memorix 1.6.1 → 1.6.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (113) hide show
  1. package/CHANGELOG.md +22 -0
  2. package/TEAM.md +86 -86
  3. package/dist/cli/index.js +1574 -1063
  4. package/dist/index.js +588 -107
  5. package/dist/maintenance-runner.js +565 -84
  6. package/dist/media-audio-runner.js +565 -84
  7. package/dist/media-video-runner.js +565 -84
  8. package/dist/memcode-runtime/CHANGELOG.md +22 -0
  9. package/dist/sdk.js +621 -111
  10. package/dist/vector-backfill-runner.js +565 -84
  11. package/docs/DESIGN_DECISIONS.md +357 -357
  12. package/docs/PERFORMANCE.md +15 -0
  13. package/package.json +2 -1
  14. package/plugins/claude/memorix/.claude-plugin/plugin.json +1 -1
  15. package/plugins/codebuddy/memorix/.codebuddy-plugin/plugin.json +1 -1
  16. package/plugins/codex/memorix/.codex-plugin/plugin.json +1 -1
  17. package/plugins/copilot/memorix/plugin.json +1 -1
  18. package/plugins/gemini/memorix/gemini-extension.json +1 -1
  19. package/plugins/omp/memorix/package.json +1 -1
  20. package/plugins/openclaw/memorix/.codex-plugin/plugin.json +1 -1
  21. package/plugins/pi/memorix/package.json +1 -1
  22. package/server.json +2 -2
  23. package/src/audit/index.ts +156 -156
  24. package/src/cli/commands/background.ts +34 -2
  25. package/src/cli/commands/formation.ts +48 -48
  26. package/src/cli/commands/git-hook-install.ts +111 -111
  27. package/src/cli/commands/handoff.ts +54 -54
  28. package/src/cli/commands/hooks-status.ts +63 -63
  29. package/src/cli/commands/ingest.ts +44 -44
  30. package/src/cli/commands/integrate-shared.ts +15 -15
  31. package/src/cli/commands/lock.ts +82 -82
  32. package/src/cli/commands/message.ts +104 -104
  33. package/src/cli/commands/operator-shared.ts +6 -3
  34. package/src/cli/commands/poll.ts +58 -58
  35. package/src/cli/commands/reasoning.ts +118 -118
  36. package/src/cli/commands/serve-http.ts +4 -0
  37. package/src/cli/commands/skills.ts +114 -114
  38. package/src/cli/commands/task.ts +167 -167
  39. package/src/cli/commands/transfer.ts +47 -47
  40. package/src/cli/index.ts +406 -406
  41. package/src/cli/tui/ChatView.tsx +234 -234
  42. package/src/cli/tui/CommandBar.tsx +312 -312
  43. package/src/cli/tui/ContextRail.tsx +118 -118
  44. package/src/cli/tui/HeaderBar.tsx +72 -72
  45. package/src/cli/tui/LogoBanner.tsx +51 -51
  46. package/src/cli/tui/index.ts +41 -41
  47. package/src/cli/version.ts +7 -7
  48. package/src/cli/workbench.ts +1 -1
  49. package/src/dashboard/project-classification.ts +64 -64
  50. package/src/embedding/api-provider.ts +503 -27
  51. package/src/embedding/provider.ts +20 -3
  52. package/src/git/hooks-path.ts +85 -85
  53. package/src/hooks/lifecycle.ts +1 -0
  54. package/src/hooks/pattern-detector.ts +173 -173
  55. package/src/hooks/significance-filter.ts +250 -250
  56. package/src/llm/memory-manager.ts +328 -328
  57. package/src/llm/quality.ts +248 -248
  58. package/src/memory/attribution-guard.ts +249 -249
  59. package/src/memory/disclosure-policy.ts +135 -135
  60. package/src/memory/entity-extractor.ts +197 -197
