muonroi-cli 1.2.0

package/src/utils/permission-mode.test.ts

@@ -0,0 +1,121 @@
+import { describe, expect, it } from "vitest";
+import { AUTO_EDIT_ALLOWED, toolNeedsApproval } from "./permission-mode.js";
+
+describe("toolNeedsApproval", () => {
+  // safe mode: always requires approval for every tool
+  describe("safe mode", () => {
+    it("requires approval for read_file in safe mode", () => {
+      expect(toolNeedsApproval("read_file", "safe")).toBe(true);
+    });
+
+    it("requires approval for write_file in safe mode", () => {
+      expect(toolNeedsApproval("write_file", "safe")).toBe(true);
+    });
+
+    it("requires approval for edit_file in safe mode", () => {
+      expect(toolNeedsApproval("edit_file", "safe")).toBe(true);
+    });
+
+    it("requires approval for grep in safe mode", () => {
+      expect(toolNeedsApproval("grep", "safe")).toBe(true);
+    });
+
+    it("requires approval for list_directory in safe mode", () => {
+      expect(toolNeedsApproval("list_directory", "safe")).toBe(true);
+    });
+
+    it("requires approval for bash in safe mode", () => {
+      expect(toolNeedsApproval("bash", "safe")).toBe(true);
+    });
+
+    it("requires approval for task in safe mode", () => {
+      expect(toolNeedsApproval("task", "safe")).toBe(true);
+    });
+
+    it("requires approval for computer_click in safe mode", () => {
+      expect(toolNeedsApproval("computer_click", "safe")).toBe(true);
+    });
+
+    it("requires approval for an arbitrary MCP tool in safe mode", () => {
+      expect(toolNeedsApproval("mcp_some_tool", "safe")).toBe(true);
+    });
+  });
+
+  // auto-edit mode: file ops auto-approved, bash/task/computer_* require approval
+  describe("auto-edit mode", () => {
+    it("auto-approves read_file in auto-edit mode", () => {
+      expect(toolNeedsApproval("read_file", "auto-edit")).toBe(false);
+    });
+
+    it("auto-approves write_file in auto-edit mode", () => {
+      expect(toolNeedsApproval("write_file", "auto-edit")).toBe(false);
+    });
+
+    it("auto-approves edit_file in auto-edit mode", () => {
+      expect(toolNeedsApproval("edit_file", "auto-edit")).toBe(false);
+    });
+
+    it("auto-approves grep in auto-edit mode", () => {
+      expect(toolNeedsApproval("grep", "auto-edit")).toBe(false);
+    });
+
+    it("auto-approves list_directory in auto-edit mode", () => {
+      expect(toolNeedsApproval("list_directory", "auto-edit")).toBe(false);
+    });
+
+    it("requires approval for bash in auto-edit mode", () => {
+      expect(toolNeedsApproval("bash", "auto-edit")).toBe(true);
+    });
+
+    it("requires approval for task in auto-edit mode", () => {
+      expect(toolNeedsApproval("task", "auto-edit")).toBe(true);
+    });
+
+    it("requires approval for computer_click in auto-edit mode", () => {
+      expect(toolNeedsApproval("computer_click", "auto-edit")).toBe(true);
+    });
+
+    it("requires approval for an arbitrary MCP tool in auto-edit mode", () => {
+      expect(toolNeedsApproval("mcp_some_tool", "auto-edit")).toBe(true);
+    });
+  });
+
+  // yolo mode: auto-approves everything
+  describe("yolo mode", () => {
+    it("auto-approves bash in yolo mode", () => {
+      expect(toolNeedsApproval("bash", "yolo")).toBe(false);
+    });
+
+    it("auto-approves read_file in yolo mode", () => {
+      expect(toolNeedsApproval("read_file", "yolo")).toBe(false);
+    });
+
+    it("auto-approves computer_click in yolo mode", () => {
+      expect(toolNeedsApproval("computer_click", "yolo")).toBe(false);
+    });
+
+    it("auto-approves task in yolo mode", () => {
+      expect(toolNeedsApproval("task", "yolo")).toBe(false);
+    });
+
+    it("auto-approves any arbitrary tool name in yolo mode", () => {
+      expect(toolNeedsApproval("anything_at_all", "yolo")).toBe(false);
+    });
+  });
+});
+
+describe("AUTO_EDIT_ALLOWED", () => {
+  it("contains the expected auto-approved tools", () => {
+    expect(AUTO_EDIT_ALLOWED.has("read_file")).toBe(true);
+    expect(AUTO_EDIT_ALLOWED.has("write_file")).toBe(true);
+    expect(AUTO_EDIT_ALLOWED.has("edit_file")).toBe(true);
+    expect(AUTO_EDIT_ALLOWED.has("grep")).toBe(true);
+    expect(AUTO_EDIT_ALLOWED.has("list_directory")).toBe(true);
+  });
+
+  it("does NOT contain bash, task, or computer tools", () => {
+    expect(AUTO_EDIT_ALLOWED.has("bash")).toBe(false);
+    expect(AUTO_EDIT_ALLOWED.has("task")).toBe(false);
+    expect(AUTO_EDIT_ALLOWED.has("computer_click")).toBe(false);
+  });
+});

package/src/utils/permission-mode.ts

@@ -0,0 +1,37 @@
+/**
+ * Permission mode controls which tool calls require manual approval before execution.
