@jungjaehoon/mama-core 2.4.1 → 4.1.0

package/dist/runtime/drivers/claude-cli-wrapper.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Claude CLI Subprocess Wrapper - ToS-Compliant Alternative to Pi Agent
+ *
+ * WHY THIS EXISTS:
+ * - Current Pi Agent uses OAuth token directly via API (ToS violation, ban risk)
+ * - Claude CLI is official Anthropic tool (ToS compliant)
+ * - Keeps $200/month subscription benefits vs $1000+/month API costs
+ *
+ * ARCHITECTURE:
+ * - Spawns `claude` CLI as subprocess
+ * - Communicates via stdin (prompts) / stdout (JSON responses)
+ * - Uses --output-format json for structured data
+ * - Session continuity via --session-id flag
+ *
+ * TRADEOFFS:
+ * + ✅ ToS compliant (official Claude tool)
+ * + ✅ Keeps subscription pricing
+ * + ✅ Real usage tracking (cost, tokens)
+ * - ⚠️ More complex than direct API
+ * - ⚠️ Requires claude CLI installed
+ * - ⚠️ Tool integration via MCP (future work)
+ */
+import type { PromptCallbacks, PromptResult } from './types.js';
+import { type ThinkingEffort } from './claude-effort.js';
+export interface ClaudeCLIWrapperOptions {
+    /** The isolated workspace this CLI runs in; the product states where. */
+    /**
+     * Where this run keeps its files. Required: a driver does not know a product's
+     * directory name, and the default it used to compute spelled one out.
+     */
+    workspaceDir: string;
+    model?: string;
+    /** Thinking effort passed as --effort on models that accept it. */
+    effort?: ThinkingEffort;
+    sessionId?: string;
+    systemPrompt?: string;
+    mcpConfigPath?: string;
+    /**
+     * Skip permission prompts for tool execution
+     *
+     * @warning SECURITY RISK: Bypasses all permission checks.
+     * Only enable in trusted environments where agent actions are pre-approved.
+     */
+    dangerouslySkipPermissions?: boolean;
+    env?: Record<string, string>;
+    /** Complete inherited environment supplied by the consumer; env is applied afterward. */
+    processEnv?: NodeJS.ProcessEnv;
+    /** Noninteractive consumers use dontAsk with explicit permission rules. */
+    permissionMode?: 'default' | 'acceptEdits' | 'dontAsk' | 'plan';
+    /** If true, use GatewayToolExecutor instead of MCP (default: false) */
+    useGatewayTools?: boolean;
+    /** Request timeout in ms (default: 120000). Increase for complex/long tasks. */
+    requestTimeout?: number;
+    /** Override built-in tool set (--tools CLI flag). Use "" to disable all tools. */
+    tools?: string;
+    /** Override plugin directory (--plugin-dir CLI flag). Use empty dir to disable plugins. */
+    pluginDir?: string;
+    /** Structurally disallowed tools (--disallowedTools CLI flag) */
+    disallowedTools?: string[];
+    /** Structurally allowed tools (--allowedTools CLI flag) */
+    allowedTools?: string[];
+}
+export type { PromptCallbacks, PromptResult, ToolUseBlock } from './types.js';
+/**
