@creativeintelligence/abbie 0.1.0

package/src/lib/tmux/map.ts

@@ -0,0 +1,252 @@
+/**
+ * Agent ↔ tmux pane correlation.
+ * Maps active agent sessions to their tmux panes.
+ */
+
+import { type ActiveSession, getActiveSessionManager } from "../active-sessions.js";
+import * as bridge from "./bridge.js";
+
+/** Agent CLI process names to detect */
+const AGENT_PROCESSES = new Set([
+  "claude",
+  "codex",
+  "copilot",
+  "gemini",
+  "pi",
+  "opencode",
+  "droid",
+]);
+
+export interface PaneLocation {
+  sessionName: string;
+  windowId: string;
+  windowIndex: number;
+  windowName: string;
+  paneIndex: number;
+  target: string; // "session:@window.pane"
+  cmd: string;
+  cwd: string;
+}
+
+export interface AgentPaneMapping {
+  session: ActiveSession;
+  pane: PaneLocation | null;
+  matchType: "process" | "cwd" | "none";
+}
+
+export interface UnmappedPane extends PaneLocation {
+  active: boolean;
+}
+
+export interface MapResult {
+  mappings: AgentPaneMapping[];
+  unmappedPanes: UnmappedPane[];
+}
+
+/**
+ * Get all panes across all tmux sessions.
+ */
+export async function getAllPanes(): Promise<PaneLocation[]> {
+  const panes: PaneLocation[] = [];
+  const sessions = await bridge.listSessions();
+
+  for (const session of sessions) {
+    const windows = await bridge.listWindows(session.name);
+
+    for (const window of windows) {
+      const windowPanes = await bridge.listPanes(window.index, session.name);
+
+      for (const pane of windowPanes) {
+        panes.push({
+          sessionName: session.name,
+          windowId: window.id,
+          windowIndex: window.index,
+          windowName: window.name,
+          paneIndex: pane.index,
+          target: `${session.name}:${window.id}.${pane.index}`,
+          cmd: pane.currentCommand,
+          cwd: pane.currentPath,
+        });
+      }
+    }
+  }
+
+  return panes;
+}
+
+/**
+ * Check if a pane is running an agent CLI.
+ */
+export function isAgentProcess(cmd: string): boolean {
+  const lowerCmd = cmd.toLowerCase();
+  return AGENT_PROCESSES.has(lowerCmd);
+}
+
+/**
+ * Detect which agent type a process is.
+ */
+export function detectAgentType(cmd: string): string | null {
+  const lowerCmd = cmd.toLowerCase();
+  if (AGENT_PROCESSES.has(lowerCmd)) {
+    return lowerCmd;
+  }
+  return null;
+}
+
+/**
+ * Normalize a path for comparison.
+ */
+function normalizePath(path: string): string {
+  // Remove trailing slashes, resolve ~ to home
+  let normalized = path.replace(/\/+$/, "");
+  if (normalized.startsWith("~")) {
+    const home = process.env.HOME || "/Users/luke";
+    normalized = normalized.replace(/^~/, home);
+  }
+  return normalized;
+}
+
+/**
+ * Check if two paths match (handles trailing slashes, ~).
+ */
+export function pathsMatch(path1: string, path2: string): boolean {
+  return normalizePath(path1) === normalizePath(path2);
+}
+
+/**
+ * Correlate active agent sessions with tmux panes.
