@wenathlan/devthink 1.1.1

package/README.md

@@ -0,0 +1,170 @@
+# DevThink
+
+**DevThink** is a provider-neutral AI development workbench with a terminal CLI, an embedded local gateway and a static web workbench. The public source lives in the [DevThink repository](https://github.com/wenathlan/devthink); **DevThink** remains the product name.
+
+> **Security boundary.** DevThink uses official provider APIs and credentials supplied explicitly by the user. It does not capture browser cookies, store browser sessions, solve CAPTCHAs, automate browser authentication or bypass anti-bot controls.
+
+| Surface | Capability |
+| --- | --- |
+| CLI | Streaming chat, provider and model discovery, 20 modes, local sessions, memory, pairing and credential-free snapshot export. |
+| Local gateway | Loopback HTTP and SSE service for health, provider models, workspaces, sessions, tabs and normalized chat streaming. |
+| Provider layer | OpenAI-compatible, Anthropic Messages and Google Generate Content protocols with user-configured endpoints. |
+| Local state | Atomic JSON compatibility records plus SQLite mirrors under `~/.config/devthink/`. |
+| Workbench | Static React application under `web/`, with addressable workspace/session/tab/section routes and local one-time pairing. |
+
+## Installation
+
+DevThink uses Bun for development and self-contained binary builds. The CLI keeps non-secret preferences in `devthink.json` and user-provided official credentials in a separate `auth.json` file.
+
+```bash
+npm install --global @wenathlan/devthink
+devthink init
+devthink --help
+```
+
+The portable static workbench is also published as an npm package. It is a browser artifact rather than a server, so it must be served with any static-file host after installation.
+
+```bash
+npm install @wenathlan/devthink.web
+```
+
+```bash
+bun install
+bun run devthink.ts init
+bun run devthink.ts --help
+```
+
+```bash
+devthink auth login zai --token "$ZAI_API_KEY" --kind api-key
+devthink config activeModel glm-5
+devthink chat --prompt "Summarize this repository in three points."
+```
+
+On Linux, the default local paths are:
+
+| File | Purpose |
+| --- | --- |
+| `~/.config/devthink/devthink.json` | Non-secret preferences and provider endpoint configuration. |
+| `~/.config/devthink/auth.json` | Explicit official API keys, bearer values or OAuth records; file mode is `0600`. |
+| `~/.config/devthink/devthink.sqlite` | Local workspaces, sessions, tabs and messages. |
+
+The examples below are deliberately inert and must be replaced locally by an official credential supplied by the user.
+
+```json
+{
+  "version": 1,
+  "providers": {
+    "zai": {
+      "kind": "api-key",
+      "value": "example_api_key_not_a_secret",
+      "updatedAt": "2026-08-19T00:00:00.000Z"
+    }
+  }
+}
+```
+
+## Provider endpoints
+
+DevThink does not use a separate proxy module. A provider-specific endpoint belongs in `providers.<id>.baseUrl` within the user-owned `devthink.json` file.
+
+```json
+{
+  "activeProvider": "zai",
+  "activeModel": "glm-5",
+  "gateway": { "mode": "embedded", "stream": true },
+  "providers": {
+    "zai": {
+      "baseUrl": "https://api.z.ai/api/paas/v4",
+      "transport": "openai-compatible"
+    }
+  },
+  "web": { "enabled": true }
+}
+```
+
+| Provider family | Protocol |
+| --- | --- |
+| OpenAI, Z.AI, Qwen, OpenRouter, DeepSeek, Groq, Mistral, xAI, Ollama and Xiaomi MiMo | OpenAI-compatible streaming. |
+| Anthropic | Messages streaming. |
+| Google Gemini | Generate Content streaming. |
+
+## CLI commands
+
+```text
+devthink init
+devthink chat --provider <id> --model <id> --prompt <text>
+devthink providers
+devthink models --provider <id>
+devthink modes
+devthink config [key] [value]
+devthink auth login <provider> --token <credential> [--kind api-key|bearer|oauth]
+devthink auth status
+devthink auth clear <provider>
+devthink auth migrate
+devthink identity
+devthink pair create [--web-url <url>] [--gateway <url>]
+devthink pair revoke
+devthink sync status
+devthink sync export
+devthink gateway status
+devthink sessions list
+devthink sessions export <id> --format markdown
+devthink serve
+devthink interactive
+```
+
+`devthink serve` listens only on the local loopback interface. The web workbench must pair through a short-lived, one-time code before a browser origin can access local records. Provider credentials remain local and are never sent to GitHub Pages.
