devlensio 0.2.0

package/dist/config/types.js

@@ -0,0 +1,81 @@
+// Note: apiKey is intentionally absent from all defaults.
+// If a user reaches the defaults with no key configured anywhere,
+// the system fails clearly at the LLM call — never silently sends an empty key.
+export const OLLAMA_DEFAULTS = {
+    deploymentMode: "local",
+    summarization: {
+        provider: "ollama",
+        model: "qwen2.5-coder:3b", // code-aware, 3B params, runs on ~2GB RAM
+        baseUrl: "http://localhost:11434",
+        batchSize: 50,
+    },
+    embedding: {
+        provider: "ollama",
+        model: "nomic-embed-text", // best local embedding model, 768 dims
+        baseUrl: "http://localhost:11434",
+    },
+    // neo4j absent — file-only mode is the safe default
+};
+export const ANTHROPIC_DEFAULTS = {
+    deploymentMode: "local",
+    summarization: {
+        provider: "anthropic",
+        model: "claude-haiku-4-5", // fastest Claude, cheapest, good code understanding
+        batchSize: 50,
+        // apiKey intentionally absent — user must set in config.json
+    },
+    embedding: {
+        provider: "openai",
+        model: "text-embedding-3-small", // most common, cheapest OpenAI embedding
+        // apiKey intentionally absent
+    },
+    // neo4j absent
+};
+// ─── Request Header Names ─────────────────────────────────────────────────────
+//
+// Exact header names the cloud backend sends to this Bun backend.
+// Defined as constants so they are never mistyped across files.
+//
+// The server layer MUST call sanitizeHeaders() before logging any request.
+// Headers marked "NEVER LOG" must never appear in any log output.
+export const CONFIG_HEADERS = {
+    // LLM provider for summarization
+    PROVIDER: "x-llm-provider", // e.g. "anthropic"
+    MODEL: "x-llm-model", // e.g. "claude-haiku-4-5"
+    API_KEY: "x-llm-key",
+    BASE_URL: "x-llm-base-url", // for Ollama: "http://localhost:11434"
+    BATCH_SIZE: "x-batch-size", // e.g. "30"
+    EMBED_PROVIDER: "x-embed-provider",
+    EMBED_MODEL: "x-embed-model",
+    EMBED_KEY: "x-embed-key",
+    EMBED_BASE_URL: "x-embed-base-url", // for Ollama embedding
+    NEO4J_URL: "x-neo4j-url",
+    NEO4J_USER: "x-neo4j-user",
+    NEO4J_PASSWORD: "x-neo4j-password",
+    NEO4J_STORECODE: "false",
+};
+// ─── Sensitive Headers Set ────────────────────────────────────────────────────
+//
+// Used by sanitizeHeaders() below.
+// Add any new secret header here the moment it is added to CONFIG_HEADERS.
+const SENSITIVE_HEADERS = new Set([
+    CONFIG_HEADERS.API_KEY,
+    CONFIG_HEADERS.EMBED_KEY,
+    CONFIG_HEADERS.NEO4J_PASSWORD,
+]);
+// ─── sanitizeHeaders ──────────────────────────────────────────────────────────
+//
+// Call this before logging ANY request headers anywhere in the codebase.
+// Replaces secret values with "[REDACTED]" so API keys never appear in logs.
+//
+// Usage:
+//   console.log("Incoming headers:", sanitizeHeaders(Object.fromEntries(req.headers)));
+export function sanitizeHeaders(headers) {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(headers)) {
+        sanitized[key] = SENSITIVE_HEADERS.has(key.toLowerCase())
+            ? "[REDACTED]"
+            : value;
+    }
+    return sanitized;
+}

package/dist/config/writer.d.ts

@@ -0,0 +1,29 @@
+import type { DevLensConfig } from "./types.js";
+type DeepPartial<T> = {
+    [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P];
+};
+type PartialConfig = DeepPartial<DevLensConfig>;
+export interface SafeConfig {
+    deploymentMode: DevLensConfig["deploymentMode"];
+    summarization: {
+        provider: string;
+        model: string;
+        baseUrl?: string;
+        batchSize: number;
+        apiKeyHint?: string;
+    };
+    embedding: {
+        provider: string;
+        model: string;
+        baseUrl?: string;
+        apiKeyHint?: string;
+    };
+    neo4j?: {
+        url: string;
+        username: string;
+        storeRawCode: boolean;
+    };
+}
+export declare function writeConfig(partial: PartialConfig): void;
+export declare function maskConfig(config: DevLensConfig): SafeConfig;
+export {};

