@poncho-ai/harness 0.14.0 → 0.14.2

package/dist/index.js

@@ -330,8 +330,8 @@ var resolveStateConfig = (config) => {
   if (config?.storage) {
     return {
       provider: config.storage.provider,
-      url: config.storage.url,
-      token: config.storage.token,
+      urlEnv: config.storage.urlEnv,
+      tokenEnv: config.storage.tokenEnv,
       table: config.storage.table,
       region: config.storage.region,
       ttl: resolveTtl(config.storage.ttl, "conversations")
@@ -344,8 +344,8 @@ var resolveMemoryConfig = (config) => {
     return {
       enabled: config.storage.memory?.enabled ?? config.memory?.enabled,
       provider: config.storage.provider,
-      url: config.storage.url,
-      token: config.storage.token,
+      urlEnv: config.storage.urlEnv,
+      tokenEnv: config.storage.tokenEnv,
       table: config.storage.table,
       region: config.storage.region,
       ttl: resolveTtl(config.storage.ttl, "memory"),
@@ -1121,8 +1121,10 @@ var createMemoryStore = (agentId, config, options) => {
     return new InMemoryMemoryStore(ttl);
   }
   if (provider === "upstash") {
-    const url = config?.url ?? process.env.UPSTASH_REDIS_REST_URL ?? process.env.KV_REST_API_URL ?? "";
-    const token = config?.token ?? process.env.UPSTASH_REDIS_REST_TOKEN ?? process.env.KV_REST_API_TOKEN ?? "";
+    const urlEnv = config?.urlEnv ?? (process.env.UPSTASH_REDIS_REST_URL ? "UPSTASH_REDIS_REST_URL" : "KV_REST_API_URL");
+    const tokenEnv = config?.tokenEnv ?? (process.env.UPSTASH_REDIS_REST_TOKEN ? "UPSTASH_REDIS_REST_TOKEN" : "KV_REST_API_TOKEN");
+    const url = process.env[urlEnv] ?? "";
+    const token = process.env[tokenEnv] ?? "";
     if (url && token) {
       return new UpstashMemoryStore({
         baseUrl: url,
@@ -1134,7 +1136,8 @@ var createMemoryStore = (agentId, config, options) => {
     return new InMemoryMemoryStore(ttl);
   }
   if (provider === "redis") {
-    const url = config?.url ?? process.env.REDIS_URL ?? "";
+    const urlEnv = config?.urlEnv ?? "REDIS_URL";
+    const url = process.env[urlEnv] ?? "";
     if (url) {
       return new RedisMemoryStore({
         url,
@@ -1763,16 +1766,18 @@ var getModelContextWindow = (modelName) => {
   }
   return best ? MODEL_CONTEXT_WINDOWS[best] : DEFAULT_CONTEXT_WINDOW;
 };
-var createModelProvider = (provider) => {
+var createModelProvider = (provider, config) => {
   const normalized = (provider ?? "anthropic").toLowerCase();
   if (normalized === "openai") {
+    const apiKeyEnv2 = config?.openai?.apiKeyEnv ?? "OPENAI_API_KEY";
     const openai = createOpenAI({
-      apiKey: process.env.OPENAI_API_KEY
+      apiKey: process.env[apiKeyEnv2]
     });
     return (modelName) => openai(modelName);
   }
+  const apiKeyEnv = config?.anthropic?.apiKeyEnv ?? "ANTHROPIC_API_KEY";
   const anthropic = createAnthropic({
-    apiKey: process.env.ANTHROPIC_API_KEY
+    apiKey: process.env[apiKeyEnv]
   });
   return (modelName) => anthropic(modelName);
 };
@@ -2812,18 +2817,51 @@ When configuring Latitude telemetry, use **exactly** these field names:
 telemetry: {
   enabled: true,
   latitude: {
-    apiKey: process.env.LATITUDE_API_KEY,       // NOT "apiKeyEnv"
-    projectId: process.env.LATITUDE_PROJECT_ID, // string or number
-    path: "your/prompt-path",                   // optional, defaults to agent name
+    apiKeyEnv: "LATITUDE_API_KEY",       // env var name (default)
+    projectIdEnv: "LATITUDE_PROJECT_ID", // env var name (default)
+    path: "your/prompt-path",            // optional, defaults to agent name
   },
 },
 \`\`\`
 
-- The field is \`apiKey\` (not \`apiKeyEnv\`, \`api_key\`, or \`key\`).