+ */
+export async function correlateAgentsToPanes(): Promise<MapResult> {
+  const manager = getActiveSessionManager();
+  const activeSessions = await manager.listAsync({ status: "running" });
+  const allPanes = await getAllPanes();
+
+  const mappings: AgentPaneMapping[] = [];
+  const mappedPaneTargets = new Set<string>();
+
+  for (const session of activeSessions) {
+    let matchedPane: PaneLocation | null = null;
+    let matchType: "process" | "cwd" | "none" = "none";
+
+    // Strategy 1: Find pane running the agent CLI with matching cwd
+    for (const pane of allPanes) {
+      if (isAgentProcess(pane.cmd) && session.cwd && pathsMatch(pane.cwd, session.cwd)) {
+        matchedPane = pane;
+        matchType = "process";
+        break;
+      }
+    }
+
+    // Strategy 2: If no process match, try cwd match only
+    if (!matchedPane && session.cwd) {
+      for (const pane of allPanes) {
+        if (pathsMatch(pane.cwd, session.cwd)) {
+          matchedPane = pane;
+          matchType = "cwd";
+          break;
+        }
+      }
+    }
+
+    mappings.push({
+      session,
+      pane: matchedPane,
+      matchType,
+    });
+
+    if (matchedPane) {
+      mappedPaneTargets.add(matchedPane.target);
+    }
+  }
+
+  // Find unmapped panes (excluding agent processes that weren't matched)
+  const unmappedPanes: UnmappedPane[] = [];
+  for (const pane of allPanes) {
+    if (!mappedPaneTargets.has(pane.target)) {
+      // Get active status
+      const sessions = await bridge.listSessions();
+      const tmuxSession = sessions.find((s) => s.name === pane.sessionName);
+      let isActive = false;
+
+      if (tmuxSession) {
+        const windows = await bridge.listWindows(pane.sessionName);
+        const window = windows.find((w) => w.id === pane.windowId);
+        if (window) {
+          const panes = await bridge.listPanes(window.index, pane.sessionName);
+          const p = panes.find((pp) => pp.index === pane.paneIndex);
+          isActive = p?.active ?? false;
+        }
+      }
+
+      unmappedPanes.push({
+        ...pane,
+        active: isActive,
+      });
+    }
+  }
+
+  return { mappings, unmappedPanes };
+}
+
+/**
+ * Get the currently focused tmux pane.
+ */
+export async function getFocusedPane(): Promise<PaneLocation | null> {
+  const running = await bridge.isRunning();
+  if (!running) return null;
+
+  // Get all sessions and find the attached one
+  const sessions = await bridge.listSessions();
+  const attachedSession = sessions.find((s) => s.attached);
+  if (!attachedSession) return null;
+
+  // Get windows and find the active one
+  const windows = await bridge.listWindows(attachedSession.name);
+  const activeWindow = windows.find((w) => w.active);
+  if (!activeWindow) return null;
+
+  // Get panes and find the active one
+  const panes = await bridge.listPanes(activeWindow.index, attachedSession.name);
+  const activePane = panes.find((p) => p.active);
+  if (!activePane) return null;
+
+  return {
+    sessionName: attachedSession.name,
+    windowId: activeWindow.id,
+    windowIndex: activeWindow.index,
+    windowName: activeWindow.name,
+    paneIndex: activePane.index,
+    target: `${attachedSession.name}:${activeWindow.id}.${activePane.index}`,
+    cmd: activePane.currentCommand,
+    cwd: activePane.currentPath,
+  };
+}
+
+/**
+ * Extract project name from a path.
+ * Matches ~/Developer/apps/{project} or ~/Developer/utils/{project} patterns.
+ */
+export function extractProjectFromPath(path: string): string | null {
+  const normalized = normalizePath(path);
+  const home = process.env.HOME || "/Users/luke";
+
+  // Pattern: ~/Developer/apps/{project}/...
+  const appsMatch = normalized.match(new RegExp(`^${home}/Developer/apps/([^/]+)`));
+  if (appsMatch) {
+    return appsMatch[1];
+  }
+
+  // Pattern: ~/Developer/utils/{project}/...
+  const utilsMatch = normalized.match(new RegExp(`^${home}/Developer/utils/([^/]+)`));
+  if (utilsMatch) {
+    return utilsMatch[1];
+  }
+
+  // Pattern: ~/Developer/{project}/...