+ *
+ * safe      - Every tool call prompts the user for approval.
+ * auto-edit - File operation tools (read/write/edit/grep/list) auto-approve;
+ *             shell execution and computer tools still require confirmation.
+ * yolo      - All tool calls auto-approve without any prompting.
+ */
+export type PermissionMode = "safe" | "auto-edit" | "yolo";
+
+/**
+ * Set of tool names that are auto-approved in auto-edit mode.
+ * These are read/write file operations that are considered safe to run
+ * without manual confirmation when the user has opted into auto-edit mode.
+ */
+export const AUTO_EDIT_ALLOWED: ReadonlySet<string> = new Set([
+  "read_file",
+  "write_file",
+  "edit_file",
+  "grep",
+  "list_directory",
+]);
+
+/**
+ * Returns true if the given tool call requires manual user approval
+ * under the specified permission mode.
+ *
+ * @param toolName - The name of the tool being invoked.
+ * @param mode     - The active PermissionMode.
+ * @returns true if the tool needs user approval, false if it should auto-approve.
+ */
+export function toolNeedsApproval(toolName: string, mode: PermissionMode): boolean {
+  if (mode === "yolo") return false;
+  if (mode === "auto-edit") return !AUTO_EDIT_ALLOWED.has(toolName);
+  // "safe" — always confirm
+  return true;
+}

package/src/utils/redactor.test.ts

@@ -0,0 +1,100 @@
+import { afterEach, describe, expect, it } from "vitest";
+
+// Import the module under test — will fail until src/utils/redactor.ts is created
+import { redactor } from "./redactor";
+
+describe("Redactor — Layer 1: static regex scrubbing", () => {
+  it("Test 1: redacts sk-ant-* bearer token from string", () => {
+    const input = "Bearer sk-ant-1234567890abcdefghij";
+    const result = redactor.redact(input);
+    expect(result).not.toContain("sk-ant-1234567890abcdefghij");
+    expect(result).toContain("***REDACTED***");
+  });
+
+  it("Test 2: redacts JWT triple-segment shape from Authorization header", () => {
+    const input = "Authorization: Bearer eyJabc.def.ghi";
+    const result = redactor.redact(input);
+    expect(result).not.toContain("eyJabc.def.ghi");
+  });
+
+  it("Test 3: redacts ANTHROPIC_API_KEY env var pattern", () => {
+    const input = "ANTHROPIC_API_KEY=sk-ant-real-key-here-1234567890";
+    const result = redactor.redact(input);
+    expect(result).toContain("***REDACTED***");
+    // Value should be gone; variable name may remain
+    expect(result).not.toContain("sk-ant-real-key-here-1234567890");
+  });
+});
+
+describe("Redactor — Layer 2: enrolled live values", () => {
+  afterEach(() => {
+    // Clear enrolled secrets between tests by creating a fresh state
+    // The redactor is a singleton — we test idempotency elsewhere
+  });
+
+  it("Test 4: redacts enrolled live secret value", () => {
+    redactor.enrollSecret("sk-customformat-abcdefghij");
+    const result = redactor.redact("...sk-customformat-abcdefghij...");
+    expect(result).not.toContain("sk-customformat-abcdefghij");
+  });
+
+  it("Test 5: does NOT redact short enrolled values (< 8 chars)", () => {
+    redactor.enrollSecret("ab");
+    const result = redactor.redact("absolute");
+    // Short secret 'ab' must NOT cause 'absolute' to be redacted
+    expect(result).toBe("absolute");
+    expect(result).toContain("absolute");
+  });
+});
+
+describe("Redactor — error redaction", () => {
+  it("Test 6: redactError removes secrets from Error message and stack", () => {
+    const err = new Error("Failed with key sk-ant-shouldredact1234567890");
+    const result = redactor.redactError(err);
+    expect(result).not.toContain("sk-ant-shouldredact1234567890");
+  });
+});
+
+describe("Redactor — global patches", () => {
+  it("Test 7: installGlobalPatches patches console.log to redact secrets", () => {
+    const captured: string[] = [];
+
+    // Intercept the original console.log BEFORE installGlobalPatches wraps it
+    // so we capture what the PATCHED version actually forwards.
