@abhaydesu/git-pilot 1.3.1 → 2.0.0

package/src/lib/provider.js

@@ -0,0 +1,353 @@
+import axios from "axios";
+import process from "node:process";
+import { sanitizeTerminalText } from "./sanitizer.js";
+import { redactSecretText } from "./credentials.js";
+
+export const OFFICIAL_GEMINI_HOST = "https://generativelanguage.googleapis.com";
+export const OFFICIAL_GEMINI_HOSTNAME = "generativelanguage.googleapis.com";
+export const DEFAULT_MODEL = "gemini-3.5-flash-lite";
+export const REQUEST_TIMEOUT_MS = 30_000;
+export const MAX_CONTENT_LENGTH = 1_000_000;
+export const MAX_REQUEST_BYTES = 1_000_000;
+export const MAX_DIFF_CHARS = 800_000;
+export const MAX_SUMMARY_BYTES = 200_000;
+
+const SAFE_MODEL_REGEX = /^[a-zA-Z0-9._-]+$/;
+
+let defaultHttpClientOverride = null;
+
+/**
+ * Allows test suites to inject an in-process mock HTTP client without exposing
+ * any environment-variable endpoint override in published CLI code.
+ */
+export function setDefaultHttpClientForTesting(client) {
+  defaultHttpClientOverride = client || null;
+}
+
+export class ProviderError extends Error {
+  constructor(message, code, status = null) {
+    super(message);
+    this.name = "ProviderError";
+    this.code = code;
+    this.status = status;
+  }
+}
+
+/**
+ * Validates and resolves the Gemini API base URL.
+ * Strictly pins the hostname to generativelanguage.googleapis.com over HTTPS,
+ * and rejects embedded credentials, query strings, fragments, custom paths, and local overrides.
+ */
+export function getGeminiBaseUrl(rawOverride = process.env.GEMINI_API_URL) {
+  const raw = rawOverride || OFFICIAL_GEMINI_HOST;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new ProviderError(
+      `Invalid provider URL: ${sanitizeTerminalText(String(raw))}`,
+      "INVALID_ENDPOINT"
+    );
+  }
+
+  if (url.username || url.password) {
+    throw new ProviderError(
+      "Provider URL must not contain embedded credentials.",
+      "INVALID_ENDPOINT"
+    );
+  }
+
+  if (url.search || url.hash) {
+    throw new ProviderError(
+      "Provider URL must not contain query strings or fragments.",
+      "INVALID_ENDPOINT"
+    );
+  }
+
+  if (url.pathname && url.pathname !== "/") {
+    throw new ProviderError(
+      "Provider base URL must not include a custom path.",
+      "INVALID_ENDPOINT"
+    );
+  }
+
+  if (url.protocol !== "https:") {
+    throw new ProviderError("GEMINI_API_URL must use https.", "INVALID_ENDPOINT");
+  }
+
+  if (url.hostname !== OFFICIAL_GEMINI_HOSTNAME) {
+    throw new ProviderError(
+      `Refusing to send Gemini API key to untrusted host "${sanitizeTerminalText(url.hostname)}". ` +
+        `Personal keys are only transmitted to ${OFFICIAL_GEMINI_HOSTNAME}.`,
+      "UNTRUSTED_HOST"
+    );
+  }
+
+  if (url.port && url.port !== "443") {
+    throw new ProviderError(
+      `Refusing to connect to non-standard port "${url.port}" on ${OFFICIAL_GEMINI_HOSTNAME}.`,
+      "INVALID_ENDPOINT"
+    );
+  }
+
+  return `${url.protocol}//${url.host}`;
+}
+
+export function buildGeminiRequestBody(prompt) {
+  return {
+    contents: [
+      {
+        parts: [{ text: prompt }],
+      },
+    ],
+  };
+}
+
+/**
+ * Checks that both the character length of `rawDiff` and the UTF-8 byte length
+ * of the JSON-serialized Gemini request body are within safe limits.
+ */
+export function fitsInGeminiRequest(prompt, rawDiff = "") {
+  if (rawDiff && rawDiff.length > MAX_DIFF_CHARS) {
+    return false;
+  }
+  const body = buildGeminiRequestBody(prompt);
+  const encodedBytes = Buffer.byteLength(JSON.stringify(body), "utf8");
+  return encodedBytes <= MAX_REQUEST_BYTES;
+}
+
+/**