-- The field is \`projectId\` (not \`project_id\`, \`projectID\`, or \`project\`).
+- \`apiKeyEnv\` specifies the environment variable name for the Latitude API key (defaults to \`"LATITUDE_API_KEY"\`).
+- \`projectIdEnv\` specifies the environment variable name for the project ID (defaults to \`"LATITUDE_PROJECT_ID"\`).
+- With defaults, you only need \`telemetry: { latitude: {} }\` if the env vars are already named \`LATITUDE_API_KEY\` and \`LATITUDE_PROJECT_ID\`.
 - \`path\` must only contain letters, numbers, hyphens, underscores, dots, and slashes.
 - For a generic OTLP endpoint instead: \`telemetry: { otlp: process.env.OTEL_EXPORTER_OTLP_ENDPOINT }\`.
-- Always read the env vars from \`process.env\` \u2014 do not hardcode secrets in \`poncho.config.js\`.
+
+## Credential Configuration Pattern
+
+All credentials in \`poncho.config.js\` use the **env var name** pattern (\`*Env\` fields). Config specifies which environment variable to read \u2014 never the secret itself. Sensible defaults mean zero config when using conventional env var names.
+
+\`\`\`javascript
+// poncho.config.js \u2014 credentials use *Env fields with defaults
+export default {
+  // Model provider API keys (optional, defaults shown)
+  providers: {
+    anthropic: { apiKeyEnv: "ANTHROPIC_API_KEY" },
+    openai: { apiKeyEnv: "OPENAI_API_KEY" },
+  },
+  auth: {
+    required: true,
+    tokenEnv: "PONCHO_AUTH_TOKEN",  // default
+  },
+  storage: {
+    provider: "upstash",
+    urlEnv: "UPSTASH_REDIS_REST_URL",       // default (falls back to KV_REST_API_URL)
+    tokenEnv: "UPSTASH_REDIS_REST_TOKEN",   // default (falls back to KV_REST_API_TOKEN)
+  },
+  telemetry: {
+    latitude: {
+      apiKeyEnv: "LATITUDE_API_KEY",       // default
+      projectIdEnv: "LATITUDE_PROJECT_ID", // default
+    },
+  },
+  messaging: [{ platform: "slack" }],      // reads SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET by default
+}
+\`\`\`
+
+Since all fields have defaults, you only need to specify \`*Env\` when your env var name differs from the convention.
 
 ## When users ask about customization:
 
@@ -2838,6 +2876,7 @@ telemetry: {
 - To scope tools to a skill: keep server config in \`poncho.config.js\`, add desired \`allowed-tools\`/ \`approval-required\` patterns in that skill's \`SKILL.md\`, and remove global \`AGENT.md\` patterns if you do not want global availability.
 - Do not invent unsupported top-level config keys (for example \`model\` in \`poncho.config.js\`). Keep existing config structure unless README/spec explicitly says otherwise.
 - Keep \`poncho.config.js\` valid JavaScript and preserve existing imports/types/comments. If there is a JSDoc type import, do not rewrite it to a different package name.
+- Credentials always use \`*Env\` fields (env var names), never raw \`process.env.*\` values. For example, use \`apiKeyEnv: "MY_KEY"\` not \`apiKey: process.env.MY_KEY\`.
 - Preferred MCP config shape in \`poncho.config.js\`:
   \`mcp: [{ name: "linear", url: "https://mcp.linear.app/mcp", auth: { type: "bearer", tokenEnv: "LINEAR_TOKEN" } }]\`
 - If shell/CLI access exists, you can use \`poncho mcp add --url ... --name ... --auth-bearer-env ...\`, then \`poncho mcp tools list <server>\` and \`poncho mcp tools select <server>\`.
