@ouro.bot/cli 0.1.0-alpha.7 → 0.1.0-alpha.700

package/dist/nerves/redact.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_PATTERNS = exports.SENSITIVE_KEYS = void 0;
+exports.redactMeta = redactMeta;
+exports.redactString = redactString;
+exports.redactLogEntry = redactLogEntry;
+/**
+ * Lowercase key names that trigger structured redaction.
+ * Matched case-insensitively against meta object keys.
+ */
+exports.SENSITIVE_KEYS = new Set([
+    "password",
+    "secret",
+    "token",
+    "accesstoken",
+    "refreshtoken",
+    "clientsecret",
+    "apikey",
+    "oauthaccesstoken",
+    "authorization",
+    "cookie",
+    "set-cookie",
+]);
+/**
+ * Regex patterns for string-level fallback redaction.
+ * Applied in order; each match is replaced with `[REDACTED:name]`.
+ */
+exports.SENSITIVE_PATTERNS = [
+    { name: "anthropic_key", pattern: /sk-ant-[A-Za-z0-9_-]+/g },
+    { name: "openai_key", pattern: /sk-proj-[A-Za-z0-9_-]+/g },
+    { name: "bearer_token", pattern: /Bearer [A-Za-z0-9\-_.]+/g },
+    { name: "api_key_assignment", pattern: /api[_-]?key[=:]\s*["']?[A-Za-z0-9\-_.]+/g },
+    { name: "url_token", pattern: /[?&](?:token|key|api_key|access_token)=[A-Za-z0-9\-_.%]+/g },
+];
+/**
+ * Deep-clone meta and replace values at sensitive keys with `[REDACTED:key_name]`.
+ * Recurses into nested objects. Case-insensitive key matching.
+ */
+function redactMeta(meta) {
+    const result = {};
+    for (const key of Object.keys(meta)) {
+        const value = meta[key];
+        if (exports.SENSITIVE_KEYS.has(key.toLowerCase())) {
+            result[key] = `[REDACTED:${key}]`;
+        }
+        else if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+            result[key] = redactMeta(value);
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Apply all regex patterns to a string, replacing matches with `[REDACTED:pattern_name]`.
+ */
+function redactString(text) {
+    let result = text;
+    for (const { name, pattern } of exports.SENSITIVE_PATTERNS) {
+        // Reset lastIndex for global regexes reused across calls
+        pattern.lastIndex = 0;
+        result = result.replace(pattern, `[REDACTED:${name}]`);
+    }
+    return result;
+}
+/**
+ * Full redaction pipeline: redact meta (structured keys), then redact message (regex patterns).
+ * Returns a new LogEvent -- never mutates the input.
+ */
+function redactLogEntry(entry) {
+    const redactedMeta = redactMeta(entry.meta);
+    const redactedMessage = redactString(entry.message);
+    return {
+        ...entry,
+        meta: redactedMeta,
+        message: redactedMessage,
+    };
+}

package/dist/nerves/review/cli-main.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const cli_1 = require("./cli");
+const code = (0, cli_1.runNervesReviewCli)(process.argv.slice(2));
+process.exit(code);

