@amodalai/runtime 0.3.49 → 0.3.50

package/dist/src/session/credential-scrubber.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Scrub credential-shaped substrings from a string. Returns the
+ * input unchanged when no match is found; otherwise returns a copy
+ * with each match replaced by `[REDACTED]` (or `KEY=[REDACTED]`
+ * for env-var lines).
+ */
+export declare function scrubCredentials(text: string): string;
+/**
+ * Scrub the messages array from a session's PersistedSession before
+ * write. Walks every user-role message and replaces credential-shaped
+ * substrings inside text content.
+ *
+ * Assistant messages aren't scrubbed because:
+ *   1. The model isn't supposed to echo credentials (and the F.4
+ *      prompt rule plus this scrubber's coverage of user input mean
+ *      it never sees them in the first place).
+ *   2. Scrubbing assistant output could chew on legitimately
+ *      credential-shaped strings the agent quotes from a connection
+ *      package's docs (e.g. "the format is sk_live_…").
+ *
+ * Tool-result messages aren't scrubbed because they're already
+ * structured by the tool and the chat surface; if a tool returns a
+ * raw token in its output, that's a tool bug to fix in the tool, not
+ * a generic scrubber concern.
+ *
+ * The function is shape-tolerant — it walks any object/array and
+ * applies the scrubber to string-valued `text` / `content` fields
+ * inside user-role messages. Anything else passes through unchanged.
+ */
+export declare function scrubMessagesForPersistence(messages: readonly unknown[]): unknown[];

package/dist/src/session/credential-scrubber.js

@@ -0,0 +1,150 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Credential scrubber — Phase F.5 of the admin-setup build plan.
+ *
+ * Belt-and-suspenders for the inline-paste credential redirect rule
+ * (F.4): if the user pastes a token in chat anyway, the runtime
+ * still sees the raw text in the active SSE stream so the agent can
+ * recognize and redirect — but anything written to the database via
+ * `sessionToRow` is sanitized to `[REDACTED]`.
+ *
+ * The scrubber runs at the persistence boundary, not on the
+ * in-memory message array. The agent's reasoning context keeps the
+ * raw text for one turn (it needs to see the credential to recognize
+ * it as one); only the persisted history is sanitized.
+ */
+const REDACTED = '[REDACTED]';
+// ---------------------------------------------------------------------------
+// Patterns
+// ---------------------------------------------------------------------------
+/**
+ * Well-known credential prefixes. Each entry is a single regex that
+ * matches the whole token; we replace with `[REDACTED]` to fully
+ * sanitize. Adding a new vendor: extend the alternation; tests pin
+ * the existing matches.
+ */
+const TOKEN_PREFIX_PATTERNS = [
+    // Slack: xoxb-, xoxp-, xapp-, xoxa-, xoxr-, xoxs- followed by dash-separated segments.
+    /\bxox[abprs]-[A-Za-z0-9-]{20,}/g,
+    // Slack app-level token: xapp-1-...
+    /\bxapp-\d+-[A-Za-z0-9-]{20,}/g,
+    // Stripe (and Stripe-style) live + test keys: sk_live_..., sk_test_..., pk_live_..., pk_test_...
+    /\b(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g,
+    // Anthropic Claude API keys: sk-ant-api03-...
+    /\bsk-ant-(?:api|sid)\d+-[A-Za-z0-9_-]{16,}/g,
+    // OpenAI API keys: sk-... (older format) and sk-proj-... (project-scoped).
+    /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/g,
+    // GitHub PATs / fine-grained / install tokens: ghp_, gho_, ghr_, ghs_, gha_, github_pat_
+    /\bgh[opsra]_[A-Za-z0-9]{30,}/g,
+    /\bgithub_pat_[A-Za-z0-9_]{40,}/g,
+    // Google API keys: AIza...
+    /\bAIza[A-Za-z0-9_-]{30,}/g,
+    // AWS access key id: AKIA + 16 chars; secret keys are 40-char base64ish.
+    /\bAKIA[A-Z0-9]{14,20}/g,
+    // Resend API keys: re_... + 20+ chars.
+    /\bre_[A-Za-z0-9]{20,}/g,
+    // SendGrid API keys: SG.<24>.<43+>
+    /\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{40,}/g,
+    // Twilio auth tokens: 32-char hex (without a public prefix). Only
+    // match when adjacent to a "TWILIO_AUTH_TOKEN" hint so we don't
+    // chew on every 32-char hex string. Handled via env-var line scrub
+    // below; intentionally not added as a standalone pattern.
