memorix 1.2.2 → 1.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (139) hide show
  1. package/CHANGELOG.md +7 -0
  2. package/TEAM.md +86 -86
  3. package/dist/cli/index.js +34 -18
  4. package/dist/cli/index.js.map +1 -1
  5. package/dist/index.js +17 -8
  6. package/dist/index.js.map +1 -1
  7. package/dist/maintenance-runner.js.map +1 -1
  8. package/dist/memcode-runtime/CHANGELOG.md +7 -0
  9. package/dist/sdk.js +17 -8
  10. package/dist/sdk.js.map +1 -1
  11. package/docs/DESIGN_DECISIONS.md +357 -357
  12. package/docs/dev-log/progress.txt +18 -8
  13. package/package.json +1 -1
  14. package/plugins/codex/memorix/.codex-plugin/plugin.json +1 -1
  15. package/src/audit/index.ts +156 -156
  16. package/src/cli/commands/audit-list.ts +89 -89
  17. package/src/cli/commands/background.ts +659 -659
  18. package/src/cli/commands/formation.ts +48 -48
  19. package/src/cli/commands/git-hook-install.ts +111 -111
  20. package/src/cli/commands/handoff.ts +54 -54
  21. package/src/cli/commands/hooks-status.ts +63 -63
  22. package/src/cli/commands/ingest-commit.ts +153 -153
  23. package/src/cli/commands/ingest-image.ts +66 -66
  24. package/src/cli/commands/ingest-log.ts +180 -180
  25. package/src/cli/commands/ingest.ts +44 -44
  26. package/src/cli/commands/integrate-shared.ts +15 -15
  27. package/src/cli/commands/lock.ts +82 -82
  28. package/src/cli/commands/message.ts +104 -104
  29. package/src/cli/commands/poll.ts +58 -58
  30. package/src/cli/commands/purge-all-memory.ts +85 -85
  31. package/src/cli/commands/purge-project-memory.ts +83 -83
  32. package/src/cli/commands/reasoning.ts +118 -118
  33. package/src/cli/commands/serve-shared.ts +118 -118
  34. package/src/cli/commands/session.ts +15 -7
  35. package/src/cli/commands/skills.ts +114 -114
  36. package/src/cli/commands/task.ts +167 -167
  37. package/src/cli/commands/transfer.ts +47 -47
  38. package/src/cli/commands/uninstall-project-artifacts.ts +85 -85
  39. package/src/cli/tui/ChatView.tsx +234 -234
  40. package/src/cli/tui/CommandBar.tsx +312 -312
  41. package/src/cli/tui/ContextRail.tsx +118 -118
  42. package/src/cli/tui/HeaderBar.tsx +72 -72
  43. package/src/cli/tui/LogoBanner.tsx +51 -51
  44. package/src/cli/tui/Sidebar.tsx +179 -179
  45. package/src/cli/tui/index.ts +41 -41
  46. package/src/cli/tui/markdown-render.tsx +371 -371
  47. package/src/cli/tui/session-service.ts +3 -2
  48. package/src/cli/tui/use-mouse.ts +157 -157
  49. package/src/cli/tui/useNavigation.ts +56 -56
  50. package/src/cli/update-checker.ts +211 -211
  51. package/src/cli/version.ts +7 -7
  52. package/src/cli/workbench.ts +1 -1
  53. package/src/compact/token-budget.ts +74 -74
  54. package/src/dashboard/project-classification.ts +64 -64
  55. package/src/embedding/fastembed-provider.ts +142 -142
  56. package/src/embedding/transformers-provider.ts +111 -111
  57. package/src/git/extractor.ts +209 -209
  58. package/src/git/hooks-path.ts +85 -85
  59. package/src/hooks/pattern-detector.ts +173 -173
  60. package/src/hooks/significance-filter.ts +250 -250
  61. package/src/llm/memory-manager.ts +328 -328
  62. package/src/llm/provider.ts +885 -885
  63. package/src/llm/quality.ts +248 -248
  64. package/src/memory/attribution-guard.ts +249 -249
  65. package/src/memory/disclosure-policy.ts +135 -135
  66. package/src/memory/entity-extractor.ts +197 -197
  67. package/src/memory/formation/evaluate.ts +217 -217
  68. package/src/memory/formation/extract.ts +361 -361
  69. package/src/memory/formation/index.ts +417 -417
  70. package/src/memory/formation/resolve.ts +344 -344
  71. package/src/memory/formation/types.ts +315 -315
  72. package/src/memory/freshness.ts +122 -122
  73. package/src/memory/graph.ts +197 -197
