crewly 1.20.471 → 1.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewly",
-  "version": "1.20.471",
+  "version": "1.21.0",
   "type": "module",
   "description": "Multi-agent orchestration platform for AI coding teams — coordinates Claude Code, Gemini CLI, and Codex agents with a real-time web dashboard",
   "workspaces": [

package/packages/crewly-agent/src/runtime/agent-runner.service.test.ts

@@ -2,7 +2,8 @@ import { describe, it, expect, beforeEach, afterEach, vi, type Mocked, type Mock
 import { AgentRunnerService, AgentRunTimeoutError, ToolCallLoopDetector } from './agent-runner.service.js';
 import { ModelManager } from './model-manager.js';
 import { CrewlyApiClient } from './api-client.js';
-import { CREWLY_AGENT_DEFAULTS, type CrewlyAgentConfig, type SecurityPolicy, type AuditEntry } from './types.js';
+import { CREWLY_AGENT_DEFAULTS, type CrewlyAgentConfig, type SecurityPolicy, type AuditEntry, type ToolSensitivity } from './types.js';
+import { TOOL_SENSITIVITY } from './tool-registry.js';
 
 describe('AgentRunnerService', () => {
   let runner: AgentRunnerService;
@@ -1255,6 +1256,21 @@ describe('AgentRunnerService', () => {
       expect(mockApiClient.post).not.toHaveBeenCalled();
     });
 
+    it('should block create_github_issue in readOnlyMode and ask for approval when sensitive tools need it', () => {
+      const check = (name: string) =>
+        (runner as unknown as { checkApproval: (n: string, s: ToolSensitivity) => { allowed: boolean; blocked?: boolean } })
+          .checkApproval(name, TOOL_SENSITIVITY[name]);
+
+      runner.updateSecurityPolicy({ readOnlyMode: true });
+      expect(check('create_github_issue')).toMatchObject({ allowed: false, blocked: true });
+
+      runner.updateSecurityPolicy({ readOnlyMode: false, requireApproval: ['sensitive'] });
+      expect(check('create_github_issue')).toMatchObject({ allowed: false, blocked: false });
+
+      runner.updateSecurityPolicy({ readOnlyMode: false, requireApproval: [] });
+      expect(check('create_github_issue')).toEqual({ allowed: true });
+    });
+
     it('should allow safe/read-only tools when readOnlyMode is active', async () => {
       runner.updateSecurityPolicy({ readOnlyMode: true });
 

package/packages/crewly-agent/src/runtime/auditor-tools.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect, beforeEach, afterEach, vi, type Mocked, type MockInstance } from 'vitest';
-import { promises as fs } from 'fs';
+import { promises as fs, mkdtempSync, writeFileSync, readFileSync, existsSync, chmodSync, rmSync } from 'fs';
+import * as os from 'os';
 import * as path from 'path';
 import { createAuditorTools, getAuditorToolNames } from './auditor-tools.js';
 import { CrewlyApiClient } from './api-client.js';
@@ -271,4 +272,72 @@ describe('Auditor Tools', () => {
       expect(result.recentFindings).toContain('No audit history');
     });
   });
+  describe('create_github_issue (CREW-967: no shell)', () => {
+    let binDir: string;
+    let logFile: string;
+    let originalPath: string | undefined;
+
+    /** Splits the fake gh's NUL-separated log into one argv array per call. */
+    function readCalls(): string[][] {
+      const parts = readFileSync(logFile, 'utf8').split('\0');
+      const calls: string[][] = [];
+      for (const part of parts) {
+        if (part === 'CALL') calls.push([]);
+        else if (part !== '' && calls.length > 0) calls[calls.length - 1].push(part);
+      }
+      return calls;
+    }
+
+    beforeEach(() => {
+      binDir = mkdtempSync(path.join(os.tmpdir(), 'fake-gh-'));
+      logFile = path.join(binDir, 'argv.log');
+      writeFileSync(logFile, '');
+      const script = [
+        '#!/bin/bash',
+        'printf "CALL\\0" >> "$GH_ARGV_LOG"',
+        'printf "%s\\0" "$@" >> "$GH_ARGV_LOG"',
+        'if [ "$2" = "list" ]; then echo "[]"; else echo "https://github.com/o/r/issues/1"; fi',
+      ].join('\n');
+      writeFileSync(path.join(binDir, 'gh'), script);
+      chmodSync(path.join(binDir, 'gh'), 0o755);
+      originalPath = process.env.PATH;
+      process.env.PATH = `${binDir}:${originalPath}`;
+      process.env.GH_ARGV_LOG = logFile;
+    });
+
+    afterEach(() => {
+      process.env.PATH = originalPath;
+      delete process.env.GH_ARGV_LOG;
+      rmSync(binDir, { recursive: true, force: true });
+    });
+
+    it('does not evaluate $(...) or backticks and passes each value as one argv entry', async () => {
+      const marker1 = path.join(binDir, 'pwned-subshell');
+      const marker2 = path.join(binDir, 'pwned-backtick');
+      const title = `[High] x $(touch ${marker1}) \`touch ${marker2}\` "q"`;
+      const body = `body $(touch ${marker1}) \`touch ${marker2}\``;
+      const label = `bug$(touch ${marker1})`;
+
+      const result = await tools.create_github_issue.execute({ title, body, labels: [label, 'enhancement'] }) as { success: boolean; created: boolean };
+
+      expect(result.success).toBe(true);
+      expect(result.created).toBe(true);
+      expect(existsSync(marker1)).toBe(false);
+      expect(existsSync(marker2)).toBe(false);
+
+      const calls = readCalls();
+      expect(calls).toHaveLength(2); // dedup search + create
+      const search = calls[0];
+      expect(search.slice(0, 4)).toEqual(['issue', 'list', '--state', 'open']);
+      expect(search[search.indexOf('--search') + 1]).toContain('$(touch');
+
+      const create = calls[1];
+      expect(create[0]).toBe('issue');
+      expect(create[1]).toBe('create');
+      expect(create[create.indexOf('--title') + 1]).toBe(title);
+      expect(create[create.indexOf('--body') + 1]).toBe(body);
+      const labelValues = create.flatMap((a, i) => (a === '--label' ? [create[i + 1]] : []));
+      expect(labelValues).toEqual([label, 'enhancement']);
+    });
+  });
 });

