gnosys 5.11.4 → 5.12.2

package/dist/lib/apiKeyVault.js

@@ -0,0 +1,447 @@
+/**
+ * API key storage and resolution for Gnosys LLM providers.
+ *
+ * Keychain / env service names (also used as GNOSYS_*_KEY env vars):
+ *   - Global:    GNOSYS_GLOBAL_<PROVIDER>_KEY    (one key for all tasks using that provider)
+ *   - Provider:  GNOSYS_<PROVIDER>_KEY           (legacy default / fallback)
+ */
+import { execSync } from "child_process";
+import dotenv from "dotenv";
+import fsSync from "fs";
+import os from "os";
+import path from "path";
+import { resolveTaskModel, getProviderModel, } from "./config.js";
+const LEGACY_ENV = {
+    anthropic: "ANTHROPIC_API_KEY",
+    openai: "OPENAI_API_KEY",
+    groq: "GROQ_API_KEY",
+    xai: "XAI_API_KEY",
+    mistral: "MISTRAL_API_KEY",
+    openrouter: "OPENROUTER_API_KEY",
+};
+const CLOUD_TASKS = [
+    "structuring",
+    "synthesis",
+    "vision",
+    "transcription",
+    "chat",
+];
+export function providerNeedsApiKey(provider) {
+    return provider !== "ollama" && provider !== "lmstudio" && provider !== "skip";
+}
+function providerSlug(provider) {
+    return provider === "custom" ? "CUSTOM" : provider.toUpperCase();
+}
+/** Keychain service / env var name for a specific scope. */
+export function apiKeyServiceName(provider, scope) {
+    const slug = providerSlug(provider);
+    if (scope === "global") {
+        return `GNOSYS_GLOBAL_${slug}_KEY`;
+    }
+    return `GNOSYS_${slug}_KEY`;
+}
+/** Lookup order: global → provider default (legacy/generic via readFirstInChain). */
+export function apiKeyLookupChain(provider) {
+    return [
+        apiKeyServiceName(provider, "global"),
+        apiKeyServiceName(provider, "provider"),
+    ];
+}
+function configApiKey(config, provider) {
+    switch (provider) {
+        case "anthropic":
+            return config.llm.anthropic.apiKey;
+        case "openai":
+            return config.llm.openai.apiKey;
+        case "groq":
+            return config.llm.groq.apiKey;
+        case "xai":
+            return config.llm.xai.apiKey;
+        case "mistral":
+            return config.llm.mistral.apiKey;
+        case "openrouter":
+            return config.llm.openrouter.apiKey;
+        case "custom":
+            return config.llm.custom?.apiKey;
+        default:
+            return undefined;
+    }
+}
+function readFromKeychain(service) {
+    if (process.env.VITEST)
+        return undefined;
+    if (process.platform === "darwin") {
+        try {
+            return execSync(`security find-generic-password -a "$USER" -s "${service}" -w 2>/dev/null`, { stdio: "pipe", encoding: "utf-8", timeout: 2000 }).trim() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (process.platform === "linux") {
+        try {
+            return execSync(`secret-tool lookup service gnosys account ${service} 2>/dev/null`, { stdio: "pipe", encoding: "utf-8", timeout: 2000 }).trim() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/** Read a secret directly from the secure store, ignoring env vars. */
+export function readSecureStoreSecret(service) {
+    return readFromKeychain(service);
+}
+/** Read a secret from env or secure store by service name. */
+export function readStoredSecret(service) {
+    if (process.env[service])
+        return process.env[service];
+    return readSecureStoreSecret(service);
+}
+function keyLocationChain(provider) {
+    const slug = provider.toUpperCase();
+    const globalEnvVar = `GNOSYS_GLOBAL_${slug}_KEY`;
+    const providerEnvVar = `GNOSYS_${slug}_KEY`;
+    return [
+        {
+            envVarName: globalEnvVar,
+            serviceName: globalEnvVar,
+        },
+        {
+            envVarName: providerEnvVar,
+            serviceName: providerEnvVar,
+        },
+        { envVarName: `${slug}_API_KEY` },
+        { envVarName: "GNOSYS_LLM_API_KEY" },
+    ];
+}