  61. package/src/memory/formation/evaluate.ts +217 -217
  62. package/src/memory/freshness.ts +122 -122
  63. package/src/memory/graph.ts +197 -197
  64. package/src/memory/observations.ts +68 -18
  65. package/src/memory/refs.ts +94 -94
  66. package/src/memory/secret-filter.ts +79 -79
  67. package/src/orchestrate/adapters/claude-stream.ts +192 -192
  68. package/src/orchestrate/adapters/claude.ts +111 -111
  69. package/src/orchestrate/adapters/codex-stream.ts +134 -134
  70. package/src/orchestrate/adapters/codex.ts +41 -41
  71. package/src/orchestrate/adapters/gemini-stream.ts +166 -166
  72. package/src/orchestrate/adapters/gemini.ts +42 -42
  73. package/src/orchestrate/adapters/index.ts +73 -73
  74. package/src/orchestrate/adapters/opencode-stream.ts +143 -143
  75. package/src/orchestrate/adapters/opencode.ts +47 -47
  76. package/src/orchestrate/adapters/types.ts +77 -77
  77. package/src/orchestrate/capability-router.ts +284 -284
  78. package/src/orchestrate/cost-tracker.ts +219 -219
  79. package/src/orchestrate/error-recovery.ts +191 -191
  80. package/src/orchestrate/evidence.ts +140 -140
  81. package/src/orchestrate/ledger.ts +110 -110
  82. package/src/orchestrate/memorix-bridge.ts +343 -343
  83. package/src/orchestrate/output-budget.ts +80 -80
  84. package/src/orchestrate/permission.ts +152 -152
  85. package/src/orchestrate/pipeline-trace.ts +131 -131
  86. package/src/orchestrate/prompt-builder.ts +155 -155
  87. package/src/orchestrate/ring-buffer.ts +37 -37
  88. package/src/orchestrate/task-graph.ts +389 -389
  89. package/src/project/aliases.ts +374 -374
  90. package/src/rules/adapters/trae.ts +56 -56
  91. package/src/rules/syncer.ts +235 -235
  92. package/src/sdk.ts +12 -8
  93. package/src/search/query-expansion.ts +52 -52
  94. package/src/server/formation-timeout.ts +27 -27
  95. package/src/skills/mini-skills.ts +386 -386
  96. package/src/store/chat-store.ts +119 -119
  97. package/src/store/graph-store.ts +249 -249
  98. package/src/store/mini-skill-store.ts +349 -349
  99. package/src/store/orama-store.ts +21 -3
  100. package/src/store/persistence-json.ts +212 -212
  101. package/src/store/persistence.ts +291 -291
  102. package/src/store/project-affinity.ts +195 -195
  103. package/src/team/event-bus.ts +76 -76
  104. package/src/team/handoff.ts +161 -161
  105. package/src/team/poll.ts +132 -132
  106. package/src/workspace/mcp-adapters/codex.ts +191 -191
  107. package/src/workspace/mcp-adapters/copilot.ts +105 -105
  108. package/src/workspace/mcp-adapters/cursor.ts +53 -53
  109. package/src/workspace/mcp-adapters/kiro.ts +64 -64
  110. package/src/workspace/mcp-adapters/opencode.ts +123 -123
  111. package/src/workspace/mcp-adapters/trae.ts +134 -134
  112. package/src/workspace/mcp-adapters/windsurf.ts +91 -91
  113. package/src/workspace/sanitizer.ts +60 -60
@@ -1,134 +1,134 @@
1
- import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
- import { join } from 'node:path';
3
- import { homedir } from 'node:os';
4
-
5
- /**
6
- * Trae IDE MCP Configuration Adapter.