+  const devMatch = normalized.match(new RegExp(`^${home}/Developer/([^/]+)`));
+  if (devMatch) {
+    return devMatch[1];
+  }
+
+  return null;
+}

package/src/lib/tmux/panes.ts

@@ -0,0 +1,170 @@
+import { spawn } from "node:child_process";
+
+export type PaneMetrics = {
+  paneId: string;
+  cols: number;
+  rows: number;
+  cursorX: number;
+  cursorY: number;
+  cursorFlag: number;
+  title: string;
+};
+
+function isCsiFinalByte(code: number): boolean {
+  return code >= 0x40 && code <= 0x7e;
+}
+
+function scanAnsiEscape(input: string, start: number): number {
+  if (input[start] !== "\u001b") return start;
+  const next = input[start + 1];
+
+  // CSI: ESC [ ... final
+  if (next === "[") {
+    let i = start + 2;
+    for (; i < input.length; i++) {
+      const code = input.charCodeAt(i);
+      if (isCsiFinalByte(code)) return i + 1;
+    }
+    return input.length;
+  }
+
+  // OSC: ESC ] ... BEL or ESC \
+  if (next === "]") {
+    let i = start + 2;
+    for (; i < input.length; i++) {
+      const code = input.charCodeAt(i);
+      if (code === 0x07 /* BEL */) return i + 1;
+      if (input[i] === "\u001b" && input[i + 1] === "\\") return i + 2;
+    }
+    return input.length;
+  }
+
+  return Math.min(input.length, start + 2);
+}
+
+function nextCodePoint(input: string, index: number): { cp: number; size: number } {
+  const cp = input.codePointAt(index) ?? 0;
+  const size = cp > 0xffff ? 2 : 1;
+  return { cp, size };
+}
+
+function markCursorAnsi(line: string, cursorX: number): string {
+  // Best-effort: wrap the cursor cell with reverse-video toggles (7/27).
+  const x = Math.max(0, cursorX);
+  let out = "";
+  let visible = 0;
+  let i = 0;
+
+  while (i < line.length) {
+    if (line[i] === "\u001b") {
+      const end = scanAnsiEscape(line, i);
+      out += line.slice(i, end);
+      i = end;
+      continue;
+    }
+
+    const { cp, size } = nextCodePoint(line, i);
+    const ch = String.fromCodePoint(cp);
+    if (visible === x) out += "\u001b[7m";
+    out += ch;
+    if (visible === x) out += "\u001b[27m";
+    visible += 1;
+    i += size;
+  }
+
+  // If cursor is past EOL, render a reversed space.
+  if (x >= visible) {
+    out += "\u001b[7m \u001b[27m";
+  }
+
+  return out;
+}
+
+function runTmuxRaw(args: string[]): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const proc = spawn("tmux", args, { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (d) => {
+      stdout += d.toString("utf8");
+    });
+    proc.stderr.on("data", (d) => {
+      stderr += d.toString("utf8");
+    });
+    proc.on("close", (code) => {
+      if (code === 0) resolve(stdout);
+      else reject(new Error(stderr.trim() || `tmux ${args.join(" ")} exited ${code}`));
+    });
+    proc.on("error", reject);
+  });
+}
+
+export async function getPaneMetrics(paneId: string): Promise<PaneMetrics | null> {
+  try {
+    const out = await runTmuxRaw([
+      "display-message",
+      "-p",
+      "-t",
+      paneId,
+      "#{pane_width}\t#{pane_height}\t#{cursor_x}\t#{cursor_y}\t#{cursor_flag}\t#{pane_title}",
+    ]);
+    const [colsRaw, rowsRaw, cursorXRaw, cursorYRaw, cursorFlagRaw, titleRaw] = out
+      .trimEnd()
+      .split("\t");
+    const cols = Number.parseInt(colsRaw ?? "", 10);
+    const rows = Number.parseInt(rowsRaw ?? "", 10);
+    const cursorX = Number.parseInt(cursorXRaw ?? "", 10);
+    const cursorY = Number.parseInt(cursorYRaw ?? "", 10);
+    const cursorFlag = Number.parseInt(cursorFlagRaw ?? "", 10);
+    const title = titleRaw ?? "";
+
+    if (!Number.isFinite(cols) || !Number.isFinite(rows)) return null;
+    return { paneId, cols, rows, cursorX, cursorY, cursorFlag, title };
+  } catch {
+    return null;
+  }
+}
+
+export async function capturePaneScreen(
+  paneId: string,
+  opts: { ansi: boolean; rows: number; cursor?: { x: number; y: number; visible: boolean } },
+): Promise<string> {
+  const rows = Math.max(1, opts.rows);
+  const args = ["capture-pane", "-t", paneId, "-p"];
+  if (opts.ansi) args.push("-e");
+  args.push("-S", `-${rows}`);
+
+  try {
+    // Preserve all whitespace; do not trim (important for full-screen apps).