@@ -2851,7 +2890,6 @@ var AgentHarness = class {
   modelProvider;
   modelProviderInjected;
   dispatcher = new ToolDispatcher();
-  approvalHandler;
   uploadStore;
   skillContextWindow = "";
   memoryStore;
@@ -2925,7 +2963,6 @@ var AgentHarness = class {
     this.environment = options.environment ?? "development";
     this.modelProviderInjected = !!options.modelProvider;
     this.modelProvider = options.modelProvider ?? createModelProvider("anthropic");
-    this.approvalHandler = options.approvalHandler;
     this.uploadStore = options.uploadStore;
     if (options.toolDefinitions?.length) {
       this.dispatcher.registerMany(options.toolDefinitions);
@@ -3159,7 +3196,7 @@ var AgentHarness = class {
     const provider = this.parsedAgent.frontmatter.model?.provider ?? "anthropic";
     const memoryConfig = resolveMemoryConfig(config);
     if (!this.modelProviderInjected) {
-      this.modelProvider = createModelProvider(provider);
+      this.modelProvider = createModelProvider(provider, config?.providers);
     }
     const bridge = new LocalMcpBridge(config);
     this.mcpBridge = bridge;
@@ -3186,10 +3223,12 @@ var AgentHarness = class {
     await bridge.discoverTools();
     await this.refreshMcpTools("initialize");
     const telemetryEnabled = config?.telemetry?.enabled !== false;
-    const latitudeApiKey = config?.telemetry?.latitude?.apiKey;
-    const rawProjectId = config?.telemetry?.latitude?.projectId;
-    const latitudeProjectId = typeof rawProjectId === "string" ? parseInt(rawProjectId, 10) : rawProjectId;
     const latitudeBlock = config?.telemetry?.latitude;
+    const latApiKeyEnv = latitudeBlock?.apiKeyEnv ?? "LATITUDE_API_KEY";
+    const latProjectIdEnv = latitudeBlock?.projectIdEnv ?? "LATITUDE_PROJECT_ID";
+    const latitudeApiKey = process.env[latApiKeyEnv];
+    const rawProjectId = process.env[latProjectIdEnv];
+    const latitudeProjectId = rawProjectId ? parseInt(rawProjectId, 10) : void 0;
     if (telemetryEnabled && latitudeApiKey && latitudeProjectId) {
       diag.setLogger(
         {
@@ -3211,14 +3250,10 @@ var AgentHarness = class {
       this.latitudeTelemetry = new LatitudeTelemetry(latitudeApiKey, { disableBatch: true });
     } else if (telemetryEnabled && latitudeBlock && (!latitudeApiKey || !latitudeProjectId)) {
       const missing = [];
-      if (!latitudeApiKey) missing.push("apiKey");
-      if (!latitudeProjectId) missing.push("projectId");
-      const unknownKeys = Object.keys(latitudeBlock).filter(
-        (k) => !["apiKey", "projectId", "path", "documentPath"].includes(k)
-      );
-      const hint = unknownKeys.length > 0 ? ` (found unknown key${unknownKeys.length > 1 ? "s" : ""}: ${unknownKeys.join(", ")} \u2013 did you mean "apiKey"?)` : "";
+      if (!latitudeApiKey) missing.push(`${latApiKeyEnv} env var`);
+      if (!latitudeProjectId) missing.push(`${latProjectIdEnv} env var`);
       console.warn(
-        `[poncho][telemetry] Latitude telemetry is configured but missing: ${missing.join(", ")}${hint}. Traces will NOT be sent.`
+        `[poncho][telemetry] Latitude telemetry is configured but missing: ${missing.join(", ")}. Traces will NOT be sent.`
       );
     }
   }
@@ -3244,8 +3279,8 @@ var AgentHarness = class {
     const config = this.loadedConfig;
     const telemetry = this.latitudeTelemetry;
     if (telemetry) {
-      const rawProjectId = config?.telemetry?.latitude?.projectId;
-      const projectId = typeof rawProjectId === "string" ? parseInt(rawProjectId, 10) : rawProjectId;
+      const latProjectIdEnv2 = config?.telemetry?.latitude?.projectIdEnv ?? "LATITUDE_PROJECT_ID";
+      const projectId = parseInt(process.env[latProjectIdEnv2] ?? "", 10);