7
- *
8
- * Trae stores MCP config at the user level:
9
- * %APPDATA%/Trae/User/mcp.json (Windows)
10
- * ~/Library/Application Support/Trae/User/mcp.json (macOS)
11
- * ~/.config/Trae/User/mcp.json (Linux)
12
- *
13
- * Format (OBJECT-keyed, same as Cursor):
14
- * {
15
- * "mcpServers": {
16
- * "memorix": {
17
- * "command": "memorix",
18
- * "args": ["serve"],
19
- * "env": { "KEY": "value" }
20
- * }
21
- * }
22
- * }
23
- *
24
- * SSE transport:
25
- * {
26
- * "mcpServers": {
27
- * "remote": {
28
- * "url": "https://...",
29
- * "type": "sse"
30
- * }
31
- * }
32
- * }
33
- *
34
- * Source: https://docs.trae.ai/ide/model-context-protocol
35
- */
36
- export class TraeMCPAdapter implements MCPConfigAdapter {
37
- readonly source = 'trae' as const;
38
-
39
- parse(content: string): MCPServerEntry[] {
40
- try {
41
- const config = JSON.parse(content);
42
- const servers = config.mcpServers;
43
-
44
- if (!servers || typeof servers !== 'object') return [];
45
-
46
- // Object-keyed format: { "mcpServers": { "name": { ... } } }
47
- return Object.entries(servers).map(([name, entry]: [string, any]) => {
48
- const result: MCPServerEntry = {
49
- name,
50
- command: '',
51
- args: [],
52
- };
53
-
54
- if (typeof entry.command === 'string') {
55
- result.command = entry.command;
56
- }
57
-
58
- if (Array.isArray(entry.args)) {
59
- result.args = entry.args;
60
- }
61
-
62
- // SSE/HTTP transport
63
- if (entry.url) {
64
- result.url = entry.url;
65
- }
66
-
67
- // Environment variables
68
- if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
69
- result.env = entry.env;
70
- }
71
-
72
- // Headers (for HTTP transport)
73
- if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
74
- result.headers = entry.headers;
75
- }
76
-
77
- // Disabled flag
78
- if (entry.disabled === true) {
79
- result.disabled = true;
80
- }
81
-
82
- return result;
83
- });
84
- } catch {
85
- return [];
86
- }
87
- }
88
-
89
- generate(servers: MCPServerEntry[]): string {
90
- const mcpServers: Record<string, any> = {};
91
-
92
- for (const s of servers) {
93
- const entry: Record<string, any> = {};
94
-
95
- if (s.url) {
96
- // SSE/HTTP transport
97
- entry.url = s.url;
98
- if (s.headers && Object.keys(s.headers).length > 0) {
99
- entry.headers = s.headers;
100
- }
101
- } else {
102
- // stdio transport
103
- entry.command = s.command;
104
- if (s.args && s.args.length > 0) {
105
- entry.args = s.args;
106
- }
107
- }
108
-
109
- if (s.env && Object.keys(s.env).length > 0) {
110
- entry.env = s.env;
111
- }
112
-
113
- if (s.disabled === true) {
114
- entry.disabled = true;
115
- }
116
-
117
- mcpServers[s.name] = entry;
118
- }
119
-
120
- return JSON.stringify({ mcpServers }, null, 2);
121
- }
122
-
123
- getConfigPath(_projectRoot?: string): string {
124
- const home = homedir();
125
- // Trae stores user-level MCP config in AppData (Windows) / Application Support (macOS) / .config (Linux)
126
- if (process.platform === 'win32') {
127
- return join(process.env.APPDATA || join(home, 'AppData', 'Roaming'), 'Trae', 'User', 'mcp.json');
128
- }
129
- if (process.platform === 'darwin') {
130
- return join(home, 'Library', 'Application Support', 'Trae', 'User', 'mcp.json');
131
- }
132
- return join(home, '.config', 'Trae', 'User', 'mcp.json');
133
- }
134
- }
1
+ import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
+ import { join } from 'node:path';
3
+ import { homedir } from 'node:os';
4
+
5
+ /**
6
+ * Trae IDE MCP Configuration Adapter.
