poe-code 3.0.265 → 3.0.267

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.265",
+  "version": "3.0.267",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "type": "module",
   "main": "./dist/index.js",

package/packages/acp-telemetry/dist/redact.js

@@ -3,6 +3,9 @@ const MAX_JSON_BYTES = 262_144;
 const BINARY_SCAN_BYTES = 1_024;
 const REDACTED_SECRET = "[redacted]";
 const BEARER_TOKEN_PATTERN = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi;
+const AUTH_HEADER_PATTERN = /\b((?:Proxy-)?Authorization\s*:\s*(?:Bearer|Basic|Token)\s+)[^\s"'\r\n]+/gi;
+const COOKIE_HEADER_PATTERN = /\b((?:Set-)?Cookie\s*:\s*)[^\r\n"']+/gi;
+const URL_USERINFO_PATTERN = /\b([A-Za-z][A-Za-z0-9+.-]*:\/\/)([^/?#\s@]+@)/g;
 const ASSIGNED_SECRET_NAME_PATTERN = String.raw `(?:(?:[A-Za-z0-9]+[-_])*api[-_ ]?key|(?:[A-Za-z0-9]+[-_])*(?:token|secret|password|private[-_ ]?key))`;
 const ASSIGNED_SECRET_PATTERN = new RegExp(String.raw `\b(${ASSIGNED_SECRET_NAME_PATTERN}\s*[:=]\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[A-Za-z0-9._~+/=-]+)`, "gi");
 export function redact(value) {
@@ -51,7 +54,7 @@ function redactLeaf(value, ancestors, key) {
                 configurable: true,
                 enumerable: true,
                 value: redactLeaf(item, ancestors, key),
-                writable: true,
+                writable: true
             });
         }
         ancestors.delete(value);
@@ -65,6 +68,9 @@ function redactString(value) {
         return `[truncated:${bytes}]`;
     }
     return value
+        .replace(URL_USERINFO_PATTERN, `$1${REDACTED_SECRET}@`)
+        .replace(AUTH_HEADER_PATTERN, `$1${REDACTED_SECRET}`)
+        .replace(COOKIE_HEADER_PATTERN, `$1${REDACTED_SECRET}`)
         .replace(BEARER_TOKEN_PATTERN, `$1${REDACTED_SECRET}`)
         .replace(ASSIGNED_SECRET_PATTERN, redactAssignedSecretValue);
 }

