crewx-pi-kit 0.1.14 → 0.1.15

package/extensions/crewx-tools.ts

@@ -11,8 +11,24 @@ type JsonRecord = Record<string, unknown>;
 const CONTROL_PATH_PATTERN = /(?:\/proc\/[^/]+\/environ|\.config\/crewx(?:-cloud)?\/|\.local\/state\/crewx\/|bootstrap\.env|bridge\/config\.json)/i;
 const CONTROL_VALUE_PATTERN = /\bCREWX_(?:TOKEN|URL|CLI_PATH|RUNTIME_PROXY_[A-Z0-9_]+)\b/;
 
-function containsControlCredential(value: unknown): boolean {
-  const serialized = JSON.stringify(value);
+function containsControlCredential(value: unknown, toolName: string): boolean {
+  // The work CLI path is managed configuration, but executing the documented
+  // work commands is intentional. Exempt only that executable-position token;
+  // still inspect all arguments, extra input fields and subsequent commands.
+  let inspected = value;
+  if (toolName === "bash" && value && typeof value === "object") {
+    const input = value as JsonRecord;
+    if (typeof input.command === "string") {
+      inspected = {
+        ...input,
+        command: input.command.replace(
+          /^(\s*node\s+)"\$(?:CREWX_CLI_PATH|\{CREWX_CLI_PATH\})"(?=\s+(?:task|doc|memory|integration|file|preview)(?:\s|$))/,
+          '$1"[CrewX work CLI]"',
+        ),
+      };
+    }
+  }
+  const serialized = JSON.stringify(inspected);
   return CONTROL_PATH_PATTERN.test(serialized) || CONTROL_VALUE_PATTERN.test(serialized);
 }
 
@@ -214,7 +230,7 @@ export default function crewxTools(pi: ExtensionAPI) {
   pi.on("tool_call", async (event, ctx) => {
     if (
       ["bash", "read", "write", "edit"].includes(event.toolName) &&
-      containsControlCredential(event.input)
+      containsControlCredential(event.input, event.toolName)
     ) {
       return {
         block: true,

package/package.json

@@ -1,19 +1,16 @@
 {
   "name": "crewx-pi-kit",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Typed CrewX tools and operating skills for managed Pi agents.",
   "type": "module",
-  "files": [
-    "extensions",
-    "skills"
-  ],
+  "files": ["extensions", "skills"],
   "pi": {
-    "extensions": [
-      "extensions"
-    ],
-    "skills": [
-      "skills"
-    ]
+    "extensions": ["extensions"],
+    "skills": ["skills"]
+  },
+  "scripts": {
+    "types:check": "tsc --noEmit",
+    "test": "tsc --noEmit && node --experimental-strip-types --test test/*.test.mjs"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "*",
@@ -25,15 +22,7 @@
     "typebox": "^1.0.55",
     "typescript": "^5.9.3"
   },
-  "engines": {
-    "node": ">=22"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "license": "MIT",
-  "scripts": {
-    "types:check": "tsc --noEmit",
-    "test": "tsc --noEmit && node --experimental-strip-types --test test/*.test.mjs"
-  }
-}
+  "engines": {"node": ">=22"},
+  "publishConfig": {"access": "public"},
+  "license": "MIT"
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 CrewX contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.