, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(C.REQUEST_TIMEOUT_MS),
+            });
+        }
+        catch (error) {
+            this.logger.debug('Could not report a canvas action result', { actionId, error: error instanceof Error ? error.message : String(error) });
+        }
+    }
+}
+//# sourceMappingURL=canvas-inbound.service.js.map

package/dist/backend/backend/src/services/board/canvas/canvas-inbound.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-inbound.service.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/board/canvas/canvas-inbound.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAwB,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAY3E,MAAM,CAAC,GAAG,gBAAgB,CAAC;AAE3B,kGAAkG;AAClG,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxH,MAAM,MAAM,GAAG,CAAC,CAAU,EAAyB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAEjI;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACtG,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO;QACN,QAAQ;QACR,UAAU;QACV,OAAO;QACP,IAAI;QACJ,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,eAAe,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvG,CAAC;AACH,CAAC;AAoCD,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IACjC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,kFAAkF;AAClF,MAAM,OAAO,oBAAoB;IAaH;IAZZ,MAAM,CAAkB;IACxB,SAAS,CAAiB;IAC1B,KAAK,CAAgC;IACrC,GAAG,CAAe;IAClB,WAAW,CAAS;IACpB,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,IAAI,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC5E,QAAQ,GAAG,CAAC,GAAoB,EAAQ,EAAE;QAC1D,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC;IACM,OAAO,GAAG,KAAK,CAAC;IAExB,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;QAChG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,wBAAwB,CAAC,aAAa,CAAC;IAC/E,CAAC;IAED,4EAA4E;IAC5E,KAAK;QACJ,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,2DAA2D;IAC3D,IAAI;QACH,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,GAAG,KAAK,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,GAAoB;QAChC,IAAI,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,kBAAkB;YAAE,OAAO,SAAS,CAAC;QACzD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,WAAW,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrI,OAAO,cAAc,CAAC;QACvB,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAA2B;QAChD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACtG,OAAO,sBAAsB,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO,WAAW,CAAC;QACpB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qEAAqE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrH,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YACjI,OAAO,cAAc,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3I,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/G,OAAO,YAAY,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,UAAU,IAAI,cAAc,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,yBAAyB,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACxH,IAAI,MAAiC,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,OAAO,QAAQ,MAAM,EAAE,EAAE,CAAC;QACzG,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,MAAiC,EAAE,OAAe,EAAE,UAAkB,EAAE,MAAc;QACvG,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAa,EAA6B,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClH,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,SAAS,CAAC,CAAC,CAAC;gBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;gBACxD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW;oBAAE,OAAO,IAAI,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC,WAAW,aAAa,CAAC,CAAC;gBACnH,IAAI,QAAgD,CAAC;gBACrD,IAAI,CAAC;oBACJ,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;wBAC9C,YAAY,EAAE,OAAO;wBACrB,IAAI;wBACJ,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,UAAU,MAAM,CAAC,QAAQ,EAAE;wBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;qBAC7B,CAAC,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,OAAO,IAAI,CAAC,eAAe,EAAE,mCAAmC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtI,CAAC;gBACD,IAAI,QAAQ,CAAC,OAAO;oBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACtD,IAAI,CAAC;oBACJ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC3G,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,4EAA4E;oBAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACrJ,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACb,IAAI,OAAO,KAAK,yBAAyB;oBAAE,OAAO,IAAI,CAAC,aAAa,EAAE,mDAAmD,CAAC,CAAC;gBAC3H,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,IAAI,0BAA0B,CAAC,CAAC;YACrG,CAAC;YACD,KAAK,eAAe,CAAC;YACrB,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACvB,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBAC3G,iEAAiE;gBACjE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3C,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC;YAC1N,CAAC;YACD,KAAK,gBAAgB;gBACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC5C,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAClC,CAAC;IACF,CAAC;IAEO,SAAS;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,mBAAmB,CAAC;QAClD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;IACvG,CAAC;IAEO,GAAG,CAAC,MAAc;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED,iHAAiH;IACzG,KAAK,CAAC,WAAW,CAAC,IAA2B,EAAE,UAAkB;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,qBAAqB,CAAC;QACvC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,SAAS,GAAG,SAAS,CAAC;QAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YAC3D,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YAC7E,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACJ,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAC3J,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,SAAS;YACV,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC9E,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChE,OAAO,EAAE,CAAC;oBACV,SAAS;gBACV,CAAC;YACF,CAAC;YACD,8EAA8E;YAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACrF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACxD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;YAClH,CAAC;YACD,SAAS,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM;QACvF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAA+B;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;YAAE,OAAO;QAC3B,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;aACjD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3I,CAAC;IACF,CAAC;CACD"}

package/dist/backend/backend/src/services/board/canvas/canvas-redact.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Redaction for what the canvas shows (crewly#1247 v2), on the machine, before
+ * anything leaves it:
+ *
+ * - {@link shortAgentLine}: the agent's own words from a transcript, reduced
+ *   to one short line (at most 280 characters), no code blocks, no secrets;
+ * - {@link maskTerminalText}: a terminal tail with every secret, token, email
+ *   and URL query masked.
+ *
+ * Both reuse the board's {@link scrubText} and the secret redactor that guards
+ * the session logs; this file only adds what those do not cover (zero-width
+ * characters, base64 blobs, spaced `key = value` secrets, ANSI).
+ *
+ * Pure (no I/O).
+ *
+ * @module services/board/canvas/canvas-redact
+ */
+import type { SecretEnvValue } from '../../../utils/secret-env.js';
+/**
+ * Reduce an assistant message block to one short, safe line.
+ *
+ * Takes the first paragraph outside code fences (a list item or heading loses
+ * its marker), removes markdown emphasis, masks secrets / emails / URL
+ * queries / phone numbers, and cuts at 280 characters. Anything that is
+ * markup (`<system-reminder>`), an interrupt notice, or empty after masking
+ * gives null.
+ *
+ * @param raw - Text of a `text` block
+ * @param secrets - Exact secret values to mask (backend env)
+ * @returns The line, or null when nothing worth showing is left
+ */
+export declare function shortAgentLine(raw: unknown, secrets?: readonly SecretEnvValue[]): string | null;
+/**
+ * Mask a terminal tail for the canvas: ANSI and control characters removed,
+ * then secrets (by value, by `NAME=value`, by shape), emails, URL queries and
+ * credentials, bearer tokens, password prompts and long token-like words.
+ *
+ * @param text - Raw tail (the PTY capture)
+ * @param secrets - Exact secret values to mask (backend env)
+ * @param maxLines - Keep this many lines from the end
+ * @returns Lines, oldest first, each at most {@link CANVAS_CONSTANTS.TERMINAL_MAX_LINE_CHARS} characters
+ */
+export declare function maskTerminalText(text: string, secrets?: readonly SecretEnvValue[], maxLines?: number): string[];
+//# sourceMappingURL=canvas-redact.d.ts.map

package/dist/backend/backend/src/services/board/canvas/canvas-redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-redact.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/board/canvas/canvas-redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAgEnE;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,SAAS,cAAc,EAAO,GAAG,MAAM,GAAG,IAAI,CAsBnG;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,SAAS,cAAc,EAAO,EAAE,QAAQ,GAAE,MAA8B,GAAG,MAAM,EAAE,CA6B1I"}