package/dist/config/writer.js

@@ -0,0 +1,103 @@
+//! The concept of local config file should only exist in open Source, and in case of deployment the apis for writing this cofig file should never be exposed. 
+import fs from "fs";
+import { CONFIG_FILE, CONFIG_DIR } from "./providers/file.js";
+function readRawFile() {
+    if (!fs.existsSync(CONFIG_FILE))
+        return {};
+    try {
+        return JSON.parse(fs.readFileSync(CONFIG_FILE, "utf-8"));
+    }
+    catch {
+        console.warn(`DevLens: config file is malformed, resetting to empty.`);
+        return {};
+    }
+}
+//  atomicWrite 
+// Writes to a temp file first, then renames to the real path.
+// If the server crashes mid-write, the old config survives intact.
+function atomicWrite(filePath, content) {
+    const tmp = `${filePath}.tmp`;
+    fs.writeFileSync(tmp, content, "utf-8");
+    fs.renameSync(tmp, filePath);
+}
+//  writeConfig ─
+//
+// Public — called by PATCH /api/config handler.
+//
+// Takes only what the user changed from the UI settings form.
+// Merges it on top of whatever is currently in config.json.
+// Writes the result back atomically.
+//
+// Does NOT merge with defaults or env vars — that is file.ts's job at read time.
+// The file only ever contains what the user explicitly set.
+export function writeConfig(partial) {
+    // Ensure ~/.devlens/ exists — creates it on first save
+    if (!fs.existsSync(CONFIG_DIR)) {
+        fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    }
+    const existing = readRawFile();
+    const updated = {
+        ...existing,
+        // Only merge blocks that the user actually touched
+        ...(partial.deploymentMode && {
+            deploymentMode: partial.deploymentMode,
+        }),
+        ...(partial.summarization && {
+            summarization: {
+                ...existing.summarization,
+                ...partial.summarization,
+            },
+        }),
+        ...(partial.embedding && {
+            embedding: {
+                ...existing.embedding,
+                ...partial.embedding,
+            },
+        }),
+        // neo4j: if user sent it, merge. If user sent null explicitly, delete it.
+        // undefined means "don't touch it"
+        ...(partial.neo4j !== undefined && {
+            neo4j: partial.neo4j === null
+                ? undefined // user explicitly removed Neo4j config
+                : {
+                    ...existing.neo4j,
+                    ...partial.neo4j,
+                },
+        }),
+    };
+    atomicWrite(CONFIG_FILE, JSON.stringify(updated, null, 2));
+}
+function maskKey(key) {
+    if (!key)
+        return undefined;
+    // Show last 3 characters only — enough to identify which key is set
+    return `...${key.slice(-3)}`;
+}
+//  maskConfig 
+// Public — called by GET /api/config handler.
+export function maskConfig(config) {
+    return {
+        deploymentMode: config.deploymentMode,
+        summarization: {
+            provider: config.summarization.provider,
+            model: config.summarization.model,
+            baseUrl: config.summarization.baseUrl,
+            batchSize: config.summarization.batchSize,
+            apiKeyHint: maskKey(config.summarization.apiKey),
+        },
+        embedding: {
+            provider: config.embedding.provider,
+            model: config.embedding.model,
+            baseUrl: config.embedding.baseUrl,
+            apiKeyHint: maskKey(config.embedding.apiKey),
+        },
+        // neo4j: return url, storeCode, and username only — password never sent to browser
+        ...(config.neo4j && {
+            neo4j: {
+                url: config.neo4j.url,
+                username: config.neo4j.username,
+                storeRawCode: config.neo4j.storeRawCode,
+            },
+        }),
+    };
+}

