@wundam/orchex 1.0.0-rc.1 → 1.0.0-rc.2

package/dist/artifacts.js

@@ -4,7 +4,8 @@ import { StreamArtifactSchema } from './types.js';
 import { getArtifactPath, loadManifest } from './manifest.js';
 import { checkOwnership as checkOwnershipEnhanced, } from './ownership.js';
 import { createLogger } from './logging.js';
-import { runCommands } from './commands.js';
+import { runCommand, runCommands } from './commands.js';
+import { jsonrepair } from 'jsonrepair';
 const log = createLogger('artifacts');
 // ============================================================================
 // Read & Validate
@@ -296,10 +297,11 @@ function repairInvalidEscapes(json) {
 }
 /**
  * Parse JSON string, normalize, and validate against schema.
- * Returns null on any failure.
+ * Returns null artifact on any failure.
  */
 function parseAndValidate(jsonStr, wasRepaired) {
     let parsed;
+    let usedJsonRepair = false;
     // Attempt 1: Direct parse
     try {
         parsed = JSON.parse(jsonStr);
@@ -314,19 +316,29 @@ function parseAndValidate(jsonStr, wasRepaired) {
             catch { /* still invalid */ }
         }
     }
+    // Attempt 3: jsonrepair — handles trailing commas, single quotes, unquoted keys, comments
+    if (!parsed) {
+        try {
+            const repaired = jsonrepair(jsonStr);
+            parsed = JSON.parse(repaired);
+            usedJsonRepair = true;
+            log.info('artifact_json_repaired: jsonrepair recovered malformed JSON');
+        }
+        catch { /* jsonrepair could not fix it either */ }
+    }
     if (!parsed) {
         if (!wasRepaired) {
             log.warn('Artifact block contains invalid JSON');
         }
-        return null;
+        return { artifact: null, usedJsonRepair: false };
     }
     normalizeArtifactInput(parsed);
     const result = StreamArtifactSchema.safeParse(parsed);
     if (!result.success) {
         log.warn({ issues: result.error.issues, rawKeys: Object.keys(parsed) }, 'Artifact validation failed after normalization');
-        return null;
+        return { artifact: null, usedJsonRepair: false };
     }
-    return result.data;
+    return { artifact: result.data, usedJsonRepair };
 }
 /**
  * Extract artifact JSON from an agent's response text with full diagnostics.
@@ -337,9 +349,9 @@ export function extractArtifactWithDiagnostics(agentOutput) {
     // Strategy 1: Exact match (current behavior, fast path)
     const exactMatch = agentOutput.match(/```orchex-artifact\s*\n([\s\S]*?)\n?```/);
     if (exactMatch) {
-        const artifact = parseAndValidate(exactMatch[1].trim(), false);
+        const { artifact, usedJsonRepair } = parseAndValidate(exactMatch[1].trim(), false);
         if (artifact) {
-            return { artifact, diagnostic: { strategy: 'exact', jsonRepaired: false, rawLength } };
+            return { artifact, diagnostic: { strategy: 'exact', jsonRepaired: usedJsonRepair, rawLength } };
         }
         // Matched the fence but JSON was invalid — report as exact strategy with error
         return {
@@ -368,17 +380,17 @@ export function extractArtifactWithDiagnostics(agentOutput) {
     // Remove trailing ``` if present (could be at end of string without newline)
     jsonContent = jsonContent.replace(/```\s*$/, '').trim();
     // Try parsing as-is first
-    const directArtifact = parseAndValidate(jsonContent, false);
-    if (directArtifact) {
-        return { artifact: directArtifact, diagnostic: { strategy: 'fence_recovery', jsonRepaired: false, rawLength } };
+    const directResult = parseAndValidate(jsonContent, false);
+    if (directResult.artifact) {
+        return { artifact: directResult.artifact, diagnostic: { strategy: 'fence_recovery', jsonRepaired: directResult.usedJsonRepair, rawLength } };
     }
     // Try repairing truncated JSON
     const repaired = repairTruncatedJson(jsonContent);
     if (repaired) {
-        const repairedArtifact = parseAndValidate(repaired, true);
-        if (repairedArtifact) {
+        const repairedResult = parseAndValidate(repaired, true);
+        if (repairedResult.artifact) {
             log.info('artifact_json_repaired: truncated JSON was recovered');
-            return { artifact: repairedArtifact, diagnostic: { strategy: 'fence_recovery', jsonRepaired: true, rawLength } };
+            return { artifact: repairedResult.artifact, diagnostic: { strategy: 'fence_recovery', jsonRepaired: true, rawLength } };
         }
     }
     return {
@@ -432,6 +444,167 @@ export function checkOwnership(operations, owns, options) {
 export function checkOwnershipDetailed(operations, owns, options) {
     return checkOwnershipEnhanced(operations, owns, options);
 }
+/**
+ * Check if TypeScript syntax validation is available in this project.