+    const originalLog = console.log;
+    console.log = (...args: unknown[]) => {
+      captured.push(args.map(String).join(" "));
+    };
+
+    // Now install global patches — they will wrap the spy above
+    redactor.installGlobalPatches();
+
+    // Call through the patched console.log
+    console.log("test sk-ant-1234567890abcdefghij");
+
+    // Restore
+    redactor.uninstallGlobalPatches();
+    console.log = originalLog;
+
+    // The captured string should have been redacted by the patch
+    const output = captured.join(" ");
+    expect(output).not.toContain("sk-ant-1234567890abcdefghij");
+    expect(output).toContain("***REDACTED***");
+  });
+});
+
+describe("Redactor — idempotency", () => {
+  it("Test 8: enrolling the same secret twice produces identical redacted output", () => {
+    const secret = "sk-ant-idempotent-test-abcdefghijklm";
+    redactor.enrollSecret(secret);
+    redactor.enrollSecret(secret); // enroll same value again
+
+    const result1 = redactor.redact(`key is ${secret}`);
+    // Enroll again for safety
+    redactor.enrollSecret(secret);
+    const result2 = redactor.redact(`key is ${secret}`);
+
+    expect(result1).toBe(result2);
+    expect(result1).not.toContain(secret);
+  });
+});

package/src/utils/redactor.ts

@@ -0,0 +1,223 @@
+/**
+ * src/utils/redactor.ts
+ *
+ * Process-wide log redactor singleton.
+ * Mitigates Pitfall 2 (HIGH severity API key leakage).
+ *
+ * Two-layer scrubbing strategy:
+ *   Layer 1 — Static regex patterns for known secret shapes (sk-*, JWT, Bearer, env vars)
+ *   Layer 2 — Enrolled live values registered at runtime (>=8 chars) via enrollSecret()
+ *
+ * Usage:
+ *   import { redactor } from "./utils/redactor.js";
+ *   redactor.installGlobalPatches(); // call FIRST at process boot
+ *   redactor.enrollSecret(loadedApiKey); // call immediately after key load
+ */
+
+// ---------------------------------------------------------------------------
+// Static regex patterns for Layer 1 scrubbing
+// ---------------------------------------------------------------------------
+
+const STATIC_PATTERNS: Array<{ pattern: RegExp; replacement: string }> = [
+  // Anthropic sk-ant-* keys (most specific — checked first)
+  {
+    pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g,
+    replacement: "sk-ant-***REDACTED***",
+  },
+  // General sk-* keys (OpenAI and other providers)
+  {
+    pattern: /sk-[A-Za-z0-9_-]{20,}/g,
+    replacement: "sk-***REDACTED***",
+  },
+  // JWT triple-segment shape  eyJ<base64url>.<base64url>.<base64url>
+  {
+    pattern: /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+    replacement: "***REDACTED-JWT***",
+  },
+  // Environment variable assignments for common API keys
+  {
+    pattern: /(ANTHROPIC_API_KEY|OPENAI_API_KEY|GOOGLE_API_KEY|DEEPSEEK_API_KEY)\s*=\s*\S+/g,
+    replacement: "$1=***REDACTED***",
+  },
+  // Authorization Bearer header
+  {
+    pattern: /Authorization:\s*Bearer\s+\S+/gi,
+    replacement: "Authorization: Bearer ***REDACTED***",
+  },
+  // x-api-key header (case-insensitive)
+  {
+    pattern: /[Xx]-[Aa]pi-[Kk]ey:\s*\S+/g,
+    replacement: "x-api-key: ***REDACTED***",
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Redactor class
+// ---------------------------------------------------------------------------
+
+class Redactor {
+  /** Set of enrolled live secret values (length >= 8). */
+  private enrolled = new Set<string>();
+
+  /** Original console method references, saved before patching. */
+  private originals: {
+    log: typeof console.log;
+    error: typeof console.error;
+    warn: typeof console.warn;
+    info: typeof console.info;
+    debug: typeof console.debug;
+  } | null = null;
+
+  /**
+   * Enroll a live secret value for Layer 2 scrubbing.