7
+ *
8
+ * Trae stores MCP config at the user level:
9
+ * %APPDATA%/Trae/User/mcp.json (Windows)
10
+ * ~/Library/Application Support/Trae/User/mcp.json (macOS)
11
+ * ~/.config/Trae/User/mcp.json (Linux)
12
+ *
13
+ * Format (OBJECT-keyed, same as Cursor):
14
+ * {
15
+ * "mcpServers": {
16
+ * "memorix": {
17
+ * "command": "memorix",
18
+ * "args": ["serve"],
19
+ * "env": { "KEY": "value" }
20
+ * }
21
+ * }
22
+ * }
23
+ *
24
+ * SSE transport:
25
+ * {
26
+ * "mcpServers": {
27
+ * "remote": {
28
+ * "url": "https://...",
29
+ * "type": "sse"
30
+ * }
31
+ * }
32
+ * }
33
+ *
34
+ * Source: https://docs.trae.ai/ide/model-context-protocol
35
+ */
36
+ export class TraeMCPAdapter implements MCPConfigAdapter {
37
+ readonly source = 'trae' as const;
38
+
39
+ parse(content: string): MCPServerEntry[] {
40
+ try {
41
+ const config = JSON.parse(content);
42
+ const servers = config.mcpServers;
43
+
44
+ if (!servers || typeof servers !== 'object') return [];
45
+
46
+ // Object-keyed format: { "mcpServers": { "name": { ... } } }
47
+ return Object.entries(servers).map(([name, entry]: [string, any]) => {
48
+ const result: MCPServerEntry = {
49
+ name,
50
+ command: '',
51
+ args: [],
52
+ };
53
+
54
+ if (typeof entry.command === 'string') {
55
+ result.command = entry.command;
56
+ }
57
+
58
+ if (Array.isArray(entry.args)) {
59
+ result.args = entry.args;
60
+ }
61
+
62
+ // SSE/HTTP transport
63
+ if (entry.url) {
64
+ result.url = entry.url;
65
+ }
66
+
67
+ // Environment variables
68
+ if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
69
+ result.env = entry.env;
70
+ }
71
+
72
+ // Headers (for HTTP transport)
73
+ if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
74
+ result.headers = entry.headers;
75
+ }
76
+
77
+ // Disabled flag
78
+ if (entry.disabled === true) {
79
+ result.disabled = true;
80
+ }
81
+
82
+ return result;
83
+ });
84
+ } catch {
85
+ return [];
86
+ }
87
+ }
88
+
89
+ generate(servers: MCPServerEntry[]): string {
90
+ const mcpServers: Record<string, any> = {};
91
+
92
+ for (const s of servers) {
93
+ const entry: Record<string, any> = {};
94
+
95
+ if (s.url) {
96
+ // SSE/HTTP transport
97
+ entry.url = s.url;
98
+ if (s.headers && Object.keys(s.headers).length > 0) {
99
+ entry.headers = s.headers;
100
+ }
101
+ } else {
102
+ // stdio transport
103
+ entry.command = s.command;
104
+ if (s.args && s.args.length > 0) {
105
+ entry.args = s.args;
106
+ }
107
+ }
108
+
109
+ if (s.env && Object.keys(s.env).length > 0) {
110
+ entry.env = s.env;
111
+ }
112
+
113
+ if (s.disabled === true) {
114
+ entry.disabled = true;
115
+ }
116
+
117
+ mcpServers[s.name] = entry;
118
+ }
119
+
120
+ return JSON.stringify({ mcpServers }, null, 2);
121
+ }
122
+
123
+ getConfigPath(_projectRoot?: string): string {
124
+ const home = homedir();
125
+ // Trae stores user-level MCP config in AppData (Windows) / Application Support (macOS) / .config (Linux)
126
+ if (process.platform === 'win32') {
127
+ return join(process.env.APPDATA || join(home, 'AppData', 'Roaming'), 'Trae', 'User', 'mcp.json');
128
+ }
129
+ if (process.platform === 'darwin') {
130
+ return join(home, 'Library', 'Application Support', 'Trae', 'User', 'mcp.json');
131
+ }
132
+ return join(home, '.config', 'Trae', 'User', 'mcp.json');
133
+ }
134
+ }
@@ -1,91 +1,91 @@
1
- import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
- import { homedir } from 'node:os';
3
- import { join } from 'node:path';
4
-
5
- /**
6
- * Windsurf MCP config adapter.