+ * Requires tsconfig.json to exist (indicates a TS project).
+ */
+async function isTscAvailable(projectDir) {
+    try {
+        await fs.access(path.join(projectDir, 'tsconfig.json'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Filter tsc output to only include error lines referencing specific files.
+ * tsc error format: `path/to/file.ts(line,col): error TSxxxx: message`
+ * Strips node_modules errors and errors from files not in the target set.
+ */
+function filterTscErrors(output, targetFiles) {
+    return output
+        .split('\n')
+        .filter(line => {
+        // Skip blank lines and node_modules errors
+        if (!line.trim() || line.startsWith('node_modules/'))
+            return false;
+        // Match tsc error format: `relative/path.ts(line,col):`
+        const match = line.match(/^(.+?)\(\d+,\d+\):/);
+        if (!match)
+            return false;
+        return targetFiles.has(match[1]);
+    })
+        .join('\n');
+}
+/**
+ * Resolve which TS files fall inside tsconfig's `include` paths.
+ * Files outside include (e.g. tests/) need per-file fallback validation.
+ */
+async function resolveTsconfigInclude(projectDir) {
+    try {
+        const raw = await fs.readFile(path.join(projectDir, 'tsconfig.json'), 'utf-8');
+        const tsconfig = JSON.parse(raw);
+        return tsconfig.include ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Validate syntax of files modified by artifact operations.
+ *
+ * Strategy:
+ * - JSON: in-process JSON.parse (fast, no child process)
+ * - JS/MJS/CJS: node --check (per-file syntax check)
+ * - TS/TSX inside tsconfig include: project-wide `tsc --noEmit --project tsconfig.json`,
+ *   filtered to only report errors from stream-owned files. This respects skipLibCheck,
+ *   global type augmentations (declare global), and include/exclude paths.
+ * - TS/TSX outside tsconfig include (e.g. tests/): per-file `tsc --noEmit
+ *   --isolatedModules --skipLibCheck`, filtered to exclude node_modules errors.
+ *
+ * Returns valid:true if all files pass or have unsupported extensions.
+ */
+export async function validateSyntax(projectDir, operations) {
+    const errors = [];
+    // Collect unique files to validate (skip deletes)
+    const filesToCheck = [...new Set(operations
+            .filter(op => op.type !== 'delete')
+            .map(op => op.path))];
+    // Partition TS files vs non-TS files
+    const tsFiles = [];
+    const otherFiles = [];
+    for (const f of filesToCheck) {
+        const ext = path.extname(f).toLowerCase();
+        if (ext === '.ts' || ext === '.tsx') {
+            tsFiles.push(f);
+        }
+        else {
+            otherFiles.push(f);
+        }
+    }
+    // Only attempt TS validation if the project has a tsconfig.json
+    const hasTsc = tsFiles.length > 0 ? await isTscAvailable(projectDir) : false;
+    // --- TypeScript validation (project-aware) ---
+    if (hasTsc && tsFiles.length > 0) {
+        const includePaths = await resolveTsconfigInclude(projectDir);
+        // Split TS files into "inside tsconfig include" vs "outside" (e.g. tests/)
+        const insideProject = [];
+        const outsideProject = [];
+        for (const f of tsFiles) {
+            const isIncluded = includePaths.length === 0 || includePaths.some(inc => f.startsWith(inc.replace(/\/?\*\*.*$/, '')));
+            if (isIncluded) {
+                insideProject.push(f);
+            }
+            else {
+                outsideProject.push(f);
+            }
+        }
+        // Project-wide tsc for files inside tsconfig include
+        if (insideProject.length > 0) {
+            const targetSet = new Set(insideProject);
+            const result = await runCommand('npx tsc --noEmit --project tsconfig.json', projectDir, { timeoutMs: 15000 });
+            if (!result.success) {
+                if (result.exitCode === null) {
+                    log.debug('tsc_project_unavailable');
+                }
+                else {
+                    const rawOutput = (result.stderr || result.stdout || '').trim();
+                    const filtered = filterTscErrors(rawOutput, targetSet);
+                    if (filtered.trim()) {
+                        errors.push(`${insideProject.join(', ')}: syntax validation failed — ${filtered}`);
+                    }
+                }
+            }
+        }
+        // Per-file fallback for files outside tsconfig include (tests, etc.)
