@tuan_son.dinh/gsd 2.6.0

package/src/resources/extensions/get-secrets-from-user.ts

@@ -0,0 +1,352 @@
+/**
+ * get-secrets-from-user — paged secure env var collection + apply
+ *
+ * Collects secrets one-per-page via masked TUI input, then writes them
+ * to .env (local), Vercel, or Convex. No ctx.callTool, no external deps.
+ * Uses Node fs/promises for file I/O and pi.exec() for CLI sinks.
+ */
+
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+
+import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import { CURSOR_MARKER, Editor, type EditorTheme, Key, matchesKey, Text, truncateToWidth } from "@mariozechner/pi-tui";
+import { Type } from "@sinclair/typebox";
+
+// ─── Types ────────────────────────────────────────────────────────────────────
+
+interface CollectedSecret {
+	key: string;
+	value: string | null; // null = skipped
+}
+
+interface ToolResultDetails {
+	destination: string;
+	environment?: string;
+	applied: string[];
+	skipped: string[];
+}
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+function maskPreview(value: string): string {
+	if (!value) return "";
+	if (value.length <= 8) return "*".repeat(value.length);
+	return `${value.slice(0, 4)}${"*".repeat(Math.max(4, value.length - 8))}${value.slice(-4)}`;
+}
+
+/**
+ * Replace editor visible text with masked characters while preserving ANSI cursor/sequencer codes.
+ */
+function maskEditorLine(line: string): string {
+	// Keep border / metadata lines readable.
+	if (line.startsWith("─")) {
+		return line;
+	}
+
+	let output = "";
+	let i = 0;
+	while (i < line.length) {
+		if (line.startsWith(CURSOR_MARKER, i)) {
+			output += CURSOR_MARKER;
+			i += CURSOR_MARKER.length;
+			continue;
+		}
+
+		const ansiMatch = /^\x1b\[[0-9;]*m/.exec(line.slice(i));
+		if (ansiMatch) {
+			output += ansiMatch[0];
+			i += ansiMatch[0].length;
+			continue;
+		}
+
+		const ch = line[i] as string;
+		output += ch === " " ? " " : "*";
+		i += 1;
+	}
+
+	return output;
+}
+
+function shellEscapeSingle(value: string): string {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+async function writeEnvKey(filePath: string, key: string, value: string): Promise<void> {
+	let content = "";
+	try {
+		content = await readFile(filePath, "utf8");
+	} catch {
+		content = "";
+	}
+	const escaped = value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/\r/g, "");
+	const line = `${key}=${escaped}`;
+	const regex = new RegExp(`^${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*=.*$`, "m");
+	if (regex.test(content)) {
+		content = content.replace(regex, line);
+	} else {
+		if (content.length > 0 && !content.endsWith("\n")) content += "\n";
+		content += `${line}\n`;
+	}
+	await writeFile(filePath, content, "utf8");
+}
+
+// ─── Paged secure input UI ────────────────────────────────────────────────────
+
+/**
+ * Show a single-key masked input page via ctx.ui.custom().
+ * Returns the entered value, or null if skipped/cancelled.