+ * Bounds a file-status summary so its UTF-8 JSON-escaped byte size never exceeds `maxBytes`.
+ */
+export function boundSummary(summaryText, maxBytes = MAX_SUMMARY_BYTES) {
+  if (typeof summaryText !== "string" || !summaryText) return "";
+  if (Buffer.byteLength(JSON.stringify(summaryText), "utf8") <= maxBytes) {
+    return summaryText;
+  }
+
+  const lines = summaryText.split("\n");
+  const kept = [];
+  let currentBytes = 0;
+  const suffix = "\n... [file summary truncated due to size]";
+  const budget = Math.max(256, maxBytes - Buffer.byteLength(suffix, "utf8") - 64);
+
+  for (const line of lines) {
+    const lineBytes = Buffer.byteLength(JSON.stringify(line + "\n"), "utf8");
+    if (currentBytes + lineBytes > budget) {
+      break;
+    }
+    kept.push(line);
+    currentBytes += lineBytes;
+  }
+
+  if (kept.length === 0) {
+    return summaryText.slice(0, Math.floor(budget / 4)) + suffix;
+  }
+
+  return kept.join("\n") + suffix;
+}
+
+/** Strips code fences, quotes, and backticks */
+export function stripFences(text) {
+  if (typeof text !== "string") return "";
+  return text
+    .replace(/^```\w*\n?/, "")
+    .replace(/\n?```$/, "")
+    .replace(/^`|`$/g, "")
+    .trim();
+}
+
+/**
+ * Direct client for Google Gemini REST API.
+ * Uses x-goog-api-key header over HTTPS directly to Google.
+ */
+export class GeminiProvider {
+  constructor({ apiKey, model = DEFAULT_MODEL, httpClient = null } = {}) {
+    if (!apiKey || typeof apiKey !== "string" || !apiKey.trim()) {
+      throw new Error("API key is required for GeminiProvider.");
+    }
+    if (typeof model !== "string" || !SAFE_MODEL_REGEX.test(model)) {
+      throw new ProviderError(
+        `Invalid model identifier "${sanitizeTerminalText(String(model))}".`,
+        "INVALID_MODEL"
+      );
+    }
+
+    this.apiKey = apiKey.trim();
+    this.model = model;
+    this.baseURL = getGeminiBaseUrl();
+    this.client =
+      httpClient ||
+      defaultHttpClientOverride ||
+      axios.create({
+        baseURL: this.baseURL,
+        timeout: REQUEST_TIMEOUT_MS,
+        maxRedirects: 0,
+        maxContentLength: MAX_CONTENT_LENGTH,
+        maxBodyLength: MAX_REQUEST_BYTES,
+      });
+  }
+
+  /**
+   * Translates raw HTTP/axios errors into sanitized, stable ProviderErrors.
+   * Strips out any credential material or raw payload text.
+   */
+  classifyError(err) {
+    if (err instanceof ProviderError) return err;
+
+    if (err.response) {
+      const status = err.response.status;
+      const rawApiMessage = err.response.data?.error?.message || "";
+      const apiMessage = redactSecretText(rawApiMessage, [this.apiKey]);
+
+      if (
+        status === 400 &&
+        (apiMessage.includes("API_KEY_INVALID") || apiMessage.includes("API key not valid"))
+      ) {
+        return new ProviderError(
+          "Your Gemini API key is invalid. Run `git pilot setup` to configure a valid key.",
+          "INVALID_KEY",
+          status
+        );
+      }
+
+      if (status === 401 || status === 403) {
+        return new ProviderError(
+          "Access denied by Gemini API (401/403). Check that your API key is valid and has permissions.",
+          "PERMISSION_DENIED",
+          status
+        );
+      }
+
+      if (status === 429 || apiMessage.includes("RESOURCE_EXHAUSTED")) {
+        return new ProviderError(
+          "Gemini API rate limit or quota exceeded. Please check your account quota and billing status.",
+          "QUOTA_EXCEEDED",
+          status
+        );
+      }
+
+      if (status === 404 || apiMessage.includes("models/")) {
+        return new ProviderError(