package/packages/crewly-agent/src/runtime/auditor-tools.ts

@@ -226,15 +226,18 @@ export function createAuditorTools(
       }),
       execute: async (args) => {
         const { title, body, labels } = args as { title: string; body: string; labels: string[] };
-        const { execSync } = await import('child_process');
+        // No shell: every value below reaches gh as one literal argv entry, so
+        // $(...) and backticks in model-supplied text are never evaluated (CREW-967).
+        const { execFileSync } = await import('child_process');
 
         try {
           // Dedup: search for existing open issues with similar title
           const searchQuery = title.replace(/\[.*?\]\s*/, '').slice(0, 50);
           let existingIssues = '';
           try {
-            existingIssues = execSync(
-              `gh issue list --state open --search "${searchQuery.replace(/"/g, '\\"')}" --json number,title --limit 5`,
+            existingIssues = execFileSync(
+              'gh',
+              ['issue', 'list', '--state', 'open', '--search', searchQuery, '--json', 'number,title', '--limit', '5'],
               { encoding: 'utf-8', timeout: 15000 }
             );
           } catch { /* gh not available or no repo */ }
@@ -255,9 +258,10 @@ export function createAuditorTools(
           }
 
           // Create the issue
-          const labelFlag = labels.map(l => `--label "${l}"`).join(' ');
-          const result = execSync(
-            `gh issue create --title "${title.replace(/"/g, '\\"')}" --body "${body.replace(/"/g, '\\"')}" ${labelFlag}`,
+          const labelArgs = labels.flatMap(l => ['--label', l]);
+          const result = execFileSync(
+            'gh',
+            ['issue', 'create', '--title', title, '--body', body, ...labelArgs],
             { encoding: 'utf-8', timeout: 30000 }
           );
 

package/packages/crewly-agent/src/runtime/tool-registry.test.ts

@@ -4,6 +4,7 @@ import { createTools, getToolNames, TOOL_SENSITIVITY, stripNotifyMarkers, conver
 import { CrewlyApiClient } from './api-client.js';
 import type { AuditEntry, ToolCallbacks, CompactionResult, AuditLogFilters } from './types.js';
 import { WRITE_TOOLS } from './types.js';
+import { getAuditorToolNames } from './auditor-tools.js';
 
 describe('Tool Registry', () => {
   let mockClient: Mocked<CrewlyApiClient>;
@@ -1574,6 +1575,10 @@ describe('Tool Registry', () => {
   });
 
   describe('TOOL_SENSITIVITY', () => {
+    it('should classify create_github_issue as sensitive', () => {
+      expect(TOOL_SENSITIVITY.create_github_issue).toBe('sensitive');
+    });
+
     it('should classify read-only tools as safe', () => {
       expect(TOOL_SENSITIVITY.get_agent_status).toBe('safe');
       expect(TOOL_SENSITIVITY.get_team_status).toBe('safe');
@@ -2025,7 +2030,8 @@ describe('Tool Registry', () => {
     });
 
     it('should only contain valid tool names from the registry', () => {
-      const validNames = getToolNames();
+      // The auditor registry owns create_github_issue, so both name lists count.
+      const validNames = [...getToolNames(), ...getAuditorToolNames()];
       for (const writeTool of WRITE_TOOLS) {
         expect(validNames).toContain(writeTool);
       }

package/packages/crewly-agent/src/runtime/tool-registry.ts

@@ -596,6 +596,8 @@ export const TOOL_SENSITIVITY: Record<string, ToolSensitivity> = {
   remember: 'sensitive',
   complete_task: 'sensitive',
   broadcast: 'sensitive',
+  // Files an issue on GitHub as the owner's gh login (CREW-967).
+  create_github_issue: 'sensitive',
   // Destructive: irreversible or high-impact operations
   start_agent: 'destructive',
   stop_agent: 'destructive',

package/packages/crewly-agent/src/runtime/types.test.ts

@@ -341,6 +341,10 @@ describe('Crewly Agent Types', () => {
       expect(WRITE_TOOLS).toContain('handle_agent_failure');
     });
 
+    it('should contain create_github_issue (files an issue as the owner)', () => {
+      expect(WRITE_TOOLS).toContain('create_github_issue');
+    });
+
     it('should not contain read-only tools', () => {
       expect(WRITE_TOOLS).not.toContain('read_file');
       expect(WRITE_TOOLS).not.toContain('get_team_status');

package/packages/crewly-agent/src/runtime/types.ts

@@ -392,6 +392,7 @@ export const WRITE_TOOLS: readonly string[] = [
   'report_status',
   'remember',
   'complete_task',
+  'create_github_issue',
 ] as const;
 
 /**