       const rawPath = config?.telemetry?.latitude?.path ?? this.parsedAgent?.frontmatter.name ?? "agent";
       const path = rawPath.replace(/[^\w\-./]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "") || "agent";
       const conversationUuid = input.conversationId ?? (typeof input.parameters?.__activeConversationId === "string" ? input.parameters.__activeConversationId : void 0);
@@ -3317,6 +3352,7 @@ var AgentHarness = class {
     const platformMaxDurationSec = Number(process.env.PONCHO_MAX_DURATION) || 0;
     const softDeadlineMs = platformMaxDurationSec > 0 ? platformMaxDurationSec * 800 : 0;
     const messages = [...input.messages ?? []];
+    const inputMessageCount = messages.length;
     const events = [];
     const systemPrompt = renderAgentPrompt(agent, {
       parameters: input.parameters,
@@ -3366,41 +3402,43 @@ ${boundedMainMemory.trim()}` : "";
       agentId: agent.frontmatter.id ?? agent.frontmatter.name,
       contextWindow
     });
-    if (input.files && input.files.length > 0) {
-      const parts = [
-        { type: "text", text: input.task }
-      ];
-      for (const file of input.files) {
-        if (this.uploadStore) {
-          const buf = Buffer.from(file.data, "base64");
-          const key = deriveUploadKey(buf, file.mediaType);
-          const ref = await this.uploadStore.put(key, buf, file.mediaType);
-          parts.push({
-            type: "file",
-            data: ref,
-            mediaType: file.mediaType,
-            filename: file.filename
-          });
-        } else {
-          parts.push({
-            type: "file",
-            data: file.data,
-            mediaType: file.mediaType,
-            filename: file.filename
-          });
+    if (input.task != null) {
+      if (input.files && input.files.length > 0) {
+        const parts = [
+          { type: "text", text: input.task }
+        ];
+        for (const file of input.files) {
+          if (this.uploadStore) {
+            const buf = Buffer.from(file.data, "base64");
+            const key = deriveUploadKey(buf, file.mediaType);
+            const ref = await this.uploadStore.put(key, buf, file.mediaType);
+            parts.push({
+              type: "file",
+              data: ref,
+              mediaType: file.mediaType,
+              filename: file.filename
+            });
+          } else {
+            parts.push({
+              type: "file",
+              data: file.data,
+              mediaType: file.mediaType,
+              filename: file.filename
+            });
+          }
         }
+        messages.push({
+          role: "user",
+          content: parts,
+          metadata: { timestamp: now(), id: randomUUID3() }
+        });
+      } else {
+        messages.push({
+          role: "user",
+          content: input.task,
+          metadata: { timestamp: now(), id: randomUUID3() }
+        });
       }
-      messages.push({
-        role: "user",
-        content: parts,
-        metadata: { timestamp: now(), id: randomUUID3() }
-      });
-    } else {
-      messages.push({
-        role: "user",
-        content: input.task,
-        metadata: { timestamp: now(), id: randomUUID3() }
-      });
     }
     let responseText = "";
     let totalInputTokens = 0;
@@ -3640,7 +3678,6 @@ ${textContent}` };
         const modelInstance = this.modelProvider(modelName);
         const cachedMessages = addPromptCacheBreakpoints(coreMessages, modelInstance);
         const telemetryEnabled = this.loadedConfig?.telemetry?.enabled !== false;
-        const latitudeApiKey = this.loadedConfig?.telemetry?.latitude?.apiKey;
         const result = await streamText({
           model: modelInstance,