+    // HuggingFace user access tokens: hf_...
+    /\bhf_[A-Za-z0-9]{30,}/g,
+];
+/**
+ * `KEY=VALUE` env-var line shape. Matches a line that opens with an
+ * uppercase env-var-style key followed by `=` and 16+ non-whitespace
+ * characters. Catches `SLACK_BOT_TOKEN=xoxb-…` even when the value
+ * format isn't in our prefix list (e.g. raw 32-char hex tokens like
+ * Twilio's auth token).
+ *
+ * The match is intentionally line-anchored — `KEY=VALUE` mid-prose
+ * is ambiguous (could be code-snippet output the agent should see).
+ * If it shows up at the start of a line, treat as a credential.
+ *
+ * We preserve the key name (so the agent / user can see what they
+ * tried to paste) and replace only the value with `[REDACTED]`.
+ */
+const ENV_VAR_LINE_PATTERN = /^(\s*)([A-Z][A-Z0-9_]{2,}=)([^\s]{16,})$/gm;
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Scrub credential-shaped substrings from a string. Returns the
+ * input unchanged when no match is found; otherwise returns a copy
+ * with each match replaced by `[REDACTED]` (or `KEY=[REDACTED]`
+ * for env-var lines).
+ */
+export function scrubCredentials(text) {
+    if (typeof text !== 'string' || text.length === 0)
+        return text;
+    let scrubbed = text;
+    for (const pattern of TOKEN_PREFIX_PATTERNS) {
+        scrubbed = scrubbed.replace(pattern, REDACTED);
+    }
+    scrubbed = scrubbed.replace(ENV_VAR_LINE_PATTERN, (_match, indent, keyEq) => `${indent}${keyEq}${REDACTED}`);
+    return scrubbed;
+}
+/**
+ * Scrub the messages array from a session's PersistedSession before
+ * write. Walks every user-role message and replaces credential-shaped
+ * substrings inside text content.
+ *
+ * Assistant messages aren't scrubbed because:
+ *   1. The model isn't supposed to echo credentials (and the F.4
+ *      prompt rule plus this scrubber's coverage of user input mean
+ *      it never sees them in the first place).
+ *   2. Scrubbing assistant output could chew on legitimately
+ *      credential-shaped strings the agent quotes from a connection
+ *      package's docs (e.g. "the format is sk_live_…").
+ *
+ * Tool-result messages aren't scrubbed because they're already
+ * structured by the tool and the chat surface; if a tool returns a
+ * raw token in its output, that's a tool bug to fix in the tool, not
+ * a generic scrubber concern.
+ *
+ * The function is shape-tolerant — it walks any object/array and
+ * applies the scrubber to string-valued `text` / `content` fields
+ * inside user-role messages. Anything else passes through unchanged.
+ */
+export function scrubMessagesForPersistence(messages) {
+    return messages.map((message) => {
+        if (!isObject(message))
+            return message;
+        if (message['role'] !== 'user')
+            return message;
+        return scrubUserMessage(message);
+    });
+}
+// ---------------------------------------------------------------------------
+// Internals
+// ---------------------------------------------------------------------------
+function scrubUserMessage(message) {
+    const content = message['content'];
+    if (typeof content === 'string') {
+        return { ...message, content: scrubCredentials(content) };
+    }
+    if (Array.isArray(content)) {
+        return { ...message, content: content.map(scrubContentPart) };
+    }
+    return message;
+}
+function scrubContentPart(part) {
+    if (!isObject(part))
+        return part;
+    // The Vercel AI SDK ModelMessage user-content shape: {type: 'text', text: '...'}
+    // or {type: 'image', image: '...', mediaType: '...'}. We only scrub text parts.