+
+## Workbench and GitHub Pages
+
+The workbench lives directly under [`web/`](./web), with no `web/src` or `web/client/src` nesting. Its route preserves the same stable identifiers used by the CLI and local gateway.
+
+```text
+/w/:workspaceId/s/:sessionId/t/:tabId/:sectionId
+```
+
+```bash
+cd web
+pnpm install --frozen-lockfile
+pnpm check
+pnpm build
+```
+
+The GitHub Pages build is static. It never embeds a provider credential or remote database. To interact with the CLI, users run `devthink serve` locally and pair the browser explicitly.
+
+## TypeScript documentation
+
+The public `docs/` directory contains compact `category.ts.md` collections. Legacy non-TypeScript executable documentation was rewritten as typed, JSDoc-described TypeScript contracts. The root code integrates the safe parts of those contracts: bounded retry behavior, error redaction, exact allowed-origin matching, secure remote-endpoint validation and Pages base-path normalization.
+
+| Collection | Focus |
+| --- | --- |
+| `auth.ts.md` | Official credential shapes and inert examples. |
+| `providers.ts.md` | Protocol adapters, retry and error redaction. |
+| `gateway.ts.md` | Local gateway request and origin contract. |
+| `storage.ts.md` | Credential-free local persistence and sync boundary. |
+| `web.ts.md` | Static base-path and addressable route contract. |
+
+## Validation and release
+
+```bash
+bun run check
+bun run build:binary
+
+cd web
+pnpm check
+pnpm build
+```
+
+The release workflow builds Bun binaries for Linux x64, macOS arm64 and Windows x64. The Pages workflow validates and publishes the static workbench with a repository-scoped base path and SPA fallback.
+
+## References
+
+[1] [Bun documentation](https://bun.sh/docs)
+
+[2] [Anthropic streaming documentation](https://platform.claude.com/docs/en/build-with-claude/streaming)
+
+[3] [Google Gemini Generate Content](https://ai.google.dev/gemini-api/docs/generate-content)
+
+[4] [Z.AI API documentation](https://docs.z.ai/api-reference/introduction)
+
+[5] [Xiaomi MiMo quick start](https://mimo.mi.com/docs/quick-start/first-api-call)

package/build.ts

@@ -0,0 +1,41 @@
+import { readFileSync } from "node:fs";
+import { arch, platform } from "node:process";
+
+type BunRuntime = {
+  build: (options: Record<string, unknown>) => Promise<{ success: boolean; logs: unknown[] }>;
+};
+
+function bunRuntime(): BunRuntime {
+  const runtime = (globalThis as { Bun?: BunRuntime }).Bun;
+  if (!runtime) throw new Error("Bun is required to compile DevThink binaries.");
+  return runtime;
+}
+
+function flag(name: string): string | undefined {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function packageVersion(): string {
+  const packageData = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8")) as { version?: string };
+  return packageData.version || "0.0.0";
+}
+
+function localCompileTarget(): string {
+  const os = platform === "darwin" ? "darwin" : platform === "win32" ? "windows" : "linux";
+  const cpu = arch === "arm64" ? "arm64" : "x64";
+  return `bun-${os}-${cpu}`;
+}
+
+export async function buildBinary(): Promise<void> {
+  const runtime = bunRuntime();
+  const target = flag("--target") || process.env.BUN_TARGET || localCompileTarget();
+  const outfile = flag("--outfile") || process.env.DEVTHINK_OUTFILE || `release/devthink-${target}`;
+  const result = await runtime.build({ entrypoints: ["./devthink.ts"], target, define: { "process.env.DEVTHINK_VERSION": JSON.stringify(packageVersion()) }, compile: { target, outfile }, minify: true, sourcemap: "none" });
+  if (!result.success) throw new Error(`Bun compilation failed: ${JSON.stringify(result.logs)}`);
+  console.log(`Built ${outfile}`);
+}
+
+const directEntry = process.argv[1]?.endsWith("build.ts") || process.argv[1]?.endsWith("build");
+const bunEntry = (import.meta as ImportMeta & { main?: boolean }).main === true;
+if (directEntry || bunEntry) buildBinary().catch((error: unknown) => { console.error(error instanceof Error ? error.message : "Build failed."); process.exitCode = 1; });