           system: integrityPrompt,
@@ -3650,7 +3687,7 @@ ${textContent}` };
           abortSignal: input.abortSignal,
           ...typeof maxTokens === "number" ? { maxTokens } : {},
           experimental_telemetry: {
-            isEnabled: telemetryEnabled && !!latitudeApiKey
+            isEnabled: telemetryEnabled && !!this.latitudeTelemetry
           }
         });
         let fullText = "";
@@ -3843,45 +3880,34 @@ ${textContent}` };
               input: call.input,
               approvalId
             });
-            const approved = this.approvalHandler ? await this.approvalHandler({
+            const assistantContent2 = JSON.stringify({
+              text: fullText,
+              tool_calls: toolCalls.map((tc) => ({
+                id: tc.id,
+                name: exposedToolNames.get(tc.name) ?? tc.name,
+                input: tc.input
+              }))
+            });
+            const assistantMsg = {
+              role: "assistant",
+              content: assistantContent2,
+              metadata: { timestamp: now(), id: randomUUID3(), step }
+            };
+            const deltaMessages = [...messages.slice(inputMessageCount), assistantMsg];
+            yield pushEvent({
+              type: "tool:approval:checkpoint",
+              approvalId,
               tool: runtimeToolName,
+              toolCallId: call.id,
               input: call.input,
-              runId,
-              step,
-              approvalId
-            }) : false;
-            if (isCancelled()) {
-              yield emitCancellation();
-              return;
-            }
-            if (!approved) {
-              if (this.insideTelemetryCapture && this.latitudeTelemetry) {
-                const deniedSpan = this.latitudeTelemetry.span.tool({
-                  name: runtimeToolName,
-                  call: { id: call.id, arguments: call.input }
-                });
-                deniedSpan.end({ result: { value: "Tool execution denied by approval policy", isError: true } });
-              }
-              yield pushEvent({
-                type: "tool:approval:denied",
-                approvalId,
-                reason: "No approval handler granted execution"
-              });
-              yield pushEvent({
-                type: "tool:error",
-                tool: call.name,
-                error: "Tool execution denied by approval policy",
-                recoverable: true
-              });
-              toolResultsForModel.push({
-                type: "tool_result",
-                tool_use_id: call.id,
-                tool_name: runtimeToolName,
-                content: "Tool error: Tool execution denied by approval policy"
-              });
-              continue;
-            }
-            yield pushEvent({ type: "tool:approval:granted", approvalId });
+              checkpointMessages: deltaMessages,
+              pendingToolCalls: toolCalls.map((tc) => ({
+                id: tc.id,
+                name: exposedToolNames.get(tc.name) ?? tc.name,
+                input: tc.input
+              }))
+            });
+            return;
           }
           approvedCalls.push({
             id: call.id,
@@ -4015,12 +4041,64 @@ ${textContent}` };
       });
     }
   }
+  async executeTools(calls, context) {
+    return this.dispatcher.executeBatch(calls, context);
+  }
+  async *continueFromToolResult(input) {
+    const messages = [...input.messages];
+    const lastMsg = messages[messages.length - 1];
+    if (!lastMsg || lastMsg.role !== "assistant") {
+      throw new Error("continueFromToolResult: last message must be an assistant message with tool calls");
+    }
+    let allToolCalls = [];
+    try {