  74. package/src/memory/refs.ts +94 -94
  75. package/src/memory/secret-filter.ts +79 -79
  76. package/src/memory/session.ts +24 -9
  77. package/src/multimodal/image-loader.ts +143 -143
  78. package/src/orchestrate/adapters/claude-stream.ts +192 -192
  79. package/src/orchestrate/adapters/claude.ts +111 -111
  80. package/src/orchestrate/adapters/codex-stream.ts +134 -134
  81. package/src/orchestrate/adapters/codex.ts +41 -41
  82. package/src/orchestrate/adapters/gemini-stream.ts +166 -166
  83. package/src/orchestrate/adapters/gemini.ts +42 -42
  84. package/src/orchestrate/adapters/index.ts +73 -73
  85. package/src/orchestrate/adapters/opencode-stream.ts +143 -143
  86. package/src/orchestrate/adapters/opencode.ts +47 -47
  87. package/src/orchestrate/adapters/spawn-helper.ts +286 -286
  88. package/src/orchestrate/adapters/types.ts +77 -77
  89. package/src/orchestrate/capability-router.ts +284 -284
  90. package/src/orchestrate/context-compact.ts +188 -188
  91. package/src/orchestrate/cost-tracker.ts +219 -219
  92. package/src/orchestrate/error-recovery.ts +191 -191
  93. package/src/orchestrate/evidence.ts +140 -140
  94. package/src/orchestrate/ledger.ts +110 -110
  95. package/src/orchestrate/memorix-bridge.ts +343 -343
  96. package/src/orchestrate/output-budget.ts +80 -80
  97. package/src/orchestrate/permission.ts +152 -152
  98. package/src/orchestrate/pipeline-trace.ts +131 -131
  99. package/src/orchestrate/prompt-builder.ts +155 -155
  100. package/src/orchestrate/ring-buffer.ts +37 -37
  101. package/src/orchestrate/task-graph.ts +389 -389
  102. package/src/orchestrate/worktree.ts +232 -232
  103. package/src/project/aliases.ts +374 -374
  104. package/src/project/detector.ts +268 -268
  105. package/src/rules/adapters/claude-code.ts +99 -99
  106. package/src/rules/adapters/codex.ts +97 -97
  107. package/src/rules/adapters/copilot.ts +124 -124
  108. package/src/rules/adapters/cursor.ts +114 -114
  109. package/src/rules/adapters/kiro.ts +126 -126
  110. package/src/rules/adapters/trae.ts +56 -56
  111. package/src/rules/adapters/windsurf.ts +83 -83
  112. package/src/rules/syncer.ts +235 -235
  113. package/src/sdk.ts +299 -299
  114. package/src/search/intent-detector.ts +289 -289
  115. package/src/search/query-expansion.ts +52 -52
  116. package/src/server/formation-timeout.ts +27 -27
  117. package/src/server.ts +7 -2
  118. package/src/skills/mini-skills.ts +386 -386
  119. package/src/store/chat-store.ts +119 -119
  120. package/src/store/graph-store.ts +249 -249
  121. package/src/store/mini-skill-store.ts +349 -349
  122. package/src/store/persistence-json.ts +212 -212
  123. package/src/store/persistence.ts +291 -291
  124. package/src/store/project-affinity.ts +195 -195
  125. package/src/team/event-bus.ts +76 -76
  126. package/src/team/file-locks.ts +173 -173
  127. package/src/team/handoff.ts +161 -161
  128. package/src/team/messages.ts +203 -203
  129. package/src/team/poll.ts +132 -132
  130. package/src/team/tasks.ts +211 -211
  131. package/src/workspace/mcp-adapters/codex.ts +191 -191
  132. package/src/workspace/mcp-adapters/copilot.ts +105 -105
  133. package/src/workspace/mcp-adapters/cursor.ts +53 -53
  134. package/src/workspace/mcp-adapters/kiro.ts +64 -64
  135. package/src/workspace/mcp-adapters/opencode.ts +123 -123
  136. package/src/workspace/mcp-adapters/trae.ts +134 -134
  137. package/src/workspace/mcp-adapters/windsurf.ts +91 -91
  138. package/src/workspace/sanitizer.ts +60 -60
  139. package/src/workspace/workflow-sync.ts +131 -131
@@ -1,134 +1,134 @@
1
- import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
- import { join } from 'node:path';
3
- import { homedir } from 'node:os';
4
-
5
- /**
6
- * Trae IDE MCP Configuration Adapter.