7
- * Format: JSON file at ~/.codeium/windsurf/mcp_config.json
8
- *
9
- * Supports two transport modes:
10
- * 1. stdio: { command, args, env? }
11
- * 2. HTTP: { serverUrl, headers? }
12
- *
13
- * Also handles: disabled, disabledTools, env: null
14
- */
15
- export class WindsurfMCPAdapter implements MCPConfigAdapter {
16
- readonly source = 'windsurf' as const;
17
-
18
- parse(content: string): MCPServerEntry[] {
19
- try {
20
- const config = JSON.parse(content);
21
- const servers = config.mcpServers ?? config.mcp_servers ?? {};
22
- return Object.entries(servers).map(([name, entry]: [string, any]) => {
23
- const result: MCPServerEntry = {
24
- name,
25
- command: entry.command ?? '',
26
- args: entry.args ?? [],
27
- };
28
-
29
- // HTTP transport: Windsurf uses "serverUrl" (not "url")
30
- if (entry.serverUrl) {
31
- result.url = entry.serverUrl;
32
- } else if (entry.url) {
33
- result.url = entry.url;
34
- }
35
-
36
- // Headers (for HTTP transport)
37
- if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
38
- result.headers = entry.headers;
39
- }
40
-
41
- // Env (can be null in Windsurf)
42
- if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
43
- result.env = entry.env;
44
- }
45
-
46
- // Disabled flag
47
- if (entry.disabled === true) {
48
- result.disabled = true;
49
- }
50
-
51
- return result;
52
- });
53
- } catch {
54
- return [];
55
- }
56
- }
57
-
58
- generate(servers: MCPServerEntry[]): string {
59
- const mcpServers: Record<string, any> = {};
60
- for (const s of servers) {
61
- const entry: Record<string, any> = {};
62
-
63
- if (s.url) {
64
- // HTTP transport — Windsurf uses "serverUrl"
65
- entry.serverUrl = s.url;
66
- if (s.headers && Object.keys(s.headers).length > 0) {
67
- entry.headers = s.headers;
68
- }
69
- } else {
70
- // stdio transport
71
- entry.command = s.command;
72
- entry.args = s.args;
73
- }
74
-
75
- if (s.env && Object.keys(s.env).length > 0) {
76
- entry.env = s.env;
77
- }
78
-
79
- if (s.disabled === true) {
80
- entry.disabled = true;
81
- }
82
-
83
- mcpServers[s.name] = entry;
84
- }
85
- return JSON.stringify({ mcpServers }, null, 2);
86
- }
87
-
88
- getConfigPath(_projectRoot?: string): string {
89
- return join(homedir(), '.codeium', 'windsurf', 'mcp_config.json');
90
- }
91
- }
1
+ import type { MCPConfigAdapter, MCPServerEntry } from '../../types.js';
2
+ import { homedir } from 'node:os';
3
+ import { join } from 'node:path';
4
+
5
+ /**
6
+ * Windsurf MCP config adapter.