+function maskedLastFour(key) {
+    return `••••${key.trim().slice(-4)}`;
+}
+function readDotenvKeys() {
+    try {
+        const envPath = path.join(process.env.HOME ?? os.homedir(), ".config", "gnosys", ".env");
+        return dotenv.parse(fsSync.readFileSync(envPath, "utf-8"));
+    }
+    catch {
+        return {};
+    }
+}
+export function detectKeyLocation(provider) {
+    if (!providerNeedsApiKey(provider)) {
+        return { found: false, location: "none" };
+    }
+    const chain = keyLocationChain(provider);
+    const dotenvKeys = readDotenvKeys();
+    for (const { envVarName, serviceName } of chain) {
+        const envKey = process.env[envVarName]?.trim();
+        if (envKey) {
+            return {
+                found: true,
+                location: "env",
+                envVarName,
+                lastFour: maskedLastFour(envKey),
+            };
+        }
+        if (serviceName) {
+            const storedKey = readStoredSecret(serviceName)?.trim();
+            if (storedKey) {
+                return {
+                    found: true,
+                    location: "keychain",
+                    serviceName,
+                    lastFour: maskedLastFour(storedKey),
+                };
+            }
+        }
+        const dotenvKey = dotenvKeys[envVarName]?.trim();
+        if (dotenvKey) {
+            return {
+                found: true,
+                location: "dotenv",
+                envVarName,
+                lastFour: maskedLastFour(dotenvKey),
+            };
+        }
+    }
+    return { found: false, location: "none" };
+}
+/** First non-empty secret in the lookup chain. */
+export function readFirstInChain(provider) {
+    for (const service of apiKeyLookupChain(provider)) {
+        const v = readStoredSecret(service);
+        if (v)
+            return v;
+    }
+    const legacy = LEGACY_ENV[provider];
+    if (legacy && process.env[legacy])
+        return process.env[legacy];
+    if (process.env.GNOSYS_LLM_API_KEY)
+        return process.env.GNOSYS_LLM_API_KEY;
+    return undefined;
+}
+/** Mask for display: first 4 + ellipsis + last 4 characters. */
+export function maskKeySnippet(key) {
+    const trimmed = key.trim();
+    if (trimmed.length <= 8) {
+        return trimmed.length <= 2 ? "••" : `${trimmed.slice(0, 2)}…${trimmed.slice(-2)}`;
+    }
+    return `${trimmed.slice(0, 4)}…${trimmed.slice(-4)}`;
+}
+/**
+ * Where a secret is stored (Keychain, env var name, gnosys.json, or .env file).
+ */
+export function detectSecretSource(service, legacyEnv) {
+    if (process.platform === "darwin" && !process.env.VITEST) {
+        try {
+            const result = execSync(`security find-generic-password -a "$USER" -s "${service}" -w 2>/dev/null`, { stdio: "pipe", encoding: "utf-8", timeout: 2000 }).trim();
+            if (result)
+                return "macOS Keychain";
+        }
+        catch {
+            // not in keychain
+        }
+    }
+    if (process.platform === "linux" && !process.env.VITEST) {
+        try {
+            const result = execSync(`secret-tool lookup service gnosys account ${service} 2>/dev/null`, { stdio: "pipe", encoding: "utf-8", timeout: 2000 }).trim();
+            if (result)
+                return "GNOME Keyring";
+        }
+        catch {
+            // not in keyring
+        }
+    }
+    if (process.env[service])
+        return `$${service}`;
+    if (legacyEnv && process.env[legacyEnv])
+        return `$${legacyEnv}`;
+    try {
+        const envPath = path.join(os.homedir(), ".config", "gnosys", ".env");
+        const content = fsSync.readFileSync(envPath, "utf-8");
+        if (content.includes(`${service}=`))
+            return "~/.config/gnosys/.env";
+    }
+    catch {
+        // no .env
+    }
+    return "";
+}
+/**
+ * List every key slot for a provider that currently holds a value.
