muonroi-cli 1.2.0

package/dist/utils/instructions.js

@@ -0,0 +1,107 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { executeEventHooks } from "../hooks/index";
+import { findGitRoot } from "./git-root";
+const instructionsHookFiredFor = new Set();
+// --- Instructions cache ---
+const _instructionsCache = new Map();
+const INSTRUCTIONS_CACHE_TTL_MS = 60_000; // 1 minute TTL — files rarely change mid-session
+function computeHash(parts) {
+    const joined = parts.join("|");
+    return `${joined.length}:${joined.slice(0, 50)}:${joined.slice(-50)}`;
+}
+/** Clear the instructions cache (for tests). */
+export function resetInstructionsCache() {
+    _instructionsCache.clear();
+}
+function readNonEmptyFile(filePath) {
+    try {
+        if (!fs.existsSync(filePath))
+            return null;
+        const text = fs.readFileSync(filePath, "utf-8").trim();
+        return text.length > 0 ? text : null;
+    }
+    catch {
+        return null;
+    }
+}
+function directoryChain(fromRoot, toCwd) {
+    const rel = path.relative(fromRoot, toCwd);
+    if (rel === "")
+        return [fromRoot];
+    if (rel.startsWith(".."))
+        return [toCwd];
+    const segments = rel.split(path.sep).filter(Boolean);
+    const chain = [];
+    let acc = fromRoot;
+    chain.push(acc);
+    for (const segment of segments) {
+        acc = path.join(acc, segment);
+        chain.push(acc);
+    }
+    return chain;
+}
+function loadAgentsSegments(canonicalCwd) {
+    const segments = [];
+    const globalAgents = readNonEmptyFile(path.join(os.homedir(), ".muonroi-cli", "AGENTS.md"));
+    if (globalAgents)
+        segments.push(globalAgents);
+    const root = findGitRoot(canonicalCwd) ?? canonicalCwd;
+    for (const dir of directoryChain(root, canonicalCwd)) {
+        const overridePath = path.join(dir, "AGENTS.override.md");
+        if (fs.existsSync(overridePath)) {
+            const text = readNonEmptyFile(overridePath);
+            if (text)
+                segments.push(text);
+            continue;
+        }
+        const text = readNonEmptyFile(path.join(dir, "AGENTS.md"));
+        if (text)
+            segments.push(text);
+    }
+    return segments;
+}
+export function loadCustomInstructions(cwd) {
+    let canonical;
+    try {
+        canonical = fs.realpathSync.native(cwd);
+    }
+    catch {
+        canonical = path.resolve(cwd);
+    }
+    // Check cache first
+    const now = Date.now();
+    const cached = _instructionsCache.get(canonical);
+    if (cached && now - cached.cachedAt < INSTRUCTIONS_CACHE_TTL_MS) {
+        // Still fire hook on first call even when returning cached content
+        if (cached.content !== null && !instructionsHookFiredFor.has(canonical)) {
+            instructionsHookFiredFor.add(canonical);
+            const hookInput = {
+                hook_event_name: "InstructionsLoaded",
+                files_loaded: cached.content.split("\n\n").length,
+                cwd: canonical,
+            };
+            executeEventHooks(hookInput, canonical).catch(() => { });
+        }
+        return cached.content;
+    }
+    const parts = [...loadAgentsSegments(canonical)];
+    if (parts.length === 0) {
+        _instructionsCache.set(canonical, { content: null, hash: "", cachedAt: now });
+        return null;
+    }
+    if (!instructionsHookFiredFor.has(canonical)) {
+        instructionsHookFiredFor.add(canonical);
+        const hookInput = {
+            hook_event_name: "InstructionsLoaded",
+            files_loaded: parts.length,
+            cwd: canonical,
+        };
+        executeEventHooks(hookInput, canonical).catch(() => { });
+    }
+    const content = parts.join("\n\n");
+    _instructionsCache.set(canonical, { content, hash: computeHash(parts), cachedAt: now });
+    return content;
+}
+//# sourceMappingURL=instructions.js.map

package/dist/utils/instructions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../../src/utils/instructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEnD,6BAA6B;AAC7B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAsE,CAAC;AACzG,MAAM,yBAAyB,GAAG,MAAM,CAAC,CAAC,iDAAiD;AAE3F,SAAS,WAAW,CAAC,KAAe;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,sBAAsB;IACpC,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,KAAa;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5F,IAAI,YAAY;QAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE9C,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,oBAAoB;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,yBAAyB,EAAE,CAAC;QAChE,mEAAmE;QACnE,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxE,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,SAAS,GAAgC;gBAC7C,eAAe,EAAE,oBAAoB;gBACrC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM;gBACjD,GAAG,EAAE,SAAS;aACf,CAAC;YACF,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAE3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,SAAS,GAAgC;YAC7C,eAAe,EAAE,oBAAoB;YACrC,YAAY,EAAE,KAAK,CAAC,MAAM;YAC1B,GAAG,EAAE,SAAS;SACf,CAAC;QACF,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IACxF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/utils/instructions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/instructions.test.js