package/dist/filesystem/appRouter.d.ts

@@ -0,0 +1,2 @@
+import type { RouteNode } from "../types.js";
+export declare function analyzeAppRouter(repoPath: string): RouteNode[];

package/dist/filesystem/appRouter.js

@@ -0,0 +1,126 @@
+import fs from "fs";
+import path from "path";
+// Converts a filesystem path to a URL path
+// e.g. /users/[userId]/posts → /users/:userId/posts
+function toUrlPath(relativePath) {
+    return ("/" +
+        relativePath
+            .split(path.sep)
+            .map((segment) => {
+            if (segment.startsWith("[...") && segment.endsWith("]")) {
+                // Catch-all: [...slug] → :slug*
+                const param = segment.slice(4, -1);
+                return `:${param}*`;
+            }
+            if (segment.startsWith("[") && segment.endsWith("]")) {
+                // Dynamic: [userId] → :userId
+                const param = segment.slice(1, -1);
+                return `:${param}`;
+            }
+            if (segment.startsWith("(") && segment.endsWith(")")) {
+                // Route group: (auth) → ignored in URL
+                return null;
+            }
+            return segment;
+        })
+            .filter(Boolean)
+            .join("/"));
+}
+// Extracts param names from a url path
+// e.g. /users/:userId/posts/:postId → ["userId", "postId"]
+function extractParams(urlPath) {
+    const matches = urlPath.match(/:([a-zA-Z]+)\*?/g) || [];
+    return matches.map((m) => m.replace(":", "").replace("*", ""));
+}
+// Determines the RouteNodeType from a filename
+function getRouteNodeType(fileName) {
+    if (fileName === "page.tsx" || fileName === "page.ts" || fileName === "page.jsx" || fileName === "page.js")
+        return "PAGE";
+    if (fileName === "layout.tsx" || fileName === "layout.ts" || fileName === "layout.jsx" || fileName === "layout.js")
+        return "LAYOUT";
+    if (fileName === "loading.tsx" || fileName === "loading.ts")
+        return "LOADING";
+    if (fileName === "error.tsx" || fileName === "error.ts")
+        return "ERROR";
+    if (fileName === "not-found.tsx" || fileName === "not-found.ts")
+        return "NOT_FOUND";
+    if (fileName === "route.ts" || fileName === "route.js")
+        return "API_ROUTE";
+    return null;
+}
+// Finds the closest layout file that wraps a given route
+function findLayoutPath(filePath, appDir) {
+    let dir = path.dirname(filePath);
+    while (dir !== appDir && dir !== path.dirname(appDir)) {
+        const layout = ["layout.tsx", "layout.ts", "layout.jsx", "layout.js"]
+            .map((f) => path.join(dir, f))
+            .find((f) => fs.existsSync(f));
+        if (layout)
+            return layout;
+        dir = path.dirname(dir);
+    }
+    return undefined;
+}
+// Recursively walks the app directory and collects all route nodes
+function walkAppDir(currentDir, appDir, nodes) {
+    const entries = fs.readdirSync(currentDir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(currentDir, entry.name);
+        if (entry.isDirectory()) {
+            walkAppDir(fullPath, appDir, nodes);
+            continue;
+        }
+        const nodeType = getRouteNodeType(entry.name);
+        if (!nodeType)
+            continue;
+        // Get path relative to app directory
+        const relativePath = path.relative(appDir, path.dirname(fullPath));
+        const urlPath = relativePath === "." ? "/" : toUrlPath(relativePath);
+        const params = extractParams(urlPath);
+        const isDynamic = params.length > 0;
+        const isCatchAll = urlPath.includes("*");
+        const isGroupRoute = path
+            .dirname(fullPath)
+            .split(path.sep)
+            .some((s) => s.startsWith("(") && s.endsWith(")"));
+        const layoutPath = nodeType === "PAGE"
+            ? findLayoutPath(fullPath, appDir)
+            : undefined;
+        nodes.push({
+            type: nodeType,
+            urlPath,
+            filePath: fullPath,
+            isDynamic,
+            isCatchAll,
+            isGroupRoute,
+            layoutPath,
+            params: params.length > 0 ? params : undefined,
+        });
+    }
+}
+export function analyzeAppRouter(repoPath) {
+    let appDir = path.join(repoPath, "src/app");
+    if (!fs.existsSync(appDir)) {
+        appDir = path.join(repoPath, "app");
+    }
+    if (!fs.existsSync(appDir)) {
+        throw new Error(`No app directory found at: ${appDir}`);
+    }
+    // Check for middleware at root level
+    const nodes = [];
+    const middlewarePath = ["middleware.ts", "middleware.js"]
+        .map((f) => path.join(repoPath, f))
+        .find((f) => fs.existsSync(f));
+    if (middlewarePath) {
+        nodes.push({
+            type: "MIDDLEWARE",
+            urlPath: "*",
+            filePath: middlewarePath,
+            isDynamic: false,
+            isCatchAll: true,
+            isGroupRoute: false,
+        });
+    }
+    walkAppDir(appDir, appDir, nodes);
+    return nodes;
+}

