@creativeintelligence/abbie 0.1.0

package/src/lib/tmux/redaction.ts

@@ -0,0 +1,201 @@
+/**
+ * Redaction utilities for tmux context.
+ * Detects and redacts sensitive data like API keys, tokens, and credentials.
+ */
+
+export type RedactMode = "balanced" | "strict";
+
+const REDACTED_MARKER = "***REDACTED***";
+
+/**
+ * Pattern definitions for sensitive data.
+ */
+const PATTERNS = {
+  // OpenAI/OpenRouter/Anthropic-style keys
+  openaiKey: /sk-[A-Za-z0-9_-]{16,}/g,
+  anthropicKey: /sk-ant-[A-Za-z0-9_-]{16,}/g,
+
+  // GitHub tokens
+  githubPat: /ghp_[A-Za-z0-9]{20,}/g,
+  githubPatNew: /github_pat_[A-Za-z0-9_]{20,}/g,
+  githubOther: /gh[ours]_[A-Za-z0-9]{20,}/g,
+
+  // Slack tokens
+  slackToken: /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+
+  // URLs with user:pass
+  urlWithAuth: /https?:\/\/[^:]+:[^@]+@[^\s'"]+/g,
+
+  // PEM private keys (multiline)
+  pemKey:
+    /-----BEGIN\s+(?:[A-Z\s]+)?PRIVATE\s+KEY-----[\s\S]*?-----END\s+(?:[A-Z\s]+)?PRIVATE\s+KEY-----/g,
+
+  // AWS keys
+  awsAccessKey: /AKIA[A-Z0-9]{16}/g,
+
+  // Generic secret-looking patterns (base64-ish long strings after common key names)
+  genericSecret:
+    /(?:api[_-]?key|secret[_-]?key|access[_-]?token|auth[_-]?token)\s*[:=]\s*["']?[A-Za-z0-9+/=_-]{20,}["']?/gi,
+};
+
+/**
+ * Line-level patterns that should cause entire line redaction.
+ */
+const LINE_PATTERNS = [
+  // Common secret assignments (case-insensitive)
+  // Matches: API_KEY=, SECRET=, SECRET_KEY=, PASSWORD=, AUTH_TOKEN=, PRIVATE_KEY=, etc.
+  /(?:\S*(?:API_KEY|SECRET|TOKEN|PASSWORD|PASS|PRIVATE_KEY)\S*)\s*=/i,
+  // export with secret names
+  /export\s+(?:\S*(?:KEY|TOKEN|SECRET|PASSWORD|PASS)\S*)\s*=/i,
+];
+
+/**
+ * Commands that typically contain sensitive output and should be fully redacted in strict mode.
+ */
+const SENSITIVE_COMMANDS = ["pass", "vault", "1password", "op", "aws configure"];
+
+/**
+ * Redact sensitive tokens within a string.
+ */
+export function redactTokens(text: string): string {
+  let result = text;
+
+  // Apply all token patterns
+  for (const pattern of Object.values(PATTERNS)) {
+    result = result.replace(pattern, REDACTED_MARKER);
+  }
+
+  return result;
+}
+
+/**
+ * Check if a line should be fully redacted.
+ */
+export function shouldRedactLine(line: string): boolean {
+  return LINE_PATTERNS.some((pattern) => pattern.test(line));
+}
+
+/**
+ * Redact a single line of text.
+ */
+export function redactLine(line: string): string {
+  // First check if entire line should be redacted
+  if (shouldRedactLine(line)) {
+    return REDACTED_MARKER;
+  }
+
+  // Otherwise, apply token-level redaction
+  return redactTokens(line);
+}
+
+/**
+ * Redact sensitive data from text content.
+ * In strict mode, redacts more aggressively.
+ */
+export function redactContent(
+  text: string,
+  _mode: RedactMode = "balanced",
+): { content: string; wasRedacted: boolean } {
+  const lines = text.split("\n");
+  let wasRedacted = false;
+
+  const redactedLines = lines.map((line) => {
+    const redacted = redactLine(line);
+    if (redacted !== line) {
+      wasRedacted = true;
+    }
+    return redacted;
+  });
+
+  return {
+    content: redactedLines.join("\n"),
+    wasRedacted,
+  };
+}
+
+/**
+ * Check if a command is considered sensitive.
+ */
+export function isSensitiveCommand(command: string): boolean {
+  const lowerCmd = command.toLowerCase();
+  return SENSITIVE_COMMANDS.some((sc) => lowerCmd.includes(sc));
+}
+
+/**
+ * Filter patterns for deny/allow lists.