+        for (const filePath of outsideProject) {
+            const fullPath = path.join(projectDir, filePath);
+            const result = await runCommand(`npx tsc --noEmit --isolatedModules --skipLibCheck "${fullPath}"`, projectDir, { timeoutMs: 5000 });
+            if (!result.success) {
+                if (result.exitCode === null) {
+                    log.debug({ filePath }, 'syntax_validator_unavailable');
+                    continue;
+                }
+                const rawOutput = (result.stderr || result.stdout || '').trim();
+                const targetSet = new Set([filePath, fullPath]);
+                const filtered = filterTscErrors(rawOutput, targetSet);
+                if (filtered.trim()) {
+                    errors.push(`${filePath}: syntax validation failed — ${filtered}`);
+                }
+            }
+        }
+    }
+    // --- Non-TS file validation (JSON, JS) ---
+    for (const filePath of otherFiles) {
+        const ext = path.extname(filePath).toLowerCase();
+        const fullPath = path.join(projectDir, filePath);
+        // JSON: in-process parse (no child process needed)
+        if (ext === '.json') {
+            try {
+                const content = await fs.readFile(fullPath, 'utf-8');
+                JSON.parse(content);
+            }
+            catch (err) {
+                errors.push(`${filePath}: JSON syntax error — ${err instanceof Error ? err.message : err}`);
+            }
+            continue;
+        }
+        // JS: node --check
+        if (ext === '.js' || ext === '.mjs' || ext === '.cjs') {
+            const result = await runCommand(`node --check "${fullPath}"`, projectDir, { timeoutMs: 5000 });
+            if (!result.success) {
+                if (result.exitCode === null) {
+                    log.debug({ filePath, error: result.error }, 'syntax_validator_unavailable');
+                    continue;
+                }
+                const detail = (result.stderr || result.stdout || '').trim();
+                errors.push(`${filePath}: syntax validation failed — ${detail}`);
+            }
+        }
+    }
+    return { valid: errors.length === 0, errors };
+}
 /**
  * Apply a stream's artifact to the project codebase.
  * Creates a backup before applying. Rolls back on error.
@@ -492,6 +665,18 @@ export async function applyArtifact(projectDir, streamId, options = {}) {
             await applyOperation(projectDir, op);
             appliedCount++;
         }
+        // Post-apply syntax validation — revert if broken syntax applied
+        const syntaxResult = await validateSyntax(projectDir, artifact.operations);
+        if (!syntaxResult.valid) {
+            log.warn({ streamId, errors: syntaxResult.errors }, 'syntax_validation_failed');
+            await revertStreamBackup(projectDir, backup);
+            return {
+                success: false,
+                streamId,
+                appliedOps: appliedCount,
+                error: `Syntax validation failed, rolled back: ${syntaxResult.errors.join('; ')}`,
+            };
+        }
         return { success: true, streamId, appliedOps: appliedCount };
     }
     catch (err) {
@@ -708,6 +893,138 @@ export async function createStreamBackup(projectDir, streamId, operations) {
     }
     return { streamId, entries, createdFiles };
 }
+const BACKUPS_DIR = 'backups';
+function backupsPath(projectDir) {
+    return path.join(projectDir, '.orchex', 'active', BACKUPS_DIR);
+}
+function backupFilePath(projectDir, streamId) {
+    return path.join(backupsPath(projectDir), `${streamId}.json`);
+}
+/**
+ * Persist a stream backup to disk as JSON.
+ * Stored in .orchex/active/backups/<streamId>.json
+ */
+export async function writeBackup(projectDir, backup) {
+    const dir = backupsPath(projectDir);
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(backupFilePath(projectDir, backup.streamId), JSON.stringify(backup), 'utf-8');
+}
+/**
+ * Read a single backup from disk. Returns null if not found.
+ */
+export async function readBackup(projectDir, streamId) {
+    try {
+        const raw = await fs.readFile(backupFilePath(projectDir, streamId), 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read all persisted backups from disk.