7
- *
8
- * Trae stores MCP config at the user level:
9
- * %APPDATA%/Trae/User/mcp.json (Windows)
10
- * ~/Library/Application Support/Trae/User/mcp.json (macOS)
11
- * ~/.config/Trae/User/mcp.json (Linux)
12
- *
13
- * Format (OBJECT-keyed, same as Cursor):
14
- * {
15
- * "mcpServers": {
16
- * "memorix": {
17
- * "command": "memorix",
18
- * "args": ["serve"],
19
- * "env": { "KEY": "value" }
20
- * }
21
- * }
22
- * }
23
- *
24
- * SSE transport:
25
- * {
26
- * "mcpServers": {
27
- * "remote": {
28
- * "url": "https://...",
29
- * "type": "sse"
30
- * }
31
- * }
32
- * }
33
- *
34
- * Source: https://docs.trae.ai/ide/model-context-protocol
35
- */
36
- export class TraeMCPAdapter implements MCPConfigAdapter {
37
- readonly source = 'trae' as const;
38
-
39
- parse(content: string): MCPServerEntry[] {
40
- try {
41
- const config = JSON.parse(content);
42
- const servers = config.mcpServers;
43
-
44
- if (!servers || typeof servers !== 'object') return [];
45
-
46
- // Object-keyed format: { "mcpServers": { "name": { ... } } }
47
- return Object.entries(servers).map(([name, entry]: [string, any]) => {
48
- const result: MCPServerEntry = {
49
- name,
50
- command: '',
51
- args: [],
52
- };
53
-
54
- if (typeof entry.command === 'string') {
55
- result.command = entry.command;
56
- }
57
-
58
- if (Array.isArray(entry.args)) {
59
- result.args = entry.args;
60
- }
61
-
62
- // SSE/HTTP transport
63
- if (entry.url) {
64
- result.url = entry.url;
65
- }
66
-
67
- // Environment variables
68
- if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
69
- result.env = entry.env;
70
- }
71
-
72
- // Headers (for HTTP transport)
73
- if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
74
- result.headers = entry.headers;
75
- }
76
-
77
- // Disabled flag
78
- if (entry.disabled === true) {
79
- result.disabled = true;
80
- }
81
-
82
- return result;
83
- });
84
- } catch {
85
- return [];
86
- }
87
- }
88
-
89
- generate(servers: MCPServerEntry[]): string {
90
- const mcpServers: Record<string, any> = {};
91
-
92
- for (const s of servers) {
93
- const entry: Record<string, any> = {};
94
-
95
- if (s.url) {
96
- // SSE/HTTP transport
97
- entry.url = s.url;
98
- if (s.headers && Object.keys(s.headers).length > 0) {
99
- entry.headers = s.headers;
100
- }
101
- } else {
102
- // stdio transport
103
- entry.command = s.command;
104
- if (s.args && s.args.length > 0) {
105
- entry.args = s.args;
106
- }
107
- }
108
-
109
- if (s.env && Object.keys(s.env).length > 0) {
110
- entry.env = s.env;
111
- }
112
-
113
- if (s.disabled === true) {
114
- entry.disabled = true;
115
- }
116
-
117
- mcpServers[s.name] = entry;
118
- }
119
-
120
- return JSON.stringify({ mcpServers }, null, 2);
121
- }
122
-
123
- getConfigPath(_projectRoot?: string): string {
124
- const home = homedir();
125
- // Trae stores user-level MCP config in AppData (Windows) / Application Support (macOS) / .config (Linux)
126
- if (process.platform === 'win32') {
127
- return join(process.env.APPDATA || join(home, 'AppData', 'Roaming'), 'Trae', 'User', 'mcp.json');
128
- }
129
- if (process.platform === 'darwin') {
130
- return join(home, 'Library', 'Application Support', 'Trae', 'User', 'mcp.json');
131
- }
132
- return join(home, '.config', 'Trae', 'User', 'mcp.json');
133
- }
134
- }
1
+ import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
+ import { join } from 'node:path';
3
+ import { homedir } from 'node:os';
4
+
5
+ /**
6
+ * Trae IDE MCP Configuration Adapter.