+          `Configured Gemini model "${this.model}" is unavailable to this API key or Google project. ` +
+            `Check model access, or change the "model" value in your Git Pilot config and rerun ` +
+            "`git pilot setup`.",
+          "MODEL_NOT_FOUND",
+          status
+        );
+      }
+
+      return new ProviderError(
+        `Gemini API request failed (${status}): ${sanitizeTerminalText(apiMessage || "Unknown error")}`,
+        "PROVIDER_ERROR",
+        status
+      );
+    }
+
+    const cleanMsg = redactSecretText(err.message || "Unknown", [this.apiKey]);
+
+    if (err.code === "ECONNABORTED" || cleanMsg.includes("timeout")) {
+      return new ProviderError(
+        "Request to Gemini API timed out. Please check your network connection.",
+        "TIMEOUT"
+      );
+    }
+
+    if (
+      err.code === "ENOTFOUND" ||
+      err.code === "ECONNREFUSED" ||
+      cleanMsg.includes("Network Error")
+    ) {
+      return new ProviderError(
+        "Could not connect to Gemini API. Check your internet connection.",
+        "NETWORK_ERROR"
+      );
+    }
+
+    return new ProviderError(`Unexpected error: ${sanitizeTerminalText(cleanMsg)}`, "UNKNOWN");
+  }
+
+  /**
+   * Validates the provided API key with a minimal request without repository data.
+   */
+  async validateKey() {
+    try {
+      const endpoint = `/v1beta/models/${encodeURIComponent(this.model)}:generateContent`;
+      const body = {
+        contents: [
+          {
+            parts: [{ text: "ping" }],
+          },
+        ],
+        generationConfig: {
+          maxOutputTokens: 1,
+        },
+      };
+
+      await this.client.post(endpoint, body, {
+        headers: {
+          "x-goog-api-key": this.apiKey,
+          "Content-Type": "application/json",
+        },
+      });
+
+      return { valid: true };
+    } catch (err) {
+      throw this.classifyError(err);
+    }
+  }
+
+  /**
+   * Sends prompt directly to Gemini and returns response text.
+   * Enforces serialized UTF-8 byte limit before sending and retries once on transient errors (429/503).
+   */
+  async generate(prompt) {
+    const endpoint = `/v1beta/models/${encodeURIComponent(this.model)}:generateContent`;
+    const body = buildGeminiRequestBody(prompt);
+    const serialized = JSON.stringify(body);
+    const byteLength = Buffer.byteLength(serialized, "utf8");
+
+    if (byteLength > MAX_REQUEST_BYTES) {
+      throw new ProviderError(
+        `Request payload (${byteLength} bytes) exceeds maximum allowed size (${MAX_REQUEST_BYTES} bytes).`,
+        "PAYLOAD_TOO_LARGE",
+        413
+      );
+    }
+
+    let attempts = 0;
+    const maxRetries = 1;
+
+    while (attempts <= maxRetries) {
+      attempts++;
+      try {
+        const response = await this.client.post(endpoint, body, {
+          headers: {
+            "x-goog-api-key": this.apiKey,
+            "Content-Type": "application/json",
+          },
+        });
+
+        const text = response.data?.candidates?.[0]?.content?.parts?.[0]?.text;
+        if (typeof text !== "string") {
+          throw new ProviderError(
+            "Gemini response did not contain expected content.",
+            "EMPTY_RESPONSE"
+          );
+        }
+
+        return sanitizeTerminalText(text);
+      } catch (err) {
+        const classified = this.classifyError(err);
+        const isTransient = classified.status === 429 || classified.status === 503;
+
+        if (isTransient && attempts <= maxRetries) {
+          await new Promise((r) => setTimeout(r, 1000 * attempts));
+          continue;
+        }
+
+        throw classified;
+      }
+    }
+  }
+}