+    const raw = await runTmuxRaw(args);
+    const cursor = opts.cursor;
+    if (!cursor || !cursor.visible) return raw;
+
+    const lines = raw.replace(/\n$/, "").split("\n");
+    if (cursor.y < 0 || cursor.y >= lines.length) return raw;
+    const target = lines[cursor.y] ?? "";
+    lines[cursor.y] = opts.ansi ? markCursorAnsi(target, cursor.x) : target;
+    return `${lines.join("\n")}\n`;
+  } catch {
+    return "";
+  }
+}
+
+export async function ensurePipePane(
+  paneId: string,
+  shellCommand: string,
+  opts: { onlyIfUnset: boolean; bidirectional: boolean },
+): Promise<{ attached: boolean; error?: string }> {
+  const args = ["pipe-pane", "-t", paneId];
+  if (opts.onlyIfUnset) args.push("-o");
+  if (opts.bidirectional) args.push("-I", "-O");
+  // If neither -I nor -O are specified, tmux defaults to -O (stdin connected).
+  args.push(shellCommand);
+
+  try {
+    await runTmuxRaw(args);
+    return { attached: true };
+  } catch (err) {
+    return { attached: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}

package/src/lib/tmux/redaction.test.ts

@@ -0,0 +1,231 @@
+import { describe, expect, test } from "bun:test";
+import {
+  isSensitiveCommand,
+  redactContent,
+  redactLine,
+  redactTokens,
+  shouldFilterCommand,
+  shouldFilterPath,
+  shouldFilterSession,
+  shouldFilterWindow,
+  shouldRedactLine,
+} from "./redaction.js";
+
+describe("redactTokens", () => {
+  test("redacts OpenAI-style keys", () => {
+    expect(redactTokens("sk-abc123def456ghi789jkl012mno345pqr678stu901vwx")).toBe("***REDACTED***");
+    expect(redactTokens("key: sk-abcdefghijklmnop")).toBe("key: ***REDACTED***");
+  });
+
+  test("redacts Anthropic-style keys", () => {
+    expect(redactTokens("sk-ant-abc123def456ghi789jkl012mno345pqr678stu901")).toBe(
+      "***REDACTED***",
+    );
+  });
+
+  test("redacts GitHub PATs", () => {
+    expect(redactTokens("ghp_abc123def456ghi789jkl")).toBe("***REDACTED***");
+    expect(redactTokens("github_pat_abc123def456ghi789jkl012mno345")).toBe("***REDACTED***");
+    expect(redactTokens("gho_abc123def456ghi789jkl")).toBe("***REDACTED***");
+  });
+
+  test("redacts Slack tokens", () => {
+    expect(redactTokens("xoxb-123456789012-abcdefghij")).toBe("***REDACTED***");
+    expect(redactTokens("xoxp-123456789012-abcdefghij")).toBe("***REDACTED***");
+  });
+
+  test("redacts URLs with auth", () => {
+    expect(redactTokens("https://user:password@api.example.com/v1")).toBe("***REDACTED***");
+    expect(redactTokens("http://admin:secret123@localhost:8080")).toBe("***REDACTED***");
+  });
+
+  test("redacts AWS access keys", () => {
+    expect(redactTokens("AKIAIOSFODNN7EXAMPLE")).toBe("***REDACTED***");
+  });
+
+  test("redacts generic secret patterns", () => {
+    expect(redactTokens("api_key=abcdefghijklmnopqrstuvwxyz123456")).toBe("***REDACTED***");
+    expect(redactTokens('SECRET_KEY: "abcdefghijklmnopqrstuvwxyz"')).toBe("***REDACTED***");
+    expect(redactTokens("auth_token='abcdefghijklmnopqrstuvwxyz'")).toBe("***REDACTED***");
+  });
+
+  test("preserves non-sensitive content", () => {
+    expect(redactTokens("hello world")).toBe("hello world");
+    expect(redactTokens("const x = 42;")).toBe("const x = 42;");