+ */
+export async function readAllBackups(projectDir) {
+    const dir = backupsPath(projectDir);
+    try {
+        const files = await fs.readdir(dir);
+        const backups = [];
+        for (const file of files) {
+            if (!file.endsWith('.json'))
+                continue;
+            try {
+                const raw = await fs.readFile(path.join(dir, file), 'utf-8');
+                backups.push(JSON.parse(raw));
+            }
+            catch {
+                // Skip corrupt files
+            }
+        }
+        return backups;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Delete a single backup file.
+ */
+export async function deleteBackup(projectDir, streamId) {
+    try {
+        await fs.unlink(backupFilePath(projectDir, streamId));
+    }
+    catch {
+        // Already gone — no-op
+    }
+}
+function isolationStatePath(projectDir) {
+    return path.join(projectDir, '.orchex', 'active', '.isolation-state');
+}
+/**
+ * Write isolation state to disk before each dangerous phase.
+ * If the process crashes, recovery can read this to know which
+ * stream was being tested and restore from its disk backup.
+ */
+export async function writeIsolationState(projectDir, streamId, phase) {
+    const state = { streamId, phase, timestamp: new Date().toISOString() };
+    const dir = path.dirname(isolationStatePath(projectDir));
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(isolationStatePath(projectDir), JSON.stringify(state), 'utf-8');
+}
+/**
+ * Read isolation state. Returns null if no state file exists.
+ */
+export async function readIsolationState(projectDir) {
+    try {
+        const raw = await fs.readFile(isolationStatePath(projectDir), 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Clear isolation state after successful completion or recovery.
+ */
+export async function clearIsolationState(projectDir) {
+    try {
+        await fs.unlink(isolationStatePath(projectDir));
+    }
+    catch {
+        // Already gone
+    }
+}
+/**
+ * Recover from a crash that happened during verify isolation.
+ * Reads .isolation-state to determine which stream was being tested,
+ * then restores it from its disk backup.
+ *
+ * Returns true if recovery was performed, false if no recovery needed.
+ */
+export async function recoverFromIsolationCrash(projectDir) {
+    const state = await readIsolationState(projectDir);
+    if (!state)
+        return false;
+    log.warn({ streamId: state.streamId, phase: state.phase }, 'Recovering from isolation crash');
+    const backup = await readBackup(projectDir, state.streamId);
+    if (!backup) {
+        log.warn({ streamId: state.streamId }, 'No disk backup found for crashed isolation stream');
+        await clearIsolationState(projectDir);
+        return false;
+    }
+    // If we crashed during 'reverting' or 'testing', the files may be in a
+    // reverted state. We need to restore the stream's changes.
+    // If we crashed during 'restoring', the restore may be partial — re-apply.
+    try {
+        await restoreStreamBackup(projectDir, backup);
+        log.info({ streamId: state.streamId }, 'Isolation crash recovery: stream restored from disk backup');
+    }
+    catch (err) {
+        log.error({ streamId: state.streamId, error: err.message }, 'Isolation crash recovery failed');
+    }
+    await clearIsolationState(projectDir);
+    return true;
+}
 /**
  * Revert a stream's changes using its backup.
  * Restores modified files and removes created files.
@@ -771,27 +1088,80 @@ export async function restoreStreamBackup(projectDir, backup) {
 // ============================================================================
 // Verify Isolation
 // ============================================================================
+/**
+ * Execute a function with only the specified stream's changes on disk.
+ * Temporarily reverts all other streams' backups, runs fn, then restores them.
+ * Uses crash-recovery state machine (.isolation-state) for safety.
+ *
+ * If otherBackups is empty, fn is called directly without isolation.
+ */
+export async function withStreamIsolation(projectDir, streamId, otherBackups, fn) {
+    if (otherBackups.length === 0) {
+        return fn();
+    }
+    // Save current state of files modified by other streams (for restore)
+    const currentStates = [];
+    try {
+        // Phase 1: Revert all other streams' changes
+        await writeIsolationState(projectDir, streamId, 'reverting');
+        for (const backup of otherBackups) {
+            const currentState = await createStreamBackup(projectDir, `${backup.streamId}-current`, backup.entries.map(e => ({ type: 'edit', path: e.path, edits: [] })));
+            for (const createdFile of backup.createdFiles) {
+                try {
+                    const content = await fs.readFile(path.join(projectDir, createdFile), 'utf-8');
+                    currentState.entries.push({ path: createdFile, content });
+                }
+                catch {
+                    // File doesn't exist
+                }
+            }
+            currentStates.push(currentState);
+            await revertStreamBackup(projectDir, backup);
+        }
+        // Phase 2: Run fn with only this stream's changes on disk
+        await writeIsolationState(projectDir, streamId, 'testing');
+        return await fn();
+    }
+    finally {
+        // Phase 3: ALWAYS restore all other streams' changes
+        await writeIsolationState(projectDir, streamId, 'restoring');
+        for (const state of currentStates) {
+            await restoreStreamBackup(projectDir, state);
+        }
+        await clearIsolationState(projectDir);
+    }
+}
 /**
  * Isolate which stream(s) caused a verify failure by temporarily
  * reverting each stream's changes and re-running its verify commands.