+ */
+export interface FilterConfig {
+  denySessions?: string[];
+  denyWindows?: string[];
+  denyPaths?: string[];
+  denyCommands?: string[];
+  includeSessions?: string[];
+  includeWindows?: string[];
+}
+
+/**
+ * Check if a session should be filtered out.
+ */
+export function shouldFilterSession(sessionName: string, config: FilterConfig): boolean {
+  // If include list is specified, only include those
+  if (config.includeSessions?.length) {
+    return !config.includeSessions.some((pattern) => matchPattern(sessionName, pattern));
+  }
+
+  // Otherwise, check deny list
+  if (config.denySessions?.length) {
+    return config.denySessions.some((pattern) => matchPattern(sessionName, pattern));
+  }
+
+  return false;
+}
+
+/**
+ * Check if a window should be filtered out.
+ */
+export function shouldFilterWindow(windowName: string, config: FilterConfig): boolean {
+  // If include list is specified, only include those
+  if (config.includeWindows?.length) {
+    return !config.includeWindows.some((pattern) => matchPattern(windowName, pattern));
+  }
+
+  // Otherwise, check deny list
+  if (config.denyWindows?.length) {
+    return config.denyWindows.some((pattern) => matchPattern(windowName, pattern));
+  }
+
+  return false;
+}
+
+/**
+ * Check if a path should be filtered out.
+ */
+export function shouldFilterPath(path: string, config: FilterConfig): boolean {
+  if (config.denyPaths?.length) {
+    return config.denyPaths.some((pattern) => matchPattern(path, pattern));
+  }
+  return false;
+}
+
+/**
+ * Check if a command should be filtered out.
+ */
+export function shouldFilterCommand(command: string, config: FilterConfig): boolean {
+  if (config.denyCommands?.length) {
+    return config.denyCommands.some((pattern) => matchPattern(command, pattern));
+  }
+  return false;
+}
+
+/**
+ * Simple glob-like pattern matching (supports * wildcards).
+ */
+function matchPattern(value: string, pattern: string): boolean {
+  // Convert glob pattern to regex
+  const regexPattern = pattern
+    .replace(/[.+^${}()|[\]\\]/g, "\\$&") // Escape special chars except *
+    .replace(/\*/g, ".*"); // Convert * to .*
+
+  const regex = new RegExp(`^${regexPattern}$`, "i");
+  return regex.test(value);
+}

package/src/lib/triage-llm.ts

@@ -0,0 +1,312 @@
+import { spawnSync } from "node:child_process";
+import { telemetry } from "./analytics.js";
+import type { AgentCapability, Complexity, IssueType, LinearIssue } from "./triage.js";
+import { AGENT_CAPABILITIES } from "./types.js";
+
+/**
+ * LLM classification result with full reasoning.
+ */
+export interface LLMClassification {
+  type: IssueType;
+  complexity: Complexity;
+  agent: AgentCapability;
+  confidence: number;
+  reasoning: string;
+  suggested_prompt: string;
+  tags: string[];
+  raw_response?: string;
+}
+
+/**
+ * Classification prompt template.
+ */
+const CLASSIFICATION_PROMPT = `You are a technical project manager triaging Linear issues for an AI coding assistant system.
+
+<issue>
+<identifier>{{IDENTIFIER}}</identifier>
+<title>{{TITLE}}</title>
+<description>
+{{DESCRIPTION}}
+</description>
+<priority>{{PRIORITY}}</priority>
+<labels>{{LABELS}}</labels>
+</issue>
+
+<context>
+This is for Zo Computer, a cloud development environment with AI coding assistance.
+Tech stack: Next.js 15, React 19, FastAPI, Modal, Neon Postgres, Cloudflare Workers.
+The codebase is a monorepo with Python backend and TypeScript frontend.
+</context>
+
+<task>
+Classify this issue for agent assignment. Consider:
+1. **Type**: What kind of work is this?
+2. **Complexity**: How much effort/scope?
+3. **Agent**: Which agent is best suited?
+4. **Prompt**: What should we tell the agent?