+ * ClaudeCLIWrapper - Wraps Claude CLI for programmatic use
+ *
+ * Usage:
+ *   const wrapper = new ClaudeCLIWrapper({ workspaceDir: '/tmp/mama-test-workspace', sessionId: 'my-session' });
+ *   const result = await wrapper.prompt('Hello, Claude!', {
+ *     onDelta: (text) => console.log('Delta:', text)
+ *   });
+ *
+ * Key Features:
+ * - Session continuity (multi-turn conversations)
+ * - Real-time streaming (--output-format json streams)
+ * - Usage tracking (tokens, cost)
+ * - ToS compliant (official CLI)
+ *
+ * IMPORTANT:
+ * - Requires `claude` CLI in PATH
+ * - Uses subscription credentials from ~/.claude/.credentials.json
+ * - Tools not yet supported (future: via MCP)
+ */
+export declare class ClaudeCLIWrapper {
+    private sessionId;
+    private options;
+    private turnCount;
+    constructor(options: ClaudeCLIWrapperOptions);
+    /**
+     * Send a prompt to Claude CLI
+     *
+     * Workflow:
+     * 1. Spawn `claude -p "<prompt>" --output-format json`
+     * 2. Parse JSON output (type: result | error | delta)
+     * 3. Aggregate deltas for streaming
+     * 4. Return final result with usage stats
+     *
+     * @param content - Prompt text (images not yet supported)
+     * @param callbacks - Streaming callbacks
+     * @param options - Optional per-request overrides (model, etc.)
+     * @returns PromptResult with response and usage
+     */
+    prompt(content: string, callbacks?: PromptCallbacks, options?: {
+        model?: string;
+        resumeSession?: boolean;
+    }): Promise<PromptResult>;
+    /**
+     * Get current session ID
+     */
+    getSessionId(): string;
+    /**
+     * Create a new session (resets conversation history)
+     */
+    resetSession(): void;
+    /**
+     * Set session ID (for channel-specific conversations)
+     */
+    setSessionId(sessionId: string): void;
+    /**
+     * Set system prompt (updates options for next prompt)
+     */
+    setSystemPrompt(prompt: string): void;
+    /**
+     * Get current options (for debugging)
+     */
+    getOptions(): ClaudeCLIWrapperOptions;
+}
+/**
+ * Usage Example:
+ *
+ * const wrapper = new ClaudeCLIWrapper({ workspaceDir: '/tmp/mama-test-workspace', sessionId: 'discord-channel-123' });
+ *
+ * // First message
+ * const result1 = await wrapper.prompt('Hello, what is 2+2?', {
+ *   onDelta: (text) => console.log('Streaming:', text)
+ * });
+ *
+ * console.log(result1.response); // "4"
+ * console.log(result1.usage.input_tokens); // 3
+ * console.log(result1.cost_usd); // 0.045
+ *
+ * // Follow-up (same session)
+ * const result2 = await wrapper.prompt('What about 3+3?');
+ * console.log(result2.response); // "6"
+ *
+ * // Cost Tracking Example:
+ * let totalCost = 0;
+ * const result = await wrapper.prompt('...');
+ * totalCost += result.cost_usd || 0;
+ * console.log(`Total spent: $${totalCost.toFixed(4)}`);
+ */
+//# sourceMappingURL=claude-cli-wrapper.d.ts.map

