memorix 1.4.3 → 1.4.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (144) hide show
  1. package/CHANGELOG.md +19 -0
  2. package/README.md +11 -4
  3. package/README.zh-CN.md +7 -1
  4. package/TEAM.md +86 -86
  5. package/assets/star-history-dark.svg +8 -8
  6. package/assets/star-history-light.svg +8 -8
  7. package/assets/star-history.json +16 -2
  8. package/dist/cli/index.js +194 -109
  9. package/dist/cli/memcode.js +0 -0
  10. package/dist/index.js +39 -12
  11. package/dist/maintenance-runner.js +9 -7
  12. package/dist/media-audio-runner.js +9 -7
  13. package/dist/media-video-runner.js +9 -7
  14. package/dist/memcode/index.js +9 -7
  15. package/dist/memcode-runtime/CHANGELOG.md +19 -0
  16. package/dist/sdk.js +38 -11
  17. package/dist/vector-backfill-runner.js +9 -7
  18. package/docs/AGENT_OPERATOR_PLAYBOOK.md +3 -3
  19. package/docs/API_REFERENCE.md +9 -5
  20. package/docs/CONFIGURATION.md +15 -5
  21. package/docs/DESIGN_DECISIONS.md +357 -357
  22. package/docs/DEVELOPMENT.md +2 -2
  23. package/docs/KNOWN_ISSUES_AND_ROADMAP.md +3 -3
  24. package/docs/MODULES.md +1 -1
  25. package/docs/README.md +1 -1
  26. package/docs/SETUP.md +3 -3
  27. package/docs/hooks-architecture.md +2 -1
  28. package/llms-full.txt +4 -4
  29. package/llms.txt +2 -2
  30. package/package.json +1 -1
  31. package/plugins/claude/memorix/.claude-plugin/plugin.json +1 -1
  32. package/plugins/codebuddy/memorix/.codebuddy-plugin/plugin.json +1 -1
  33. package/plugins/codex/memorix/.codex-plugin/plugin.json +1 -1
  34. package/plugins/copilot/memorix/plugin.json +1 -1
  35. package/plugins/gemini/memorix/gemini-extension.json +1 -1
  36. package/plugins/omp/memorix/package.json +1 -1
  37. package/plugins/openclaw/memorix/.codex-plugin/plugin.json +1 -1
  38. package/plugins/pi/memorix/package.json +1 -1
  39. package/server.json +2 -2
  40. package/src/audit/index.ts +156 -156
  41. package/src/cli/commands/audit-list.ts +89 -89
  42. package/src/cli/commands/formation.ts +48 -48
  43. package/src/cli/commands/git-hook-install.ts +111 -111
  44. package/src/cli/commands/handoff.ts +54 -54
  45. package/src/cli/commands/hooks-status.ts +63 -63
  46. package/src/cli/commands/ingest.ts +44 -44
  47. package/src/cli/commands/integrate-shared.ts +15 -15
  48. package/src/cli/commands/lock.ts +82 -82
  49. package/src/cli/commands/media-image.ts +27 -0
  50. package/src/cli/commands/media.ts +8 -1
  51. package/src/cli/commands/memory.ts +44 -34
  52. package/src/cli/commands/message.ts +104 -104
  53. package/src/cli/commands/operator-shared.ts +62 -18
  54. package/src/cli/commands/poll.ts +58 -58
  55. package/src/cli/commands/purge-all-memory.ts +85 -85
  56. package/src/cli/commands/purge-project-memory.ts +83 -83
  57. package/src/cli/commands/reasoning.ts +118 -118
  58. package/src/cli/commands/skills.ts +114 -114
  59. package/src/cli/commands/task.ts +167 -167
  60. package/src/cli/commands/transfer.ts +47 -47
  61. package/src/cli/commands/uninstall-project-artifacts.ts +85 -85
  62. package/src/cli/tui/ChatView.tsx +234 -234
  63. package/src/cli/tui/CommandBar.tsx +312 -312
  64. package/src/cli/tui/ContextRail.tsx +118 -118
  65. package/src/cli/tui/HeaderBar.tsx +72 -72
  66. package/src/cli/tui/LogoBanner.tsx +51 -51
  67. package/src/cli/tui/Sidebar.tsx +179 -179
  68. package/src/cli/tui/index.ts +41 -41
  69. package/src/cli/tui/markdown-render.tsx +371 -371
  70. package/src/cli/tui/use-mouse.ts +157 -157
  71. package/src/cli/tui/useNavigation.ts +56 -56
  72. package/src/cli/version.ts +7 -7
  73. package/src/cli/workbench.ts +1 -1
  74. package/src/dashboard/project-classification.ts +64 -64
  75. package/src/git/hooks-path.ts +85 -85
  76. package/src/hooks/pattern-detector.ts +173 -173
  77. package/src/hooks/significance-filter.ts +250 -250