7
+ * Format: JSON file at ~/.codeium/windsurf/mcp_config.json
8
+ *
9
+ * Supports two transport modes:
10
+ * 1. stdio: { command, args, env? }
11
+ * 2. HTTP: { serverUrl, headers? }
12
+ *
13
+ * Also handles: disabled, disabledTools, env: null
14
+ */
15
+ export class WindsurfMCPAdapter implements MCPConfigAdapter {
16
+ readonly source = 'windsurf' as const;
17
+
18
+ parse(content: string): MCPServerEntry[] {
19
+ try {
20
+ const config = JSON.parse(content);
21
+ const servers = config.mcpServers ?? config.mcp_servers ?? {};
22
+ return Object.entries(servers).map(([name, entry]: [string, any]) => {
23
+ const result: MCPServerEntry = {
24
+ name,
25
+ command: entry.command ?? '',
26
+ args: entry.args ?? [],
27
+ };
28
+
29
+ // HTTP transport: Windsurf uses "serverUrl" (not "url")
30
+ if (entry.serverUrl) {
31
+ result.url = entry.serverUrl;
32
+ } else if (entry.url) {
33
+ result.url = entry.url;
34
+ }
35
+
36
+ // Headers (for HTTP transport)
37
+ if (entry.headers && typeof entry.headers === 'object' && Object.keys(entry.headers).length > 0) {
38
+ result.headers = entry.headers;
39
+ }
40
+
41
+ // Env (can be null in Windsurf)
42
+ if (entry.env && typeof entry.env === 'object' && Object.keys(entry.env).length > 0) {
43
+ result.env = entry.env;
44
+ }
45
+
46
+ // Disabled flag
47
+ if (entry.disabled === true) {
48
+ result.disabled = true;
49
+ }
50
+
51
+ return result;
52
+ });
53
+ } catch {
54
+ return [];
55
+ }
56
+ }
57
+
58
+ generate(servers: MCPServerEntry[]): string {
59
+ const mcpServers: Record<string, any> = {};
60
+ for (const s of servers) {
61
+ const entry: Record<string, any> = {};
62
+
63
+ if (s.url) {
64
+ // HTTP transport — Windsurf uses "serverUrl"
65
+ entry.serverUrl = s.url;
66
+ if (s.headers && Object.keys(s.headers).length > 0) {
67
+ entry.headers = s.headers;
68
+ }
69
+ } else {
70
+ // stdio transport
71
+ entry.command = s.command;
72
+ entry.args = s.args;
73
+ }
74
+
75
+ if (s.env && Object.keys(s.env).length > 0) {
76
+ entry.env = s.env;
77
+ }
78
+
79
+ if (s.disabled === true) {
80
+ entry.disabled = true;
81
+ }
82
+
83
+ mcpServers[s.name] = entry;
84
+ }
85
+ return JSON.stringify({ mcpServers }, null, 2);
86
+ }
87
+
88
+ getConfigPath(_projectRoot?: string): string {
89
+ return join(homedir(), '.codeium', 'windsurf', 'mcp_config.json');
90
+ }
91
+ }
@@ -1,60 +1,60 @@
1
- /**
2
- * Sanitizer — mask sensitive values (tokens, keys, passwords) in output.
3
- *
4
- * Patterns detected:
5
- * - API keys / tokens (github_pat_*, ctx7sk-*, sk-*, ghp_*, ghu_*, etc.)
6
- * - Generic key=value where key contains "token", "key", "secret", "password"
7
- * - Bearer tokens
8
- */
9
-
10
- const SENSITIVE_PATTERNS: { pattern: RegExp; replacement: string }[] = [
11
- // GitHub PAT (classic & fine-grained)
12
- { pattern: /ghp_[A-Za-z0-9_]{36,}/g, replacement: 'ghp_***' },
13
- { pattern: /github_pat_[A-Za-z0-9_]{60,}/g, replacement: 'github_pat_***' },
14
- { pattern: /ghu_[A-Za-z0-9_]{36,}/g, replacement: 'ghu_***' },
15
- { pattern: /ghs_[A-Za-z0-9_]{36,}/g, replacement: 'ghs_***' },
16
- // OpenAI / Anthropic style keys
17
- { pattern: /sk-[A-Za-z0-9_-]{20,}/g, replacement: 'sk-***' },
18
- // Context7 keys
19
- { pattern: /ctx7sk-[A-Za-z0-9-]{20,}/g, replacement: 'ctx7sk-***' },
20
- // Generic long hex/base64 tokens (32+ chars) in quoted values
21
- { pattern: /"([A-Za-z0-9_-]{40,})"/g, replacement: '"***"' },
22
- ];
23
-
24
- const SENSITIVE_KEY_PATTERN = /(?:token|key|secret|password|credential|auth)/i;
25
-
26
- /**
27
- * Mask sensitive values in a string.