package/src/lib/sanitizer.js

@@ -0,0 +1,37 @@
+/**
+ * Terminal control sequence sanitizer.
+ * Strips ANSI escape sequences, OSC strings, and control characters
+ * from untrusted AI output before displaying it in the terminal.
+ */
+
+// Matches ANSI escape codes, OSC sequences, cursor controls
+const ANSI_PATTERN =
+  // eslint-disable-next-line no-control-regex
+  /[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|[\u001b\u009b]\].*?(\u0007|\u001b\\)/g;
+
+// Strip other non-printable ASCII control characters except newline and tab
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u0008\u000B-\u001A\u001C-\u001F\u007F]/g;
+
+export const MAX_MESSAGE_CHARS = 5000;
+export const MAX_MESSAGE_LINES = 100;
+
+export function sanitizeTerminalText(input) {
+  if (typeof input !== "string") return "";
+  let clean = input.replace(ANSI_PATTERN, "").replace(CONTROL_CHARS, "");
+
+  // Normalize line endings
+  clean = clean.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+
+  // Enforce length and line count bounds
+  if (clean.length > MAX_MESSAGE_CHARS) {
+    clean = clean.slice(0, MAX_MESSAGE_CHARS) + "\n...[output truncated for safety]";
+  }
+
+  const lines = clean.split("\n");
+  if (lines.length > MAX_MESSAGE_LINES) {
+    clean = lines.slice(0, MAX_MESSAGE_LINES).join("\n") + "\n...[output truncated for safety]";
+  }
+
+  return clean.trim();
+}

package/src/lib/scanner.js

@@ -0,0 +1,74 @@
+/**
+ * Best-effort heuristic secret scanner for staged diffs.
+ * Blocks transmission of high-confidence credential patterns (private keys,
+ * well-known provider tokens, and explicit secret assignments) before network requests.
+ *
+ * NOTE: Heuristic pattern matching cannot guarantee that a diff is free of all
+ * sensitive material (such as custom passphrases or unstructured tokens). Users are
+ * informed via the privacy notice that staged diffs are transmitted to Google Gemini.
+ */
+
+const RULES = [
+  {
+    name: "Private Key",
+    regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+  },
+  {
+    name: "AWS Access Key ID",
+    regex: /\b(AKIA[0-9A-Z]{16})\b/,
+  },
+  {
+    name: "GitHub Token",
+    regex: /\b((?:ghp|gho|ghu|ghs|ghr)_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9_]{40,})\b/,
+  },
+  {
+    name: "Slack Token",
+    regex: /\b(xox[baprs]-[0-9a-zA-Z-]{10,})\b/,
+  },
+  {
+    name: "Google API Key",
+    regex: /\b(AIza[0-9A-Za-z-_]{30,40})\b/,
+  },
+  {
+    name: "Generic Secret / Token Assignment",
+    regex:
+      /(?:api[_-]?key|secret[_-]?key|client[_-]?secret|access[_-]?token|bearer[_-]?token)\s*[:=]\s*['"]([a-zA-Z0-9_-]{20,})['"]/i,
+  },
+];
+
+function maskMatch(str) {
+  if (str.length <= 8) return "****";
+  return str.slice(0, 4) + "*".repeat(str.length - 8) + str.slice(-4);
+}
+
+export function scanDiffForSecrets(diffText) {
+  if (!diffText || typeof diffText !== "string") {
+    return { clean: true, findings: [] };
+  }
+
+  const findings = [];
+  const lines = diffText.split("\n");
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.startsWith("---") || line.startsWith("+++")) continue;
+
+    for (const rule of RULES) {
+      const match = rule.regex.exec(line);
+      if (match) {
+        const rawSecret = match[1] || match[0];
+        findings.push({
+          rule: rule.name,
+          line: i + 1,
+          preview: maskMatch(rawSecret),
+        });
+        break;
+      }
+    }
+  }
+
+  return {
+    clean: findings.length === 0,
+    findings,
+  };
+}

package/src/lib/ui.js

@@ -1,28 +1,76 @@
 import chalk from "chalk";
 import inquirer from "inquirer";
 import ora from "ora";
-import { describeError } from "./api.js";
+import process from "node:process";
 import { UnsafeCommandError } from "./exec.js";
+import { ProviderError } from "./provider.js";
+import { GitCommitError } from "./git.js";
+import { CredentialStoreUnavailableError, redactSecretText } from "./credentials.js";
+import { sanitizeTerminalText } from "./sanitizer.js";
 