package/dist/filesystem/backendRoutes.d.ts

@@ -0,0 +1,2 @@
+import type { BackendRouteNode } from "../types.js";
+export declare function analyzeBackendRoutes(repoPath: string): BackendRouteNode[];

package/dist/filesystem/backendRoutes.js

@@ -0,0 +1,161 @@
+import { Project, SyntaxKind } from "ts-morph";
+import path from "path";
+import fs from "fs";
+const HTTP_METHODS = [
+    "get", "post", "put", "delete",
+    "patch", "options", "head",
+];
+const APP_INSTANCE_NAMES = [
+    "app", "router", "fastify",
+    "server", "api", "koa",
+];
+const IGNORE_DIRS = [
+    "node_modules", "dist", "build",
+    ".next", "coverage", ".git",
+];
+function extractParams(urlPath) {
+    const matches = urlPath.match(/:([a-zA-Z0-9_]+)/g) || [];
+    return matches.map((m) => m.replace(":", ""));
+}
+function normalizeMethod(method) {
+    return method.toUpperCase();
+}
+// Detects backend framework from file import statements
+function detectFileFramework(fileContent) {
+    if (fileContent.includes("from 'express'") ||
+        fileContent.includes('from "express"') ||
+        fileContent.includes("require('express')") ||
+        fileContent.includes('require("express")'))
+        return "express";
+    if (fileContent.includes("from 'fastify'") ||
+        fileContent.includes('from "fastify"') ||
+        fileContent.includes("require('fastify')") ||
+        fileContent.includes('require("fastify")'))
+        return "fastify";
+    if (fileContent.includes("from 'koa'") ||
+        fileContent.includes('from "koa"') ||
+        fileContent.includes("require('koa')") ||
+        fileContent.includes('require("koa")'))
+        return "koa";
+    return null;
+}
+function findBackendFiles(dir, files = []) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return files;
+    }
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (IGNORE_DIRS.includes(entry.name))
+                continue;
+            findBackendFiles(fullPath, files);
+        }
+        else if (entry.isFile()) {
+            if (/\.(ts|js)$/.test(entry.name)) {
+                files.push(fullPath);
+            }
+        }
+    }
+    return files;
+}
+export function analyzeBackendRoutes(repoPath) {
+    const nodes = [];
+    const project = new Project({
+        compilerOptions: {
+            allowJs: true,
+            checkJs: false,
+            strict: false,
+        },
+        skipAddingFilesFromTsConfig: true,
+    });
+    const files = findBackendFiles(repoPath);
+    // Only add files that actually import a backend framework
+    for (const filePath of files) {
+        const content = fs.readFileSync(filePath, "utf-8");
+        if (detectFileFramework(content)) {
+            project.addSourceFileAtPath(filePath);
+        }
+    }
+    for (const file of project.getSourceFiles()) {
+        const filePath = file.getFilePath();
+        const content = fs.readFileSync(filePath, "utf-8");
+        const framework = detectFileFramework(content);
+        if (!framework)
+            continue;
+        const callExpressions = file.getDescendantsOfKind(SyntaxKind.CallExpression);
+        for (const call of callExpressions) {
+            try {
+                const expression = call.getExpression();
+                const expressionText = expression.getText();
+                const parts = expressionText.split(".");
+                if (parts.length < 2)
+                    continue;
+                const methodName = parts[parts.length - 1].toLowerCase();
+                const objectName = parts[parts.length - 2].toLowerCase();
+                if (!HTTP_METHODS.includes(methodName))
+                    continue;
+                const isKnownInstance = APP_INSTANCE_NAMES.includes(objectName);
+                const looksLikeRouter = objectName.includes("router") ||
+                    objectName.includes("app") ||
+                    objectName.includes("server") ||
+                    objectName.includes("api");
+                if (!isKnownInstance && !looksLikeRouter)
+                    continue;
+                const args = call.getArguments();
+                if (args.length === 0)
+                    continue;
+                const firstArgText = args[0].getText();
+                // Must be a string literal
+                if (!firstArgText.startsWith("'") &&
+                    !firstArgText.startsWith('"') &&
+                    !firstArgText.startsWith("`"))
+                    continue;
+                // Remove quotes correctly — handles single, double, and backtick
+                const urlPath = firstArgText.replace(/^['"`]|['"`]$/g, "");
+                if (!urlPath.startsWith("/"))
+                    continue;
+                // Extract handler name if last argument is a simple identifier
+                let handlerName;
+                let inlineHandler;
+                if (args.length >= 2) {
+                    const lastArg = args[args.length - 1];
+                    const lastArgText = lastArg.getText();
+                    if (!lastArgText.includes("=>") &&
+                        !lastArgText.includes("function") &&
+                        /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(lastArgText)) {
+                        handlerName = lastArgText;
+                    }
+                    else if (lastArgText.includes("=>") || lastArgText.includes("function")) {
+                        //extract the inline handler 
+                        inlineHandler = {
+                            rawCode: lastArgText,
+                            startLine: lastArg.getStartLineNumber(),
+                            endLine: lastArg.getEndLineNumber(),
+                        };
+                    }
+                    ;
+                }
+                const params = extractParams(urlPath);
+                nodes.push({
+                    type: "BACKEND_ROUTE",
+                    urlPath,
+                    filePath,
+                    httpMethod: normalizeMethod(methodName),
+                    handlerName,
+                    inlineHandler,
+                    framework,
+                    isDynamic: params.length > 0,
+                    params: params.length > 0 ? params : undefined,
+                });
+            }
+            catch {
+                continue;
+            }
+        }
+    }
+    return nodes;
+}