+    if (part['type'] === 'text' && typeof part['text'] === 'string') {
+        return { ...part, text: scrubCredentials(part['text']) };
+    }
+    return part;
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=credential-scrubber.js.map

package/dist/src/session/credential-scrubber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-scrubber.js","sourceRoot":"","sources":["../../../src/session/credential-scrubber.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;;GAaG;AAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB;IAC/C,uFAAuF;IACvF,iCAAiC;IACjC,oCAAoC;IACpC,+BAA+B;IAC/B,iGAAiG;IACjG,gDAAgD;IAChD,8CAA8C;IAC9C,6CAA6C;IAC7C,2EAA2E;IAC3E,oCAAoC;IACpC,yFAAyF;IACzF,+BAA+B;IAC/B,iCAAiC;IACjC,2BAA2B;IAC3B,2BAA2B;IAC3B,yEAAyE;IACzE,wBAAwB;IACxB,uCAAuC;IACvC,wBAAwB;IACxB,mCAAmC;IACnC,+CAA+C;IAC/C,kEAAkE;IAClE,gEAAgE;IAChE,mEAAmE;IACnE,0DAA0D;IAC1D,yCAAyC;IACzC,wBAAwB;CACzB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAE1E,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IACD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,KAAa,EAAE,EAAE,CAC1F,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,EAAE,CAC/B,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA4B;IAE5B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC;QAC/C,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAC,GAAG,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAC,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,iFAAiF;IACjF,gFAAgF;IAChF,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAC,GAAG,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/src/session/credential-scrubber.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export {};

package/dist/src/session/credential-scrubber.test.js

@@ -0,0 +1,192 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Phase F.5 — credential scrubber tests. Pin each token-prefix
+ * pattern, the env-var line shape, and the user-message-only walking
+ * behaviour. The asserted leakage check at the bottom is the
+ * load-bearing guarantee: no recognized credential shape survives
+ * `scrubMessagesForPersistence`.
+ */
+import { describe, expect, it } from 'vitest';
+import { scrubCredentials, scrubMessagesForPersistence, } from './credential-scrubber.js';
+describe('scrubCredentials — token prefix patterns', () => {
+    it('redacts Slack bot, user, app, and admin tokens', () => {
+        // Synthetic fixtures: structurally match the scrubber regex
+        // (`xox[abprs]-[A-Za-z0-9-]{20,}` etc.) but use EXAMPLE / TEST
+        // markers instead of realistic-looking segments so the values
+        // can't be misread as real Slack tokens by secret scanners.
+        const tokens = [
+            'xoxb-EXAMPLE-EXAMPLE-EXAMPLEEXAMPLEEXAMPLE',
+            'xoxp-EXAMPLE-EXAMPLE-EXAMPLEEXAMPLEEXAMPLE',
+            'xoxa-1-EXAMPLE-EXAMPLE-EXAMPLEEXAMPLEEXAMPLE',
+            'xapp-1-EXAMPLE-EXAMPLE-EXAMPLEEXAMPLEEXAMPLE',
+        ];
+        for (const t of tokens) {
+            const scrubbed = scrubCredentials(`my token is ${t} please keep`);
+            expect(scrubbed).toContain('[REDACTED]');
+            expect(scrubbed).not.toContain(t);
+        }
+    });
+    it('redacts Stripe live + test keys (sk_/pk_/rk_)', () => {
+        const tokens = [
+            'sk_live_abcdef0123456789ABCDEF',
+            'sk_test_abcdef0123456789ABCDEF',
+            'pk_live_abcdef0123456789ABCDEF',
+            'rk_test_abcdef0123456789ABCDEF',
+        ];
+        for (const t of tokens) {
+            expect(scrubCredentials(`use ${t} now`)).not.toContain(t);
+        }
+    });
+    it('redacts Anthropic API keys', () => {
+        const t = 'sk-ant-api03-aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890';
+        expect(scrubCredentials(`KEY: ${t}`)).not.toContain(t);
+    });
+    it('redacts OpenAI API keys (legacy + project-scoped)', () => {
+        const legacy = 'sk-aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789aB';
+        const proj = 'sk-proj-aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789aB';
+        expect(scrubCredentials(`legacy ${legacy}`)).not.toContain(legacy);
+        expect(scrubCredentials(`proj ${proj}`)).not.toContain(proj);
+    });
+    it('redacts GitHub PATs and fine-grained tokens', () => {
+        const tokens = [
+            'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789',
+            'gho_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789',
+            'ghs_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789',
+            'github_pat_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789_extra',
+        ];