package/dist/runtime/drivers/claude-cli-wrapper.js

@@ -0,0 +1,375 @@
+"use strict";
+/**
+ * Claude CLI Subprocess Wrapper - ToS-Compliant Alternative to Pi Agent
+ *
+ * WHY THIS EXISTS:
+ * - Current Pi Agent uses OAuth token directly via API (ToS violation, ban risk)
+ * - Claude CLI is official Anthropic tool (ToS compliant)
+ * - Keeps $200/month subscription benefits vs $1000+/month API costs
+ *
+ * ARCHITECTURE:
+ * - Spawns `claude` CLI as subprocess
+ * - Communicates via stdin (prompts) / stdout (JSON responses)
+ * - Uses --output-format json for structured data
+ * - Session continuity via --session-id flag
+ *
+ * TRADEOFFS:
+ * + ✅ ToS compliant (official Claude tool)
+ * + ✅ Keeps subscription pricing
+ * + ✅ Real usage tracking (cost, tokens)
+ * - ⚠️ More complex than direct API
+ * - ⚠️ Requires claude CLI installed
+ * - ⚠️ Tool integration via MCP (future work)
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClaudeCLIWrapper = void 0;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = __importDefault(require("path"));
+const debugLogger = __importStar(require("@jungjaehoon/mama-core/debug-logger"));
+const cli_secret_redaction_js_1 = require("./cli-secret-redaction.js");
+const cli_arg_redaction_js_1 = require("./cli-arg-redaction.js");
+const claude_effort_js_1 = require("./claude-effort.js");
+const { DebugLogger } = debugLogger;
+const logger = new DebugLogger('ClaudeCLI');
+/**
+ * ClaudeCLIWrapper - Wraps Claude CLI for programmatic use
+ *
+ * Usage:
+ *   const wrapper = new ClaudeCLIWrapper({ workspaceDir: '/tmp/mama-test-workspace', sessionId: 'my-session' });
+ *   const result = await wrapper.prompt('Hello, Claude!', {
+ *     onDelta: (text) => console.log('Delta:', text)
+ *   });
+ *
+ * Key Features:
+ * - Session continuity (multi-turn conversations)
+ * - Real-time streaming (--output-format json streams)
+ * - Usage tracking (tokens, cost)
+ * - ToS compliant (official CLI)
+ *
+ * IMPORTANT:
+ * - Requires `claude` CLI in PATH
+ * - Uses subscription credentials from ~/.claude/.credentials.json
+ * - Tools not yet supported (future: via MCP)
+ */
+class ClaudeCLIWrapper {
+    sessionId;
+    options;
+    turnCount = 0;
+    constructor(options) {
+        this.options = options;
+        this.sessionId = options.sessionId || (0, crypto_1.randomUUID)();
+    }
+    /**
+     * Send a prompt to Claude CLI
+     *
+     * Workflow:
+     * 1. Spawn `claude -p "<prompt>" --output-format json`
+     * 2. Parse JSON output (type: result | error | delta)
+     * 3. Aggregate deltas for streaming
+     * 4. Return final result with usage stats
+     *
+     * @param content - Prompt text (images not yet supported)
+     * @param callbacks - Streaming callbacks
+     * @param options - Optional per-request overrides (model, etc.)
+     * @returns PromptResult with response and usage
+     */
+    async prompt(content, callbacks, options) {
+        return new Promise((resolve, reject) => {
+            // Use stdin for large content to avoid E2BIG error (ARG_MAX exceeded)
+            const useStdin = content.length > 50000; // 50KB threshold
+            const args = useStdin
+                ? ['--output-format', 'json']
+                : ['-p', content, '--output-format', 'json'];
+            if (useStdin) {
+                console.log(`[ClaudeCLI] Using stdin mode (content: ${content.length} chars)`);
+            }
+            // Session persistence: keeps context across turns, avoids re-injecting system prompt
+            args.push('--session-id', this.sessionId);
+            // ⚠️ BLOCK GLOBAL SETTINGS — exclude 'user' to prevent loading ~/.claude/settings.json
+            // Prevents global plugins from enabledPlugins being injected every turn
+            args.push('--setting-sources', 'project,local');
+            console.log(`[ClaudeCLI] Session: ${this.sessionId}`);
+            // Add model flag - per-request override takes precedence
+            const model = options?.model || this.options.model;
+            if (model) {
+                args.push('--model', model);
+            }
+            args.push(...(0, claude_effort_js_1.claudeEffortArgs)(model, this.options.effort));
+            // System prompt: first turn only (session persistence keeps it across turns)
+            if (this.options.systemPrompt && this.turnCount === 0) {
+                args.push('--system-prompt', this.options.systemPrompt);
+                console.log(`[ClaudeCLI] System prompt injected (${this.options.systemPrompt.length} chars, first turn)`);
+            }
+            this.turnCount++;
+            // Hybrid mode: MCP + Gateway can both be enabled
+            if (this.options.mcpConfigPath) {
+                args.push('--mcp-config', this.options.mcpConfigPath);
+                args.push('--strict-mcp-config');
+                logger.debug('MCP enabled:', this.options.mcpConfigPath);
+            }
+            if (this.options.useGatewayTools) {
+                logger.debug('Gateway Tools mode enabled');
+            }
+            if (this.options.permissionMode) {
+                args.push('--permission-mode', this.options.permissionMode);
+            }