package/packages/acp-telemetry/dist/trace.js

@@ -8,17 +8,17 @@ export function acpToTrace(ctx) {
             input: redact({
                 prompt: ctx.prompt,
                 mode: ctx.mode,
-                cwd: ctx.cwd,
+                cwd: ctx.cwd
             }),
             output: redact(accumulateAgentOutput(ctx.events)),
             metadata: redactRecord({
                 ...spawnCtx.metadata,
                 sessionId: ctx.sessionId,
-                threadId: ctx.threadId,
+                threadId: ctx.threadId
             }),
             metrics: buildMetrics(ctx),
-            children: logToolSpans(ctx.events),
-        },
+            children: logToolSpans(ctx.events)
+        }
     };
 }
 function logToolSpans(events) {
@@ -37,14 +37,14 @@ function logToolSpans(events) {
             output: redact(assembleToolOutput(events, index, toolCallId)),
             ...(metadata ? { metadata } : {}),
             ...readSpanTimestamps(metadata),
-            children: [],
+            children: []
         });
     }
     return spans;
 }
 function collectToolMeta(events, toolCallIndex, toolCallId) {
     const merged = {
-        ...(toolCallId !== undefined ? { toolCallId } : {}),
+        ...(toolCallId !== undefined ? { toolCallId } : {})
     };
     const startMeta = asRecord(asRecord(events[toolCallIndex])?._meta);
     if (startMeta) {
@@ -53,6 +53,9 @@ function collectToolMeta(events, toolCallIndex, toolCallId) {
         }
     }
     for (const event of events.slice(toolCallIndex + 1)) {
+        if (toolCallId === undefined && asToolCall(event) !== undefined) {
+            break;
+        }
         const update = asToolCallUpdate(event);
         if (update === undefined)
             continue;
@@ -91,6 +94,9 @@ function assembleToolOutput(events, toolCallIndex, toolCallId) {
     const outputs = [];
     let text = "";
     for (const event of events.slice(toolCallIndex + 1)) {
+        if (toolCallId === undefined && asToolCall(event) !== undefined) {
+            break;
+        }
         const update = asToolCallUpdate(event);
         if (update === undefined) {
             continue;
@@ -169,7 +175,7 @@ function readSpanTimestamps(metadata) {
     const endTs = readNumber(metadata.endTs);
     return {
         ...(startTs !== undefined ? { startTs } : {}),
-        ...(endTs !== undefined ? { endTs } : {}),
+        ...(endTs !== undefined ? { endTs } : {})
     };
 }
 function redactRecord(record) {
@@ -177,25 +183,21 @@ function redactRecord(record) {
     return asRecord(redacted) ?? { redacted };
 }
 function asRecord(value) {
-    return typeof value === "object" && value !== null
-        ? value
-        : undefined;
+    return typeof value === "object" && value !== null ? value : undefined;
 }
 function readString(value) {
     return typeof value === "string" ? value : undefined;
 }
 function readNumber(value) {
-    return typeof value === "number" && Number.isFinite(value)
-        ? value
-        : undefined;
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
 function addMetric(metrics, key, value) {
-    if (value !== undefined) {
+    if (value !== undefined && value >= 0) {
         metrics[key] = value;
     }
 }
 function sumIfPresent(left, right) {
-    if (left === undefined || right === undefined) {
+    if (left === undefined || right === undefined || left < 0 || right < 0) {
         return undefined;
     }
     return readNumber(left + right);
@@ -205,6 +207,6 @@ function setOwnProperty(target, key, value) {
         configurable: true,
         enumerable: true,
         value,
-        writable: true,
+        writable: true
     });
 }

package/packages/agent-child-process/dist/index.d.ts

@@ -1,4 +1,4 @@
-import type { Readable, Writable } from "node:stream";
+import { type Readable, type Writable } from "node:stream";
 import type { SpawnResult, SpawnUsage } from "../../agent-spawn/dist/index.js";
 export type SpawnProcess = typeof import("node:child_process").spawn;
 export type AgentChildProcessKind = "exec" | "execFile" | "spawn";