+        for (const t of tokens) {
+            expect(scrubCredentials(`token: ${t}`)).not.toContain(t);
+        }
+    });
+    it('redacts Google API keys (AIza prefix)', () => {
+        const t = 'AIzaSyABCDEFGHIJKLMNOPQRSTUVWXYZ0123456';
+        expect(scrubCredentials(`google: ${t}`)).not.toContain(t);
+    });
+    it('redacts AWS access key IDs (AKIA prefix)', () => {
+        const t = 'AKIAIOSFODNN7EXAMPLE';
+        expect(scrubCredentials(`AWS ${t}`)).not.toContain(t);
+    });
+    it('redacts Resend, SendGrid, and HuggingFace tokens', () => {
+        const resend = 're_aBcDeFgHiJkLmNoPqRsTuV';
+        const sendgrid = 'SG.aBcDeFgHiJkLmNoPqRsTu.aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789aBcDe';
+        const hf = 'hf_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345';
+        expect(scrubCredentials(`r ${resend}`)).not.toContain(resend);
+        expect(scrubCredentials(`s ${sendgrid}`)).not.toContain(sendgrid);
+        expect(scrubCredentials(`h ${hf}`)).not.toContain(hf);
+    });
+});
+describe('scrubCredentials — env-var line shape', () => {
+    it('redacts KEY=VALUE on its own line, preserving the key', () => {
+        const input = 'TWILIO_AUTH_TOKEN=abcdef0123456789abcdef0123456789';
+        const out = scrubCredentials(input);
+        expect(out).toBe('TWILIO_AUTH_TOKEN=[REDACTED]');
+    });
+    it('handles indented env-var lines and multi-line .env paste', () => {
+        const input = [
+            'SLACK_BOT_TOKEN=xoxb-EXAMPLE-EXAMPLEEXAMPLEEXAMPLE',
+            '  TWILIO_AUTH_TOKEN=abcdef0123456789abcdef0123456789',
+            'OPENAI_API_KEY=sk-aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789aB',
+        ].join('\n');
+        const out = scrubCredentials(input);
+        expect(out).not.toContain('xoxb-EXAMPLE');
+        expect(out).not.toContain('abcdef0123456789abcdef0123456789');
+        expect(out).not.toContain('sk-aBcDeFgHiJkLmNoPqRsTuV');
+        expect(out).toContain('SLACK_BOT_TOKEN=');
+        expect(out).toContain('TWILIO_AUTH_TOKEN=');
+        expect(out).toContain('OPENAI_API_KEY=');
+        expect(out.split('[REDACTED]').length - 1).toBeGreaterThanOrEqual(3);
+    });
+    it('does not match KEY=VALUE mid-prose (line-anchored)', () => {
+        // No anchor → not an env-var line. The token regex still wouldn't
+        // match a 16-char alpha string, so we expect the input to pass
+        // through unchanged.
+        const input = 'set FOO=somevaluethatislong16 in the shell';
+        expect(scrubCredentials(input)).toBe(input);
+    });
+});
+describe('scrubCredentials — passthrough', () => {
+    it('returns plain text unchanged', () => {
+        const input = 'Connect Slack via OAuth and pick a channel.';
+        expect(scrubCredentials(input)).toBe(input);
+    });
+    it('handles empty + non-string input', () => {
+        expect(scrubCredentials('')).toBe('');
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- defensive type guard test
+        expect(scrubCredentials(null)).toBe(null);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- defensive type guard test
+        expect(scrubCredentials(undefined)).toBe(undefined);
+    });
+    it('does not chew arbitrary base64-ish strings without recognized prefix', () => {
+        const input = 'commit hash abcdef0123456789deadbeef0123456789cafef00d';
+        expect(scrubCredentials(input)).toBe(input);
+    });
+});
+describe('scrubMessagesForPersistence', () => {
+    it('scrubs string content of user messages', () => {
+        const messages = [
+            { role: 'user', content: 'my key is sk_live_abcdef0123456789ABCDEF, keep secret' },
+        ];
+        const out = scrubMessagesForPersistence(messages);
+        const first = out[0];
+        expect(first.role).toBe('user');
+        expect(first.content).toContain('[REDACTED]');
+        expect(first.content).not.toContain('sk_live_');
+    });
+    it('scrubs text parts inside structured user content', () => {
+        const messages = [
+            {
+                role: 'user',
+                content: [
+                    { type: 'text', text: 'before sk-ant-api03-aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890 after' },
+                    { type: 'image', image: 'data:...', mediaType: 'image/png' },
+                ],
+            },
+        ];
+        const out = scrubMessagesForPersistence(messages);
+        const parts = out[0].content;
+        expect(parts[0]?.['text']).toContain('[REDACTED]');
+        expect(parts[0]?.['text']).not.toContain('sk-ant-api03');
+        // Image part untouched.