+ */
+export function listStoredKeySlots(config, provider) {
+    const slots = [];
+    const fromConfig = configApiKey(config, provider);
+    if (fromConfig) {
+        slots.push({
+            service: "gnosys.json",
+            scope: "provider",
+            source: "gnosys.json (llm block)",
+            preview: maskKeySnippet(fromConfig),
+        });
+    }
+    const seen = new Set();
+    const push = (slot, raw) => {
+        if (seen.has(slot.service))
+            return;
+        seen.add(slot.service);
+        const source = slot.source || detectSecretSource(slot.service, LEGACY_ENV[provider]) || "stored";
+        slots.push({ ...slot, source, preview: maskKeySnippet(raw) });
+    };
+    const globalSvc = apiKeyServiceName(provider, "global");
+    const globalVal = readStoredSecret(globalSvc);
+    if (globalVal) {
+        push({ service: globalSvc, scope: "global", source: detectSecretSource(globalSvc) }, globalVal);
+    }
+    const providerSvc = apiKeyServiceName(provider, "provider");
+    const providerVal = readStoredSecret(providerSvc);
+    if (providerVal) {
+        push({ service: providerSvc, scope: "provider", source: detectSecretSource(providerSvc) }, providerVal);
+    }
+    const legacy = LEGACY_ENV[provider];
+    if (legacy && process.env[legacy] && !seen.has(legacy)) {
+        slots.push({
+            service: legacy,
+            scope: "provider",
+            source: `$${legacy}`,
+            preview: maskKeySnippet(process.env[legacy]),
+        });
+    }
+    if (process.env.GNOSYS_LLM_API_KEY && !seen.has("GNOSYS_LLM_API_KEY")) {
+        slots.push({
+            service: "GNOSYS_LLM_API_KEY",
+            scope: "provider",
+            source: "$GNOSYS_LLM_API_KEY",
+            preview: maskKeySnippet(process.env.GNOSYS_LLM_API_KEY),
+        });
+    }
+    return slots;
+}
+/** Delete a secret from Keychain / GNOME Keyring (not process env). */
+export function deleteStoredSecret(service) {
+    if (service === "gnosys.json")
+        return false;
+    if (process.env.VITEST)
+        return false;
+    if (process.platform === "darwin") {
+        try {
+            execSync(`security delete-generic-password -a "$USER" -s "${service}" 2>/dev/null`, { stdio: "pipe" });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (process.platform === "linux") {
+        try {
+            execSync(`secret-tool clear service gnosys account ${service}`, {
+                stdio: "pipe",
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+/** Resolve API key for a provider. */
+export function getApiKeyForProviderFromConfig(config, provider) {
+    const fromConfig = configApiKey(config, provider);
+    if (fromConfig)
+        return fromConfig;
+    return readFirstInChain(provider);
+}
+export function writeApiKeyToKeychain(service, key) {
+    if (process.platform !== "darwin")
+        return false;
+    try {
+        execSync(`security add-generic-password -a "$USER" -s "${service}" -w "${key.replace(/"/g, '\\"')}" -U`, { stdio: "pipe" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function writeApiKeyToSecretTool(service, key, label) {
+    if (process.platform === "darwin")
+        return false;
+    try {
+        execSync("which secret-tool", { stdio: "pipe" });
+        execSync(`printf "%s" "${key.replace(/"/g, '\\"')}" | secret-tool store --label="${label}" service gnosys account ${service}`, { stdio: "pipe", shell: "/bin/sh" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function storeApiKeySecret(service, key, provider) {
+    if (process.platform === "darwin") {
+        return writeApiKeyToKeychain(service, key);
+    }
+    if (process.platform === "linux") {
+        return writeApiKeyToSecretTool(service, key, `Gnosys ${provider}`);
+    }
+    return false;
+}
+function requirementLabel(req) {
+    if (req.scope === "global") {
+        return `all tasks → ${req.provider}`;
+    }
+    return req.provider;
+}
+function dedupeRequirements(reqs) {
+    const seen = new Set();
+    const out = [];
+    for (const r of reqs) {
+        const id = apiKeyServiceName(r.provider, r.scope);
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        out.push(r);
+    }
+    return out;
+}
+/**
+ * Build key requirements from effective routing — one global key per cloud provider in use.