-// ora 9.x divides by stream.columns; a PTY that reports 0 columns makes its
-// redraw loop spin forever. Give it a sane fallback.
+// Check NO_COLOR standard (https://no-color.org)
+if (process.env.NO_COLOR) {
+  chalk.level = 0;
+}
+
+// ora 9.x column fallback
 if (!process.stderr.columns) process.stderr.columns = 80;
 
-// discardStdin is off so the spinner never swallows the input inquirer needs next.
-export const spin = (text) => ora({ text, discardStdin: false }).start();
+export const spin = (text) => ora({ text, discardStdin: false, stream: process.stderr }).start();
 
 export function showBlock(title, body) {
-  const bar = "-".repeat(title.length + 14);
+  const bar = "-".repeat(Math.max(title.length + 14, 30));
   console.log(chalk.green(`\n------ ${title} ------`));
   console.log(chalk.cyan(body));
   console.log(chalk.green(`${bar}\n`));
 }
 
-export async function confirm(message) {
-  const { ok } = await inquirer.prompt([{ type: "confirm", name: "ok", message, default: false }]);
+export function showPanel({ title, details = [], content, stream = process.stdout }) {
+  const write = (line) => stream.write(line + "\n");
+  write(chalk.bold.cyan(`\n╭─ ${title} ` + "─".repeat(Math.max(0, 50 - title.length))));
+  for (const detail of details) {
+    write(chalk.dim(`│  ${detail}`));
+  }
+  if (details.length > 0) {
+    write(chalk.dim(`├${"─".repeat(55)}`));
+  }
+  const lines = (content || "").split("\n");
+  for (const line of lines) {
+    write(`│  ${chalk.white(line)}`);
+  }
+  write(chalk.bold.cyan(`╰${"─".repeat(56)}\n`));
+}
+
+export async function confirm(message, defaultVal = false) {
+  const { ok } = await inquirer.prompt([
+    { type: "confirm", name: "ok", message, default: defaultVal },
+  ]);
   return ok;
 }
 
+/**
+ * Action menu for commit flow: returns "accept" | "edit" | "regenerate" | "abort".
+ * Default selection is "abort" (non-destructive) so pressing Enter accidentally
+ * never creates an unintended commit.
+ */
+export async function chooseCommitAction() {
+  const { action } = await inquirer.prompt([
+    {
+      type: "list",
+      name: "action",
+      message: "What would you like to do?",
+      default: "abort",
+      choices: [
+        { name: "Accept and commit", value: "accept" },
+        { name: "Edit in $EDITOR", value: "edit" },
+        { name: "Regenerate message", value: "regenerate" },
+        { name: "Abort", value: "abort" },
+      ],
+    },
+  ]);
+  return action;
+}
+
 /** Accept / Edit / Abort menu; returns "accept" | "edit" | "abort". */
 export async function chooseAcceptEditAbort() {
   const { choice } = await inquirer.prompt([
@@ -30,6 +78,7 @@ export async function chooseAcceptEditAbort() {
       type: "list",
       name: "choice",
       message: "What would you like to do?",
+      default: "abort",
       choices: [
         { name: "Accept", value: "accept" },
         { name: "Edit", value: "edit" },
@@ -54,21 +103,70 @@ export async function editText(message, initial, emptyMessage) {
   return text.trim();
 }
 
-export const success = (text) => console.log(chalk.bgGreen.black(text));
-export const aborted = (text) => console.log(chalk.red(text));
+/** Non-echoing masked password prompt */
+export async function promptMaskedPassword(message) {
+  const { secret } = await inquirer.prompt([
+    {
+      type: "password",
+      name: "secret",
+      message,
+      mask: "*",
+      validate: (input) => (input.trim().length > 0 ? true : "Input cannot be empty."),
+    },
+  ]);
+  return secret.trim();
+}
+
+export const success = (text) => console.log(chalk.green(`✔ ${text}`));
+export const warn = (text) => console.error(chalk.yellow(`⚠ ${text}`));
+export const info = (text) => console.error(chalk.blue(`ℹ ${text}`));
+export const aborted = (text) => console.log(chalk.dim(`Cancelled. ${text}`));
+
+export function formatSafeErrorText(text) {
+  return sanitizeTerminalText(redactSecretText(String(text || "")));
+}
 