28
- */
29
- export function sanitize(input: string): string {
30
- let result = input;
31
-
32
- // Apply known token patterns
33
- for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
34
- // Reset lastIndex for global regexes
35
- pattern.lastIndex = 0;
36
- result = result.replace(pattern, replacement);
37
- }
38
-
39
- return result;
40
- }
41
-
42
- /**
43
- * Mask sensitive values in MCPServerEntry env/headers objects.
44
- * Returns a new object with masked values.
45
- */
46
- export function sanitizeRecord(
47
- record: Record<string, string> | undefined | null,
48
- ): Record<string, string> | undefined {
49
- if (!record) return undefined;
50
-
51
- const masked: Record<string, string> = {};
52
- for (const [key, value] of Object.entries(record)) {
53
- if (SENSITIVE_KEY_PATTERN.test(key)) {
54
- masked[key] = '***';
55
- } else {
56
- masked[key] = value;
57
- }
58
- }
59
- return masked;
60
- }
1
+ /**
2
+ * Sanitizer — mask sensitive values (tokens, keys, passwords) in output.
3
+ *
4
+ * Patterns detected:
5
+ * - API keys / tokens (github_pat_*, ctx7sk-*, sk-*, ghp_*, ghu_*, etc.)
6
+ * - Generic key=value where key contains "token", "key", "secret", "password"
7
+ * - Bearer tokens
8
+ */
9
+
10
+ const SENSITIVE_PATTERNS: { pattern: RegExp; replacement: string }[] = [
11
+ // GitHub PAT (classic & fine-grained)
12
+ { pattern: /ghp_[A-Za-z0-9_]{36,}/g, replacement: 'ghp_***' },
13
+ { pattern: /github_pat_[A-Za-z0-9_]{60,}/g, replacement: 'github_pat_***' },
14
+ { pattern: /ghu_[A-Za-z0-9_]{36,}/g, replacement: 'ghu_***' },
15
+ { pattern: /ghs_[A-Za-z0-9_]{36,}/g, replacement: 'ghs_***' },
16
+ // OpenAI / Anthropic style keys
17
+ { pattern: /sk-[A-Za-z0-9_-]{20,}/g, replacement: 'sk-***' },
18
+ // Context7 keys
19
+ { pattern: /ctx7sk-[A-Za-z0-9-]{20,}/g, replacement: 'ctx7sk-***' },
20
+ // Generic long hex/base64 tokens (32+ chars) in quoted values
21
+ { pattern: /"([A-Za-z0-9_-]{40,})"/g, replacement: '"***"' },
22
+ ];
23
+
24
+ const SENSITIVE_KEY_PATTERN = /(?:token|key|secret|password|credential|auth)/i;
25
+
26
+ /**
27
+ * Mask sensitive values in a string.
28
+ */
29
+ export function sanitize(input: string): string {
30
+ let result = input;
31
+
32
+ // Apply known token patterns
33
+ for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
34
+ // Reset lastIndex for global regexes
35
+ pattern.lastIndex = 0;
36
+ result = result.replace(pattern, replacement);
37
+ }
38
+
39
+ return result;
40
+ }
41
+
42
+ /**
43
+ * Mask sensitive values in MCPServerEntry env/headers objects.
44
+ * Returns a new object with masked values.
45
+ */
46
+ export function sanitizeRecord(
47
+ record: Record<string, string> | undefined | null,
48
+ ): Record<string, string> | undefined {
49
+ if (!record) return undefined;
50
+
51
+ const masked: Record<string, string> = {};
52
+ for (const [key, value] of Object.entries(record)) {
53
+ if (SENSITIVE_KEY_PATTERN.test(key)) {
54
+ masked[key] = '***';
55
+ } else {
56
+ masked[key] = value;
57
+ }
58
+ }
59
+ return masked;
60
+ }