+</task>
+
+<output_contract>
+Respond with ONLY valid JSON matching this schema:
+{
+  "type": "bug" | "feature" | "refactor" | "improvement" | "chore",
+  "complexity": "trivial" | "simple" | "medium" | "complex" | "epic",
+  "agent": "copilot" | "claude" | "codex" | "human",
+  "confidence": 1-10,
+  "reasoning": "2-3 sentences explaining classification",
+  "suggested_prompt": "specific instructions for the agent",
+  "tags": ["relevant", "tags"]
+}
+
+Agent capabilities:
+- copilot: Quick, good for simple bugs, chores, low-scope improvements (simple complexity max)
+- claude: Orchestrator, good for features, improvements, moderate refactors (medium complexity max)
+- codex: Implementer, deep reasoning, good for complex features and architecture work (complex max)
+- human: Epic scope, ambiguous requirements, needs product decisions
+
+Complexity guide:
+- trivial: typo, copy change, single line fix
+- simple: single file change, clear requirements
+- medium: 2-5 files, some design decisions
+- complex: cross-cutting concerns, architecture impact
+- epic: multi-week, needs breakdown
+</output_contract>`;
+
+/**
+ * Build classification prompt for an issue.
+ */
+function buildPrompt(issue: LinearIssue): string {
+  const labels = issue.labels.nodes.map((l) => l.name).join(", ") || "none";
+
+  return CLASSIFICATION_PROMPT.replace("{{IDENTIFIER}}", issue.identifier)
+    .replace("{{TITLE}}", issue.title)
+    .replace("{{DESCRIPTION}}", issue.description || "No description provided.")
+    .replace("{{PRIORITY}}", issue.priorityLabel)
+    .replace("{{LABELS}}", labels);
+}
+
+/**
+ * Parse LLM response into structured classification.
+ */
+function parseResponse(response: string): LLMClassification | null {
+  const validTypes: IssueType[] = ["bug", "feature", "refactor", "improvement", "chore"];
+  const validComplexities: Complexity[] = ["trivial", "simple", "medium", "complex", "epic"];
+  const validAgents: AgentCapability[] = AGENT_CAPABILITIES;
+
+  const normalize = (candidate: unknown): LLMClassification => {
+    const parsed: Record<string, unknown> =
+      typeof candidate === "object" && candidate !== null
+        ? (candidate as Record<string, unknown>)
+        : {};
+
+    const type =
+      typeof parsed.type === "string" && validTypes.includes(parsed.type as IssueType)
+        ? (parsed.type as IssueType)
+        : "improvement";
+    const complexity =
+      typeof parsed.complexity === "string" &&
+      validComplexities.includes(parsed.complexity as Complexity)
+        ? (parsed.complexity as Complexity)
+        : "medium";
+    const agent =
+      typeof parsed.agent === "string" && validAgents.includes(parsed.agent as AgentCapability)
+        ? (parsed.agent as AgentCapability)
+        : "claude";
+    const confidence = typeof parsed.confidence === "number" ? parsed.confidence : 5;
+    const reasoning =
+      typeof parsed.reasoning === "string" ? parsed.reasoning : "No reasoning provided";
+    const suggested_prompt =
+      typeof parsed.suggested_prompt === "string" ? parsed.suggested_prompt : `Work on: ${type}`;
+    const tags = Array.isArray(parsed.tags)
+      ? parsed.tags.filter((t): t is string => typeof t === "string")
+      : [];
+
+    return {
+      type,
+      complexity,
+      agent,
+      confidence: Math.min(10, Math.max(1, confidence)),
+      reasoning,
+      suggested_prompt,
+      tags,
+      raw_response: response,
+    };
+  };
+
+  const trimmed = response.trim();
+
+  // 1) Try raw JSON
+  try {
+    const direct = JSON.parse(trimmed);
+    if (typeof direct?.result === "string") {
+      // wrapper-style
+      const inner = direct.result.trim();
+      const match = inner.match(/\{[\s\S]*\}/);
+      if (!match) return null;
+      return normalize(JSON.parse(match[0]));
+    }
+    return normalize(direct);
+  } catch {
+    // continue
+  }
+
+  // 2) Try to extract JSON object from noisy output
+  const match = trimmed.match(/\{[\s\S]*\}/);
+  if (!match) return null;
+  try {
+    return normalize(JSON.parse(match[0]));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check if a binary is available on PATH.
+ */
+function isBinaryAvailable(bin: string): boolean {
+  const result = spawnSync("which", [bin], { stdio: "pipe" });
+  return result.status === 0;
+}
+
+/**
+ * Classify an issue using an LLM (gemini CLI preferred, fallback to copilot).