package/packages/agent-child-process/dist/index.js

@@ -1,4 +1,5 @@
 import { spawn as defaultSpawn } from "node:child_process";
+import { PassThrough } from "node:stream";
 import { StringDecoder } from "node:string_decoder";
 export class AgentChildProcessError extends Error {
     result;
@@ -9,7 +10,10 @@ export class AgentChildProcessError extends Error {
     }
 }
 export async function exec(command, options) {
-    const shell = process.platform === "win32" ? process.env.ComSpec ?? "cmd.exe" : process.env.SHELL ?? "sh";
+    assertNonBlank(command, "command");
+    const shell = process.platform === "win32"
+        ? (options?.env?.ComSpec ?? process.env.ComSpec ?? "cmd.exe")
+        : (options?.env?.SHELL ?? process.env.SHELL ?? "sh");
     const shellArgs = process.platform === "win32" ? ["/d", "/s", "/c", command] : ["-c", command];
     return runExecution({
         kind: "exec",
@@ -21,6 +25,7 @@ export async function exec(command, options) {
     });
 }
 export async function execFile(file, argsOrOptions = [], maybeOptions) {
+    assertNonBlank(file, "file");
     const args = Array.isArray(argsOrOptions) ? argsOrOptions : [];
     const options = Array.isArray(argsOrOptions) ? maybeOptions : argsOrOptions;
     return runExecution({
@@ -33,10 +38,11 @@ export async function execFile(file, argsOrOptions = [], maybeOptions) {
     });
 }
 export function spawn(file, argsOrOptions = [], maybeOptions) {
-    const args = Array.isArray(argsOrOptions) ? argsOrOptions : [];
-    const options = Array.isArray(argsOrOptions) ? maybeOptions : argsOrOptions;
     let child;
     try {
+        assertNonBlank(file, "file");
+        const args = Array.isArray(argsOrOptions) ? argsOrOptions : [];
+        const options = Array.isArray(argsOrOptions) ? maybeOptions : argsOrOptions;
         child = startChildProcess({
             kind: "spawn",
             file,
@@ -59,8 +65,8 @@ export function spawn(file, argsOrOptions = [], maybeOptions) {
     return {
         pid: child.process.pid,
         stdin: child.process.stdin,
-        stdout: child.process.stdout,
-        stderr: child.process.stderr,
+        stdout: child.stdout,
+        stderr: child.stderr,
         kill(signal) {
             return child.process.kill(signal);
         },
@@ -72,8 +78,13 @@ async function runExecution(spec) {
 }
 function startChildProcess(spec) {
     const child = spawnChild(spec);
-    const result = collectResult(child, spec).then((commandResult) => applyExitPolicy(commandResult, spec.options));
-    return { process: child, result };
+    const stdout = createOutputPipes(child.stdout, spec.kind === "spawn");
+    const stderr = createOutputPipes(child.stderr, spec.kind === "spawn");
+    const result = collectResult(child, spec, {
+        stdout: stdout.result,
+        stderr: stderr.result
+    }).then((commandResult) => applyExitPolicy(commandResult, spec.options));
+    return { process: child, stdout: stdout.user, stderr: stderr.user, result };
 }
 function spawnChild(spec) {
     const options = spec.options;
@@ -89,22 +100,22 @@ function spawnChild(spec) {
 function getStdio(kind) {
     return kind === "spawn" ? ["pipe", "pipe", "pipe"] : ["ignore", "pipe", "pipe"];
 }
-function collectResult(child, spec) {
+function collectResult(child, spec, streams) {
     const stdoutDecoder = new StringDecoder("utf8");
     const stderrDecoder = new StringDecoder("utf8");
     let stdout = "";
     let stderr = "";
     let childClosed = false;
-    let stdoutFinished = child.stdout === null;
-    let stderrFinished = child.stderr === null;
+    let stdoutFinished = streams.stdout === null;
+    let stderrFinished = streams.stderr === null;
     let exitCode = 1;
     let exitSignal = null;
     let processError;
     let outputError;
-    child.stdout?.on("data", (chunk) => {
+    streams.stdout?.on("data", (chunk) => {
         stdout += typeof chunk === "string" ? chunk : stdoutDecoder.write(chunk);
     });
-    child.stderr?.on("data", (chunk) => {
+    streams.stderr?.on("data", (chunk) => {
         stderr += typeof chunk === "string" ? chunk : stderrDecoder.write(chunk);
     });
     return new Promise((resolve) => {
@@ -127,20 +138,20 @@ function collectResult(child, spec) {
             });
             resolve({ ...attempt, attempts: [attempt] });
         };
-        child.stdout?.once("end", () => {
+        streams.stdout?.once("end", () => {
             stdoutFinished = true;
             finish();
         });
-        child.stderr?.once("end", () => {
+        streams.stderr?.once("end", () => {
             stderrFinished = true;
             finish();
         });
-        child.stdout?.once("error", (error) => {
+        streams.stdout?.once("error", (error) => {
             outputError = error;
             stdoutFinished = true;
             finish();
         });
-        child.stderr?.once("error", (error) => {
+        streams.stderr?.once("error", (error) => {
             outputError = error;
             stderrFinished = true;
             finish();
@@ -161,6 +172,22 @@ function collectResult(child, spec) {
         });
     });
 }
+function createOutputPipes(source, exposeUserStream) {
+    if (source === null) {
+        return { result: null, user: null };
+    }
+    const result = new PassThrough();
+    const user = exposeUserStream ? new PassThrough() : null;
+    source.once("error", (error) => {
+        result.destroy(error);
+        user?.destroy();
+    });
+    source.pipe(result);
+    if (user !== null) {
+        source.pipe(user);
+    }
+    return { result, user };
+}
 function createAttempt(spec, output) {
     return {
         kind: spec.kind,
@@ -195,6 +222,14 @@ async function maybeRunAgent(result, options) {
             cause: error
         });
     }
+    try {
+        validateExitPolicy(policy);
+    }
+    catch (error) {
+        throw new AgentChildProcessError("Agent exit policy is invalid", result, {
+            cause: error
+        });
+    }
     const runAgent = options.runAgent ?? defaultRunAgent;
     let agentResult;
     try {
@@ -225,6 +260,15 @@ async function maybeRunAgent(result, options) {
         }
     };
 }
+function validateExitPolicy(policy) {
+    assertNonBlank(policy.agent, "onExit.agent");
+    assertNonBlank(policy.prompt, "onExit.prompt");
+}
+function assertNonBlank(value, field) {
+    if (value.trim().length === 0) {
+        throw new TypeError(`${field} must not be empty`);
+    }
+}
 async function defaultRunAgent(input) {
     const { spawn: spawnAgent } = await import("@poe-code/agent-spawn");
     return spawnAgent(input.agent, {