7
+ *
8
+ * Trae stores MCP config at the user level:
9
+ * %APPDATA%/Trae/User/mcp.json (Windows)
10
+ * ~/Library/Application Support/Trae/User/mcp.json (macOS)
11
+ * ~/.config/Trae/User/mcp.json (Linux)
12
+ *
13
+ * Format (OBJECT-keyed, same as Cursor):
14
+ * {
15
+ * "mcpServers": {
16
+ * "memorix": {
17
+ * "command": "memorix",
18
+ * "args": ["serve"],
19
+ * "env": { "KEY": "value" }
20
+ * }
21
+ * }
22
+ * }
23
+ *
24
+ * SSE transport:
25
+ * {
26
+ * "mcpServers": {
27
+ * "remote": {
28
+ * "url": "https://...",
29
+ * "type": "sse"
30
+ * }
31
+ * }
32
+ * }
33
+ *
34
+ * Source: https://docs.trae.ai/ide/model-context-protocol
35
+ */
36
+ export class TraeMCPAdapter implements MCPConfigAdapter {
37
+ readonly source = 'trae' as const;
38
+
39
+ parse(content: string): MCPServerEntry[] {
40
+ try {
41
+ const config = JSON.parse(content);
42
+ const servers = config.mcpServers;
43
+
44
+ if (!servers || typeof servers !== 'object') return [];
45
+
46
+ // Object-keyed format: { "mcpServers": { "name": { ... } } }
47
+ return Object.entries(servers).map(([name, entry]: [string, any]) => {
48
+ const result: MCPServerEntry = {
49
+ name,
50
+ command: '',
51
+ args: [],
52
+ };
53
+
54
+ if (typeof entry.command === 'string') {
55
+ result.command = entry.command;
56
+ }
57
+
58
+ if (Array.isArray(entry.args)) {
59
+ result.args = entry.args;
60
+ }
61
+
62
+ // SSE/HTTP transport
63
+ if (entry.url) {
64
+ result.url = entry.url;
65
+ }
66
+
67
+ // Environment variables
68
+ if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
69
+ result.env = entry.env;
70
+ }
71
+
72
+ // Headers (for HTTP transport)
73
+ if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
74
+ result.headers = entry.headers;
75
+ }
76
+
77
+ // Disabled flag
78
+ if (entry.disabled === true) {
79
+ result.disabled = true;
80
+ }
81
+
82
+ return result;
83
+ });
84
+ } catch {
85
+ return [];
86
+ }
87
+ }
88
+
89
+ generate(servers: MCPServerEntry[]): string {
90
+ const mcpServers: Record<string, any> = {};
91
+
92
+ for (const s of servers) {
93
+ const entry: Record<string, any> = {};
94
+
95
+ if (s.url) {
96
+ // SSE/HTTP transport
97
+ entry.url = s.url;
98
+ if (s.headers && Object.keys(s.headers).length > 0) {
99
+ entry.headers = s.headers;
100
+ }
101
+ } else {
102
+ // stdio transport
103
+ entry.command = s.command;
104
+ if (s.args && s.args.length > 0) {
105
+ entry.args = s.args;
106
+ }
107
+ }
108
+
109
+ if (s.env && Object.keys(s.env).length > 0) {
110
+ entry.env = s.env;
111
+ }
112
+
113
+ if (s.disabled === true) {
114
+ entry.disabled = true;
115
+ }
116
+
117
+ mcpServers[s.name] = entry;
118
+ }
119
+
120
+ return JSON.stringify({ mcpServers }, null, 2);
121
+ }
122
+
123
+ getConfigPath(_projectRoot?: string): string {
124
+ const home = homedir();
125
+ // Trae stores user-level MCP config in AppData (Windows) / Application Support (macOS) / .config (Linux)
126
+ if (process.platform === 'win32') {
127
+ return join(process.env.APPDATA || join(home, 'AppData', 'Roaming'), 'Trae', 'User', 'mcp.json');
128
+ }
129
+ if (process.platform === 'darwin') {
130
+ return join(home, 'Library', 'Application Support', 'Trae', 'User', 'mcp.json');
131
+ }
132
+ return join(home, '.config', 'Trae', 'User', 'mcp.json');
133
+ }
134
+ }
@@ -1,91 +1,91 @@
1
- import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
- import { homedir } from 'node:os';
3
- import { join } from 'node:path';
4
-
5
- /**
6
- * Windsurf MCP config adapter.