+ */
+async function collectOneSecret(
+	ctx: { ui: any; hasUI: boolean },
+	pageIndex: number,
+	totalPages: number,
+	keyName: string,
+	hint: string | undefined,
+): Promise<string | null> {
+	if (!ctx.hasUI) return null;
+
+	return ctx.ui.custom<string | null>((tui: any, theme: any, _kb: any, done: (r: string | null) => void) => {
+		let value = "";
+		let cachedLines: string[] | undefined;
+
+		const editorTheme: EditorTheme = {
+			borderColor: (s: string) => theme.fg("accent", s),
+			selectList: {
+				selectedPrefix: (t: string) => theme.fg("accent", t),
+				selectedText: (t: string) => theme.fg("accent", t),
+				description: (t: string) => theme.fg("muted", t),
+				scrollInfo: (t: string) => theme.fg("dim", t),
+				noMatch: (t: string) => theme.fg("warning", t),
+			},
+		};
+		const editor = new Editor(tui, editorTheme, { paddingX: 1 });
+
+		function refresh() {
+			cachedLines = undefined;
+			tui.requestRender();
+		}
+
+		function handleInput(data: string) {
+			if (matchesKey(data, Key.enter)) {
+				value = editor.getText().trim();
+				done(value.length > 0 ? value : null);
+				return;
+			}
+			if (matchesKey(data, Key.escape)) {
+				done(null);
+				return;
+			}
+			// ctrl+s = skip this key
+			if (data === "\x13") {
+				done(null);
+				return;
+			}
+			editor.handleInput(data);
+			refresh();
+		}
+
+		function render(width: number): string[] {
+			if (cachedLines) return cachedLines;
+			const lines: string[] = [];
+			const add = (s: string) => lines.push(truncateToWidth(s, width));
+
+			add(theme.fg("accent", "─".repeat(width)));
+			add(theme.fg("dim", ` Page ${pageIndex + 1}/${totalPages} · Secure Env Setup`));
+			lines.push("");
+
+			// Key name as big header
+			add(theme.fg("accent", theme.bold(` ${keyName}`)));
+			if (hint) {
+				add(theme.fg("muted", `  ${hint}`));
+			}
+			lines.push("");
+
+			// Masked preview
+			const raw = editor.getText();
+			const preview = raw.length > 0 ? maskPreview(raw) : theme.fg("dim", "(empty — press enter to skip)");
+			add(theme.fg("text", `  Preview: ${preview}`));
+			lines.push("");
+
+			// Editor
+			add(theme.fg("muted", " Enter value:"));
+			for (const line of editor.render(width - 2)) {
+				add(theme.fg("text", maskEditorLine(line)));
+			}
+
+			lines.push("");
+			add(theme.fg("dim", ` enter to confirm  |  ctrl+s or esc to skip  |  esc cancels`));
+			add(theme.fg("accent", "─".repeat(width)));
+
+			cachedLines = lines;
+			return lines;
+		}
+
+		return {
+			render,
+			invalidate: () => { cachedLines = undefined; },
+			handleInput,
+		};
+	});
+}
+
+// ─── Extension ────────────────────────────────────────────────────────────────
+
+export default function secureEnv(pi: ExtensionAPI) {
+	pi.registerTool({
+		name: "secure_env_collect",
+		label: "Secure Env Collect",
+		description:
+			"Collect one or more env vars through a paged masked-input UI, then write them to .env, Vercel, or Convex. " +
+			"Values are shown masked to the user (e.g. sk-ir***dgdh) and never echoed in tool output.",
+		promptSnippet: "Collect and apply env vars securely without asking user to edit files manually.",
+		promptGuidelines: [
+			"NEVER ask the user to manually edit .env files, copy-paste into a terminal, or open a dashboard to set env vars. Always use secure_env_collect instead.",
+			"When a command fails due to a missing env var (e.g. 'OPENAI_API_KEY is not set', 'Missing required environment variable', 'Invalid API key', 'authentication required'), immediately call secure_env_collect with the missing keys before retrying.",
+			"When starting a new project or running setup steps that require secrets (API keys, tokens, database URLs), proactively call secure_env_collect before the first command that needs them.",
+			"Detect the right destination: use 'dotenv' for local dev, 'vercel' when deploying to Vercel, 'convex' when using Convex backend.",
+			"After secure_env_collect completes, re-run the originally blocked command to verify the fix worked.",
+			"Never echo, log, or repeat secret values in your responses. Only report key names and applied/skipped status.",
+		],
+		parameters: Type.Object({
+			destination: Type.Union([
+				Type.Literal("dotenv"),
+				Type.Literal("vercel"),
+				Type.Literal("convex"),
+			], { description: "Where to write the collected secrets" }),
+			keys: Type.Array(
+				Type.Object({
+					key: Type.String({ description: "Env var name, e.g. OPENAI_API_KEY" }),
