memorix 1.5.1 → 1.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (122) hide show
  1. package/CHANGELOG.md +23 -0
  2. package/README.md +3 -3
  3. package/README.zh-CN.md +3 -3
  4. package/TEAM.md +86 -86
  5. package/dist/cli/index.js +243 -42
  6. package/dist/cli/memcode.js +0 -0
  7. package/dist/index.js +167 -20
  8. package/dist/maintenance-runner.js +5 -4
  9. package/dist/media-audio-runner.js +5 -4
  10. package/dist/media-video-runner.js +5 -4
  11. package/dist/memcode-runtime/CHANGELOG.md +23 -0
  12. package/dist/sdk.js +166 -19
  13. package/dist/vector-backfill-runner.js +5 -4
  14. package/docs/1.2.4-PERSISTENT-MEMORY-DELIVERY.md +1 -1
  15. package/docs/API_REFERENCE.md +1 -1
  16. package/docs/DESIGN_DECISIONS.md +357 -357
  17. package/docs/DEVELOPMENT.md +5 -3
  18. package/package.json +1 -1
  19. package/plugins/claude/memorix/.claude-plugin/plugin.json +1 -1
  20. package/plugins/codebuddy/memorix/.codebuddy-plugin/plugin.json +1 -1
  21. package/plugins/codex/memorix/.codex-plugin/plugin.json +1 -1
  22. package/plugins/copilot/memorix/plugin.json +1 -1
  23. package/plugins/gemini/memorix/gemini-extension.json +1 -1
  24. package/plugins/omp/memorix/package.json +1 -1
  25. package/plugins/openclaw/memorix/.codex-plugin/plugin.json +1 -1
  26. package/plugins/pi/memorix/package.json +1 -1
  27. package/server.json +2 -2
  28. package/src/audit/index.ts +156 -156
  29. package/src/cli/commands/codegraph.ts +48 -5
  30. package/src/cli/commands/context.ts +20 -4
  31. package/src/cli/commands/formation.ts +48 -48
  32. package/src/cli/commands/git-hook-install.ts +111 -111
  33. package/src/cli/commands/handoff.ts +54 -54
  34. package/src/cli/commands/hooks-status.ts +63 -63
  35. package/src/cli/commands/ingest.ts +44 -44
  36. package/src/cli/commands/integrate-shared.ts +15 -15
  37. package/src/cli/commands/lock.ts +82 -82
  38. package/src/cli/commands/message.ts +104 -104
  39. package/src/cli/commands/poll.ts +58 -58
  40. package/src/cli/commands/reasoning.ts +118 -118
  41. package/src/cli/commands/resume.ts +4 -0
  42. package/src/cli/commands/skills.ts +114 -114
  43. package/src/cli/commands/task.ts +167 -167
  44. package/src/cli/commands/transfer.ts +47 -47
  45. package/src/cli/index.ts +406 -406
  46. package/src/cli/tui/ChatView.tsx +234 -234
  47. package/src/cli/tui/CommandBar.tsx +312 -312
  48. package/src/cli/tui/ContextRail.tsx +118 -118
  49. package/src/cli/tui/HeaderBar.tsx +72 -72
  50. package/src/cli/tui/LogoBanner.tsx +51 -51
  51. package/src/cli/tui/index.ts +41 -41
  52. package/src/cli/version.ts +7 -7
  53. package/src/cli/workbench.ts +1 -1
  54. package/src/codegraph/auto-context.ts +4 -1
  55. package/src/codegraph/context-pack.ts +3 -1
  56. package/src/codegraph/external-provider.ts +93 -0
  57. package/src/dashboard/project-classification.ts +64 -64
  58. package/src/git/hooks-path.ts +85 -85
  59. package/src/hooks/installers/index.ts +1 -1
  60. package/src/hooks/official-skills.ts +3 -3
  61. package/src/hooks/pattern-detector.ts +173 -173
  62. package/src/hooks/rules/memorix-agent-rules.md +1 -1
  63. package/src/hooks/significance-filter.ts +250 -250
  64. package/src/knowledge/context-receipt.ts +41 -0
  65. package/src/knowledge/workflows.ts +6 -3