 /** Prints an error, stops the spinner if it is running, and exits non-zero. */
 export function handleError(error, spinner) {
   if (spinner?.isSpinning) spinner.fail();
 
   if (error?.name === "ExitPromptError") {
-    console.error(chalk.red("\nCancelled."));
+    console.error(chalk.dim("\nCancelled by user."));
     process.exit(130);
   }
+
+  if (error instanceof CredentialStoreUnavailableError) {
+    console.error(chalk.red.bold(`\nCredential Store Unavailable:`));
+    console.error(chalk.red(formatSafeErrorText(error.message)));
+    console.error(
+      chalk.yellow(
+        "\nTip: For CI or automated environments, you can alternatively set the GEMINI_API_KEY environment variable."
+      )
+    );
+    process.exit(1);
+  }
+
   if (error instanceof UnsafeCommandError) {
-    console.error(chalk.red(`Refusing to run: ${error.message}`));
-  } else {
-    console.error(chalk.red(describeError(error)));
+    console.error(chalk.red(`Refusing to run: ${formatSafeErrorText(error.message)}`));
+    process.exit(1);
+  }
+
+  if (error instanceof ProviderError) {
+    console.error(chalk.red(`Provider Error: ${formatSafeErrorText(error.message)}`));
+    process.exit(1);
+  }
+
+  if (error instanceof GitCommitError) {
+    console.error(chalk.red(`\nCommit Error: ${formatSafeErrorText(error.message)}`));
+    console.error(chalk.yellow(`\nYour generated message was preserved:`));
+    console.error(chalk.cyan(sanitizeTerminalText(error.commitMessage)));
+    process.exit(1);
   }
+
+  console.error(
+    chalk.red(
+      `An unexpected error occurred: ${formatSafeErrorText(error?.message || String(error))}`
+    )
+  );
   process.exit(1);
 }

package/src/lib/api.js

@@ -1,59 +0,0 @@
-import axios from "axios";
-
-export const DEFAULT_API_URL = "https://git-pilot-api.vercel.app";
-
-// The API rejects request bodies over 1 MB (bytes, after JSON encoding) and diffs over
-// 800,000 characters.
-export const MAX_DIFF_CHARS = 800_000;
-const MAX_BODY_BYTES = 1_000_000;
-
-/** True if `body` (containing `diff`) is small enough for the API to accept. */
-export const fitsInRequest = (body, diff) =>
-  diff.length <= MAX_DIFF_CHARS && Buffer.byteLength(JSON.stringify(body)) <= MAX_BODY_BYTES;
-
-const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
-
-export function apiBaseUrl() {
-  const raw = (process.env.GIT_PILOT_API_URL || DEFAULT_API_URL).replace(/\/+$/, "");
-
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    throw new Error(`GIT_PILOT_API_URL is not a valid URL: ${raw}`);
-  }
-  // Your staged diffs are sent to this server, so never over plain http except locally.
-  const plainHttpOk = url.protocol === "http:" && LOCAL_HOSTS.has(url.hostname);
-  if (url.protocol !== "https:" && !plainHttpOk) {
-    throw new Error("GIT_PILOT_API_URL must use https (plain http is only allowed for localhost).");
-  }
-  return raw;
-}
-
-/** POSTs `body` to `/api/<endpoint>` and returns the parsed response data. */
-export async function callApi(endpoint, body) {
-  const { data } = await axios.post(`${apiBaseUrl()}/api/${endpoint}`, body, {
-    timeout: 30_000,
-    maxRedirects: 0, // the API never redirects a POST; don't follow one to somewhere else
-    maxContentLength: 1_000_000,
-  });
-  return data;
-}
-
-/** Returns `data[field]` if it is a non-empty string; otherwise throws a clear error. */
-export function requireString(data, field) {
-  const value = data?.[field];
-  if (typeof value !== "string" || value === "") {
-    throw new Error(`Unexpected response from the API (missing "${field}").`);
-  }
-  return value;
-}
-
-/** Human-readable message for an axios/network/other error. */
-export function describeError(error) {
-  if (error.response) {
-    const detail = error.response.data?.error || "No message";
-    return `API Error: ${error.response.status} - ${detail}`;
-  }
-  return `An unexpected error occurred: ${error.message}`;
-}