+      const parsed = JSON.parse(typeof lastMsg.content === "string" ? lastMsg.content : "");
+      allToolCalls = parsed.tool_calls ?? [];
+    } catch {
+      throw new Error("continueFromToolResult: could not parse tool calls from last assistant message");
+    }
+    const providedMap = new Map(
+      input.toolResults.map((r) => [r.callId, r])
+    );
+    const toolResultsForModel = [];
+    for (const tc of allToolCalls) {
+      const provided = providedMap.get(tc.id);
+      if (provided) {
+        toolResultsForModel.push({
+          type: "tool_result",
+          tool_use_id: tc.id,
+          tool_name: provided.toolName,
+          content: provided.error ? `Tool error: ${provided.error}` : JSON.stringify(provided.result ?? null)
+        });
+      } else {
+        toolResultsForModel.push({
+          type: "tool_result",
+          tool_use_id: tc.id,
+          tool_name: tc.name,
+          content: "Tool error: Tool execution deferred (pending approval checkpoint)"
+        });
+      }
+    }
+    messages.push({
+      role: "tool",
+      content: JSON.stringify(toolResultsForModel),
+      metadata: { timestamp: Date.now(), id: randomUUID3() }
+    });
+    yield* this.runWithTelemetry({
+      messages,
+      conversationId: input.conversationId,
+      parameters: input.parameters,
+      abortSignal: input.abortSignal
+    });
+  }
   async runToCompletion(input) {
     const events = [];
     let runId = "";
     let finalResult;
     const messages = [...input.messages ?? []];
-    messages.push({ role: "user", content: input.task });
+    if (input.task != null) {
+      messages.push({ role: "user", content: input.task });
+    }
     for await (const event of this.runWithTelemetry(input)) {
       events.push(event);
       if (event.type === "run:started") {
@@ -4072,9 +4150,11 @@ var LatitudeCapture = class {
   projectId;
   path;
   constructor(config) {
-    this.apiKey = config?.apiKey ?? process.env.LATITUDE_API_KEY;
-    const rawProjectId = config?.projectId ?? process.env.LATITUDE_PROJECT_ID;
-    const projectIdNumber = typeof rawProjectId === "number" ? rawProjectId : rawProjectId ? Number.parseInt(rawProjectId, 10) : Number.NaN;
+    const apiKeyEnv = config?.apiKeyEnv ?? "LATITUDE_API_KEY";
+    this.apiKey = process.env[apiKeyEnv];
+    const projectIdEnv = config?.projectIdEnv ?? "LATITUDE_PROJECT_ID";
+    const rawProjectId = process.env[projectIdEnv];
+    const projectIdNumber = rawProjectId ? Number.parseInt(rawProjectId, 10) : Number.NaN;
     this.projectId = Number.isFinite(projectIdNumber) ? projectIdNumber : void 0;
     const rawPath = config?.path ?? process.env.LATITUDE_PATH ?? process.env.LATITUDE_DOCUMENT_PATH ?? config?.defaultPath;
     this.path = rawPath;
@@ -4982,15 +5062,18 @@ var createStateStore = (config, options) => {
     return new InMemoryStateStore(ttl);
   }
   if (provider === "upstash") {
-    const url = config?.url ?? process.env.UPSTASH_REDIS_REST_URL ?? "";
-    const token = config?.token ?? process.env.UPSTASH_REDIS_REST_TOKEN ?? "";
+    const urlEnv = config?.urlEnv ?? (process.env.UPSTASH_REDIS_REST_URL ? "UPSTASH_REDIS_REST_URL" : "KV_REST_API_URL");
+    const tokenEnv = config?.tokenEnv ?? (process.env.UPSTASH_REDIS_REST_TOKEN ? "UPSTASH_REDIS_REST_TOKEN" : "KV_REST_API_TOKEN");
+    const url = process.env[urlEnv] ?? "";
+    const token = process.env[tokenEnv] ?? "";
     if (url && token) {
       return new UpstashStateStore(url, token, ttl);
     }
     return new InMemoryStateStore(ttl);
   }
   if (provider === "redis") {
-    const url = config?.url ?? process.env.REDIS_URL ?? "";
+    const urlEnv = config?.urlEnv ?? "REDIS_URL";