  66. package/src/knowledge/workset.ts +56 -2
  67. package/src/llm/memory-manager.ts +328 -328
  68. package/src/llm/quality.ts +248 -248
  69. package/src/memory/attribution-guard.ts +249 -249
  70. package/src/memory/disclosure-policy.ts +135 -135
  71. package/src/memory/entity-extractor.ts +197 -197
  72. package/src/memory/formation/evaluate.ts +217 -217
  73. package/src/memory/freshness.ts +122 -122
  74. package/src/memory/graph.ts +197 -197
  75. package/src/memory/refs.ts +94 -94
  76. package/src/memory/secret-filter.ts +79 -79
  77. package/src/orchestrate/adapters/claude-stream.ts +192 -192
  78. package/src/orchestrate/adapters/claude.ts +111 -111
  79. package/src/orchestrate/adapters/codex-stream.ts +134 -134
  80. package/src/orchestrate/adapters/codex.ts +41 -41
  81. package/src/orchestrate/adapters/gemini-stream.ts +166 -166
  82. package/src/orchestrate/adapters/gemini.ts +42 -42
  83. package/src/orchestrate/adapters/index.ts +73 -73
  84. package/src/orchestrate/adapters/opencode-stream.ts +143 -143
  85. package/src/orchestrate/adapters/opencode.ts +47 -47
  86. package/src/orchestrate/adapters/types.ts +77 -77
  87. package/src/orchestrate/capability-router.ts +284 -284
  88. package/src/orchestrate/cost-tracker.ts +219 -219
  89. package/src/orchestrate/error-recovery.ts +191 -191
  90. package/src/orchestrate/evidence.ts +140 -140
  91. package/src/orchestrate/ledger.ts +110 -110
  92. package/src/orchestrate/memorix-bridge.ts +343 -343
  93. package/src/orchestrate/output-budget.ts +80 -80
  94. package/src/orchestrate/permission.ts +152 -152
  95. package/src/orchestrate/pipeline-trace.ts +131 -131
  96. package/src/orchestrate/prompt-builder.ts +155 -155
  97. package/src/orchestrate/ring-buffer.ts +37 -37
  98. package/src/orchestrate/task-graph.ts +389 -389
  99. package/src/project/aliases.ts +374 -374
  100. package/src/rules/adapters/trae.ts +56 -56
  101. package/src/rules/syncer.ts +235 -235
  102. package/src/search/query-expansion.ts +52 -52
  103. package/src/server/formation-timeout.ts +27 -27
  104. package/src/server.ts +15 -3
  105. package/src/skills/mini-skills.ts +386 -386
  106. package/src/store/chat-store.ts +119 -119
  107. package/src/store/graph-store.ts +249 -249
  108. package/src/store/mini-skill-store.ts +349 -349
  109. package/src/store/persistence-json.ts +212 -212
  110. package/src/store/persistence.ts +291 -291
  111. package/src/store/project-affinity.ts +195 -195
  112. package/src/team/event-bus.ts +76 -76
  113. package/src/team/handoff.ts +161 -161
  114. package/src/team/poll.ts +132 -132
  115. package/src/workspace/mcp-adapters/codex.ts +191 -191
  116. package/src/workspace/mcp-adapters/copilot.ts +105 -105
  117. package/src/workspace/mcp-adapters/cursor.ts +53 -53
  118. package/src/workspace/mcp-adapters/kiro.ts +64 -64
  119. package/src/workspace/mcp-adapters/opencode.ts +123 -123
  120. package/src/workspace/mcp-adapters/trae.ts +134 -134
  121. package/src/workspace/mcp-adapters/windsurf.ts +91 -91
  122. package/src/workspace/sanitizer.ts +60 -60
@@ -1,134 +1,134 @@
1
- import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
- import { join } from 'node:path';
3
- import { homedir } from 'node:os';
4
-
5
- /**
6
- * Trae IDE MCP Configuration Adapter.