+    expect(redactTokens("sk-short")).toBe("sk-short"); // Too short to be a key
+  });
+
+  test("handles multiple secrets in one line", () => {
+    const input = "key1: sk-abc123def456ghi789jkl012mno345, key2: ghp_abc123def456ghi789jkl";
+    const output = redactTokens(input);
+    expect(output).toBe("key1: ***REDACTED***, key2: ***REDACTED***");
+  });
+});
+
+describe("shouldRedactLine", () => {
+  test("detects API_KEY assignments", () => {
+    expect(shouldRedactLine("API_KEY=abc123")).toBe(true);
+    expect(shouldRedactLine('export API_KEY="value"')).toBe(true);
+  });
+
+  test("detects TOKEN assignments", () => {
+    expect(shouldRedactLine("TOKEN=abc123")).toBe(true);
+    expect(shouldRedactLine("AUTH_TOKEN=abc123")).toBe(true);
+  });
+
+  test("detects SECRET assignments", () => {
+    expect(shouldRedactLine("SECRET=abc123")).toBe(true);
+    expect(shouldRedactLine("SECRET_KEY=abc123")).toBe(true);
+  });
+
+  test("detects PASSWORD assignments", () => {
+    expect(shouldRedactLine("PASSWORD=abc123")).toBe(true);
+    expect(shouldRedactLine("PASS=abc123")).toBe(true);
+    expect(shouldRedactLine("DB_PASSWORD=abc123")).toBe(true);
+  });
+
+  test("detects PRIVATE_KEY assignments", () => {
+    expect(shouldRedactLine("PRIVATE_KEY=abc123")).toBe(true);
+    expect(shouldRedactLine("SSH_PRIVATE_KEY=abc123")).toBe(true);
+  });
+
+  test("is case-insensitive", () => {
+    expect(shouldRedactLine("api_key=abc123")).toBe(true);
+    expect(shouldRedactLine("Api_Key=abc123")).toBe(true);
+  });
+
+  test("does not match non-sensitive lines", () => {
+    expect(shouldRedactLine("const x = 42;")).toBe(false);
+    expect(shouldRedactLine('echo "hello"')).toBe(false);
+    expect(shouldRedactLine("API_ENDPOINT=https://example.com")).toBe(false);
+  });
+});
+
+describe("redactLine", () => {
+  test("fully redacts sensitive assignment lines", () => {
+    expect(redactLine("API_KEY=sk-abc123def456ghi789jkl012")).toBe("***REDACTED***");
+  });
+
+  test("token-redacts lines with embedded secrets", () => {
+    expect(redactLine("Using token: ghp_abc123def456ghi789jkl")).toBe(
+      "Using token: ***REDACTED***",
+    );
+  });
+
+  test("preserves clean lines", () => {
+    expect(redactLine('echo "hello"')).toBe('echo "hello"');
+  });
+});
+
+describe("redactContent", () => {
+  test("redacts multiline content", () => {
+    const input = `
+echo "hello"
+API_KEY=secret
+Using ghp_abc123def456ghi789jkl
+const x = 42;
+`.trim();
+
+    const { content, wasRedacted } = redactContent(input);
+    expect(wasRedacted).toBe(true);
+    expect(content).toContain('echo "hello"');
+    expect(content).toContain("***REDACTED***");
+    expect(content).toContain("const x = 42;");
+    expect(content).not.toContain("API_KEY=secret");
+    expect(content).not.toContain("ghp_");
+  });
+
+  test("reports when no redaction occurred", () => {
+    const input = 'echo "hello"\nconst x = 42;';
+    const { content, wasRedacted } = redactContent(input);
+    expect(wasRedacted).toBe(false);
+    expect(content).toBe(input);
+  });
+});
+
+describe("isSensitiveCommand", () => {
+  test("detects pass command", () => {