package/check-secrets.ts

@@ -0,0 +1,52 @@
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+const patterns = [
+  /sk-[A-Za-z0-9_-]{20,}/g,
+  /AIza[A-Za-z0-9_-]{20,}/g,
+  /xox[baprs]-[A-Za-z0-9-]{16,}/g,
+  /gh[pousr]_[A-Za-z0-9_]{20,}/g,
+  /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+  /eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,
+];
+
+function productFiles(root: string): string[] {
+  const files: string[] = [];
+  const visit = (path: string) => {
+    if (!existsSync(path)) return;
+    const stat = statSync(path);
+    if (stat.isFile()) return files.push(path);
+    for (const entry of readdirSync(path)) {
+      if (entry === "node_modules" || entry === ".git" || entry === "docs" || entry === "dist" || entry === "release") continue;
+      visit(join(path, entry));
+    }
+  };
+  visit(join(root, "devthink.ts"));
+  for (const name of ["config.ts", "providers.ts", "stream.ts", "session.ts", "memory.ts", "modes.ts", "plugin.ts", "server.ts", "ui.ts", "build.ts", "check-secrets.ts", "package.json", "tsconfig.json", "README.md", "CHANGELOG.md", "SECURITY.md"]) visit(join(root, name));
+  visit(join(root, ".github"));
+  visit(join(root, "tests"));
+  return files.filter((path) => existsSync(path));
+}
+
+export function scanSecrets(root = process.cwd()): string[] {
+  const findings: string[] = [];
+  for (const file of productFiles(root)) {
+    const text = readFileSync(file, "utf8");
+    for (const pattern of patterns) {
+      if (pattern.test(text)) findings.push(`${file}: ${pattern}`);
+      pattern.lastIndex = 0;
+    }
+  }
+  return findings;
+}
+
+const directEntry = process.argv[1]?.endsWith("check-secrets.ts") || process.argv[1]?.endsWith("check-secrets");
+const bunEntry = (import.meta as ImportMeta & { main?: boolean }).main === true;
+if (directEntry || bunEntry) {
+  const findings = scanSecrets();
+  if (findings.length) {
+    console.error("Potential embedded credentials detected:");
+    for (const finding of findings) console.error(finding);
+    process.exitCode = 1;
+  } else console.log("Secret scan passed.");
+}

package/compatibility.ts

@@ -0,0 +1,37 @@
+/**
+ * Shared TypeScript compatibility primitives derived from the converted docs logic.
+ * These helpers intentionally exclude browser automation, CAPTCHA handling and credential capture.
+ */
+
+/** Identifies the public wire formats normalized by DevThink. */
+export type ProviderProtocol = "openai" | "anthropic" | "google";
+
+/** Returns bounded exponential retry timing for a transient request failure. */
+export function retryDelay(attempt: number, baseMs = 250, maximumMs = 4_000): number {
+  return Math.min(maximumMs, baseMs * 2 ** Math.max(0, attempt));
+}
+
+/** Removes a bearer value from an error message before it reaches a terminal or browser surface. */
+export function redactProviderError(message: string): string {
+  return message.replace(/bearer\s+[^\s]+/gi, "bearer [redacted]").slice(0, 500);
+}
+
+/** Accepts a browser origin only when it exactly matches an explicit local configuration entry. */
+export function isAllowedOrigin(origin: string | undefined, allowedOrigins: readonly string[] | undefined): boolean {
+  return Boolean(origin && allowedOrigins?.includes(origin));
+}
+
+/** Verifies that a user-operated synchronization endpoint uses HTTPS. */
+export function isSecureRemoteEndpoint(value: string | undefined): boolean {
+  try {
+    return Boolean(value && new URL(value).protocol === "https:");
+  } catch {
+    return false;
+  }
+}
+
+/** Normalizes a static-site base path for repository-scoped GitHub Pages deployments. */
+export function normalizeBasePath(value: string | undefined, repository: string): string {
+  const candidate = value?.trim() || `/${repository}/`;
+  return `/${candidate.replace(/^\/+|\/+$/g, "")}/`;
+}

package/config.ts

@@ -0,0 +1,240 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+
+export type DevThinkConfig = {
+  activeProvider?: string;
+  activeModel?: string;
+  provider?: string;
+  model?: string;
+  mode?: string;