7
- *
8
- * Trae stores MCP config at the user level:
9
- * %APPDATA%/Trae/User/mcp.json (Windows)
10
- * ~/Library/Application Support/Trae/User/mcp.json (macOS)
11
- * ~/.config/Trae/User/mcp.json (Linux)
12
- *
13
- * Format (OBJECT-keyed, same as Cursor):
14
- * {
15
- * "mcpServers": {
16
- * "memorix": {
17
- * "command": "memorix",
18
- * "args": ["serve"],
19
- * "env": { "KEY": "value" }
20
- * }
21
- * }
22
- * }
23
- *
24
- * SSE transport:
25
- * {
26
- * "mcpServers": {
27
- * "remote": {
28
- * "url": "https://...",
29
- * "type": "sse"
30
- * }
31
- * }
32
- * }
33
- *
34
- * Source: https://docs.trae.ai/ide/model-context-protocol
35
- */
36
- export class TraeMCPAdapter implements MCPConfigAdapter {
37
- readonly source = 'trae' as const;
38
-
39
- parse(content: string): MCPServerEntry[] {
40
- try {
41
- const config = JSON.parse(content);
42
- const servers = config.mcpServers;
43
-
44
- if (!servers || typeof servers !== 'object') return [];
45
-
46
- // Object-keyed format: { "mcpServers": { "name": { ... } } }
47
- return Object.entries(servers).map(([name, entry]: [string, any]) => {
48
- const result: MCPServerEntry = {
49
- name,
50
- command: '',
51
- args: [],
52
- };
53
-
54
- if (typeof entry.command === 'string') {
55
- result.command = entry.command;
56
- }
57
-
58
- if (Array.isArray(entry.args)) {
59
- result.args = entry.args;
60
- }
61
-
62
- // SSE/HTTP transport
63
- if (entry.url) {
64
- result.url = entry.url;
65
- }
66
-
67
- // Environment variables
68
- if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
69
- result.env = entry.env;
70
- }
71
-
72
- // Headers (for HTTP transport)
73
- if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
74
- result.headers = entry.headers;
75
- }
76
-
77
- // Disabled flag
78
- if (entry.disabled === true) {
79
- result.disabled = true;
80
- }
81
-
82
- return result;
83
- });
84
- } catch {
85
- return [];
86
- }
87
- }
88
-
89
- generate(servers: MCPServerEntry[]): string {
90
- const mcpServers: Record<string, any> = {};
91
-
92
- for (const s of servers) {
93
- const entry: Record<string, any> = {};
94
-
95
- if (s.url) {
96
- // SSE/HTTP transport
97
- entry.url = s.url;
98
- if (s.headers && Object.keys(s.headers).length > 0) {
99
- entry.headers = s.headers;
100
- }
101
- } else {
102
- // stdio transport
103
- entry.command = s.command;
104
- if (s.args && s.args.length > 0) {
105
- entry.args = s.args;
106
- }
107
- }
108
-
109
- if (s.env && Object.keys(s.env).length > 0) {
110
- entry.env = s.env;
111
- }
112
-
113
- if (s.disabled === true) {
114
- entry.disabled = true;
115
- }
116
-
117
- mcpServers[s.name] = entry;
118
- }
119
-
120
- return JSON.stringify({ mcpServers }, null, 2);
121
- }
122
-
123
- getConfigPath(_projectRoot?: string): string {
124
- const home = homedir();
125
- // Trae stores user-level MCP config in AppData (Windows) / Application Support (macOS) / .config (Linux)
126
- if (process.platform === 'win32') {
127
- return join(process.env.APPDATA || join(home, 'AppData', 'Roaming'), 'Trae', 'User', 'mcp.json');
128
- }
129
- if (process.platform === 'darwin') {
130
- return join(home, 'Library', 'Application Support', 'Trae', 'User', 'mcp.json');
131
- }
132
- return join(home, '.config', 'Trae', 'User', 'mcp.json');
133
- }
134
- }
1
+ import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
+ import { join } from 'node:path';
3
+ import { homedir } from 'node:os';
4
+
5
+ /**
6
+ * Trae IDE MCP Configuration Adapter.