  78. package/src/llm/memory-manager.ts +328 -328
  79. package/src/llm/provider.ts +885 -885
  80. package/src/llm/quality.ts +248 -248
  81. package/src/media/minimax.ts +9 -1
  82. package/src/memory/attribution-guard.ts +249 -249
  83. package/src/memory/disclosure-policy.ts +135 -135
  84. package/src/memory/entity-extractor.ts +197 -197
  85. package/src/memory/formation/evaluate.ts +217 -217
  86. package/src/memory/formation/extract.ts +361 -361
  87. package/src/memory/formation/index.ts +417 -417
  88. package/src/memory/formation/resolve.ts +344 -344
  89. package/src/memory/formation/types.ts +315 -315
  90. package/src/memory/freshness.ts +122 -122
  91. package/src/memory/graph.ts +197 -197
  92. package/src/memory/refs.ts +94 -94
  93. package/src/memory/secret-filter.ts +79 -79
  94. package/src/orchestrate/adapters/claude-stream.ts +192 -192
  95. package/src/orchestrate/adapters/claude.ts +111 -111
  96. package/src/orchestrate/adapters/codex-stream.ts +134 -134
  97. package/src/orchestrate/adapters/codex.ts +41 -41
  98. package/src/orchestrate/adapters/gemini-stream.ts +166 -166
  99. package/src/orchestrate/adapters/gemini.ts +42 -42
  100. package/src/orchestrate/adapters/index.ts +73 -73
  101. package/src/orchestrate/adapters/opencode-stream.ts +143 -143
  102. package/src/orchestrate/adapters/opencode.ts +47 -47
  103. package/src/orchestrate/adapters/types.ts +77 -77
  104. package/src/orchestrate/capability-router.ts +284 -284
  105. package/src/orchestrate/context-compact.ts +188 -188
  106. package/src/orchestrate/cost-tracker.ts +219 -219
  107. package/src/orchestrate/error-recovery.ts +191 -191
  108. package/src/orchestrate/evidence.ts +140 -140
  109. package/src/orchestrate/ledger.ts +110 -110
  110. package/src/orchestrate/memorix-bridge.ts +343 -343
  111. package/src/orchestrate/output-budget.ts +80 -80
  112. package/src/orchestrate/permission.ts +152 -152
  113. package/src/orchestrate/pipeline-trace.ts +131 -131
  114. package/src/orchestrate/prompt-builder.ts +155 -155
  115. package/src/orchestrate/ring-buffer.ts +37 -37
  116. package/src/orchestrate/task-graph.ts +389 -389
  117. package/src/project/aliases.ts +374 -374
  118. package/src/rules/adapters/trae.ts +56 -56
  119. package/src/rules/syncer.ts +235 -235
  120. package/src/search/query-expansion.ts +52 -52
  121. package/src/server/formation-timeout.ts +27 -27
  122. package/src/server.ts +23 -1
  123. package/src/skills/mini-skills.ts +386 -386
  124. package/src/store/chat-store.ts +119 -119
  125. package/src/store/graph-store.ts +249 -249
  126. package/src/store/mini-skill-store.ts +349 -349
  127. package/src/store/persistence-json.ts +212 -212
  128. package/src/store/persistence.ts +291 -291
  129. package/src/store/project-affinity.ts +195 -195
  130. package/src/team/event-bus.ts +76 -76
  131. package/src/team/file-locks.ts +173 -173
  132. package/src/team/handoff.ts +161 -161
  133. package/src/team/messages.ts +203 -203
  134. package/src/team/poll.ts +132 -132
  135. package/src/team/tasks.ts +211 -211
  136. package/src/workspace/mcp-adapters/codex.ts +191 -191
  137. package/src/workspace/mcp-adapters/copilot.ts +105 -105
  138. package/src/workspace/mcp-adapters/cursor.ts +53 -53
  139. package/src/workspace/mcp-adapters/kiro.ts +64 -64
  140. package/src/workspace/mcp-adapters/opencode.ts +123 -123
  141. package/src/workspace/mcp-adapters/trae.ts +134 -134
  142. package/src/workspace/mcp-adapters/windsurf.ts +91 -91
  143. package/src/workspace/sanitizer.ts +60 -60
  144. package/dist/memcode-runtime/docs/images/exy.png +0 -0
@@ -1,134 +1,134 @@
1
- import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
- import { join } from 'node:path';
3
- import { homedir } from 'node:os';
4
-
5
- /**
6
- * Trae IDE MCP Configuration Adapter.