+  baseUrl?: string;
+  apiKey?: string;
+  anthropicApiKey?: string;
+  googleApiKey?: string;
+  zaiApiKey?: string;
+  temperature?: number;
+  maxTokens?: number;
+  projectMemory?: boolean;
+  externalMemory?: boolean;
+  fallbackProviders?: string[];
+  providers?: Record<string, {
+    baseUrl?: string;
+    apiKey?: string;
+    model?: string;
+    transport?: "official" | "openai-compatible" | "local-gateway";
+    auth?: { kind: "api-key" | "bearer" | "oauth"; value?: string; expiresAt?: number };
+  }>;
+  gateway?: { mode?: "embedded"; stream?: boolean; host?: string };
+  web?: { enabled?: boolean; pagesUrl?: string; gatewayUrl?: string; allowedOrigins?: string[]; remoteSync?: { enabled?: boolean; endpoint?: string } };
+};
+
+export type AuthKind = "api-key" | "bearer" | "oauth";
+export type AuthCredential = { kind: AuthKind; value?: string; accessToken?: string; refreshToken?: string; expiresAt?: number; resourceUrl?: string; updatedAt: string };
+export type DevThinkAuth = { version: 1; providers: Record<string, AuthCredential> };
+
+export type DevThinkPaths = {
+  home: string;
+  config: string;
+  auth: string;
+  identity: string;
+  pairings: string;
+  legacyConfig: string;
+  sessions: string;
+  workspaces: string;
+  database: string;
+  memory: string;
+  logs: string;
+};
+
+function resolveHome(): string {
+  const override = process.env.DEVTHINK_HOME?.trim();
+  if (override) return override;
+  if (platform() === "win32") return join(process.env.APPDATA || homedir(), "devthink");
+  if (platform() === "darwin") return join(homedir(), "Library", "Application Support", "devthink");
+  return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "devthink");
+}
+
+export function resolvePaths(root = resolveHome()): DevThinkPaths {
+  return { home: root, config: join(root, "devthink.json"), auth: join(root, "auth.json"), identity: join(root, "identity.json"), pairings: join(root, "pairings.json"), legacyConfig: join(root, "config.json"), sessions: join(root, "sessions"), workspaces: join(root, "workspaces"), database: join(root, "devthink.sqlite"), memory: join(root, "memory"), logs: join(root, "logs") };
+}
+
+export function ensurePaths(paths = resolvePaths()): DevThinkPaths {
+  for (const path of [paths.home, paths.sessions, paths.workspaces, paths.memory, paths.logs]) mkdirSync(path, { recursive: true });
+  return paths;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function writeJson(path: string, value: unknown, mode?: number): void {
+  const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, mode ? { encoding: "utf8", mode } : "utf8");
+  renameSync(temporary, path);
+}
+
+export function readConfig(paths = resolvePaths()): DevThinkConfig {
+  try {
+    const candidate = existsSync(paths.config) ? paths.config : paths.legacyConfig;
+    if (!existsSync(candidate)) return {};
+    const parsed: unknown = JSON.parse(readFileSync(candidate, "utf8"));
+    if (!isRecord(parsed)) return {};
+    const config = parsed as DevThinkConfig;
+    return { ...config, activeProvider: config.activeProvider || config.provider, activeModel: config.activeModel || config.model };
+  } catch {
+    return {};
+  }
+}
+
+export function saveConfig(config: DevThinkConfig, paths = resolvePaths()): void {
+  ensurePaths(paths);
+  writeJson(paths.config, { ...config, activeProvider: config.activeProvider || config.provider, activeModel: config.activeModel || config.model, gateway: { mode: "embedded" as const, stream: true, ...config.gateway } });
+}
+
+const forbiddenAuthFields = new Set(["cookie", "cookies", "fingerprint", "useragent", "sessiontoken", "captcha", "browserprofile"]);
+
+function validCredential(value: unknown): AuthCredential | undefined {
+  if (!isRecord(value) || Object.keys(value).some((key) => forbiddenAuthFields.has(key.toLowerCase()))) return undefined;
+  const kind = String(value.kind) as AuthKind;
+  if (!["api-key", "bearer", "oauth"].includes(kind)) return undefined;
+  const token = typeof value.value === "string" ? value.value : undefined;