  *
- * Returns a map of streamId → verdict:
- * - 'guilty': reverting this stream made verify pass
- * - 'innocent': reverting this stream didn't fix verify
- * - 'unknown': couldn't determine (interaction between streams)
+ * Returns an IsolationResult with:
+ * - verdicts: streamId → 'guilty' | 'innocent' | 'unknown'
+ * - fileOverlaps: files modified by multiple streams (diagnostic hint)
  */
-export async function isolateVerifyFailure(projectDir, backups, failedVerifyMap) {
+export async function isolateVerifyFailure(projectDir, backups, failedVerifyMap, options) {
     const verdicts = new Map();
     // Single stream: it's trivially the cause
     if (backups.length === 1) {
         verdicts.set(backups[0].streamId, 'guilty');
-        return verdicts;
+        return { verdicts, fileOverlaps: [] };
     }
+    const deadline = Date.now() + (options?.timeoutMs ?? 120_000);
     // Collect all unique failed commands for cross-stream testing
     const allFailedCmds = [...new Set([...failedVerifyMap.values()].flat())];
     // For each stream, temporarily revert its changes and re-run verify
     let foundGuilty = false;
     for (const backup of backups) {
+        // Check if we've exceeded the timeout
+        if (Date.now() >= deadline) {
+            // Mark all remaining untested streams as unknown
+            for (const b of backups) {
+                if (!verdicts.has(b.streamId)) {
+                    verdicts.set(b.streamId, 'unknown');
+                }
+            }
+            break;
+        }
         // Save current state of files this stream modified
         const currentState = await createStreamBackup(projectDir, `${backup.streamId}-current`, backup.entries.map(e => ({ type: 'edit', path: e.path, edits: [] })));
         // Also track created files that currently exist
@@ -804,16 +1174,27 @@ export async function isolateVerifyFailure(projectDir, backups, failedVerifyMap)
                 // File doesn't exist, nothing to save
             }
         }
-        // Revert this stream's changes
-        await revertStreamBackup(projectDir, backup);
-        // Use this stream's own failed verify commands if it has them,
-        // otherwise use all failed commands (cross-stream check)
-        const ownFailedCmds = failedVerifyMap.get(backup.streamId);
-        const cmdsToTest = ownFailedCmds ?? allFailedCmds;
-        const results = await runCommands(cmdsToTest, projectDir);
-        const passed = results.every(r => r.success);
-        // Restore this stream's changes
-        await restoreStreamBackup(projectDir, currentState);
+        let passed = false;
+        try {
+            // Revert this stream's changes
+            await writeIsolationState(projectDir, backup.streamId, 'reverting');
+            await revertStreamBackup(projectDir, backup);
+            // Use this stream's own failed verify commands if it has them,
+            // otherwise use all failed commands (cross-stream check)
+            const ownFailedCmds = failedVerifyMap.get(backup.streamId);
+            const cmdsToTest = ownFailedCmds ?? allFailedCmds;
+            await writeIsolationState(projectDir, backup.streamId, 'testing');
+            const remainingMs = deadline - Date.now();
+            const perCmdTimeout = Math.max(remainingMs, 1000);
+            const results = await runCommands(cmdsToTest, projectDir, { timeoutMs: perCmdTimeout });
+            passed = results.every(r => r.success);
+        }
+        finally {
+            // ALWAYS restore — even on timeout or error
+            await writeIsolationState(projectDir, backup.streamId, 'restoring');
+            await restoreStreamBackup(projectDir, currentState);
+        }
+        await clearIsolationState(projectDir);
         if (passed) {
             verdicts.set(backup.streamId, 'guilty');
             foundGuilty = true;
@@ -828,5 +1209,27 @@ export async function isolateVerifyFailure(projectDir, backups, failedVerifyMap)
             verdicts.set(backup.streamId, 'unknown');
         }
     }
-    return verdicts;
+    // Final cleanup — ensure state file is removed
+    await clearIsolationState(projectDir);
+    // Compute file overlaps for diagnostic hints