7
- *
8
- * Trae stores MCP config at the user level:
9
- * %APPDATA%/Trae/User/mcp.json (Windows)
10
- * ~/Library/Application Support/Trae/User/mcp.json (macOS)
11
- * ~/.config/Trae/User/mcp.json (Linux)
12
- *
13
- * Format (OBJECT-keyed, same as Cursor):
14
- * {
15
- * "mcpServers": {
16
- * "memorix": {
17
- * "command": "memorix",
18
- * "args": ["serve"],
19
- * "env": { "KEY": "value" }
20
- * }
21
- * }
22
- * }
23
- *
24
- * SSE transport:
25
- * {
26
- * "mcpServers": {
27
- * "remote": {
28
- * "url": "https://...",
29
- * "type": "sse"
30
- * }
31
- * }
32
- * }
33
- *
34
- * Source: https://docs.trae.ai/ide/model-context-protocol
35
- */
36
- export class TraeMCPAdapter implements MCPConfigAdapter {
37
- readonly source = 'trae' as const;
38
-
39
- parse(content: string): MCPServerEntry[] {
40
- try {
41
- const config = JSON.parse(content);
42
- const servers = config.mcpServers;
43
-
44
- if (!servers || typeof servers !== 'object') return [];
45
-
46
- // Object-keyed format: { "mcpServers": { "name": { ... } } }
47
- return Object.entries(servers).map(([name, entry]: [string, any]) => {
48
- const result: MCPServerEntry = {
49
- name,
50
- command: '',
51
- args: [],
52
- };
53
-
54
- if (typeof entry.command === 'string') {
55
- result.command = entry.command;
56
- }
57
-
58
- if (Array.isArray(entry.args)) {
59
- result.args = entry.args;
60
- }
61
-
62
- // SSE/HTTP transport
63
- if (entry.url) {
64
- result.url = entry.url;
65
- }
66
-
67
- // Environment variables
68
- if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
69
- result.env = entry.env;
70
- }
71
-
72
- // Headers (for HTTP transport)
73
- if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
74
- result.headers = entry.headers;
75
- }
76
-
77
- // Disabled flag
78
- if (entry.disabled === true) {
79
- result.disabled = true;
80
- }
81
-
82
- return result;
83
- });
84
- } catch {
85
- return [];
86
- }
87
- }
88
-
89
- generate(servers: MCPServerEntry[]): string {
90
- const mcpServers: Record<string, any> = {};
91
-
92
- for (const s of servers) {
93
- const entry: Record<string, any> = {};
94
-
95
- if (s.url) {
96
- // SSE/HTTP transport
97
- entry.url = s.url;
98
- if (s.headers && Object.keys(s.headers).length > 0) {
99
- entry.headers = s.headers;
100
- }
101
- } else {
102
- // stdio transport
103
- entry.command = s.command;
104
- if (s.args && s.args.length > 0) {
105
- entry.args = s.args;
106
- }
107
- }
108
-
109
- if (s.env && Object.keys(s.env).length > 0) {
110
- entry.env = s.env;
111
- }
112
-
113
- if (s.disabled === true) {
114
- entry.disabled = true;
115
- }
116
-
117
- mcpServers[s.name] = entry;
118
- }
119
-
120
- return JSON.stringify({ mcpServers }, null, 2);
121
- }
122
-
123
- getConfigPath(_projectRoot?: string): string {
124
- const home = homedir();
125
- // Trae stores user-level MCP config in AppData (Windows) / Application Support (macOS) / .config (Linux)
126
- if (process.platform === 'win32') {
127
- return join(process.env.APPDATA || join(home, 'AppData', 'Roaming'), 'Trae', 'User', 'mcp.json');
128
- }
129
- if (process.platform === 'darwin') {
130
- return join(home, 'Library', 'Application Support', 'Trae', 'User', 'mcp.json');
131
- }
132
- return join(home, '.config', 'Trae', 'User', 'mcp.json');
133
- }
134
- }
1
+ import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
+ import { join } from 'node:path';
3
+ import { homedir } from 'node:os';
4
+
5
+ /**
6
+ * Trae IDE MCP Configuration Adapter.