+  const accessToken = typeof value.accessToken === "string" ? value.accessToken : undefined;
+  const refreshToken = typeof value.refreshToken === "string" ? value.refreshToken : undefined;
+  if ((kind === "oauth" && !accessToken) || (kind !== "oauth" && !token)) return undefined;
+  return { kind, ...(token ? { value: token } : {}), ...(accessToken ? { accessToken } : {}), ...(refreshToken ? { refreshToken } : {}), ...(typeof value.expiresAt === "number" ? { expiresAt: value.expiresAt } : {}), ...(typeof value.resourceUrl === "string" ? { resourceUrl: value.resourceUrl } : {}), updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : new Date().toISOString() };
+}
+
+export function readAuth(paths = resolvePaths()): DevThinkAuth {
+  try {
+    if (!existsSync(paths.auth)) return { version: 1, providers: {} };
+    const parsed: unknown = JSON.parse(readFileSync(paths.auth, "utf8"));
+    if (!isRecord(parsed) || !isRecord(parsed.providers)) return { version: 1, providers: {} };
+    const providers: Record<string, AuthCredential> = {};
+    for (const [provider, raw] of Object.entries(parsed.providers)) {
+      const credential = validCredential(raw);
+      if (credential) providers[provider.toLowerCase()] = credential;
+    }
+    return { version: 1, providers };
+  } catch {
+    return { version: 1, providers: {} };
+  }
+}
+
+export function saveAuth(auth: DevThinkAuth, paths = resolvePaths()): void {
+  ensurePaths(paths);
+  const providers: Record<string, AuthCredential> = {};
+  for (const [provider, raw] of Object.entries(auth.providers)) {
+    const credential = validCredential(raw);
+    if (credential) providers[provider.toLowerCase()] = credential;
+  }
+  writeJson(paths.auth, { version: 1, providers }, 0o600);
+}
+
+export function setAuthCredential(provider: string, credential: Omit<AuthCredential, "updatedAt">, paths = resolvePaths()): DevThinkAuth {
+  const next = { ...credential, updatedAt: new Date().toISOString() };
+  if (!validCredential(next)) throw new Error("Credential must use an official api-key, bearer, or OAuth shape without browser-session fields.");
+  const current = readAuth(paths);
+  const auth = { version: 1 as const, providers: { ...current.providers, [provider.toLowerCase()]: next } };
+  saveAuth(auth, paths);
+  return auth;
+}
+
+export function clearAuthCredential(provider: string, paths = resolvePaths()): DevThinkAuth {
+  const current = readAuth(paths);
+  const providers = { ...current.providers };
+  delete providers[provider.toLowerCase()];
+  const auth = { version: 1 as const, providers };
+  saveAuth(auth, paths);
+  return auth;
+}
+
+export function migrateLegacyCredentials(config: DevThinkConfig, paths = resolvePaths()): { config: DevThinkConfig; migrated: string[] } {
+  const current = readAuth(paths);
+  const providers = { ...current.providers };
+  const nextConfig: DevThinkConfig = { ...config, providers: { ...config.providers } };
+  const migrated: string[] = [];
+  for (const [provider, settings] of Object.entries(config.providers || {})) {
+    const legacy = settings.auth?.value || settings.apiKey;
+    if (!legacy || providers[provider]) continue;
+    const kind = settings.auth?.kind || "api-key";
+    providers[provider] = kind === "oauth" ? { kind, accessToken: legacy, expiresAt: settings.auth?.expiresAt, updatedAt: new Date().toISOString() } : { kind, value: legacy, expiresAt: settings.auth?.expiresAt, updatedAt: new Date().toISOString() };
+    const { auth: _auth, apiKey: _apiKey, ...rest } = settings;
+    nextConfig.providers![provider] = rest;
+    migrated.push(provider);
+  }
+  for (const [provider, property] of Object.entries({ openai: "apiKey", anthropic: "anthropicApiKey", google: "googleApiKey", zai: "zaiApiKey" })) {
+    const value = nextConfig[property as keyof DevThinkConfig];
+    if (typeof value === "string" && value && !providers[provider]) {
+      providers[provider] = { kind: "api-key", value, updatedAt: new Date().toISOString() };
+      delete (nextConfig as Record<string, unknown>)[property];