7
+ *
8
+ * Trae stores MCP config at the user level:
9
+ * %APPDATA%/Trae/User/mcp.json (Windows)
10
+ * ~/Library/Application Support/Trae/User/mcp.json (macOS)
11
+ * ~/.config/Trae/User/mcp.json (Linux)
12
+ *
13
+ * Format (OBJECT-keyed, same as Cursor):
14
+ * {
15
+ * "mcpServers": {
16
+ * "memorix": {
17
+ * "command": "memorix",
18
+ * "args": ["serve"],
19
+ * "env": { "KEY": "value" }
20
+ * }
21
+ * }
22
+ * }
23
+ *
24
+ * SSE transport:
25
+ * {
26
+ * "mcpServers": {
27
+ * "remote": {
28
+ * "url": "https://...",
29
+ * "type": "sse"
30
+ * }
31
+ * }
32
+ * }
33
+ *
34
+ * Source: https://docs.trae.ai/ide/model-context-protocol
35
+ */
36
+ export class TraeMCPAdapter implements MCPConfigAdapter {
37
+ readonly source = 'trae' as const;
38
+
39
+ parse(content: string): MCPServerEntry[] {
40
+ try {
41
+ const config = JSON.parse(content);
42
+ const servers = config.mcpServers;
43
+
44
+ if (!servers || typeof servers !== 'object') return [];
45
+
46
+ // Object-keyed format: { "mcpServers": { "name": { ... } } }
47
+ return Object.entries(servers).map(([name, entry]: [string, any]) => {
48
+ const result: MCPServerEntry = {
49
+ name,
50
+ command: '',
51
+ args: [],
52
+ };
53
+
54
+ if (typeof entry.command === 'string') {
55
+ result.command = entry.command;
56
+ }
57
+
58
+ if (Array.isArray(entry.args)) {
59
+ result.args = entry.args;
60
+ }
61
+
62
+ // SSE/HTTP transport
63
+ if (entry.url) {
64
+ result.url = entry.url;
65
+ }
66
+
67
+ // Environment variables
68
+ if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
69
+ result.env = entry.env;
70
+ }
71
+
72
+ // Headers (for HTTP transport)
73
+ if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
74
+ result.headers = entry.headers;
75
+ }
76
+
77
+ // Disabled flag
78
+ if (entry.disabled === true) {
79
+ result.disabled = true;
80
+ }
81
+
82
+ return result;
83
+ });
84
+ } catch {
85
+ return [];
86
+ }
87
+ }
88
+
89
+ generate(servers: MCPServerEntry[]): string {
90
+ const mcpServers: Record<string, any> = {};
91
+
92
+ for (const s of servers) {
93
+ const entry: Record<string, any> = {};
94
+
95
+ if (s.url) {
96
+ // SSE/HTTP transport
97
+ entry.url = s.url;
98
+ if (s.headers && Object.keys(s.headers).length > 0) {
99
+ entry.headers = s.headers;
100
+ }
101
+ } else {
102
+ // stdio transport
103
+ entry.command = s.command;
104
+ if (s.args && s.args.length > 0) {
105
+ entry.args = s.args;
106
+ }
107
+ }
108
+
109
+ if (s.env && Object.keys(s.env).length > 0) {
110
+ entry.env = s.env;
111
+ }
112
+
113
+ if (s.disabled === true) {
114
+ entry.disabled = true;
115
+ }
116
+
117
+ mcpServers[s.name] = entry;
118
+ }
119
+
120
+ return JSON.stringify({ mcpServers }, null, 2);
121
+ }
122
+
123
+ getConfigPath(_projectRoot?: string): string {
124
+ const home = homedir();
125
+ // Trae stores user-level MCP config in AppData (Windows) / Application Support (macOS) / .config (Linux)
126
+ if (process.platform === 'win32') {
127
+ return join(process.env.APPDATA || join(home, 'AppData', 'Roaming'), 'Trae', 'User', 'mcp.json');
128
+ }
129
+ if (process.platform === 'darwin') {
130
+ return join(home, 'Library', 'Application Support', 'Trae', 'User', 'mcp.json');
131
+ }
132
+ return join(home, '.config', 'Trae', 'User', 'mcp.json');
133
+ }
134
+ }
@@ -1,91 +1,91 @@
1
- import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
- import { homedir } from 'node:os';
3
- import { join } from 'node:path';
4
-
5
- /**
6
- * Windsurf MCP config adapter.