7
+ *
8
+ * Trae stores MCP config at the user level:
9
+ * %APPDATA%/Trae/User/mcp.json (Windows)
10
+ * ~/Library/Application Support/Trae/User/mcp.json (macOS)
11
+ * ~/.config/Trae/User/mcp.json (Linux)
12
+ *
13
+ * Format (OBJECT-keyed, same as Cursor):
14
+ * {
15
+ * "mcpServers": {
16
+ * "memorix": {
17
+ * "command": "memorix",
18
+ * "args": ["serve"],
19
+ * "env": { "KEY": "value" }
20
+ * }
21
+ * }
22
+ * }
23
+ *
24
+ * SSE transport:
25
+ * {
26
+ * "mcpServers": {
27
+ * "remote": {
28
+ * "url": "https://...",
29
+ * "type": "sse"
30
+ * }
31
+ * }
32
+ * }
33
+ *
34
+ * Source: https://docs.trae.ai/ide/model-context-protocol
35
+ */
36
+ export class TraeMCPAdapter implements MCPConfigAdapter {
37
+ readonly source = 'trae' as const;
38
+
39
+ parse(content: string): MCPServerEntry[] {
40
+ try {
41
+ const config = JSON.parse(content);
42
+ const servers = config.mcpServers;
43
+
44
+ if (!servers || typeof servers !== 'object') return [];
45
+
46
+ // Object-keyed format: { "mcpServers": { "name": { ... } } }
47
+ return Object.entries(servers).map(([name, entry]: [string, any]) => {
48
+ const result: MCPServerEntry = {
49
+ name,
50
+ command: '',
51
+ args: [],
52
+ };
53
+
54
+ if (typeof entry.command === 'string') {
55
+ result.command = entry.command;
56
+ }
57
+
58
+ if (Array.isArray(entry.args)) {
59
+ result.args = entry.args;
60
+ }
61
+
62
+ // SSE/HTTP transport
63
+ if (entry.url) {
64
+ result.url = entry.url;
65
+ }
66
+
67
+ // Environment variables
68
+ if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
69
+ result.env = entry.env;
70
+ }
71
+
72
+ // Headers (for HTTP transport)
73
+ if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
74
+ result.headers = entry.headers;
75
+ }
76
+
77
+ // Disabled flag
78
+ if (entry.disabled === true) {
79
+ result.disabled = true;
80
+ }
81
+
82
+ return result;
83
+ });
84
+ } catch {
85
+ return [];
86
+ }
87
+ }
88
+
89
+ generate(servers: MCPServerEntry[]): string {
90
+ const mcpServers: Record<string, any> = {};
91
+
92
+ for (const s of servers) {
93
+ const entry: Record<string, any> = {};
94
+
95
+ if (s.url) {
96
+ // SSE/HTTP transport
97
+ entry.url = s.url;
98
+ if (s.headers && Object.keys(s.headers).length > 0) {
99
+ entry.headers = s.headers;
100
+ }
101
+ } else {
102
+ // stdio transport
103
+ entry.command = s.command;
104
+ if (s.args && s.args.length > 0) {
105
+ entry.args = s.args;
106
+ }
107
+ }
108
+
109
+ if (s.env && Object.keys(s.env).length > 0) {
110
+ entry.env = s.env;
111
+ }
112
+
113
+ if (s.disabled === true) {
114
+ entry.disabled = true;
115
+ }
116
+
117
+ mcpServers[s.name] = entry;
118
+ }
119
+
120
+ return JSON.stringify({ mcpServers }, null, 2);
121
+ }
122
+
123
+ getConfigPath(_projectRoot?: string): string {
124
+ const home = homedir();
125
+ // Trae stores user-level MCP config in AppData (Windows) / Application Support (macOS) / .config (Linux)
126
+ if (process.platform === 'win32') {
127
+ return join(process.env.APPDATA || join(home, 'AppData', 'Roaming'), 'Trae', 'User', 'mcp.json');
128
+ }
129
+ if (process.platform === 'darwin') {
130
+ return join(home, 'Library', 'Application Support', 'Trae', 'User', 'mcp.json');
131
+ }
132
+ return join(home, '.config', 'Trae', 'User', 'mcp.json');
133
+ }
134
+ }
@@ -1,91 +1,91 @@
1
- import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
- import { homedir } from 'node:os';
3
- import { join } from 'node:path';
4
-
5
- /**
6
- * Windsurf MCP config adapter.