package/dist/nerves/review/cli.js

@@ -0,0 +1,156 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runNervesReviewCli = runNervesReviewCli;
+const path = __importStar(require("node:path"));
+const identity_1 = require("../../heart/identity");
+const core_1 = require("./core");
+function parseArgs(argv) {
+    const args = { process: "daemon", json: false, help: false };
+    for (let i = 0; i < argv.length; i++) {
+        const token = argv[i];
+        const next = argv[i + 1];
+        switch (token) {
+            case "--help":
+            case "-h":
+                args.help = true;
+                break;
+            case "--process":
+                if (next)
+                    args.process = next;
+                i++;
+                break;
+            case "--agent":
+                if (next)
+                    args.agent = next;
+                i++;
+                break;
+            case "--component":
+                if (next)
+                    args.componentSubstring = next;
+                i++;
+                break;
+            case "--event":
+                if (next)
+                    args.eventSubstring = next;
+                i++;
+                break;
+            case "--level":
+                if (next)
+                    args.level = next;
+                i++;
+                break;
+            case "--since":
+                if (next)
+                    args.since = next;
+                i++;
+                break;
+            case "--limit":
+                if (next) {
+                    const parsed = Number.parseInt(next, 10);
+                    if (Number.isFinite(parsed) && parsed > 0)
+                        args.limit = parsed;
+                }
+                i++;
+                break;
+            case "--json":
+                args.json = true;
+                break;
+        }
+    }
+    return args;
+}
+function printHelp() {
+    // eslint-disable-next-line no-console -- meta-tooling
+    console.log([
+        "usage: ouro nerves-review [options]",
+        "",
+        "Tail the agent's nerves ndjson and filter recent events. Read-only.",
+        "",
+        "options:",
+        "  --process <name>      log stream to read (default: daemon)",
+        "  --agent <name>        agent bundle to read from (default: current)",
+        "  --component <substr>  filter by component substring (case-insensitive)",
+        "  --event <substr>      filter by event-name substring (case-insensitive)",
+        "  --level <level>       filter by exact level (debug|info|warn|error)",
+        "  --since <duration>    only events newer than e.g. 5m, 2h, 1d",
+        "  --limit <N>           cap returned events (default: 50)",
+        "  --json                output one JSON object per line",
+    ].join("\n"));
+}
+function runNervesReviewCli(argv) {
+    const args = parseArgs(argv);
+    if (args.help) {
+        printHelp();
+        return 0;
+    }
+    let sinceMs;
+    if (args.since) {
+        const parsed = (0, core_1.parseDuration)(args.since);
+        if (parsed === null) {
+            // eslint-disable-next-line no-console -- meta-tooling
+            console.error(`nerves-review: --since '${args.since}' is not a valid duration (e.g. 5m, 2h, 1d)`);
+            return 2;
+        }
+        sinceMs = parsed;
+    }
+    const logsDir = (0, identity_1.getAgentDaemonLogsDir)(args.agent);
+    const filePath = path.join(logsDir, `${args.process}.ndjson`);
+    const filter = {
+        componentSubstring: args.componentSubstring,
+        eventSubstring: args.eventSubstring,
+        level: args.level,
+        sinceMs,
+        limit: args.limit,
+        nowMs: Date.now(),
+    };
+    const entries = (0, core_1.reviewNerveEvents)(filePath, filter);
+    if (entries.length === 0) {
+        // eslint-disable-next-line no-console -- meta-tooling
+        console.log(`(no matching nerves events in ${filePath})`);
+        return 0;
+    }
+    for (const entry of entries) {
+        if (args.json) {
+            // eslint-disable-next-line no-console -- meta-tooling
+            console.log(entry.raw);
+        }
+        else {
+            // eslint-disable-next-line no-console -- meta-tooling
+            console.log((0, core_1.formatNerveEntry)(entry));
+        }
+    }
+    return 0;
+}