7
- * Format: JSON file at ~/.codeium/windsurf/mcp_config.json
8
- *
9
- * Supports two transport modes:
10
- * 1. stdio: { command, args, env? }
11
- * 2. HTTP: { serverUrl, headers? }
12
- *
13
- * Also handles: disabled, disabledTools, env: null
14
- */
15
- export class WindsurfMCPAdapter implements MCPConfigAdapter {
16
- readonly source = 'windsurf' as const;
17
-
18
- parse(content: string): MCPServerEntry[] {
19
- try {
20
- const config = JSON.parse(content);
21
- const servers = config.mcpServers ?? config.mcp_servers ?? {};
22
- return Object.entries(servers).map(([name, entry]: [string, any]) => {
23
- const result: MCPServerEntry = {
24
- name,
25
- command: entry.command ?? '',
26
- args: entry.args ?? [],
27
- };
28
-
29
- // HTTP transport: Windsurf uses "serverUrl" (not "url")
30
- if (entry.serverUrl) {
31
- result.url = entry.serverUrl;
32
- } else if (entry.url) {
33
- result.url = entry.url;
34
- }
35
-
36
- // Headers (for HTTP transport)
37
- if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
38
- result.headers = entry.headers;
39
- }
40
-
41
- // Env (can be null in Windsurf)
42
- if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
43
- result.env = entry.env;
44
- }
45
-
46
- // Disabled flag
47
- if (entry.disabled === true) {
48
- result.disabled = true;
49
- }
50
-
51
- return result;
52
- });
53
- } catch {
54
- return [];
55
- }
56
- }
57
-
58
- generate(servers: MCPServerEntry[]): string {
59
- const mcpServers: Record<string, any> = {};
60
- for (const s of servers) {
61
- const entry: Record<string, any> = {};
62
-
63
- if (s.url) {
64
- // HTTP transport — Windsurf uses "serverUrl"
65
- entry.serverUrl = s.url;
66
- if (s.headers && Object.keys(s.headers).length > 0) {
67
- entry.headers = s.headers;
68
- }
69
- } else {
70
- // stdio transport
71
- entry.command = s.command;
72
- entry.args = s.args;
73
- }
74
-
75
- if (s.env && Object.keys(s.env).length > 0) {
76
- entry.env = s.env;
77
- }
78
-
79
- if (s.disabled === true) {
80
- entry.disabled = true;
81
- }
82
-
83
- mcpServers[s.name] = entry;
84
- }
85
- return JSON.stringify({ mcpServers }, null, 2);
86
- }
87
-
88
- getConfigPath(_projectRoot?: string): string {
89
- return join(homedir(), '.codeium', 'windsurf', 'mcp_config.json');
90
- }
91
- }
1
+ import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
+ import { homedir } from 'node:os';
3
+ import { join } from 'node:path';
4
+
5
+ /**
6
+ * Windsurf MCP config adapter.