7
- * Format: JSON file at ~/.codeium/windsurf/mcp_config.json
8
- *
9
- * Supports two transport modes:
10
- * 1. stdio: { command, args, env? }
11
- * 2. HTTP: { serverUrl, headers? }
12
- *
13
- * Also handles: disabled, disabledTools, env: null
14
- */
15
- export class WindsurfMCPAdapter implements MCPConfigAdapter {
16
- readonly source = 'windsurf' as const;
17
-
18
- parse(content: string): MCPServerEntry[] {
19
- try {
20
- const config = JSON.parse(content);
21
- const servers = config.mcpServers ?? config.mcp_servers ?? {};
22
- return Object.entries(servers).map(([name, entry]: [string, any]) => {
23
- const result: MCPServerEntry = {
24
- name,
25
- command: entry.command ?? '',
26
- args: entry.args ?? [],
27
- };
28
-
29
- // HTTP transport: Windsurf uses "serverUrl" (not "url")
30
- if (entry.serverUrl) {
31
- result.url = entry.serverUrl;
32
- } else if (entry.url) {
33
- result.url = entry.url;
34
- }
35
-
36
- // Headers (for HTTP transport)
37
- if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
38
- result.headers = entry.headers;
39
- }
40
-
41
- // Env (can be null in Windsurf)
42
- if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
43
- result.env = entry.env;
44
- }
45
-
46
- // Disabled flag
47
- if (entry.disabled === true) {
48
- result.disabled = true;
49
- }
50
-
51
- return result;
52
- });
53
- } catch {
54
- return [];
55
- }
56
- }
57
-
58
- generate(servers: MCPServerEntry[]): string {
59
- const mcpServers: Record<string, any> = {};
60
- for (const s of servers) {
61
- const entry: Record<string, any> = {};
62
-
63
- if (s.url) {
64
- // HTTP transport — Windsurf uses "serverUrl"
65
- entry.serverUrl = s.url;
66
- if (s.headers && Object.keys(s.headers).length > 0) {
67
- entry.headers = s.headers;
68
- }
69
- } else {
70
- // stdio transport
71
- entry.command = s.command;
72
- entry.args = s.args;
73
- }
74
-
75
- if (s.env && Object.keys(s.env).length > 0) {
76
- entry.env = s.env;
77
- }
78
-
79
- if (s.disabled === true) {
80
- entry.disabled = true;
81
- }
82
-
83
- mcpServers[s.name] = entry;
84
- }
85
- return JSON.stringify({ mcpServers }, null, 2);
86
- }
87
-
88
- getConfigPath(_projectRoot?: string): string {
89
- return join(homedir(), '.codeium', 'windsurf', 'mcp_config.json');
90
- }
91
- }
1
+ import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
+ import { homedir } from 'node:os';
3
+ import { join } from 'node:path';
4
+
5
+ /**
6
+ * Windsurf MCP config adapter.