+   * Values shorter than 8 characters are silently ignored to prevent
+   * accidentally redacting common short strings (Test 5 guard).
+   */
+  enrollSecret(value: string): void {
+    if (!value || value.length < 8) {
+      return;
+    }
+    this.enrolled.add(value);
+  }
+
+  /**
+   * Scrub a string through both layers.
+   *
+   * Layer 1: apply all static regex patterns.
+   * Layer 2: replace all enrolled secret values.
+   */
+  redact(input: string): string {
+    if (!input) return input;
+
+    let result = input;
+
+    // Layer 1 — static regex
+    for (const { pattern, replacement } of STATIC_PATTERNS) {
+      // Reset lastIndex for global regexes before each call
+      pattern.lastIndex = 0;
+      result = result.replace(pattern, replacement);
+    }
+
+    // Layer 2 — enrolled live values
+    for (const secret of this.enrolled) {
+      // Only replace secrets that are still >= 8 chars (defensive)
+      if (secret.length >= 8) {
+        // Use a plain string replacement (not regex) to avoid regex special chars
+        // Replace ALL occurrences via split/join
+        result = result.split(secret).join("***REDACTED-ENROLLED***");
+      }
+    }
+
+    return result;
+  }
+
+  /**
+   * Scrub an Error (or unknown thrown value) to a safe string.
+   * Runs redact() on both the stringified error and the stack trace.
+   */
+  redactError(err: unknown): string {
+    const errStr = String(err);
+    let result = this.redact(errStr);
+
+    if (err instanceof Error && err.stack) {
+      const redactedStack = this.redact(err.stack);
+      // If the stack contains more info than just the message, append it
+      if (redactedStack !== errStr) {
+        result = redactedStack;
+      }
+    }
+
+    return result;
+  }
+
+  /**
+   * Stringify an argument for redaction.
+   * Returns the redacted string representation of any value.
+   */
+  private stringifyArg(arg: unknown): string {
+    if (typeof arg === "string") {
+      return this.redact(arg);
+    }
+    try {
+      return this.redact(JSON.stringify(arg) ?? String(arg));
+    } catch {
+      return this.redact(String(arg));
+    }
+  }
+
+  /**
+   * Install global patches on console.log/error/warn/info/debug.
+   * MUST be called exactly once at process start, before any other logging.
+   * Each patched method passes args through redact() before forwarding.
+   */
+  installGlobalPatches(): void {
+    if (this.originals) {
+      // Already patched — idempotent: no-op
+      return;
+    }
+
+    this.originals = {
+      log: console.log,
+      error: console.error,
+      warn: console.warn,
+      info: console.info,
+      debug: console.debug,
+    };
+
+    const { log: origLog, error: origError, warn: origWarn, info: origInfo, debug: origDebug } = this.originals;
+
+    console.log = (...args: unknown[]) => {
+      origLog.apply(
+        console,
+        args.map((a) => this.stringifyArg(a)),
+      );
+    };
+
+    console.error = (...args: unknown[]) => {
+      origError.apply(
+        console,
+        args.map((a) => this.stringifyArg(a)),
+      );
+    };
+
+    console.warn = (...args: unknown[]) => {
+      origWarn.apply(
+        console,
+        args.map((a) => this.stringifyArg(a)),
+      );
+    };
+
+    console.info = (...args: unknown[]) => {
+      origInfo.apply(
+        console,
+        args.map((a) => this.stringifyArg(a)),
+      );
+    };
+
+    console.debug = (...args: unknown[]) => {
+      origDebug.apply(
+        console,
+        args.map((a) => this.stringifyArg(a)),
+      );
+    };
+  }
+
+  /**
+   * Restore original console methods.