+ */
+export function buildApiKeyRequirementsFromConfig(config) {
+    const providers = new Set();
+    for (const task of CLOUD_TASKS) {
+        const { provider } = resolveTaskModel(config, task);
+        if (providerNeedsApiKey(provider)) {
+            providers.add(provider);
+        }
+    }
+    if (config.dream?.enabled) {
+        const dreamProvider = (config.dream.provider ?? "ollama");
+        if (providerNeedsApiKey(dreamProvider)) {
+            providers.add(dreamProvider);
+        }
+    }
+    if (providers.size === 0)
+        return [];
+    return dedupeRequirements([...providers].map((provider) => ({
+        provider,
+        scope: "global",
+    })));
+}
+/**
+ * Prompt for missing keys and store in Keychain / GNOME Keyring.
+ */
+export async function ensureApiKeys(rl, requirements, askInput, opts) {
+    const reqs = dedupeRequirements(requirements).filter((r) => providerNeedsApiKey(r.provider));
+    if (reqs.length === 0)
+        return 0;
+    const WARN = opts?.warn ?? "⚠";
+    const CHECK = opts?.check ?? "✓";
+    const CROSS = opts?.cross ?? "✗";
+    const DIM = opts?.dim ?? "";
+    const RESET = opts?.reset ?? "";
+    const maskKey = opts?.maskKey ?? ((k) => k.length <= 8 ? "***" : `${k.slice(0, 3)}***${k.slice(-2)}`);
+    let saved = 0;
+    console.log();
+    console.log(`  ${WARN} API keys — stored in Keychain with scoped names${RESET}`);
+    console.log(`  ${DIM}Global = one key for all tasks using that provider${RESET}`);
+    console.log();
+    for (const req of reqs) {
+        const service = apiKeyServiceName(req.provider, req.scope);
+        if (readStoredSecret(service)) {
+            console.log(`  ${CHECK} ${requirementLabel(req)} ${DIM}(${service})${RESET}`);
+            continue;
+        }
+        const label = requirementLabel(req);
+        console.log(`  ${DIM}Keychain: ${service}${RESET}`);
+        const key = await askInput(rl, `  API key for ${label}`);
+        if (!key) {
+            console.log(`  ${DIM}  skipped ${label}${RESET}`);
+            continue;
+        }
+        if (storeApiKeySecret(service, key, req.provider)) {
+            const store = process.platform === "darwin"
+                ? "macOS Keychain"
+                : "GNOME Keyring";
+            console.log(`  ${CHECK} ${label} → ${store} (${maskKey(key)})`);
+            saved++;
+        }
+        else {
+            console.log(`  ${CROSS} Could not write ${service} to secure store`);
+        }
+    }
+    return saved;
+}
+/** Effective routing map used for key collection. */
+export function buildEffectiveRouting(config) {
+    const out = {};
+    for (const task of CLOUD_TASKS) {
+        out[task] = resolveTaskModel(config, task);
+    }
+    const dreamProvider = (config.dream?.provider ?? "ollama");
+    out.dream = {
+        provider: dreamProvider,
+        model: config.dream?.model ??