package/dist/nerves/review/core.js

@@ -0,0 +1,152 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseDuration = parseDuration;
+exports.reviewNerveEvents = reviewNerveEvents;
+exports.formatNerveEntry = formatNerveEntry;
+const fs = __importStar(require("node:fs"));
+const DURATION_PATTERN = /^(\d+(?:\.\d+)?)(ms|s|m|h|d)$/;
+function parseDuration(value) {
+    const match = DURATION_PATTERN.exec(value.trim().toLowerCase());
+    if (!match)
+        return null;
+    const amount = Number.parseFloat(match[1]);
+    if (!Number.isFinite(amount) || amount < 0)
+        return null;
+    switch (match[2]) {
+        case "ms": return amount;
+        case "s": return amount * 1_000;
+        case "m": return amount * 60_000;
+        case "h": return amount * 3_600_000;
+        case "d": return amount * 86_400_000;
+        /* v8 ignore start -- exhaustive switch over the regex group; unreachable */
+        default: return null;
+        /* v8 ignore stop */
+    }
+}
+function entryTimeMs(parsed) {
+    if (!parsed)
+        return null;
+    const time = parsed.time;
+    if (typeof time === "string") {
+        const ms = Date.parse(time);
+        return Number.isFinite(ms) ? ms : null;
+    }
+    return null;
+}
+function readLastNLines(filePath, maxLines, maxBytes = 8 * 1024 * 1024) {
+    let text;
+    try {
+        const stat = fs.statSync(filePath);
+        if (stat.size > maxBytes) {
+            const fd = fs.openSync(filePath, "r");
+            try {
+                const buf = Buffer.alloc(maxBytes);
+                fs.readSync(fd, buf, 0, maxBytes, stat.size - maxBytes);
+                text = buf.toString("utf-8");
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+        else {
+            text = fs.readFileSync(filePath, "utf-8");
+        }
+    }
+    catch {
+        return [];
+    }
+    const lines = text.split("\n").filter((line) => line.length > 0);
+    return lines.slice(-maxLines);
+}
+function reviewNerveEvents(filePath, filter = {}) {
+    const limit = filter.limit ?? 50;
+    const candidateLineCount = Math.max(limit * 4, 200);
+    const lines = readLastNLines(filePath, candidateLineCount);
+    const cutoffMs = filter.sinceMs !== undefined && filter.nowMs !== undefined
+        ? filter.nowMs - filter.sinceMs
+        : null;
+    const matched = [];
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const raw = lines[i];
+        let parsed = null;
+        try {
+            const value = JSON.parse(raw);
+            if (value && typeof value === "object" && !Array.isArray(value)) {
+                parsed = value;
+            }
+        }
+        catch {
+            parsed = null;
+        }
+        if (!parsed)
+            continue;
+        if (filter.componentSubstring) {
+            const component = String(parsed.component ?? "");
+            if (!component.toLowerCase().includes(filter.componentSubstring.toLowerCase()))
+                continue;
+        }
+        if (filter.eventSubstring) {
+            const event = String(parsed.event ?? "");
+            if (!event.toLowerCase().includes(filter.eventSubstring.toLowerCase()))
+                continue;
+        }
+        if (filter.level) {
+            const level = String(parsed.level ?? "info");
+            if (level !== filter.level)
+                continue;
+        }
+        if (cutoffMs !== null) {
+            const eventMs = entryTimeMs(parsed);
+            if (eventMs === null || eventMs < cutoffMs)
+                continue;
+        }
+        matched.push({ raw, parsed });
+        if (matched.length >= limit)
+            break;
+    }
+    return matched.reverse();
+}
+function formatNerveEntry(entry) {
+    const parsed = entry.parsed;
+    if (!parsed)
+        return entry.raw;
+    const time = String(parsed.time ?? "");
+    const level = String(parsed.level ?? "info");
+    const component = String(parsed.component ?? "?");
+    const event = String(parsed.event ?? "?");
+    const message = String(parsed.message ?? "");
+    return `${time} [${level.padEnd(5)}] ${component}/${event} — ${message}`;
+}

package/dist/nerves/runtime.js

@@ -6,7 +6,11 @@ const index_1 = require("./index");
 let runtimeLogger = null;
 function getRuntimeLogger() {
     if (!runtimeLogger) {
-        runtimeLogger = (0, index_1.createLogger)({ level: "info" });
+        // Default logger has no sinks — events emitted before the real logger is
+        // configured (e.g. identity resolution during startup) are silently dropped.
+        // This prevents INFO lines from leaking to stderr and interleaving with
+        // the CLI spinner when the ouro subprocess hasn't configured its logger yet.
+        runtimeLogger = (0, index_1.createLogger)({ level: "info", sinks: [] });
     }
     return runtimeLogger;
 }