+   * Useful in tests to avoid cross-test contamination.
+   */
+  uninstallGlobalPatches(): void {
+    if (!this.originals) return;
+
+    console.log = this.originals.log;
+    console.error = this.originals.error;
+    console.warn = this.originals.warn;
+    console.info = this.originals.info;
+    console.debug = this.originals.debug;
+
+    this.originals = null;
+  }
+}
+
+// Export singleton instance
+export const redactor = new Redactor();

package/src/utils/settings.test.ts

@@ -0,0 +1,181 @@
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import { loadCatalog } from "../models/registry.js";
+
+beforeAll(async () => {
+  await loadCatalog();
+});
+
+beforeEach(async () => {
+  vi.restoreAllMocks();
+  vi.unstubAllEnvs();
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("normalizeSandboxMode", () => {
+  it("returns shuru for shuru input", async () => {
+    const { normalizeSandboxMode } = await import("./settings");
+    expect(normalizeSandboxMode("shuru")).toBe("shuru");
+  });
+
+  it("returns off for any other input", async () => {
+    const { normalizeSandboxMode } = await import("./settings");
+    expect(normalizeSandboxMode("invalid")).toBe("off");
+    expect(normalizeSandboxMode(undefined)).toBe("off");
+    expect(normalizeSandboxMode(null)).toBe("off");
+    expect(normalizeSandboxMode(42)).toBe("off");
+  });
+});
+
+describe("normalizeSandboxSettings", () => {
+  it("returns empty object for non-object input", async () => {
+    const { normalizeSandboxSettings } = await import("./settings");
+    expect(normalizeSandboxSettings(null)).toEqual({});
+    expect(normalizeSandboxSettings("string")).toEqual({});
+    expect(normalizeSandboxSettings(undefined)).toEqual({});
+    expect(normalizeSandboxSettings([])).toEqual({});
+  });
+
+  it("normalizes valid fields", async () => {
+    const { normalizeSandboxSettings } = await import("./settings");
+    const result = normalizeSandboxSettings({
+      allowNet: true,
+      allowedHosts: ["api.openai.com", ""],
+      cpus: 4,
+      memory: 2048,
+      ports: ["3000:3000", "bad", "8080:8080"],
+    });
+    expect(result.allowNet).toBe(true);
+    expect(result.allowedHosts).toEqual(["api.openai.com"]);
+    expect(result.cpus).toBe(4);
+    expect(result.memory).toBe(2048);
+    expect(result.ports).toEqual(["3000:3000", "8080:8080"]);
+  });
+
+  it("ignores non-positive numbers for cpus and memory", async () => {
+    const { normalizeSandboxSettings } = await import("./settings");
+    const result = normalizeSandboxSettings({ cpus: 0, memory: -1 });
+    expect(result.cpus).toBeUndefined();
+    expect(result.memory).toBeUndefined();
+  });
+
+  it("normalizes secrets", async () => {
+    const { normalizeSandboxSettings } = await import("./settings");
+    const result = normalizeSandboxSettings({
+      secrets: [{ name: "API_KEY", fromEnv: "MY_KEY", hosts: ["api.example.com"] }, { name: "", fromEnv: "BAD" }, null],
+    });
+    expect(result.secrets).toHaveLength(1);
+    expect(result.secrets![0].name).toBe("API_KEY");
+  });
+});
+
+describe("mergeSandboxSettings", () => {
+  it("returns empty when both undefined", async () => {
+    const { mergeSandboxSettings } = await import("./settings");
+    expect(mergeSandboxSettings(undefined, undefined)).toEqual({});
+  });
+
+  it("returns base when override is undefined", async () => {
+    const { mergeSandboxSettings } = await import("./settings");
+    const result = mergeSandboxSettings({ allowNet: true, cpus: 2 }, undefined);
+    expect(result.allowNet).toBe(true);
+    expect(result.cpus).toBe(2);
+  });
+
+  it("override takes precedence", async () => {
+    const { mergeSandboxSettings } = await import("./settings");