+            getProviderModel(config, dreamProvider),
+    };
+    return out;
+}

package/dist/lib/archive.js

@@ -10,7 +10,6 @@
  *                then dearchives used memories back to active
  */
 // Dynamic import — gracefully handles missing native module
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let Database = null;
 try {
     Database = (await import("better-sqlite3")).default;
@@ -26,7 +25,6 @@ import { enableWAL } from "./lock.js";
 import { auditLog } from "./audit.js";
 // ─── Archive Manager ────────────────────────────────────────────────────
 export class GnosysArchive {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     db = null;
     storePath;
     available = false;

package/dist/lib/askCommand.d.ts

@@ -0,0 +1,13 @@
+import type { GnosysResolver } from "./resolver.js";
+export type AskCommandOptions = {
+    limit: string;
+    mode: string;
+    stream: boolean;
+    federated?: boolean;
+    scope?: string;
+    directory?: string;
+    json?: boolean;
+};
+type GetResolver = () => Promise<GnosysResolver>;
+export declare function runAskCommand(getResolver: GetResolver, question: string, opts: AskCommandOptions): Promise<void>;
+export {};

package/dist/lib/askCommand.js

@@ -0,0 +1,145 @@
+import { loadConfig, DEFAULT_CONFIG } from "./config.js";
+import { GnosysSearch } from "./search.js";
+import { getSecureStorageSetupHint } from "./platform.js";
+function outputResult(json, data, humanFn) {
+    if (json) {
+        console.log(JSON.stringify(data, null, 2));
+    }
+    else {
+        humanFn();
+    }
+}
+export async function runAskCommand(getResolver, question, opts) {
+    const resolver = await getResolver();
+    const stores = resolver.getStores();
+    if (stores.length === 0) {
+        console.error("No stores found. Run gnosys init first.");
+        process.exit(1);
+    }
+    const storePath = stores[0].path;
+    let cliConfig;
+    try {
+        cliConfig = await loadConfig(storePath);
+    }
+    catch {
+        cliConfig = DEFAULT_CONFIG;
+    }
+    const search = new GnosysSearch(storePath);
+    search.clearIndex();
+    for (const s of stores) {
+        await search.addStoreMemories(s.store, s.label);
+    }
+    const { GnosysEmbeddings } = await import("./embeddings.js");
+    const { GnosysHybridSearch } = await import("./hybridSearch.js");
+    const { GnosysAsk } = await import("./ask.js");
+    const embeddings = new GnosysEmbeddings(storePath);
+    const hybridSearch = new GnosysHybridSearch(search, embeddings, resolver, storePath);
+    const ask = new GnosysAsk(hybridSearch, cliConfig, resolver, storePath);
+    if (!ask.isLLMAvailable) {
+        // v5.8.0 (#8): provider-aware error instead of hardcoded ANTHROPIC_API_KEY.