7
+ * Format: JSON file at ~/.codeium/windsurf/mcp_config.json
8
+ *
9
+ * Supports two transport modes:
10
+ * 1. stdio: { command, args, env? }
11
+ * 2. HTTP: { serverUrl, headers? }
12
+ *
13
+ * Also handles: disabled, disabledTools, env: null
14
+ */
15
+ export class WindsurfMCPAdapter implements MCPConfigAdapter {
16
+ readonly source = 'windsurf' as const;
17
+
18
+ parse(content: string): MCPServerEntry[] {
19
+ try {
20
+ const config = JSON.parse(content);
21
+ const servers = config.mcpServers ?? config.mcp_servers ?? {};
22
+ return Object.entries(servers).map(([name, entry]: [string, any]) => {
23
+ const result: MCPServerEntry = {
24
+ name,
25
+ command: entry.command ?? '',
26
+ args: entry.args ?? [],
27
+ };
28
+
29
+ // HTTP transport: Windsurf uses "serverUrl" (not "url")
30
+ if (entry.serverUrl) {
31
+ result.url = entry.serverUrl;
32
+ } else if (entry.url) {
33
+ result.url = entry.url;
34
+ }
35
+
36
+ // Headers (for HTTP transport)
37
+ if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
38
+ result.headers = entry.headers;
39
+ }
40
+
41
+ // Env (can be null in Windsurf)
42
+ if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
43
+ result.env = entry.env;
44
+ }
45
+
46
+ // Disabled flag
47
+ if (entry.disabled === true) {
48
+ result.disabled = true;
49
+ }
50
+
51
+ return result;
52
+ });
53
+ } catch {
54
+ return [];
55
+ }
56
+ }
57
+
58
+ generate(servers: MCPServerEntry[]): string {
59
+ const mcpServers: Record<string, any> = {};
60
+ for (const s of servers) {
61
+ const entry: Record<string, any> = {};
62
+
63
+ if (s.url) {
64
+ // HTTP transport — Windsurf uses "serverUrl"
65
+ entry.serverUrl = s.url;
66
+ if (s.headers && Object.keys(s.headers).length > 0) {
67
+ entry.headers = s.headers;
68
+ }
69
+ } else {
70
+ // stdio transport
71
+ entry.command = s.command;
72
+ entry.args = s.args;
73
+ }
74
+
75
+ if (s.env && Object.keys(s.env).length > 0) {
76
+ entry.env = s.env;
77
+ }
78
+
79
+ if (s.disabled === true) {
80
+ entry.disabled = true;
81
+ }
82
+
83
+ mcpServers[s.name] = entry;
84
+ }
85
+ return JSON.stringify({ mcpServers }, null, 2);
86
+ }
87
+
88
+ getConfigPath(_projectRoot?: string): string {
89
+ return join(homedir(), '.codeium', 'windsurf', 'mcp_config.json');
90
+ }
91
+ }
@@ -1,60 +1,60 @@
1
- /**
2
- * Sanitizer — mask sensitive values (tokens, keys, passwords) in output.
3
- *
4
- * Patterns detected:
5
- * - API keys / tokens (github_pat_*, ctx7sk-*, sk-*, ghp_*, ghu_*, etc.)
6
- * - Generic key=value where key contains "token", "key", "secret", "password"
7
- * - Bearer tokens
8
- */
9
-
10
- const SENSITIVE_PATTERNS: { pattern: RegExp; replacement: string }[] = [
11
- // GitHub PAT (classic & fine-grained)
12
- { pattern: /ghp_[A-Za-z0-9_]{36,}/g, replacement: 'ghp_***' },
13
- { pattern: /github_pat_[A-Za-z0-9_]{60,}/g, replacement: 'github_pat_***' },
14
- { pattern: /ghu_[A-Za-z0-9_]{36,}/g, replacement: 'ghu_***' },
15
- { pattern: /ghs_[A-Za-z0-9_]{36,}/g, replacement: 'ghs_***' },
16
- // OpenAI / Anthropic style keys
17
- { pattern: /sk-[A-Za-z0-9_-]{20,}/g, replacement: 'sk-***' },
18
- // Context7 keys
19
- { pattern: /ctx7sk-[A-Za-z0-9-]{20,}/g, replacement: 'ctx7sk-***' },
20
- // Generic long hex/base64 tokens (32+ chars) in quoted values
21
- { pattern: /"([A-Za-z0-9_-]{40,})"/g, replacement: '"***"' },
22
- ];
23
-
24
- const SENSITIVE_KEY_PATTERN = /(?:token|key|secret|password|credential|auth)/i;
25
-
26
- /**
27
- * Mask sensitive values in a string.