+    const url = process.env[urlEnv] ?? "";
     if (url) {
       return new RedisLikeStateStore(url, ttl);
     }
@@ -5016,15 +5099,18 @@ var createConversationStore = (config, options) => {
     return new InMemoryConversationStore(ttl);
   }
   if (provider === "upstash") {
-    const url = config?.url ?? (process.env.UPSTASH_REDIS_REST_URL || process.env.KV_REST_API_URL || "");
-    const token = config?.token ?? (process.env.UPSTASH_REDIS_REST_TOKEN || process.env.KV_REST_API_TOKEN || "");
+    const urlEnv = config?.urlEnv ?? (process.env.UPSTASH_REDIS_REST_URL ? "UPSTASH_REDIS_REST_URL" : "KV_REST_API_URL");
+    const tokenEnv = config?.tokenEnv ?? (process.env.UPSTASH_REDIS_REST_TOKEN ? "UPSTASH_REDIS_REST_TOKEN" : "KV_REST_API_TOKEN");
+    const url = process.env[urlEnv] ?? "";
+    const token = process.env[tokenEnv] ?? "";
     if (url && token) {
       return new UpstashConversationStore(url, token, workingDir, ttl, options?.agentId);
     }
     return new InMemoryConversationStore(ttl);
   }
   if (provider === "redis") {
-    const url = config?.url ?? process.env.REDIS_URL ?? "";
+    const urlEnv = config?.urlEnv ?? "REDIS_URL";
+    const url = process.env[urlEnv] ?? "";
     if (url) {
       return new RedisLikeConversationStore(url, workingDir, ttl, options?.agentId);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poncho-ai/harness",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Agent execution runtime - conversation loop, tool dispatch, streaming",
   "repository": {
     "type": "git",
@@ -31,7 +31,7 @@
     "redis": "^5.10.0",
     "yaml": "^2.4.0",
     "zod": "^3.22.0",
-    "@poncho-ai/sdk": "1.0.1"
+    "@poncho-ai/sdk": "1.0.3"
   },
   "devDependencies": {
     "@types/mustache": "^4.2.6",

package/src/config.ts

@@ -7,8 +7,8 @@ import type { StateConfig } from "./state.js";
 
 export interface StorageConfig {
   provider?: "local" | "memory" | "redis" | "upstash" | "dynamodb";
-  url?: string;
-  token?: string;
+  urlEnv?: string;
+  tokenEnv?: string;
   table?: string;
   region?: string;
   ttl?:
@@ -76,6 +76,7 @@ export interface PonchoConfig extends McpConfig {
     required?: boolean;
     type?: "bearer" | "header" | "custom";
     headerName?: string;
+    tokenEnv?: string;
     validate?: (token: string, req?: unknown) => Promise<boolean> | boolean;
   };
   state?: {
@@ -85,12 +86,16 @@ export interface PonchoConfig extends McpConfig {
   };
   memory?: MemoryConfig;
   storage?: StorageConfig;
+  providers?: {
+    openai?: { apiKeyEnv?: string };
+    anthropic?: { apiKeyEnv?: string };
+  };
   telemetry?: {
     enabled?: boolean;
     otlp?: string;
     latitude?: {
-      apiKey?: string;
-      projectId?: string | number;
+      apiKeyEnv?: string;
+      projectIdEnv?: string;
       path?: string;
       documentPath?: string;
     };
@@ -130,8 +135,8 @@ export const resolveStateConfig = (
   if (config?.storage) {
     return {
       provider: config.storage.provider,
-      url: config.storage.url,
-      token: config.storage.token,
+      urlEnv: config.storage.urlEnv,
+      tokenEnv: config.storage.tokenEnv,
       table: config.storage.table,
       region: config.storage.region,
       ttl: resolveTtl(config.storage.ttl, "conversations"),
@@ -147,8 +152,8 @@ export const resolveMemoryConfig = (
     return {
       enabled: config.storage.memory?.enabled ?? config.memory?.enabled,
       provider: config.storage.provider,
-      url: config.storage.url,
-      token: config.storage.token,
+      urlEnv: config.storage.urlEnv,
+      tokenEnv: config.storage.tokenEnv,
       table: config.storage.table,
       region: config.storage.region,
       ttl: resolveTtl(config.storage.ttl, "memory"),