+        const providerName = cliConfig.llm.defaultProvider;
+        const envVarMap = {
+            anthropic: "ANTHROPIC_API_KEY",
+            openai: "OPENAI_API_KEY",
+            groq: "GROQ_API_KEY",
+            xai: "XAI_API_KEY",
+            mistral: "MISTRAL_API_KEY",
+        };
+        const envVar = envVarMap[providerName];
+        if (envVar) {
+            console.error(`No LLM provider available. Configured default is "${providerName}" but its key wasn't found. ` +
+                `Set ${envVar}, run 'gnosys setup' to store one in ${getSecureStorageSetupHint()}, or add llm.${providerName}.apiKey to gnosys.json.`);
+        }
+        else {
+            console.error(`No LLM provider available. Provider "${providerName}" is not reachable. Run 'gnosys setup' to configure one.`);
+        }
+        process.exit(1);
+    }
+    // If --federated, pre-retrieve from central DB and inject as context
+    let federatedContext;
+    if (opts.federated || opts.scope) {
+        const { resolveClientRead } = await import("./clientReadResolve.js");
+        const resolved = resolveClientRead();
+        if (resolved) {
+            try {
+                if (resolved.db.isAvailable()) {
+                    const { federatedSearch: fSearch, detectCurrentProject } = await import("./federated.js");
+                    const projectId = await detectCurrentProject(resolved.db, opts.directory || undefined);
+                    const scopeFilter = opts.scope ? opts.scope.split(",").map(s => s.trim()) : undefined;
+                    const fResults = fSearch(resolved.db, question, {
+                        limit: parseInt(opts.limit, 10),
+                        projectId,
+                        scopeFilter,
+                    });
+                    if (fResults.length > 0) {
+                        federatedContext = fResults.map(r => {
+                            const mem = resolved.db.getMemory(r.id);
+                            return `## ${r.title} [scope:${r.scope}, score:${r.score.toFixed(3)}]\n${mem?.content || r.snippet}`;
+                        }).join("\n\n");
+                        console.error(`[federated] Found ${fResults.length} cross-scope memories as additional context`);
+                    }
+                }
+            }
+            catch { /* Central DB not available — fall through to normal ask */ }
+            finally {
+                resolved.release();
+            }
+        }
+    }
+    const mode = opts.mode;
+    const useStream = opts.stream !== false && !opts.json;
+    try {
+        const result = await ask.ask(question, {
+            limit: parseInt(opts.limit, 10),
+            mode,
+            stream: useStream,
+            additionalContext: federatedContext,
+            callbacks: useStream
+                ? {
+                    onToken: (token) => process.stdout.write(token),
+                    onSearchComplete: (count, searchMode) => {
+                        console.log(`\n Found ${count} relevant memories (${searchMode} search)\n`);
+                    },
+                    onDeepQuery: (refined) => {
+                        console.log(`\n Deep query: searching for "${refined}"...\n`);
+                    },
+                }
+                : undefined,
+        });
+        outputResult(!!opts.json, {
+            question,
+            answer: result.answer,
+            sources: result.sources.map((s) => ({
+                title: s.title,
+                relativePath: s.relativePath,
+            })),
+            deepQueryUsed: result.deepQueryUsed ?? false,
+        }, () => {
+            if (!useStream) {
+                console.log(result.answer);
+            }
+            if (result.sources.length > 0) {
+                console.log("\n\n--- Sources ---");
+                for (const s of result.sources) {
+                    console.log(`  [[${s.relativePath.split("/").pop()}]] — ${s.title}`);
+                }
+            }
+            if (result.deepQueryUsed) {
+                console.log("\n(Deep query was used — a follow-up search expanded the context)");
+            }
+        });
+        if (result.sources.length > 0) {
+            const writeTarget = resolver.getWriteTarget();
+            if (writeTarget) {
+                const { GnosysMaintenanceEngine } = await import("./maintenance.js");
+                await GnosysMaintenanceEngine.reinforceBatch(writeTarget.store, result.sources.map((s) => s.relativePath)).catch(() => { });
+            }
+        }
+    }
+    catch (err) {
+        console.error(`Ask failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    search.close();
+    embeddings.close();
+}

package/dist/lib/attachCommand.d.ts

@@ -0,0 +1,17 @@
+/**
+ * CLI handlers for inline DB-blob attachments (v5.12).
+ *
+ *   gnosys attach <file> --memory <id>      store bytes inline on a memory
+ *   gnosys get-attachment <id> [--out path] retrieve the stored bytes
+ *
+ * Inline attachments live in the memory row, so they ride the normal sync
+ * rail to other machines and a remote/dockerized server.
+ */
+export interface AttachCommandOptions {
+    memory: string;
+}
+export declare function runAttachCommand(filePath: string, opts: AttachCommandOptions): Promise<void>;
+export interface GetAttachmentCommandOptions {
+    out?: string;
+}
+export declare function runGetAttachmentCommand(memoryId: string, opts: GetAttachmentCommandOptions): Promise<void>;