+            if (this.options.dangerouslySkipPermissions) {
+                args.push('--dangerously-skip-permissions');
+            }
+            if (this.options.allowedTools?.length) {
+                args.push('--allowedTools', ...this.options.allowedTools);
+            }
+            if (this.options.disallowedTools?.length) {
+                args.push('--disallowedTools', ...this.options.disallowedTools);
+            }
+            // ============================================================
+            // ⚠️ HOST AGENT ISOLATION — DO NOT MODIFY ⚠️
+            // ============================================================
+            // Sets cwd to the host's isolated workspace and creates a git boundary to
+            // Claude Code from traversing up to ~/CLAUDE.md and other parent configs.
+            // File access is controlled separately via --add-dir and --dangerously-skip-permissions.
+            // Removing this causes global settings to be re-injected every turn, wasting tokens.
+            // ============================================================
+            const mamaWorkspace = this.options.workspaceDir;
+            if (!(0, fs_1.existsSync)(mamaWorkspace)) {
+                (0, fs_1.mkdirSync)(mamaWorkspace, { recursive: true });
+            }
+            const gitDir = path_1.default.join(mamaWorkspace, '.git');
+            if (!(0, fs_1.existsSync)(gitDir)) {
+                (0, fs_1.mkdirSync)(gitDir, { recursive: true });
+            }
+            const headFile = path_1.default.join(gitDir, 'HEAD');
+            if (!(0, fs_1.existsSync)(headFile)) {
+                (0, fs_1.writeFileSync)(headFile, 'ref: refs/heads/main\n');
+            }
+            args.push('--add-dir', mamaWorkspace);
+            logger.debug(`Spawning: claude ${formatClaudeArgsForLog(args).join(' ')}`);
+            logger.debug(`Args count: ${args.length}`);
+            let stderr = '';
+            const stderrRedactor = new cli_secret_redaction_js_1.SecretRedactingStream((0, cli_secret_redaction_js_1.claudeConfiguredSecrets)(this.options.mcpConfigPath, {
+                ...(this.options.processEnv ?? process.env),
+                ...this.options.env,
+            }), (safe) => {
+                stderr = `${stderr}${safe}`.slice(-16_000);
+                if (safe.trim())
+                    console.error(`[ClaudeCLI:stderr] ${safe.trim()}`);
+            });
+            const claude = (0, child_process_1.spawn)('claude', args, {
+                stdio: ['pipe', 'pipe', 'pipe'],
+                // ⚠️ NEVER spawn in the user's home directory — it breaks agent isolation.
+                cwd: mamaWorkspace,
+                env: { ...(this.options.processEnv ?? process.env), ...this.options.env },
+            });
+            // Handle stdin: write content if using stdin mode, otherwise close immediately
+            if (useStdin) {
+                // Write content to stdin with backpressure handling
+                // For large content (150KB+), synchronous write can block due to buffer pressure
+                // Solution: check write() return value and wait for 'drain' if needed
+                const writeContent = () => {
+                    const canContinue = claude.stdin.write(content);
+                    if (canContinue) {
+                        // Buffer had space, content written, close stdin
+                        claude.stdin.end();
+                        console.log(`[ClaudeCLI] Content written to stdin (immediate)`);
+                    }
+                    else {
+                        // Buffer was full, wait for drain before closing
+                        console.log(`[ClaudeCLI] Stdin buffer full, waiting for drain...`);
+                        claude.stdin.once('drain', () => {
+                            claude.stdin.end();
+                            console.log(`[ClaudeCLI] Content written to stdin (after drain)`);
+                        });
+                    }
+                };
+                // Handle stdin errors to prevent unhandled exceptions
+                claude.stdin.on('error', (err) => {
+                    console.error(`[ClaudeCLI] stdin error:`, err.message);
+                    // Don't reject here - let the close handler deal with it
+                });
+                writeContent();
+            }
+            else {
+                // Close stdin immediately - we use -p flag, not stdin input
+                // Without this, Claude CLI hangs waiting for stdin input
+                claude.stdin.end();
+            }
+            let stdout = '';
+            let lastDelta = '';
+            const toolUseBlocks = [];
+            claude.stderr.on('data', (chunk) => stderrRedactor.write(chunk));
+            claude.stdout.on('data', (chunk) => {
+                stdout += chunk.toString();
+                const lines = stdout.split('\n');
+                for (const line of lines) {
+                    if (!line.trim())
+                        continue;
+                    try {
+                        const event = JSON.parse(line);
+                        if (event.type === 'delta' && event.delta) {