+        expect(parts[1]).toEqual({ type: 'image', image: 'data:...', mediaType: 'image/png' });
+    });
+    it('does not scrub assistant or tool messages', () => {
+        const assistantText = 'API key format is sk_live_abcdef0123456789ABCDEF';
+        const messages = [
+            { role: 'assistant', content: assistantText },
+            { role: 'tool', content: [{ type: 'tool-result', toolName: 'foo', output: 'sk_live_abcdef0123456789ABCDEF' }] },
+        ];
+        const out = scrubMessagesForPersistence(messages);
+        expect(out[0].content).toBe(assistantText);
+        // Tool message passes through unchanged.
+        expect(out[1]).toEqual(messages[1]);
+    });
+    it('passes through non-object entries unchanged', () => {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- shape-tolerant input check
+        const messages = ['unexpected string', 42, null];
+        const out = scrubMessagesForPersistence(messages);
+        expect(out).toEqual(messages);
+    });
+    it('no-leakage guarantee: every recognized pattern is gone from persisted form', () => {
+        const known = [
+            'xoxb-EXAMPLE-EXAMPLE-EXAMPLEEXAMPLEEXAMPLE',
+            'sk_live_abcdef0123456789ABCDEF',
+            'sk-ant-api03-aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890',
+            'sk-proj-aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789aB',
+            'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789',
+            'AIzaSyABCDEFGHIJKLMNOPQRSTUVWXYZ0123456',
+            'AKIAIOSFODNN7EXAMPLE',
+            'hf_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345',
+        ];
+        const blob = `please ignore: ${known.join(' and ')}`;
+        const out = scrubMessagesForPersistence([{ role: 'user', content: blob }]);
+        const persisted = JSON.stringify(out);
+        for (const t of known) {
+            expect(persisted).not.toContain(t);
+        }
+    });
+});
+//# sourceMappingURL=credential-scrubber.test.js.map

package/dist/src/session/credential-scrubber.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-scrubber.test.js","sourceRoot":"","sources":["../../../src/session/credential-scrubber.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AAEH,OAAO,EAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAC,MAAM,QAAQ,CAAC;AAE5C,OAAO,EACL,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,4DAA4D;QAC5D,+DAA+D;QAC/D,8DAA8D;QAC9D,4DAA4D;QAC5D,MAAM,MAAM,GAAG;YACb,4CAA4C;YAC5C,4CAA4C;YAC5C,8CAA8C;YAC9C,8CAA8C;SAC/C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;YAClE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG;YACb,gCAAgC;YAChC,gCAAgC;YAChC,gCAAgC;YAChC,gCAAgC;SACjC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,mDAAmD,CAAC;QAC9D,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,2CAA2C,CAAC;QAC3D,MAAM,IAAI,GAAG,gDAAgD,CAAC;QAC9D,MAAM,CAAC,gBAAgB,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,CAAC,gBAAgB,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG;YACb,0CAA0C;YAC1C,0CAA0C;YAC1C,0CAA0C;YAC1C,uDAAuD;SACxD,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,yCAAyC,CAAC;QACpD,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,sBAAsB,CAAC;QACjC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,2BAA2B,CAAC;QAC3C,MAAM,QAAQ,GAAG,oEAAoE,CAAC;QACtF,MAAM,EAAE,GAAG,qCAAqC,CAAC;QACjD,MAAM,CAAC,gBAAgB,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,oDAAoD,CAAC;QACnE,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG;YACZ,oDAAoD;YACpD,sDAAsD;YACtD,0DAA0D;SAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,kEAAkE;QAClE,+DAA+D;QAC/D,qBAAqB;QACrB,MAAM,KAAK,GAAG,4CAA4C,CAAC;QAC3D,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,KAAK,GAAG,6CAA6C,CAAC;QAC5D,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,2FAA2F;QAC3F,MAAM,CAAC,gBAAgB,CAAC,IAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,2FAA2F;QAC3F,MAAM,CAAC,gBAAgB,CAAC,SAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,KAAK,GAAG,wDAAwD,CAAC;QACvE,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,QAAQ,GAAG;YACf,EAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uDAAuD,EAAC;SACjF,CAAC;QACF,MAAM,GAAG,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAoC,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,QAAQ,GAAG;YACf;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gEAAgE,EAAC;oBACtF,EAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAC;iBAC3D;aACF;SACF,CAAC;QACF,MAAM,GAAG,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,KAAK,GAAI,GAAG,CAAC,CAAC,CAA+C,CAAC,OAAO,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzD,wBAAwB;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAC,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