package/dist/filesystem/index.d.ts

@@ -0,0 +1,2 @@
+import type { BackendRouteNode, ProjectFingerprint, RouteNode } from "../types.js";
+export declare function analyzeFilesystem(repoPath: string, fingerprint: ProjectFingerprint): (RouteNode[] | BackendRouteNode[]);

package/dist/filesystem/index.js

@@ -0,0 +1,28 @@
+import path from "path";
+import { analyzeAppRouter } from "./appRouter.js";
+import { analyzePagesRouter } from "./pagesRouter.js";
+import { analyzeBackendRoutes } from "./backendRoutes.js";
+export function analyzeFilesystem(repoPath, fingerprint) {
+    // Handle backend frameworks first
+    if (["express", "fastify", "koa"].includes(fingerprint.framework)) {
+        return analyzeBackendRoutes(repoPath);
+    }
+    // Handle Next.js frontend
+    if (fingerprint.framework !== "nextjs") {
+        return [];
+    }
+    switch (fingerprint.router) {
+        case "app":
+            return analyzeAppRouter(repoPath);
+        case "pages":
+            return analyzePagesRouter(repoPath);
+        case "app+pages":
+            // Analyze both and merge results
+            const appRoutes = analyzeAppRouter(repoPath);
+            const pagesRoutes = analyzePagesRouter(repoPath);
+            return [...appRoutes, ...pagesRoutes];
+        default:
+            console.warn(`Next.js project detected but no app or pages folder found at: ${path.resolve(repoPath)}`);
+            return [];
+    }
+}

package/dist/filesystem/index.test.d.ts

@@ -0,0 +1 @@
+export {};