7
- * Format: JSON file at ~/.codeium/windsurf/mcp_config.json
8
- *
9
- * Supports two transport modes:
10
- * 1. stdio: { command, args, env? }
11
- * 2. HTTP: { serverUrl, headers? }
12
- *
13
- * Also handles: disabled, disabledTools, env: null
14
- */
15
- export class WindsurfMCPAdapter implements MCPConfigAdapter {
16
- readonly source = 'windsurf' as const;
17
-
18
- parse(content: string): MCPServerEntry[] {
19
- try {
20
- const config = JSON.parse(content);
21
- const servers = config.mcpServers ?? config.mcp_servers ?? {};
22
- return Object.entries(servers).map(([name, entry]: [string, any]) => {
23
- const result: MCPServerEntry = {
24
- name,
25
- command: entry.command ?? '',
26
- args: entry.args ?? [],
27
- };
28
-
29
- // HTTP transport: Windsurf uses "serverUrl" (not "url")
30
- if (entry.serverUrl) {
31
- result.url = entry.serverUrl;
32
- } else if (entry.url) {
33
- result.url = entry.url;
34
- }
35
-
36
- // Headers (for HTTP transport)
37
- if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
38
- result.headers = entry.headers;
39
- }
40
-
41
- // Env (can be null in Windsurf)
42
- if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
43
- result.env = entry.env;
44
- }
45
-
46
- // Disabled flag
47
- if (entry.disabled === true) {
48
- result.disabled = true;
49
- }
50
-
51
- return result;
52
- });
53
- } catch {
54
- return [];
55
- }
56
- }
57
-
58
- generate(servers: MCPServerEntry[]): string {
59
- const mcpServers: Record<string, any> = {};
60
- for (const s of servers) {
61
- const entry: Record<string, any> = {};
62
-
63
- if (s.url) {
64
- // HTTP transport — Windsurf uses "serverUrl"
65
- entry.serverUrl = s.url;
66
- if (s.headers && Object.keys(s.headers).length > 0) {
67
- entry.headers = s.headers;
68
- }
69
- } else {
70
- // stdio transport
71
- entry.command = s.command;
72
- entry.args = s.args;
73
- }
74
-
75
- if (s.env && Object.keys(s.env).length > 0) {
76
- entry.env = s.env;
77
- }
78
-
79
- if (s.disabled === true) {
80
- entry.disabled = true;
81
- }
82
-
83
- mcpServers[s.name] = entry;
84
- }
85
- return JSON.stringify({ mcpServers }, null, 2);
86
- }
87
-
88
- getConfigPath(_projectRoot?: string): string {
89
- return join(homedir(), '.codeium', 'windsurf', 'mcp_config.json');
90
- }
91
- }
1
+ import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
+ import { homedir } from 'node:os';
3
+ import { join } from 'node:path';
4
+
5
+ /**
6
+ * Windsurf MCP config adapter.