,aAAa,GAAG,kDAAkD,CAAC;QACzE,MAAM,QAAQ,GAAG;YACf,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAC;YAC3C,EAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAC,CAAC,EAAC;SAC5G,CAAC;QACF,MAAM,GAAG,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAE,GAAG,CAAC,CAAC,CAAuB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClE,yCAAyC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,4FAA4F;QAC5F,MAAM,QAAQ,GAAU,CAAC,mBAAmB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,KAAK,GAAG;YACZ,4CAA4C;YAC5C,gCAAgC;YAChC,mDAAmD;YACnD,gDAAgD;YAChD,0CAA0C;YAC1C,yCAAyC;YACzC,sBAAsB;YACtB,qCAAqC;SACtC,CAAC;QACF,MAAM,IAAI,GAAG,kBAAkB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,2BAA2B,CAAC,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/session/manager.intent.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export {};

package/dist/src/session/manager.intent.test.js

@@ -0,0 +1,197 @@
+/**
+ * @license
+ * Copyright 2026 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Phase 2 hook test — verifies `runMessage` short-circuits past the
+ * agent loop when an intent matches, and falls through to the LLM
+ * when it doesn't. Doesn't require a database; uses the in-memory
+ * SessionManager + a stub provider that throws if the LLM gets
+ * invoked (so a leaked agent-loop call fails the test).
+ */
+import { describe, it, expect } from 'vitest';
+import { z } from 'zod';
+import { StandaloneSessionManager } from './manager.js';
+import { SSEEventType } from '../types.js';
+import { createLogger } from '../logger.js';
+import { createToolRegistry } from '../tools/registry.js';
+const logger = createLogger({ component: 'test:manager-intent' });
+// ---------------------------------------------------------------------------
+// Stubs
+// ---------------------------------------------------------------------------
+/** Provider that records whether streamText was called. Pass-through
+ *  text response when invoked so fall-through paths still produce a
+ *  valid SSE stream. */
+function recordingProvider() {
+    let calls = 0;
+    return {
+        model: 'test-model',
+        provider: 'test-provider',
+        languageModel: {},
+        streamText() {
+            calls++;
+            const usage = { inputTokens: 1, outputTokens: 1, totalTokens: 2 };
+            const events = [
+                { type: 'text-delta', textDelta: 'fallthrough text' },
+                { type: 'finish', usage },
+            ];
+            async function* fullStream() {
+                for (const e of events)
+                    yield e;
+            }
+            async function* textStream() {
+                yield 'fallthrough text';
+            }
+            return {
+                fullStream: fullStream(),
+                textStream: textStream(),
+                usage: Promise.resolve(usage),
+                text: Promise.resolve('fallthrough text'),
+                responseMessages: Promise.resolve([{ role: 'assistant', content: 'fallthrough text' }]),
+            };
+        },
+        generateText: () => Promise.reject(new Error('not used')),
+        streamTextCalled: () => calls,
+    };
+}
+function permissive() {
+    return { check: () => ({ allowed: true }) };
+}
+function makeOpts(intents, provider) {
+    const reg = createToolRegistry();
+    const echoTool = {
+        description: 'echo',
+        parameters: z.object({ slug: z.string() }),
+        readOnly: true,
+        runningLabel: "Echoing '{{slug}}'",
+        completedLabel: "Echoed '{{slug}}'",
+        execute: async (params) => ({ echoed: params.slug }),
+    };
+    reg.register('echo', echoTool);
+    return {
+        provider,
+        toolRegistry: reg,
+        permissionChecker: permissive(),
+        systemPrompt: 'test',
+        intents,
+    };
+}
+async function collect(gen) {
+    const out = [];
+    for await (const e of gen)
+        out.push(e);
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+describe('SessionManager.runMessage — intent routing', () => {
+    it('runs the matched intent and skips the LLM entirely', async () => {
+        const installIntent = {
+            id: 'install',
+            regex: /^Set up template '(.+)'\.?$/,
+            handle: async (ctx) => {
+                await ctx.callTool('echo', { slug: ctx.match[1] });
+                return {};
+            },
+        };
+        const provider = recordingProvider();
+        const mgr = new StandaloneSessionManager({ logger });
+        const session = mgr.create(makeOpts([installIntent], provider));
+        const events = await collect(mgr.runMessage(session.id, "Set up template 'marketing-digest'."));
+        // LLM not invoked.