7
+ * Format: JSON file at ~/.codeium/windsurf/mcp_config.json
8
+ *
9
+ * Supports two transport modes:
10
+ * 1. stdio: { command, args, env? }
11
+ * 2. HTTP: { serverUrl, headers? }
12
+ *
13
+ * Also handles: disabled, disabledTools, env: null
14
+ */
15
+ export class WindsurfMCPAdapter implements MCPConfigAdapter {
16
+ readonly source = 'windsurf' as const;
17
+
18
+ parse(content: string): MCPServerEntry[] {
19
+ try {
20
+ const config = JSON.parse(content);
21
+ const servers = config.mcpServers ?? config.mcp_servers ?? {};
22
+ return Object.entries(servers).map(([name, entry]: [string, any]) => {
23
+ const result: MCPServerEntry = {
24
+ name,
25
+ command: entry.command ?? '',
26
+ args: entry.args ?? [],
27
+ };
28
+
29
+ // HTTP transport: Windsurf uses "serverUrl" (not "url")
30
+ if (entry.serverUrl) {
31
+ result.url = entry.serverUrl;
32
+ } else if (entry.url) {
33
+ result.url = entry.url;
34
+ }
35
+
36
+ // Headers (for HTTP transport)
37
+ if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
38
+ result.headers = entry.headers;
39
+ }
40
+
41
+ // Env (can be null in Windsurf)
42
+ if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
43
+ result.env = entry.env;
44
+ }
45
+
46
+ // Disabled flag
47
+ if (entry.disabled === true) {
48
+ result.disabled = true;
49
+ }
50
+
51
+ return result;
52
+ });
53
+ } catch {
54
+ return [];
55
+ }
56
+ }
57
+
58
+ generate(servers: MCPServerEntry[]): string {
59
+ const mcpServers: Record<string, any> = {};
60
+ for (const s of servers) {
61
+ const entry: Record<string, any> = {};
62
+
63
+ if (s.url) {
64
+ // HTTP transport — Windsurf uses "serverUrl"
65
+ entry.serverUrl = s.url;
66
+ if (s.headers && Object.keys(s.headers).length > 0) {
67
+ entry.headers = s.headers;
68
+ }
69
+ } else {
70
+ // stdio transport
71
+ entry.command = s.command;
72
+ entry.args = s.args;
73
+ }
74
+
75
+ if (s.env && Object.keys(s.env).length > 0) {
76
+ entry.env = s.env;
77
+ }
78
+
79
+ if (s.disabled === true) {
80
+ entry.disabled = true;
81
+ }
82
+
83
+ mcpServers[s.name] = entry;
84
+ }
85
+ return JSON.stringify({ mcpServers }, null, 2);
86
+ }
87
+
88
+ getConfigPath(_projectRoot?: string): string {
89
+ return join(homedir(), '.codeium', 'windsurf', 'mcp_config.json');
90
+ }
91
+ }
@@ -1,60 +1,60 @@
1
- /**
2
- * Sanitizer — mask sensitive values (tokens, keys, passwords) in output.
3
- *
4
- * Patterns detected:
5
- * - API keys / tokens (github_pat_*, ctx7sk-*, sk-*, ghp_*, ghu_*, etc.)
6
- * - Generic key=value where key contains "token", "key", "secret", "password"
7
- * - Bearer tokens
8
- */
9
-
10
- const SENSITIVE_PATTERNS: { pattern: RegExp; replacement: string }[] = [
11
- // GitHub PAT (classic & fine-grained)
12
- { pattern: /ghp_[A-Za-z0-9_]{36,}/g, replacement: 'ghp_***' },
13
- { pattern: /github_pat_[A-Za-z0-9_]{60,}/g, replacement: 'github_pat_***' },
14
- { pattern: /ghu_[A-Za-z0-9_]{36,}/g, replacement: 'ghu_***' },
15
- { pattern: /ghs_[A-Za-z0-9_]{36,}/g, replacement: 'ghs_***' },
16
- // OpenAI / Anthropic style keys
17
- { pattern: /sk-[A-Za-z0-9_-]{20,}/g, replacement: 'sk-***' },
18
- // Context7 keys
19
- { pattern: /ctx7sk-[A-Za-z0-9-]{20,}/g, replacement: 'ctx7sk-***' },
20
- // Generic long hex/base64 tokens (32+ chars) in quoted values
21
- { pattern: /"([A-Za-z0-9_-]{40,})"/g, replacement: '"***"' },
22
- ];
23
-
24
- const SENSITIVE_KEY_PATTERN = /(?:token|key|secret|password|credential|auth)/i;
25
-
26
- /**
27
- * Mask sensitive values in a string.