7
+ * Format: JSON file at ~/.codeium/windsurf/mcp_config.json
8
+ *
9
+ * Supports two transport modes:
10
+ * 1. stdio: { command, args, env? }
11
+ * 2. HTTP: { serverUrl, headers? }
12
+ *
13
+ * Also handles: disabled, disabledTools, env: null
14
+ */
15
+ export class WindsurfMCPAdapter implements MCPConfigAdapter {
16
+ readonly source = 'windsurf' as const;
17
+
18
+ parse(content: string): MCPServerEntry[] {
19
+ try {
20
+ const config = JSON.parse(content);
21
+ const servers = config.mcpServers ?? config.mcp_servers ?? {};
22
+ return Object.entries(servers).map(([name, entry]: [string, any]) => {
23
+ const result: MCPServerEntry = {
24
+ name,
25
+ command: entry.command ?? '',
26
+ args: entry.args ?? [],
27
+ };
28
+
29
+ // HTTP transport: Windsurf uses "serverUrl" (not "url")
30
+ if (entry.serverUrl) {
31
+ result.url = entry.serverUrl;
32
+ } else if (entry.url) {
33
+ result.url = entry.url;
34
+ }
35
+
36
+ // Headers (for HTTP transport)
37
+ if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
38
+ result.headers = entry.headers;
39
+ }
40
+
41
+ // Env (can be null in Windsurf)
42
+ if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
43
+ result.env = entry.env;
44
+ }
45
+
46
+ // Disabled flag
47
+ if (entry.disabled === true) {
48
+ result.disabled = true;
49
+ }
50
+
51
+ return result;
52
+ });
53
+ } catch {
54
+ return [];
55
+ }
56
+ }
57
+
58
+ generate(servers: MCPServerEntry[]): string {
59
+ const mcpServers: Record<string, any> = {};
60
+ for (const s of servers) {
61
+ const entry: Record<string, any> = {};
62
+
63
+ if (s.url) {
64
+ // HTTP transport — Windsurf uses "serverUrl"
65
+ entry.serverUrl = s.url;
66
+ if (s.headers && Object.keys(s.headers).length > 0) {
67
+ entry.headers = s.headers;
68
+ }
69
+ } else {
70
+ // stdio transport
71
+ entry.command = s.command;
72
+ entry.args = s.args;
73
+ }
74
+
75
+ if (s.env && Object.keys(s.env).length > 0) {
76
+ entry.env = s.env;
77
+ }
78
+
79
+ if (s.disabled === true) {
80
+ entry.disabled = true;
81
+ }
82
+
83
+ mcpServers[s.name] = entry;
84
+ }
85
+ return JSON.stringify({ mcpServers }, null, 2);
86
+ }
87
+
88
+ getConfigPath(_projectRoot?: string): string {
89
+ return join(homedir(), '.codeium', 'windsurf', 'mcp_config.json');
90
+ }
91
+ }
@@ -1,60 +1,60 @@
1
- /**
2
- * Sanitizer — mask sensitive values (tokens, keys, passwords) in output.
3
- *
4
- * Patterns detected:
5
- * - API keys / tokens (github_pat_*, ctx7sk-*, sk-*, ghp_*, ghu_*, etc.)
6
- * - Generic key=value where key contains "token", "key", "secret", "password"
7
- * - Bearer tokens
8
- */
9
-
10
- const SENSITIVE_PATTERNS: { pattern: RegExp; replacement: string }[] = [
11
- // GitHub PAT (classic & fine-grained)
12
- { pattern: /ghp_[A-Za-z0-9_]{36,}/g, replacement: 'ghp_***' },
13
- { pattern: /github_pat_[A-Za-z0-9_]{60,}/g, replacement: 'github_pat_***' },
14
- { pattern: /ghu_[A-Za-z0-9_]{36,}/g, replacement: 'ghu_***' },
15
- { pattern: /ghs_[A-Za-z0-9_]{36,}/g, replacement: 'ghs_***' },
16
- // OpenAI / Anthropic style keys
17
- { pattern: /sk-[A-Za-z0-9_-]{20,}/g, replacement: 'sk-***' },
18
- // Context7 keys
19
- { pattern: /ctx7sk-[A-Za-z0-9-]{20,}/g, replacement: 'ctx7sk-***' },
20
- // Generic long hex/base64 tokens (32+ chars) in quoted values
21
- { pattern: /"([A-Za-z0-9_-]{40,})"/g, replacement: '"***"' },
22
- ];
23
-
24
- const SENSITIVE_KEY_PATTERN = /(?:token|key|secret|password|credential|auth)/i;
25
-
26
- /**
27
- * Mask sensitive values in a string.