+                            lastDelta += event.delta;
+                            callbacks?.onDelta?.(lastDelta);
+                        }
+                        else if (event.type === 'tool_use') {
+                            // Collect tool_use blocks for GatewayToolExecutor
+                            toolUseBlocks.push({
+                                type: 'tool_use',
+                                id: event.id || `tool_${(0, crypto_1.randomUUID)()}`,
+                                name: event.name,
+                                input: event.input || {},
+                            });
+                            callbacks?.onToolUse?.(event.name, event.input);
+                            console.log(`[ClaudeCLI] Tool use detected: ${event.name}`);
+                        }
+                    }
+                    catch {
+                        // Not JSON yet, accumulate more
+                    }
+                }
+            });
+            claude.on('close', (code) => {
+                stderrRedactor.end();
+                if (code !== 0) {
+                    const error = new Error(`Claude CLI exited with code ${code}: ${stderr}`);
+                    callbacks?.onError?.(error);
+                    reject(error);
+                    return;
+                }
+                try {
+                    // Parse final JSON output
+                    const result = JSON.parse(stdout.trim());
+                    if (result.type === 'result' && result.subtype === 'success') {
+                        const promptResult = {
+                            response: result.result || '',
+                            session_id: result.session_id || this.sessionId,
+                            cost_usd: result.total_cost_usd,
+                            usage: {
+                                input_tokens: result.usage?.input_tokens || 0,
+                                output_tokens: result.usage?.output_tokens || 0,
+                                cache_creation_input_tokens: result.usage?.cache_creation_input_tokens,
+                                cache_read_input_tokens: result.usage?.cache_read_input_tokens,
+                            },
+                            toolUseBlocks: toolUseBlocks.length > 0 ? toolUseBlocks : undefined,
+                            hasToolUse: toolUseBlocks.length > 0,
+                        };
+                        if (toolUseBlocks.length > 0) {
+                            console.log(`[ClaudeCLI] Returning ${toolUseBlocks.length} tool_use blocks`);
+                        }
+                        callbacks?.onFinal?.({ content: promptResult.response, toolUseBlocks });
+                        resolve(promptResult);
+                    }
+                    else {
+                        throw new Error(`Unexpected result type: ${result.type}`);
+                    }
+                }
+                catch (parseError) {
+                    const error = new Error(`Failed to parse Claude CLI output: ${parseError}`);
+                    callbacks?.onError?.(error);
+                    reject(error);
+                }
+            });
+            claude.on('error', (error) => {
+                callbacks?.onError?.(error);
+                reject(error);
+            });
+        });
+    }
+    /**
+     * Get current session ID
+     */
+    getSessionId() {
+        return this.sessionId;
+    }
+    /**
+     * Create a new session (resets conversation history)
+     */
+    resetSession() {
+        this.sessionId = (0, crypto_1.randomUUID)();
+        this.turnCount = 0; // Reset so system prompt is injected on next turn
+    }
+    /**
+     * Set session ID (for channel-specific conversations)
+     */
+    setSessionId(sessionId) {
+        this.sessionId = sessionId;
+        this.turnCount = 0; // Reset so system prompt is injected on next turn
+    }
+    /**
+     * Set system prompt (updates options for next prompt)
+     */
+    setSystemPrompt(prompt) {
+        this.options.systemPrompt = prompt;
+    }
+    /**
+     * Get current options (for debugging)
+     */
+    getOptions() {
+        return { ...this.options };
+    }
+}
+exports.ClaudeCLIWrapper = ClaudeCLIWrapper;
+function formatClaudeArgsForLog(args) {
+    return (0, cli_arg_redaction_js_1.formatCliArgsForLog)(args);
+}
+/**
+ * Usage Example:
+ *
+ * const wrapper = new ClaudeCLIWrapper({ workspaceDir: '/tmp/mama-test-workspace', sessionId: 'discord-channel-123' });
+ *
+ * // First message
+ * const result1 = await wrapper.prompt('Hello, what is 2+2?', {
+ *   onDelta: (text) => console.log('Streaming:', text)
+ * });
+ *
+ * console.log(result1.response); // "4"
+ * console.log(result1.usage.input_tokens); // 3
+ * console.log(result1.cost_usd); // 0.045
+ *
+ * // Follow-up (same session)
+ * const result2 = await wrapper.prompt('What about 3+3?');
+ * console.log(result2.response); // "6"
+ *
+ * // Cost Tracking Example:
+ * let totalCost = 0;
+ * const result = await wrapper.prompt('...');
+ * totalCost += result.cost_usd || 0;
+ * console.log(`Total spent: $${totalCost.toFixed(4)}`);
+ */
+//# sourceMappingURL=claude-cli-wrapper.js.map