+    const result = mergeSandboxSettings({ allowNet: true, cpus: 2 }, { allowNet: false, memory: 1024 });
+    expect(result.allowNet).toBe(false);
+    expect(result.cpus).toBe(2);
+    expect(result.memory).toBe(1024);
+  });
+});
+
+describe("isReservedSubagentName", () => {
+  it("identifies reserved names", async () => {
+    const { isReservedSubagentName } = await import("./settings");
+    expect(isReservedSubagentName("general")).toBe(true);
+    expect(isReservedSubagentName("explore")).toBe(true);
+    expect(isReservedSubagentName("vision")).toBe(true);
+    expect(isReservedSubagentName("verify")).toBe(true);
+    expect(isReservedSubagentName("computer")).toBe(true);
+  });
+
+  it("trims and lowercases input", async () => {
+    const { isReservedSubagentName } = await import("./settings");
+    expect(isReservedSubagentName("  General  ")).toBe(true);
+    expect(isReservedSubagentName("EXPLORE")).toBe(true);
+  });
+
+  it("rejects non-reserved names", async () => {
+    const { isReservedSubagentName } = await import("./settings");
+    expect(isReservedSubagentName("my-agent")).toBe(false);
+    expect(isReservedSubagentName("custom")).toBe(false);
+  });
+});
+
+describe("parseSubAgentsRawList", () => {
+  it("returns empty for non-array input", async () => {
+    const { parseSubAgentsRawList } = await import("./settings");
+    expect(parseSubAgentsRawList(null)).toEqual([]);
+    expect(parseSubAgentsRawList("string")).toEqual([]);
+    expect(parseSubAgentsRawList(42)).toEqual([]);
+  });
+
+  it("filters invalid entries", async () => {
+    const { parseSubAgentsRawList } = await import("./settings");
+    const result = parseSubAgentsRawList([
+      null,
+      { name: "", model: "claude-sonnet-4-6", instruction: "test" },
+      { name: "explore", model: "claude-sonnet-4-6", instruction: "reserved" },
+    ]);
+    expect(result).toEqual([]);
+  });
+
+  it("deduplicates by lowercase name", async () => {
+    const { parseSubAgentsRawList } = await import("./settings");
+    const result = parseSubAgentsRawList([
+      { name: "MyAgent", model: "claude-sonnet-4-6", instruction: "first" },
+      { name: "myagent", model: "claude-sonnet-4-6", instruction: "dupe" },
+    ]);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toBe("MyAgent");
+  });
+});
+
+describe("resolveTelegramStreamSettings", () => {
+  it("returns defaults when settings undefined", async () => {
+    const { resolveTelegramStreamSettings } = await import("./settings");
+    const result = resolveTelegramStreamSettings(undefined);
+    expect(result.streaming).toBe("partial");
+    expect(result.typingIndicator).toBe(true);
+    expect(result.nativeDrafts).toBe(false);
+  });
+
+  it("respects explicit off", async () => {
+    const { resolveTelegramStreamSettings } = await import("./settings");
+    const result = resolveTelegramStreamSettings({ streaming: "off", typingIndicator: false });
+    expect(result.streaming).toBe("off");
+    expect(result.typingIndicator).toBe(false);
+  });
+});
+
+describe("resolveTelegramAudioInputSettings", () => {
+  it("returns defaults when settings undefined", async () => {
+    const { resolveTelegramAudioInputSettings } = await import("./settings");
+    const result = resolveTelegramAudioInputSettings(undefined);
+    expect(result.enabled).toBe(true);
+    expect(result.language).toBe("en");
+  });
+
+  it("respects explicit values", async () => {
+    const { resolveTelegramAudioInputSettings } = await import("./settings");
+    const result = resolveTelegramAudioInputSettings({
+      audioInput: { enabled: false, language: "vi" },
+    });
+    expect(result.enabled).toBe(false);
+    expect(result.language).toBe("vi");
+  });
+});