+    expect(isSensitiveCommand("pass")).toBe(true);
+    expect(isSensitiveCommand("pass show github")).toBe(true);
+  });
+
+  test("detects vault command", () => {
+    expect(isSensitiveCommand("vault")).toBe(true);
+    expect(isSensitiveCommand("vault read secret/data")).toBe(true);
+  });
+
+  test("detects 1password/op", () => {
+    expect(isSensitiveCommand("1password")).toBe(true);
+    expect(isSensitiveCommand("op")).toBe(true);
+    expect(isSensitiveCommand("op get item github")).toBe(true);
+  });
+
+  test("detects aws configure", () => {
+    expect(isSensitiveCommand("aws configure")).toBe(true);
+    expect(isSensitiveCommand("aws configure list")).toBe(true);
+  });
+
+  test("does not match non-sensitive commands", () => {
+    expect(isSensitiveCommand("nvim")).toBe(false);
+    expect(isSensitiveCommand("zsh")).toBe(false);
+    expect(isSensitiveCommand("git status")).toBe(false);
+  });
+});
+
+describe("shouldFilterSession", () => {
+  test("filters by deny list", () => {
+    const config = { denySessions: ["secret*", "private"] };
+    expect(shouldFilterSession("secret-work", config)).toBe(true);
+    expect(shouldFilterSession("secrets", config)).toBe(true);
+    expect(shouldFilterSession("private", config)).toBe(true);
+    expect(shouldFilterSession("work", config)).toBe(false);
+  });
+
+  test("filters by include list (overrides deny)", () => {
+    const config = {
+      denySessions: ["*"],
+      includeSessions: ["work", "dev*"],
+    };
+    expect(shouldFilterSession("work", config)).toBe(false);
+    expect(shouldFilterSession("dev-main", config)).toBe(false);
+    expect(shouldFilterSession("other", config)).toBe(true);
+  });
+
+  test("returns false when no filters", () => {
+    expect(shouldFilterSession("anything", {})).toBe(false);
+  });
+});
+
+describe("shouldFilterWindow", () => {
+  test("filters by deny list", () => {
+    const config = { denyWindows: ["credentials", "pass*"] };
+    expect(shouldFilterWindow("credentials", config)).toBe(true);
+    expect(shouldFilterWindow("password", config)).toBe(true);
+    expect(shouldFilterWindow("work", config)).toBe(false);
+  });
+
+  test("filters by include list", () => {
+    const config = { includeWindows: ["main", "editor*"] };
+    expect(shouldFilterWindow("main", config)).toBe(false);
+    expect(shouldFilterWindow("editor-1", config)).toBe(false);
+    expect(shouldFilterWindow("other", config)).toBe(true);
+  });
+});
+
+describe("shouldFilterPath", () => {
+  test("filters by deny list", () => {
+    const config = { denyPaths: ["*/secrets/*", "*.key"] };
+    expect(shouldFilterPath("/home/user/secrets/api.txt", config)).toBe(true);
+    expect(shouldFilterPath("/home/user/.ssh/id_rsa.key", config)).toBe(true);
+    expect(shouldFilterPath("/home/user/code/main.ts", config)).toBe(false);
+  });
+});
+
+describe("shouldFilterCommand", () => {
+  test("filters by deny list", () => {
+    const config = { denyCommands: ["pass", "vault*"] };
+    expect(shouldFilterCommand("pass", config)).toBe(true);
+    expect(shouldFilterCommand("vault", config)).toBe(true);
+    expect(shouldFilterCommand("nvim", config)).toBe(false);
+  });
+});