package/packages/superintendent/dist/mcp.js

@@ -41850,6 +41850,9 @@ var MAX_JSON_BYTES = 262144;
 var BINARY_SCAN_BYTES = 1024;
 var REDACTED_SECRET = "[redacted]";
 var BEARER_TOKEN_PATTERN = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi;
+var AUTH_HEADER_PATTERN = /\b((?:Proxy-)?Authorization\s*:\s*(?:Bearer|Basic|Token)\s+)[^\s"'\r\n]+/gi;
+var COOKIE_HEADER_PATTERN = /\b((?:Set-)?Cookie\s*:\s*)[^\r\n"']+/gi;
+var URL_USERINFO_PATTERN = /\b([A-Za-z][A-Za-z0-9+.-]*:\/\/)([^/?#\s@]+@)/g;
 var ASSIGNED_SECRET_NAME_PATTERN = String.raw`(?:(?:[A-Za-z0-9]+[-_])*api[-_ ]?key|(?:[A-Za-z0-9]+[-_])*(?:token|secret|password|private[-_ ]?key))`;
 var ASSIGNED_SECRET_PATTERN = new RegExp(
   String.raw`\b(${ASSIGNED_SECRET_NAME_PATTERN}\s*[:=]\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[A-Za-z0-9._~+/=-]+)`,
@@ -41914,7 +41917,7 @@ function redactString(value) {
   if (bytes > MAX_STRING_BYTES) {
     return `[truncated:${bytes}]`;
   }
-  return value.replace(BEARER_TOKEN_PATTERN, `$1${REDACTED_SECRET}`).replace(ASSIGNED_SECRET_PATTERN, redactAssignedSecretValue);
+  return value.replace(URL_USERINFO_PATTERN, `$1${REDACTED_SECRET}@`).replace(AUTH_HEADER_PATTERN, `$1${REDACTED_SECRET}`).replace(COOKIE_HEADER_PATTERN, `$1${REDACTED_SECRET}`).replace(BEARER_TOKEN_PATTERN, `$1${REDACTED_SECRET}`).replace(ASSIGNED_SECRET_PATTERN, redactAssignedSecretValue);
 }
 function redactAssignedSecretValue(match, prefix) {
   const secret = match.slice(prefix.length);
@@ -42000,6 +42003,9 @@ function collectToolMeta(events, toolCallIndex, toolCallId) {
     }
   }
   for (const event of events.slice(toolCallIndex + 1)) {
+    if (toolCallId === void 0 && asToolCall(event) !== void 0) {
+      break;
+    }
     const update = asToolCallUpdate(event);
     if (update === void 0) continue;
     if (readToolCallId(update) !== toolCallId) continue;
@@ -42035,6 +42041,9 @@ function assembleToolOutput(events, toolCallIndex, toolCallId) {
   const outputs = [];
   let text4 = "";
   for (const event of events.slice(toolCallIndex + 1)) {
+    if (toolCallId === void 0 && asToolCall(event) !== void 0) {
+      break;
+    }
     const update = asToolCallUpdate(event);
     if (update === void 0) {
       continue;
@@ -42138,12 +42147,12 @@ function readNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function addMetric(metrics, key2, value) {
-  if (value !== void 0) {
+  if (value !== void 0 && value >= 0) {
     metrics[key2] = value;
   }
 }
 function sumIfPresent(left, right) {
-  if (left === void 0 || right === void 0) {
+  if (left === void 0 || right === void 0 || left < 0 || right < 0) {
     return void 0;
   }
   return readNumber(left + right);