+    const fileToStreams = new Map();
+    for (const backup of backups) {
+        for (const entry of backup.entries) {
+            const streams = fileToStreams.get(entry.path) ?? [];
+            streams.push(backup.streamId);
+            fileToStreams.set(entry.path, streams);
+        }
+        for (const created of backup.createdFiles) {
+            const streams = fileToStreams.get(created) ?? [];
+            streams.push(backup.streamId);
+            fileToStreams.set(created, streams);
+        }
+    }
+    const fileOverlaps = [];
+    for (const [filePath, streams] of fileToStreams) {
+        if (streams.length > 1) {
+            fileOverlaps.push({ path: filePath, streams });
+        }
+    }
+    return { verdicts, fileOverlaps };
 }

package/dist/config.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const PRODUCTION_URL = "https://api.orchex.dev";
+export declare const PRODUCTION_URL = "https://orchex.dev";
 export declare const LLMProviderSchema: z.ZodEnum<["anthropic", "openai", "gemini", "ollama", "deepseek"]>;
 export type LLMProvider = z.infer<typeof LLMProviderSchema>;
 /**
@@ -42,7 +42,7 @@ export declare const TelemetryConfigSchema: z.ZodObject<{
 }>;
 export declare const ConfigSchema: z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<["local", "cloud"]>>;
-    apiUrl: z.ZodDefault<z.ZodString>;
+    apiUrl: z.ZodDefault<z.ZodEffects<z.ZodString, string, string>>;
     apiKey: z.ZodOptional<z.ZodString>;
     /** User's subscription tier (synced from cloud on login) */
     tier: z.ZodDefault<z.ZodEnum<["free", "pro", "team", "enterprise"]>>;
@@ -98,3 +98,7 @@ export declare function loadConfig(): Promise<Config>;
  * Save partial config. Merges with existing config.
  */
 export declare function saveConfig(partial: Partial<Config>): Promise<Config>;
+/**
+ * Returns config with apiKey masked for safe display (CLI output, logs).
+ */
+export declare function maskConfigForDisplay(config: Config): Record<string, unknown>;

package/dist/config.js

@@ -4,7 +4,7 @@ import * as os from 'os';
 import { z } from 'zod';
 import { TierIdSchema } from './tiers.js';
 // Well-known URLs
-export const PRODUCTION_URL = 'https://api.orchex.dev';
+export const PRODUCTION_URL = 'https://orchex.dev';
 // ============================================================================
 // LLM Provider Configuration
 // ============================================================================
@@ -117,7 +117,7 @@ export const TelemetryConfigSchema = z.object({
 });
 export const ConfigSchema = z.object({
     mode: z.enum(['local', 'cloud']).default('local'),
-    apiUrl: z.string().url().default(PRODUCTION_URL),
+    apiUrl: z.string().url().refine((u) => u.startsWith('https://') || u.startsWith('http://localhost') || u.startsWith('http://127.0.0.1'), { message: 'apiUrl must use https:// (http://localhost and http://127.0.0.1 are allowed for development)' }).default(PRODUCTION_URL),
     apiKey: z.string().optional(),
     /** User's subscription tier (synced from cloud on login) */
     tier: TierIdSchema.default('free'),
@@ -170,3 +170,12 @@ export async function saveConfig(partial) {
     await fs.writeFile(configPath(), JSON.stringify(validated, null, 2), { encoding: 'utf-8', mode: 0o600 });
     return validated;
 }
+/**
+ * Returns config with apiKey masked for safe display (CLI output, logs).
+ */
+export function maskConfigForDisplay(config) {
+    return {
+        ...config,
+        apiKey: config.apiKey ? '...' + config.apiKey.slice(-6) : undefined,
+    };
+}

package/dist/context-builder.d.ts

@@ -14,8 +14,9 @@ export declare function buildStreamContext(projectDir: string, owns: string[], r
 export declare function buildDependencyContext(projectDir: string, deps: string[], manifest: Manifest): Promise<string>;
 /**
  * Build output instructions: artifact format, rules, constraints.
+ * Optionally includes provider-specific guidance for known LLM weaknesses.
  */
-export declare function buildInstructions(streamId: string, owns: string[]): string;
+export declare function buildInstructions(streamId: string, owns: string[], provider?: string): string;
 /**
  * Build the complete prompt for an agent, assembling all 4 context layers.
  */