package/dist/runtime/drivers/claude-effort.d.ts

@@ -0,0 +1,4 @@
+export type ThinkingEffort = 'low' | 'medium' | 'high' | 'xhigh' | 'max';
+/** The `--effort` arguments for a Claude model; none when the model takes no effort setting. */
+export declare function claudeEffortArgs(model: string | undefined, effort: ThinkingEffort | undefined): string[];
+//# sourceMappingURL=claude-effort.d.ts.map

package/dist/runtime/drivers/claude-effort.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeEffortArgs = claudeEffortArgs;
+/** The `--effort` arguments for a Claude model; none when the model takes no effort setting. */
+function claudeEffortArgs(model, effort) {
+    // --effort: Opus/Sonnet 4.6, Opus 4.7/4.8, and the Claude 5 family (Opus, Sonnet, Fable, Mythos).
+    if (!model ||
+        !effort ||
+        !/^claude-(?:(?:opus|sonnet)-4-6|opus-4-[78]|(?:opus|sonnet|fable|mythos)-5)(?:\b|-)/.test(model)) {
+        return [];
+    }
+    // xhigh arrived with Opus 4.7; the 4.6 models take low through max.
+    const accepted = effort === 'xhigh' && /^claude-(?:opus|sonnet)-4-6(?:\b|-)/.test(model) ? 'high' : effort;
+    return ['--effort', accepted];
+}
+//# sourceMappingURL=claude-effort.js.map

package/dist/runtime/drivers/cli-arg-redaction.d.ts

@@ -0,0 +1,2 @@
+export declare function formatCliArgsForLog(args: readonly string[]): string[];
+//# sourceMappingURL=cli-arg-redaction.d.ts.map

package/dist/runtime/drivers/cli-arg-redaction.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatCliArgsForLog = formatCliArgsForLog;
+const SENSITIVE_PROMPT_ARGS = new Set(['--system-prompt', '--append-system-prompt']);
+function formatCliArgsForLog(args) {
+    const redacted = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        redacted.push(arg);
+        if (SENSITIVE_PROMPT_ARGS.has(arg) && i + 1 < args.length) {
+            const value = args[i + 1] ?? '';
+            redacted.push(`[redacted ${value.length} chars]`);
+            i++;
+        }
+    }
+    return redacted;
+}
+//# sourceMappingURL=cli-arg-redaction.js.map

package/dist/runtime/drivers/cli-secret-redaction.d.ts

@@ -0,0 +1,17 @@
+import type { CodexAppServerLaunchConfig } from './codex-home.js';
+export declare function configuredSecretValues(launch: CodexAppServerLaunchConfig): Set<string>;
+/** Exact configured values, never an entropy/token-length guess. */
+export declare function redactConfiguredSecrets(value: string, secrets: ReadonlySet<string>): string;
+export declare function claudeConfiguredSecrets(configPath: string | undefined, env: NodeJS.ProcessEnv): Set<string>;
+/** Keep the possible credential suffix until the next chunk (including UTF-8 boundaries). */
+export declare class SecretRedactingStream {
+    private readonly secrets;
+    private readonly emit;
+    private pending;
+    private readonly decoder;
+    private readonly overlap;
+    constructor(secrets: ReadonlySet<string>, emit: (safe: string) => void);
+    write(chunk: Buffer): void;
+    end(): void;
+}
+//# sourceMappingURL=cli-secret-redaction.d.ts.map