package/dist/repertoire/ado-client.js

@@ -9,6 +9,7 @@ exports.discoverOrganizations = discoverOrganizations;
 exports.discoverProjects = discoverProjects;
 const api_error_1 = require("../heart/api-error");
 const runtime_1 = require("../nerves/runtime");
+const api_client_1 = require("./api-client");
 const ADO_BASE = "https://dev.azure.com";
 const VSSPS_BASE = "https://app.vssps.visualstudio.com";
 const DEFAULT_API_VERSION = "api-version=7.1";
@@ -28,62 +29,22 @@ function resolveContentType(method, path) {
         : "application/json";
 }
 // Generic ADO API request. Returns response body as pretty-printed JSON string.
-async function adoRequest(token, method, org, path, body) {
-    try {
-        (0, runtime_1.emitNervesEvent)({
-            event: "client.request_start",
-            component: "clients",
-            message: "starting ADO request",
-            meta: { client: "ado", method, org, path },
-        });
-        const fullPath = ensureApiVersion(path);
-        const url = `${ADO_BASE}/${org}${fullPath}`;
-        const contentType = resolveContentType(method, path);
-        const opts = {
-            method,
-            headers: {
-                Authorization: `Bearer ${token}`,
-                "Content-Type": contentType,
-            },
-        };
-        if (body)
-            opts.body = body;
-        const res = await fetch(url, opts);
-        if (!res.ok) {
-            (0, runtime_1.emitNervesEvent)({
-                level: "error",
-                event: "client.error",
-                component: "clients",
-                message: "ADO request failed",
-                meta: { client: "ado", method, org, path, status: res.status },
-            });
-            return (0, api_error_1.handleApiError)(res, "ADO", "ado");
-        }
-        const data = await res.json();
-        (0, runtime_1.emitNervesEvent)({
-            event: "client.request_end",
-            component: "clients",
-            message: "ADO request completed",
-            meta: { client: "ado", method, org, path, success: true },
-        });
-        return JSON.stringify(data, null, 2);
-    }
-    catch (err) {
-        (0, runtime_1.emitNervesEvent)({
-            level: "error",
-            event: "client.error",
-            component: "clients",
-            message: "ADO request threw exception",
-            meta: {
-                client: "ado",
-                method,
-                org,
-                path,
-                reason: err instanceof Error ? err.message : String(err),
-            },
-        });
-        return (0, api_error_1.handleApiError)(err, "ADO", "ado");
-    }
+// `host` overrides the base URL for non-standard APIs (e.g. "vsapm.dev.azure.com", "vssps.dev.azure.com").
+async function adoRequest(token, method, org, path, body, host) {
+    const base = host ? `https://${host}/${org}` : `${ADO_BASE}/${org}`;
+    const fullPath = ensureApiVersion(path);
+    return (0, api_client_1.apiRequest)({
+        baseUrl: base,
+        method,
+        path: fullPath,
+        token,
+        clientName: "ado",
+        serviceLabel: "ADO",
+        connectionName: "ado",
+        body,
+        contentType: resolveContentType(method, path),
+        eventMeta: { org },
+    });
 }
 // Backward-compatible thin wrapper: runs WIQL query and returns formatted work items.
 async function queryWorkItems(token, org, query) {