28
- */
29
- export function sanitize(input: string): string {
30
- let result = input;
31
-
32
- // Apply known token patterns
33
- for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
34
- // Reset lastIndex for global regexes
35
- pattern.lastIndex = 0;
36
- result = result.replace(pattern, replacement);
37
- }
38
-
39
- return result;
40
- }
41
-
42
- /**
43
- * Mask sensitive values in MCPServerEntry env/headers objects.
44
- * Returns a new object with masked values.
45
- */
46
- export function sanitizeRecord(
47
- record: Record<string, string> | undefined | null,
48
- ): Record<string, string> | undefined {
49
- if (!record) return undefined;
50
-
51
- const masked: Record<string, string> = {};
52
- for (const [key, value] of Object.entries(record)) {
53
- if (SENSITIVE_KEY_PATTERN.test(key)) {
54
- masked[key] = '***';
55
- } else {
56
- masked[key] = value;
57
- }
58
- }
59
- return masked;
60
- }
1
+ /**
2
+ * Sanitizer — mask sensitive values (tokens, keys, passwords) in output.
3
+ *
4
+ * Patterns detected:
5
+ * - API keys / tokens (github_pat_*, ctx7sk-*, sk-*, ghp_*, ghu_*, etc.)
6
+ * - Generic key=value where key contains "token", "key", "secret", "password"
7
+ * - Bearer tokens
8
+ */
9
+
10
+ const SENSITIVE_PATTERNS: { pattern: RegExp; replacement: string }[] = [
11
+ // GitHub PAT (classic & fine-grained)
12
+ { pattern: /ghp_[A-Za-z0-9_]{36,}/g, replacement: 'ghp_***' },
13
+ { pattern: /github_pat_[A-Za-z0-9_]{60,}/g, replacement: 'github_pat_***' },
14
+ { pattern: /ghu_[A-Za-z0-9_]{36,}/g, replacement: 'ghu_***' },
15
+ { pattern: /ghs_[A-Za-z0-9_]{36,}/g, replacement: 'ghs_***' },
16
+ // OpenAI / Anthropic style keys
17
+ { pattern: /sk-[A-Za-z0-9_-]{20,}/g, replacement: 'sk-***' },
18
+ // Context7 keys
19
+ { pattern: /ctx7sk-[A-Za-z0-9-]{20,}/g, replacement: 'ctx7sk-***' },
20
+ // Generic long hex/base64 tokens (32+ chars) in quoted values
21
+ { pattern: /"([A-Za-z0-9_-]{40,})"/g, replacement: '"***"' },
22
+ ];
23
+
24
+ const SENSITIVE_KEY_PATTERN = /(?:token|key|secret|password|credential|auth)/i;
25
+
26
+ /**
27
+ * Mask sensitive values in a string.
28
+ */
29
+ export function sanitize(input: string): string {
30
+ let result = input;
31
+
32
+ // Apply known token patterns
33
+ for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
34
+ // Reset lastIndex for global regexes
35
+ pattern.lastIndex = 0;
36
+ result = result.replace(pattern, replacement);
37
+ }
38
+
39
+ return result;
40
+ }
41
+
42
+ /**
43
+ * Mask sensitive values in MCPServerEntry env/headers objects.
44
+ * Returns a new object with masked values.
45
+ */
46
+ export function sanitizeRecord(
47
+ record: Record<string, string> | undefined | null,
48
+ ): Record<string, string> | undefined {
49
+ if (!record) return undefined;
50
+
51
+ const masked: Record<string, string> = {};
52
+ for (const [key, value] of Object.entries(record)) {
53
+ if (SENSITIVE_KEY_PATTERN.test(key)) {
54
+ masked[key] = '***';
55
+ } else {
56
+ masked[key] = value;
57
+ }
58
+ }
59
+ return masked;
60
+ }