+					hint: Type.Optional(Type.String({ description: "Format hint shown to user, e.g. 'starts with sk-'" })),
+					required: Type.Optional(Type.Boolean()),
+				}),
+				{ minItems: 1 },
+			),
+			envFilePath: Type.Optional(Type.String({ description: "Path to .env file (dotenv only). Defaults to .env in cwd." })),
+			environment: Type.Optional(
+				Type.Union([
+					Type.Literal("development"),
+					Type.Literal("preview"),
+					Type.Literal("production"),
+				], { description: "Target environment (vercel only)" }),
+			),
+		}),
+
+		async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+			if (!ctx.hasUI) {
+				return {
+					content: [{ type: "text", text: "Error: UI not available (interactive mode required for secure env collection)." }],
+					isError: true,
+				};
+			}
+
+			const collected: CollectedSecret[] = [];
+
+			// Collect one key per page
+			for (let i = 0; i < params.keys.length; i++) {
+				const item = params.keys[i];
+				const value = await collectOneSecret(ctx, i, params.keys.length, item.key, item.hint);
+				collected.push({ key: item.key, value });
+			}
+
+			const provided = collected.filter((c) => c.value !== null) as Array<{ key: string; value: string }>;
+			const skipped = collected.filter((c) => c.value === null).map((c) => c.key);
+			const applied: string[] = [];
+			const errors: string[] = [];
+
+			// Apply to destination
+			if (params.destination === "dotenv") {
+				const filePath = resolve(ctx.cwd, params.envFilePath ?? ".env");
+				for (const { key, value } of provided) {
+					try {
+						await writeEnvKey(filePath, key, value);
+						applied.push(key);
+					} catch (err: any) {
+						errors.push(`${key}: ${err.message}`);
+					}
+				}
+			}
+
+			if (params.destination === "vercel") {
+				const env = params.environment ?? "development";
+				for (const { key, value } of provided) {
+					try {
+						const result = await pi.exec("sh", [
+							"-c",
+							`printf %s ${shellEscapeSingle(value)} | vercel env add ${key} ${env}`,
+						]);
+						if (result.code !== 0) {
+							errors.push(`${key}: ${result.stderr.slice(0, 200)}`);
+						} else {
+							applied.push(key);
+						}
+					} catch (err: any) {
+						errors.push(`${key}: ${err.message}`);
+					}
+				}
+			}
+
+			if (params.destination === "convex") {
+				for (const { key, value } of provided) {
+					try {
+						const result = await pi.exec("sh", [
+							"-c",
+							`npx convex env set ${key} ${shellEscapeSingle(value)}`,
+						]);
+						if (result.code !== 0) {
+							errors.push(`${key}: ${result.stderr.slice(0, 200)}`);
+						} else {
+							applied.push(key);
+						}
+					} catch (err: any) {
+						errors.push(`${key}: ${err.message}`);
+					}
+				}
+			}
+
+			const details: ToolResultDetails = {
+				destination: params.destination,
+				environment: params.environment,
+				applied,
+				skipped,
+			};
+
+			const lines = [
+				`destination: ${params.destination}${params.environment ? ` (${params.environment})` : ""}`,
+				...applied.map((k) => `✓ ${k}: applied`),
+				...skipped.map((k) => `• ${k}: skipped`),
+				...errors.map((e) => `✗ ${e}`),
+			];
+
+			return {
+				content: [{ type: "text", text: lines.join("\n") }],
+				details,
+				isError: errors.length > 0 && applied.length === 0,
+			};
+		},
+
+		renderCall(args, theme) {
+			const count = Array.isArray(args.keys) ? args.keys.length : 0;
+			return new Text(
+				theme.fg("toolTitle", theme.bold("secure_env_collect ")) +
+				theme.fg("muted", `→ ${args.destination}`) +
+				theme.fg("dim", `  ${count} key${count !== 1 ? "s" : ""}`),
+				0, 0,
+			);
+		},
+
+		renderResult(result, _options, theme) {
+			const details = result.details as ToolResultDetails | undefined;
+			if (!details) {
+				const t = result.content[0];
+				return new Text(t?.type === "text" ? t.text : "", 0, 0);
+			}
+			const lines = [
+				`${theme.fg("success", "✓")} ${details.destination}${details.environment ? ` (${details.environment})` : ""}`,
+				...details.applied.map((k) => `  ${theme.fg("success", "✓")} ${k}: applied`),
+				...details.skipped.map((k) => `  ${theme.fg("warning", "•")} ${k}: skipped`),
+			];
+			return new Text(lines.join("\n"), 0, 0);
+		},
+	});
+}

package/src/resources/extensions/google-search/index.ts

@@ -0,0 +1,323 @@
+/**
+ * Google Search Extension
+ *
+ * Provides a `google_search` tool that performs web searches via Gemini's
+ * Google Search grounding feature. Uses the user's existing GEMINI_API_KEY
+ * and Google Cloud GenAI credits.