package/dist/repertoire/ado-semantic.js

@@ -221,7 +221,7 @@ exports.adoSemanticToolDefinitions = [
             type: "function",
             function: {
                 name: "ado_backlog_list",
-                description: "Query the backlog and return enriched work items with hierarchy, type, parent, assignee, area path, and iteration. Supports filtering. Use this instead of raw WIQL queries.",
+                description: "Query the backlog and return enriched work items with hierarchy, type, parent, assignee, area path, and iteration. Supports filtering. Use this instead of raw WIQL queries. Provides enriched results with hierarchy.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -279,6 +279,7 @@ exports.adoSemanticToolDefinitions = [
             return formatForChannel(items, ctx, organization, project);
         },
         integration: "ado",
+        summaryKeys: ["organization", "project"],
     },
     // -- ado_create_epic --
     {
@@ -286,7 +287,7 @@ exports.adoSemanticToolDefinitions = [
             type: "function",
             function: {
                 name: "ado_create_epic",
-                description: "Create an epic in Azure DevOps with title, description, area path, and optional parent.",
+                description: "Create an epic in Azure DevOps with title, description, area path, and optional parent. Use ado_preview_changes first to dry-run the operation.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -317,7 +318,8 @@ exports.adoSemanticToolDefinitions = [
             return result;
         },
         integration: "ado",
-        confirmationRequired: true,
+        summaryKeys: ["organization", "project", "title"],
+        riskProfile: { mutates: "external_side_effect", risk: "high", reason: "creates an Azure DevOps epic" },
     },
     // -- ado_create_issue --
     {
@@ -325,7 +327,7 @@ exports.adoSemanticToolDefinitions = [
             type: "function",
             function: {
                 name: "ado_create_issue",
-                description: "Create an issue or user story in Azure DevOps with title, description, area path, and parent epic.",
+                description: "Create an issue or user story in Azure DevOps with title, description, area path, and parent epic. Use ado_preview_changes first to dry-run the operation.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -358,7 +360,8 @@ exports.adoSemanticToolDefinitions = [
             return result;
         },
         integration: "ado",
-        confirmationRequired: true,
+        summaryKeys: ["organization", "project", "title"],
+        riskProfile: { mutates: "external_side_effect", risk: "high", reason: "creates an Azure DevOps work item" },
     },
     // -- ado_move_items --
     {
@@ -366,7 +369,7 @@ exports.adoSemanticToolDefinitions = [
             type: "function",
             function: {
                 name: "ado_move_items",
-                description: "Reparent work items -- move them to a new parent epic or feature.",
+                description: "Reparent work items -- move them to a new parent epic or feature. Use ado_preview_changes first. These mutations affect real work items.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -412,7 +415,8 @@ exports.adoSemanticToolDefinitions = [
             return JSON.stringify({ moved, errors, organization: adoCtx.organization, project: adoCtx.project });
         },
         integration: "ado",
-        confirmationRequired: true,
+        summaryKeys: ["organization", "project", "workItemIds"],
+        riskProfile: { mutates: "external_side_effect", risk: "high", reason: "reparents Azure DevOps work items" },
     },
     // -- ado_restructure_backlog --
     {
@@ -420,7 +424,7 @@ exports.adoSemanticToolDefinitions = [
             type: "function",
             function: {
                 name: "ado_restructure_backlog",
-                description: "Bulk restructure: reparent multiple work items in a single logical operation.",
+                description: "Bulk restructure: reparent multiple work items in a single logical operation. Use ado_preview_changes first. These mutations affect real work items.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -470,7 +474,8 @@ exports.adoSemanticToolDefinitions = [
             return JSON.stringify({ results, organization: adoCtx.organization, project: adoCtx.project });
         },
         integration: "ado",
-        confirmationRequired: true,
+        summaryKeys: ["organization", "project"],
+        riskProfile: { mutates: "external_side_effect", risk: "high", reason: "bulk-reparents Azure DevOps work items" },
     },
     // -- ado_validate_structure --
     {
@@ -671,7 +676,8 @@ exports.adoSemanticToolDefinitions = [
             return JSON.stringify({ results, organization: adoCtx.organization, project: adoCtx.project });
         },
         integration: "ado",
-        confirmationRequired: true,
+        summaryKeys: ["organization", "project"],
+        riskProfile: { mutates: "external_side_effect", risk: "high", reason: "executes Azure DevOps batch mutations" },
     },
     // -- ado_detect_orphans --
     {