28
- */
29
- export function sanitize(input: string): string {
30
- let result = input;
31
-
32
- // Apply known token patterns
33
- for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
34
- // Reset lastIndex for global regexes
35
- pattern.lastIndex = 0;
36
- result = result.replace(pattern, replacement);
37
- }
38
-
39
- return result;
40
- }
41
-
42
- /**
43
- * Mask sensitive values in MCPServerEntry env/headers objects.
44
- * Returns a new object with masked values.
45
- */
46
- export function sanitizeRecord(
47
- record: Record<string, string> | undefined | null,
48
- ): Record<string, string> | undefined {
49
- if (!record) return undefined;
50
-
51
- const masked: Record<string, string> = {};
52
- for (const [key, value] of Object.entries(record)) {
53
- if (SENSITIVE_KEY_PATTERN.test(key)) {
54
- masked[key] = '***';
55
- } else {
56
- masked[key] = value;
57
- }
58
- }
59
- return masked;
60
- }
1
+ /**
2
+ * Sanitizer — mask sensitive values (tokens, keys, passwords) in output.
3
+ *
4
+ * Patterns detected:
5
+ * - API keys / tokens (github_pat_*, ctx7sk-*, sk-*, ghp_*, ghu_*, etc.)
6
+ * - Generic key=value where key contains "token", "key", "secret", "password"
7
+ * - Bearer tokens
8
+ */
9
+
10
+ const SENSITIVE_PATTERNS: { pattern: RegExp; replacement: string }[] = [
11
+ // GitHub PAT (classic & fine-grained)
12
+ { pattern: /ghp_[A-Za-z0-9_]{36,}/g, replacement: 'ghp_***' },
13
+ { pattern: /github_pat_[A-Za-z0-9_]{60,}/g, replacement: 'github_pat_***' },
14
+ { pattern: /ghu_[A-Za-z0-9_]{36,}/g, replacement: 'ghu_***' },
15
+ { pattern: /ghs_[A-Za-z0-9_]{36,}/g, replacement: 'ghs_***' },
16
+ // OpenAI / Anthropic style keys
17
+ { pattern: /sk-[A-Za-z0-9_-]{20,}/g, replacement: 'sk-***' },
18
+ // Context7 keys
19
+ { pattern: /ctx7sk-[A-Za-z0-9-]{20,}/g, replacement: 'ctx7sk-***' },
20
+ // Generic long hex/base64 tokens (32+ chars) in quoted values
21
+ { pattern: /"([A-Za-z0-9_-]{40,})"/g, replacement: '"***"' },
22
+ ];
23
+
24
+ const SENSITIVE_KEY_PATTERN = /(?:token|key|secret|password|credential|auth)/i;
25
+
26
+ /**
27
+ * Mask sensitive values in a string.
28
+ */
29
+ export function sanitize(input: string): string {
30
+ let result = input;
31
+
32
+ // Apply known token patterns
33
+ for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
34
+ // Reset lastIndex for global regexes
35
+ pattern.lastIndex = 0;
36
+ result = result.replace(pattern, replacement);
37
+ }
38
+
39
+ return result;
40
+ }
41
+
42
+ /**
43
+ * Mask sensitive values in MCPServerEntry env/headers objects.
44
+ * Returns a new object with masked values.
45
+ */
46
+ export function sanitizeRecord(
47
+ record: Record<string, string> | undefined | null,
48
+ ): Record<string, string> | undefined {
49
+ if (!record) return undefined;
50
+
51
+ const masked: Record<string, string> = {};
52
+ for (const [key, value] of Object.entries(record)) {
53
+ if (SENSITIVE_KEY_PATTERN.test(key)) {
54
+ masked[key] = '***';
55
+ } else {
56
+ masked[key] = value;
57
+ }
58
+ }
59
+ return masked;
60
+ }