+ *
+ * The tool sends queries to Gemini Flash with `googleSearch: {}` enabled.
+ * Gemini internally performs Google searches, synthesizes an answer, and
+ * returns it with source URLs from grounding metadata.
+ */
+
+import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import {
+	DEFAULT_MAX_BYTES,
+	DEFAULT_MAX_LINES,
+	formatSize,
+	truncateHead,
+} from "@mariozechner/pi-coding-agent";
+import { Text } from "@mariozechner/pi-tui";
+import { Type } from "@sinclair/typebox";
+import { GoogleGenAI } from "@google/genai";
+
+// ── Types ────────────────────────────────────────────────────────────────────
+
+interface SearchSource {
+	title: string;
+	uri: string;
+	domain: string;
+}
+
+interface SearchResult {
+	answer: string;
+	sources: SearchSource[];
+	searchQueries: string[];
+	cached: boolean;
+}
+
+interface SearchDetails {
+	query: string;
+	sourceCount: number;
+	cached: boolean;
+	durationMs: number;
+	error?: string;
+}
+
+// ── Lazy singleton client ────────────────────────────────────────────────────
+
+let client: GoogleGenAI | null = null;
+
+function getClient(): GoogleGenAI {
+	if (!client) {
+		client = new GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY! });
+	}
+	return client;
+}
+
+// ── In-session cache ─────────────────────────────────────────────────────────
+
+const resultCache = new Map<string, SearchResult>();
+
+function cacheKey(query: string): string {
+	return query.toLowerCase().trim();
+}
+
+// ── Extension ────────────────────────────────────────────────────────────────
+
+export default function (pi: ExtensionAPI) {
+	pi.registerTool({
+		name: "google_search",
+		label: "Google Search",
+		description:
+			"Search the web using Google Search via Gemini. " +
+			"Returns an AI-synthesized answer grounded in Google Search results, plus source URLs. " +
+			"Use this when you need current information from the web: recent events, documentation, " +
+			"product details, technical references, news, etc. " +
+			"Requires GEMINI_API_KEY. Alternative to Brave-based search tools for users with Google Cloud credits.",
+		promptSnippet: "Search the web via Google Search to get current information with sources",
+		promptGuidelines: [
+			"Use google_search when you need up-to-date web information that isn't in your training data.",
+			"Be specific with queries for better results, e.g. 'Next.js 15 app router migration guide' not just 'Next.js'.",
+			"The tool returns both an answer and source URLs. Cite sources when sharing results with the user.",
+			"Results are cached per-session, so repeated identical queries are free.",
+			"You can still use fetch_page to read a specific URL if needed after getting results from google_search.",
+		],
+		parameters: Type.Object({
+			query: Type.String({
+				description: "The search query, e.g. 'latest Node.js LTS version' or 'how to configure Tailwind v4'",
+			}),
+			maxSources: Type.Optional(
+				Type.Number({
+					description: "Maximum number of source URLs to include (default 5, max 10).",
+					minimum: 1,
+					maximum: 10,
+				}),
+			),
+		}),
+
+		async execute(_toolCallId, params, signal, _onUpdate, _ctx) {
+			const startTime = Date.now();
+			const maxSources = Math.min(Math.max(params.maxSources ?? 5, 1), 10);
+
+			// Check for API key
+			if (!process.env.GEMINI_API_KEY) {
+				return {
+					content: [
+						{