+ */
+export async function classifyWithLLM(issue: LinearIssue): Promise<LLMClassification> {
+  const prompt = buildPrompt(issue);
+
+  const canUseGemini = isBinaryAvailable("gemini");
+  const canUseCopilot = isBinaryAvailable("copilot");
+
+  try {
+    if (!canUseGemini && !canUseCopilot) {
+      telemetry.trackEscalation("llm", "heuristic", "no llm cli available");
+      return fallbackClassification(issue);
+    }
+
+    // Track escalation when gemini unavailable
+    if (!canUseGemini && canUseCopilot) {
+      telemetry.trackEscalation("gemini", "copilot", "gemini unavailable for triage");
+    }
+
+    const result = canUseGemini
+      ? spawnSync("gemini", ["-p", prompt, "-m", "gemini-3-flash"], {
+          encoding: "utf-8",
+          timeout: 60000,
+          stdio: ["ignore", "pipe", "pipe"],
+        })
+      : spawnSync(
+          "copilot",
+          [
+            "-p",
+            prompt,
+            "--model",
+            "gemini-3-pro-preview",
+            "--yolo",
+            "--silent",
+            "--stream",
+            "off",
+          ],
+          {
+            encoding: "utf-8",
+            timeout: 60000,
+            stdio: ["ignore", "pipe", "pipe"],
+          },
+        );
+
+    const stdout = result.stdout?.toString?.() ?? String(result.stdout ?? "");
+    const stderr = result.stderr?.toString?.() ?? String(result.stderr ?? "");
+
+    if (result.status !== 0) {
+      const fromAgent = canUseGemini ? "gemini" : "copilot";
+      telemetry.trackEscalation(fromAgent, "heuristic", `exit ${result.status ?? "unknown"}`);
+      return {
+        ...fallbackClassification(issue),
+        raw_response: [stdout, stderr].filter(Boolean).join("\n"),
+        reasoning: `LLM classification failed (exit ${result.status ?? "unknown"}), using fallback classification`,
+      };
+    }
+
+    const parsed = parseResponse(stdout);
+    if (parsed) {
+      return parsed;
+    }
+
+    // If parsing failed, try to extract what we can
+    const fromAgent = canUseGemini ? "gemini" : "copilot";
+    telemetry.trackEscalation(fromAgent, "heuristic", "parse failure");
+    return {
+      ...fallbackClassification(issue),
+      raw_response: stdout,
+      reasoning: "LLM response could not be parsed, using fallback classification",
+    };
+  } catch (err) {
+    // On error, fall back to heuristic
+    telemetry.trackEscalation("llm", "heuristic", (err as Error).message);
+    return {
+      ...fallbackClassification(issue),
+      reasoning: `LLM classification failed: ${(err as Error).message}`,
+    };
+  }
+}
+
+/**
+ * Fallback heuristic classification when LLM unavailable.
+ */
+function fallbackClassification(issue: LinearIssue): LLMClassification {
+  const text = `${issue.title} ${issue.description || ""}`.toLowerCase();
+
+  // Simple keyword-based fallback
+  let type: IssueType = "improvement";
+  if (/\b(bug|fix|broke|error|crash|fail)\b/i.test(text)) type = "bug";
+  else if (/\b(add|new|implement|create|feature)\b/i.test(text)) type = "feature";
+  else if (/\b(refactor|restructure|cleanup)\b/i.test(text)) type = "refactor";
+  else if (/\b(chore|deps|test|docs)\b/i.test(text)) type = "chore";
+
+  // Estimate complexity from title length
+  const words = issue.title.split(/\s+/).length;
+  let complexity: Complexity = "simple";
+  if (words <= 4) complexity = "trivial";
+  else if (words <= 7) complexity = "simple";
+  else if (words <= 12) complexity = "medium";
+  else complexity = "complex";
+
+  // Map to agent
+  let agent: AgentCapability = "claude";
+  if (complexity === "trivial" || complexity === "simple") agent = "copilot";
+  else if (complexity === "complex") agent = "codex";
+
+  return {
+    type,
+    complexity,
+    agent,
+    confidence: 4, // Low confidence for fallback
+    reasoning: "Fallback heuristic classification (LLM unavailable)",
+    suggested_prompt: `Work on ${issue.identifier}: ${issue.title}`,
+    tags: issue.labels.nodes.map((l) => l.name.toLowerCase()),
+  };
+}
+
+/**
+ * Batch classify multiple issues (sequentially to avoid rate limits).
+ */
+export async function classifyBatch(
+  issues: LinearIssue[],
+  onProgress?: (current: number, total: number) => void,
+): Promise<Map<string, LLMClassification>> {
+  const results = new Map<string, LLMClassification>();
+
+  for (let i = 0; i < issues.length; i++) {
+    const issue = issues[i];
+    onProgress?.(i + 1, issues.length);
+
+    const classification = await classifyWithLLM(issue);
+    results.set(issue.identifier, classification);
+
+    // Small delay between calls to avoid rate limiting
+    if (i < issues.length - 1) {
+      await new Promise((resolve) => setTimeout(resolve, 500));
+    }
+  }
+
+  return results;
+}