28
- */
29
- export function sanitize(input: string): string {
30
- let result = input;
31
-
32
- // Apply known token patterns
33
- for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
34
- // Reset lastIndex for global regexes
35
- pattern.lastIndex = 0;
36
- result = result.replace(pattern, replacement);
37
- }
38
-
39
- return result;
40
- }
41
-
42
- /**
43
- * Mask sensitive values in MCPServerEntry env/headers objects.
44
- * Returns a new object with masked values.
45
- */
46
- export function sanitizeRecord(
47
- record: Record<string, string> | undefined | null,
48
- ): Record<string, string> | undefined {
49
- if (!record) return undefined;
50
-
51
- const masked: Record<string, string> = {};
52
- for (const [key, value] of Object.entries(record)) {
53
- if (SENSITIVE_KEY_PATTERN.test(key)) {
54
- masked[key] = '***';
55
- } else {
56
- masked[key] = value;
57
- }
58
- }
59
- return masked;
60
- }
1
+ /**
2
+ * Sanitizer — mask sensitive values (tokens, keys, passwords) in output.
3
+ *
4
+ * Patterns detected:
5
+ * - API keys / tokens (github_pat_*, ctx7sk-*, sk-*, ghp_*, ghu_*, etc.)
6
+ * - Generic key=value where key contains "token", "key", "secret", "password"
7
+ * - Bearer tokens
8
+ */
9
+
10
+ const SENSITIVE_PATTERNS: { pattern: RegExp; replacement: string }[] = [
11
+ // GitHub PAT (classic & fine-grained)
12
+ { pattern: /ghp_[A-Za-z0-9_]{36,}/g, replacement: 'ghp_***' },
13
+ { pattern: /github_pat_[A-Za-z0-9_]{60,}/g, replacement: 'github_pat_***' },
14
+ { pattern: /ghu_[A-Za-z0-9_]{36,}/g, replacement: 'ghu_***' },
15
+ { pattern: /ghs_[A-Za-z0-9_]{36,}/g, replacement: 'ghs_***' },
16
+ // OpenAI / Anthropic style keys
17
+ { pattern: /sk-[A-Za-z0-9_-]{20,}/g, replacement: 'sk-***' },
18
+ // Context7 keys
19
+ { pattern: /ctx7sk-[A-Za-z0-9-]{20,}/g, replacement: 'ctx7sk-***' },
20
+ // Generic long hex/base64 tokens (32+ chars) in quoted values
21
+ { pattern: /"([A-Za-z0-9_-]{40,})"/g, replacement: '"***"' },
22
+ ];
23
+
24
+ const SENSITIVE_KEY_PATTERN = /(?:token|key|secret|password|credential|auth)/i;
25
+
26
+ /**
27
+ * Mask sensitive values in a string.
28
+ */
29
+ export function sanitize(input: string): string {
30
+ let result = input;
31
+
32
+ // Apply known token patterns
33
+ for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
34
+ // Reset lastIndex for global regexes
35
+ pattern.lastIndex = 0;
36
+ result = result.replace(pattern, replacement);
37
+ }
38
+
39
+ return result;
40
+ }
41
+
42
+ /**
43
+ * Mask sensitive values in MCPServerEntry env/headers objects.
44
+ * Returns a new object with masked values.
45
+ */
46
+ export function sanitizeRecord(
47
+ record: Record<string, string> | undefined | null,
48
+ ): Record<string, string> | undefined {
49
+ if (!record) return undefined;
50
+
51
+ const masked: Record<string, string> = {};
52
+ for (const [key, value] of Object.entries(record)) {
53
+ if (SENSITIVE_KEY_PATTERN.test(key)) {
54
+ masked[key] = '***';
55
+ } else {
56
+ masked[key] = value;
57
+ }
58
+ }
59
+ return masked;
60
+ }