+							type: "text",
+							text: "Error: GEMINI_API_KEY is not set. Please set this environment variable to use Google Search.\n\nExample: export GEMINI_API_KEY=your_key",
+						},
+					],
+					isError: true,
+					details: {
+						query: params.query,
+						sourceCount: 0,
+						cached: false,
+						durationMs: Date.now() - startTime,
+						error: "auth_error: GEMINI_API_KEY not set",
+					} as SearchDetails,
+				};
+			}
+
+			// Check cache
+			const key = cacheKey(params.query);
+			if (resultCache.has(key)) {
+				const cached = resultCache.get(key)!;
+				const output = formatOutput(cached, maxSources);
+				return {
+					content: [{ type: "text", text: output }],
+					details: {
+						query: params.query,
+						sourceCount: cached.sources.length,
+						cached: true,
+						durationMs: Date.now() - startTime,
+					} as SearchDetails,
+				};
+			}
+
+			// Call Gemini with Google Search grounding
+			let result: SearchResult;
+			try {
+				const ai = getClient();
+				const response = await ai.models.generateContent({
+					model: process.env.GEMINI_SEARCH_MODEL || "gemini-2.5-flash",
+					contents: params.query,
+					config: {
+						tools: [{ googleSearch: {} }],
+						abortSignal: signal,
+					},
+				});
+
+				// Extract answer text
+				const answer = response.text ?? "";
+
+				// Extract grounding metadata
+				const candidate = response.candidates?.[0];
+				const grounding = candidate?.groundingMetadata;
+
+				// Parse sources from grounding chunks
+				const sources: SearchSource[] = [];
+				const seenTitles = new Set<string>();
+				if (grounding?.groundingChunks) {
+					for (const chunk of grounding.groundingChunks) {
+						if (chunk.web) {
+							const title = chunk.web.title ?? "Untitled";
+							// Dedupe by title since URIs are redirect URLs that differ per call
+							if (seenTitles.has(title)) continue;
+							seenTitles.add(title);
+							// domain field is not available via Gemini API, use title as fallback
+							// (title is typically the domain name, e.g. "wikipedia.org")
+							const domain = chunk.web.domain ?? title;
+							sources.push({
+								title,
+								uri: chunk.web.uri ?? "",
+								domain,
+							});
+						}
+					}
+				}
+
+				// Extract search queries Gemini actually performed
+				const searchQueries = grounding?.webSearchQueries ?? [];
+
+				result = { answer, sources, searchQueries, cached: false };
+			} catch (err: unknown) {
+				const msg = err instanceof Error ? err.message : String(err);
+
+				let errorType = "api_error";
+				if (msg.includes("401") || msg.includes("UNAUTHENTICATED")) {
+					errorType = "auth_error";
+				} else if (msg.includes("429") || msg.includes("RESOURCE_EXHAUSTED") || msg.includes("quota")) {
+					errorType = "rate_limit";
+				}
+
+				return {
+					content: [
+						{
+							type: "text",
+							text: `Google Search failed (${errorType}): ${msg}`,
+						},
+					],
+					isError: true,
+					details: {
+						query: params.query,
+						sourceCount: 0,
+						cached: false,
+						durationMs: Date.now() - startTime,
+						error: `${errorType}: ${msg}`,
+					} as SearchDetails,
+				};
+			}
+
+			// Cache the result
+			resultCache.set(key, result);
+
+			// Format and truncate output
+			const rawOutput = formatOutput(result, maxSources);
+			const truncation = truncateHead(rawOutput, {