+        expect(provider.streamTextCalled()).toBe(0);
+        const types = events.map((e) => e.type);
+        expect(types).toEqual([
+            SSEEventType.ToolCallStart,
+            SSEEventType.ToolCallResult,
+            SSEEventType.Done,
+        ]);
+        // Tool call's params carry the captured slug.
+        const start = events[0];
+        expect(start.tool_name).toBe('echo');
+        expect(start.parameters['slug']).toBe('marketing-digest');
+        // session.messages has user + synthetic assistant + tool result.
+        const stored = mgr.get(session.id)?.messages ?? [];
+        expect(stored).toHaveLength(3);
+        expect(stored[0].role).toBe('user');
+        expect(stored[1].role).toBe('assistant');
+        expect(stored[2].role).toBe('tool');
+    });
+    it('falls through to the LLM when no intent matches', async () => {
+        const noMatchIntent = {
+            id: 'never',
+            regex: /^never going to match$/,
+            handle: async () => null,
+        };
+        const provider = recordingProvider();
+        const mgr = new StandaloneSessionManager({ logger });
+        const session = mgr.create(makeOpts([noMatchIntent], provider));
+        await collect(mgr.runMessage(session.id, 'something completely different'));
+        expect(provider.streamTextCalled()).toBe(1);
+    });
+    it('falls through to the LLM when handler returns null pre-commit', async () => {
+        const precheckIntent = {
+            id: 'precheck',
+            regex: /^run$/,
+            handle: async () => null, // bail before any tool call
+        };
+        const provider = recordingProvider();
+        const mgr = new StandaloneSessionManager({ logger });
+        const session = mgr.create(makeOpts([precheckIntent], provider));
+        await collect(mgr.runMessage(session.id, 'run'));
+        expect(provider.streamTextCalled()).toBe(1);
+    });
+    it('skips intent routing for multimodal (image-bearing) turns', async () => {
+        const wouldMatchIntent = {
+            id: 'wouldmatch',
+            regex: /^describe$/,
+            handle: async () => {
+                throw new Error('intent should not have run for image turn');
+            },
+        };
+        const provider = recordingProvider();
+        const mgr = new StandaloneSessionManager({ logger });
+        const session = mgr.create(makeOpts([wouldMatchIntent], provider));
+        // Anthropic supports vision, so images flow through to the LLM.
+        Object.assign(session, { providerName: 'anthropic' });
+        await collect(mgr.runMessage(session.id, 'describe', {
+            images: [{ mimeType: 'image/png', data: 'iVBORw0KGgo=' }],
+        }));
+        // LLM was called (image turn bypasses intents) and intent didn't run.
+        expect(provider.streamTextCalled()).toBe(1);
+    });
+    it('agents with no intents behave exactly like before', async () => {
+        const provider = recordingProvider();
+        const mgr = new StandaloneSessionManager({ logger });
+        const session = mgr.create(makeOpts([], provider));
+        await collect(mgr.runMessage(session.id, 'hello'));
+        expect(provider.streamTextCalled()).toBe(1);
+    });
+    it('intent returning {continue: true} runs tools AND invokes the LLM with the new state', async () => {
+        const continueIntent = {
+            id: 'half-deterministic',
+            regex: /^do half$/,
+            handle: async (ctx) => {
+                await ctx.callTool('echo', { slug: 'half' });
+                return { continue: true };
+            },
+        };
+        const provider = recordingProvider();
+        const mgr = new StandaloneSessionManager({ logger });
+        const session = mgr.create(makeOpts([continueIntent], provider));
+        await collect(mgr.runMessage(session.id, 'do half'));
+        // LLM was invoked exactly once, after the intent's tool ran.
+        expect(provider.streamTextCalled()).toBe(1);
+        // Stored messages: user, assistant (intent's tool call), tool
+        // (intent's tool result), assistant (LLM's response).