+      migrated.push(provider);
+    }
+  }
+  saveAuth({ version: 1, providers }, paths);
+  saveConfig(nextConfig, paths);
+  return { config: nextConfig, migrated };
+}
+
+export function getConfigValue(config: DevThinkConfig, key: string): unknown {
+  return (config as Record<string, unknown>)[key];
+}
+
+export function setConfigValue(config: DevThinkConfig, key: string, value: unknown): DevThinkConfig {
+  return { ...config, [key]: value };
+}
+
+export function resolveCredential(provider: string, config: DevThinkConfig, paths = resolvePaths()): string | undefined {
+  const auth = readAuth(paths).providers[provider.toLowerCase()];
+  if (auth) {
+    if (auth.kind === "oauth" && auth.expiresAt && auth.expiresAt <= Date.now()) throw new Error(`Official OAuth credential for ${provider} has expired. Reauthenticate with the provider-owned flow.`);
+    return auth.kind === "oauth" ? auth.accessToken : auth.value;
+  }
+  const envNames: Record<string, string[]> = { openai: ["OPENAI_API_KEY"], anthropic: ["ANTHROPIC_API_KEY"], google: ["GOOGLE_API_KEY", "GEMINI_API_KEY"], zai: ["ZAI_API_KEY"], qwen: ["QWEN_API_KEY"], openrouter: ["OPENROUTER_API_KEY"], deepseek: ["DEEPSEEK_API_KEY"], groq: ["GROQ_API_KEY"], mistral: ["MISTRAL_API_KEY"], xai: ["XAI_API_KEY"], ollama: ["OLLAMA_API_KEY"], mimo: ["MIMO_API_KEY"] };
+  for (const name of envNames[provider.toLowerCase()] || []) {
+    const value = process.env[name]?.trim();
+    if (value) return value;
+  }
+  const property = `${provider}ApiKey` as keyof DevThinkConfig;
+  const nested = config.providers?.[provider];
+  return nested?.auth?.value || nested?.apiKey || config[property] || (provider === (config.activeProvider || config.provider) ? config.apiKey : undefined) || process.env.DEVTHINK_API_KEY?.trim();
+}
+
+export function redactValue(value: unknown): unknown {
+  if (typeof value !== "string") return value;
+  if (value.length < 8) return "[redacted]";
+  return `${value.slice(0, 3)}...${value.slice(-3)}`;
+}
+
+export function redactAuth(auth: DevThinkAuth): Record<string, unknown> {
+  return { version: auth.version, providers: Object.fromEntries(Object.entries(auth.providers).map(([provider, credential]) => [provider, { kind: credential.kind, ...(credential.value ? { value: redactValue(credential.value) } : {}), ...(credential.accessToken ? { accessToken: redactValue(credential.accessToken) } : {}), ...(credential.refreshToken ? { refreshToken: redactValue(credential.refreshToken) } : {}), ...(credential.expiresAt ? { expiresAt: credential.expiresAt } : {}), ...(credential.resourceUrl ? { resourceUrl: credential.resourceUrl } : {}), updatedAt: credential.updatedAt }])) };
+}
+
+export function redactConfig(config: DevThinkConfig): Record<string, unknown> {
+  const sensitive = new Set(["apiKey", "anthropicApiKey", "googleApiKey", "zaiApiKey"]);
+  return Object.fromEntries(Object.entries(config).map(([key, value]) => {
+    if (key === "providers" && value && typeof value === "object") {
+      const providers = Object.fromEntries(Object.entries(value as Record<string, Record<string, unknown>>).map(([id, settings]) => [id, Object.fromEntries(Object.entries(settings).map(([setting, item]) => {
+        if (setting === "apiKey") return [setting, redactValue(item)];
+        if (setting === "auth" && item && typeof item === "object") {
+          const auth = item as Record<string, unknown>;
+          return [setting, { ...auth, value: redactValue(auth.value) }];
+        }
+        return [setting, item];
+      }))]));
+      return [key, providers];
+    }
+    return [key, sensitive.has(key) || key.toLowerCase().endsWith("apikey") ? redactValue(value) : value];
+  }));
+}
+
+export function parseConfigValue(raw: string): unknown {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  if (/^-?\d+$/.test(raw)) return Number.parseInt(raw, 10);
+  if (/^-?\d+\.\d+$/.test(raw)) return Number.parseFloat(raw);
+  if (raw.startsWith("[") || raw.startsWith("{")) {
+    try { return JSON.parse(raw); } catch { return raw; }
+  }
+  return raw;
+}