+				maxLines: DEFAULT_MAX_LINES,
+				maxBytes: DEFAULT_MAX_BYTES,
+			});
+
+			let finalText = truncation.content;
+			if (truncation.truncated) {
+				finalText +=
+					`\n\n[Truncated: showing ${truncation.outputLines}/${truncation.totalLines} lines` +
+					` (${formatSize(truncation.outputBytes)} of ${formatSize(truncation.totalBytes)})]`;
+			}
+
+			return {
+				content: [{ type: "text", text: finalText }],
+				details: {
+					query: params.query,
+					sourceCount: result.sources.length,
+					cached: false,
+					durationMs: Date.now() - startTime,
+				} as SearchDetails,
+			};
+		},
+
+		renderCall(args, theme) {
+			let text = theme.fg("toolTitle", theme.bold("google_search "));
+			text += theme.fg("accent", `"${args.query}"`);
+			return new Text(text, 0, 0);
+		},
+
+		renderResult(result, { isPartial, expanded }, theme) {
+			const d = result.details as SearchDetails | undefined;
+
+			if (isPartial) return new Text(theme.fg("warning", "Searching Google..."), 0, 0);
+			if (result.isError || d?.error) {
+				return new Text(theme.fg("error", `Error: ${d?.error ?? "unknown"}`), 0, 0);
+			}
+
+			let text = theme.fg("success", `${d?.sourceCount ?? 0} sources`);
+			text += theme.fg("dim", ` (${d?.durationMs ?? 0}ms)`);
+			if (d?.cached) text += theme.fg("dim", " · cached");
+
+			if (expanded) {
+				const content = result.content[0];
+				if (content?.type === "text") {
+					const preview = content.text.split("\n").slice(0, 8).join("\n");
+					text += "\n\n" + theme.fg("dim", preview);
+					if (content.text.split("\n").length > 8) {
+						text += "\n" + theme.fg("muted", "...");
+					}
+				}
+			}
+
+			return new Text(text, 0, 0);
+		},
+	});
+
+	// ── Startup notification ─────────────────────────────────────────────────
+
+	pi.on("session_start", async (_event, ctx) => {
+		if (!process.env.GEMINI_API_KEY) {
+			ctx.ui.notify(
+				"Google Search: No GEMINI_API_KEY set. The google_search tool will not work until this is configured.",
+				"warning",
+			);
+		}
+	});
+}
+
+// ── Output formatting ────────────────────────────────────────────────────────
+
+function formatOutput(result: SearchResult, maxSources: number): string {
+	const lines: string[] = [];
+
+	// Answer
+	if (result.answer) {
+		lines.push(result.answer);
+	} else {
+		lines.push("(No answer text returned from search)");
+	}
+
+	// Sources
+	if (result.sources.length > 0) {
+		lines.push("");
+		lines.push("Sources:");
+		const sourcesToShow = result.sources.slice(0, maxSources);
+		for (let i = 0; i < sourcesToShow.length; i++) {
+			const s = sourcesToShow[i];
+			lines.push(`[${i + 1}] ${s.title} - ${s.domain}`);
+			lines.push(`    ${s.uri}`);
+		}
+		if (result.sources.length > maxSources) {
+			lines.push(`(${result.sources.length - maxSources} more sources omitted)`);
+		}
+	} else {
+		lines.push("");
+		lines.push("(No source URLs found in grounding metadata)");
+	}
+
+	// Search queries
+	if (result.searchQueries.length > 0) {
+		lines.push("");
+		lines.push(`Searches performed: ${result.searchQueries.map((q) => `"${q}"`).join(", ")}`);
+	}
+
+	return lines.join("\n");
+}

package/src/resources/extensions/google-search/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "pi-extension-google-search",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "pi": {
+    "extensions": ["./index.ts"]
+  }
+}