+        const stored = mgr.get(session.id)?.messages ?? [];
+        expect(stored.length).toBeGreaterThanOrEqual(4);
+        expect(stored[0].role).toBe('user');
+        expect(stored[1].role).toBe('assistant'); // intent
+        expect(stored[2].role).toBe('tool'); // intent's tool result
+        expect(stored[3].role).toBe('assistant'); // LLM continuation
+    });
+});
+//# sourceMappingURL=manager.intent.test.js.map

package/dist/src/session/manager.intent.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.intent.test.js","sourceRoot":"","sources":["../../../src/session/manager.intent.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AAEH,OAAO,EAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAC,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAAC,wBAAwB,EAAC,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAC,YAAY,EAAC,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAC,YAAY,EAAC,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAC,kBAAkB,EAAC,MAAM,sBAAsB,CAAC;AAGxD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAC,SAAS,EAAE,qBAAqB,EAAC,CAAC,CAAC;AAEhE,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E;;wBAEwB;AACxB,SAAS,iBAAiB;IACxB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO;QACL,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,eAAe;QACzB,aAAa,EAAE,EAAkC;QACjD,UAAU;YACR,KAAK,EAAE,CAAC;YACR,MAAM,KAAK,GAAe,EAAC,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAC,CAAC;YAC5E,MAAM,MAAM,GAAkB;gBAC5B,EAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAC;gBACnD,EAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAC;aACxB,CAAC;YACF,KAAK,SAAS,CAAC,CAAC,UAAU;gBACxB,KAAK,MAAM,CAAC,IAAI,MAAM;oBAAE,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,UAAU;gBACxB,MAAM,kBAAkB,CAAC;YAC3B,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,UAAU,EAAE;gBACxB,UAAU,EAAE,UAAU,EAAE;gBACxB,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC7B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBACzC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAC,CAAC,CAAC;aACtF,CAAC;QACJ,CAAC;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAC,OAAO,EAAE,IAAa,EAAC,CAAC,EAAC,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,OAA2B,EAAE,QAAqB;IAClE,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAmB;QAC/B,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC;QACxC,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,oBAAoB;QAClC,cAAc,EAAE,mBAAmB;QACnC,OAAO,EAAE,KAAK,EAAE,MAAe,EAAE,EAAE,CAAC,CAAC,EAAC,MAAM,EAAG,MAAyB,CAAC,IAAI,EAAC,CAAC;KAChF,CAAC;IACF,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/B,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,GAAG;QACjB,iBAAiB,EAAE,UAAU,EAAE;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAI,GAAqB;IAC7C,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,aAAa,GAAqB;YACtC,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,6BAA6B;YACpC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC;gBACjD,OAAO,EAAE,CAAC;YACZ,CAAC;SACF,CAAC;QAEF,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEhE,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAClE,CAAC;QAEF,mBAAmB;QACnB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE5C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACpB,YAAY,CAAC,aAAa;YAC1B,YAAY,CAAC,cAAc;YAC3B,YAAY,CAAC,IAAI;SAClB,CAAC,CAAC;QAEH,8CAA8C;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAA0D,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAE1D,iEAAiE;QACjE,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,aAAa,GAAqB;YACtC,EAAE,EAAE,OAAO;YACX,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;SACzB,CAAC;QAEF,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEhE,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,cAAc,GAAqB;YACvC,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,4BAA4B;SACvD,CAAC;QAEF,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEjE,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QAEjD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,gBAAgB,GAAqB;YACzC,EAAE,EAAE,YAAY;YAChB,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;SACF,CAAC;QAEF,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEnE,gEAAgE;QAChE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAC,YAAY,EAAE,WAAW,EAAC,CAAC,CAAC;QAEpD,MAAM,OAAO,CACX,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE;YACrC,MAAM,EAAE,CAAC,EAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAC,CAAC;SACxD,CAAC,CACH,CAAC;QAEF,sEAAsE;QACtE,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEnD,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAEnD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,cAAc,GAAqB;YACvC,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC,CAAC,CAAC;gBAC3C,OAAO,EAAC,QAAQ,EAAE,IAAI,EAAC,CAAC;YAC1B,CAAC;SACF,CAAC;QAEF,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEjE,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAErD,6DAA6D;QAC7D,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE5C,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,uBAAuB;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}