@@ -0,0 +1,68 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+function makeTempDir(prefix) {
+    return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+function writeFile(filePath, content) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+}
+async function importLoadCustomInstructions(mockedHome) {
+    vi.resetModules();
+    vi.doUnmock("os");
+    if (mockedHome) {
+        process.env.HOME = mockedHome;
+        vi.doMock("os", async () => {
+            const actual = await vi.importActual("os");
+            return {
+                ...actual,
+                homedir: () => mockedHome,
+            };
+        });
+    }
+    const mod = await import("./instructions");
+    return mod.loadCustomInstructions;
+}
+const originalHome = process.env.HOME;
+describe("loadCustomInstructions", () => {
+    afterEach(() => {
+        process.env.HOME = originalHome;
+        vi.restoreAllMocks();
+        vi.resetModules();
+        vi.doUnmock("os");
+    });
+    it("returns null when no instruction files exist", async () => {
+        const home = makeTempDir("muonroi-home-");
+        const cwd = makeTempDir("muonroi-cwd-");
+        const loadCustomInstructions = await importLoadCustomInstructions(home);
+        expect(loadCustomInstructions(cwd)).toBeNull();
+    });
+    it("loads global plus repo-chain AGENTS files in order", async () => {
+        const home = makeTempDir("muonroi-home-");
+        const repoRoot = makeTempDir("muonroi-repo-");
+        const cwd = path.join(repoRoot, "pkg", "feature");
+        fs.mkdirSync(path.join(repoRoot, ".git"));
+        fs.mkdirSync(cwd, { recursive: true });
+        writeFile(path.join(home, ".muonroi-cli", "AGENTS.md"), "global instructions");
+        writeFile(path.join(repoRoot, "AGENTS.md"), "root instructions");
+        writeFile(path.join(repoRoot, "pkg", "AGENTS.md"), "pkg instructions");
+        writeFile(path.join(repoRoot, "pkg", "feature", "AGENTS.md"), "feature instructions");
+        const loadCustomInstructions = await importLoadCustomInstructions(home);
+        expect(loadCustomInstructions(cwd)).toBe(["global instructions", "root instructions", "pkg instructions", "feature instructions"].join("\n\n"));
+    });
+    it("prefers AGENTS.override.md over AGENTS.md in the same directory", async () => {
+        const home = makeTempDir("muonroi-home-");
+        const repoRoot = makeTempDir("muonroi-repo-");
+        const cwd = path.join(repoRoot, "nested");
+        fs.mkdirSync(path.join(repoRoot, ".git"));
+        fs.mkdirSync(cwd, { recursive: true });
+        writeFile(path.join(repoRoot, "AGENTS.md"), "root instructions");
+        writeFile(path.join(repoRoot, "nested", "AGENTS.md"), "nested base instructions");
+        writeFile(path.join(repoRoot, "nested", "AGENTS.override.md"), "nested override instructions");
+        const loadCustomInstructions = await importLoadCustomInstructions(home);
+        expect(loadCustomInstructions(cwd)).toBe(["root instructions", "nested override instructions"].join("\n\n"));
+    });
+});
+//# sourceMappingURL=instructions.test.js.map

package/dist/utils/instructions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instructions.test.js","sourceRoot":"","sources":["../../src/utils/instructions.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE7D,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,OAAe;IAClD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,UAAmB;IAC7D,EAAE,CAAC,YAAY,EAAE,CAAC;IAClB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElB,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,UAAU,CAAC;QAC9B,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAAsB,IAAI,CAAC,CAAC;YAChE,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU;aAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,sBAAsB,CAAC;AACpC,CAAC;AAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;AAEtC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC;QAChC,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,EAAE,CAAC,YAAY,EAAE,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,sBAAsB,GAAG,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAExE,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAClD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAC/E,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACjE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACtF,MAAM,sBAAsB,GAAG,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAExE,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CACtC,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CACtG,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACjE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAClF,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAC/F,MAAM,sBAAsB,GAAG,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAExE,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/utils/permission-mode.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Permission mode controls which tool calls require manual approval before execution.
+ *
+ * safe      - Every tool call prompts the user for approval.
+ * auto-edit - File operation tools (read/write/edit/grep/list) auto-approve;
+ *             shell execution and computer tools still require confirmation.
+ * yolo      - All tool calls auto-approve without any prompting.
+ */
+export type PermissionMode = "safe" | "auto-edit" | "yolo";
+/**
+ * Set of tool names that are auto-approved in auto-edit mode.
+ * These are read/write file operations that are considered safe to run
+ * without manual confirmation when the user has opted into auto-edit mode.
+ */
+export declare const AUTO_EDIT_ALLOWED: ReadonlySet<string>;
+/**
+ * Returns true if the given tool call requires manual user approval
+ * under the specified permission mode.
+ *
+ * @param toolName - The name of the tool being invoked.
+ * @param mode     - The active PermissionMode.
+ * @returns true if the tool needs user approval, false if it should auto-approve.
+ */
+export declare function toolNeedsApproval(toolName: string, mode: PermissionMode): boolean;

package/dist/utils/permission-mode.js

@@ -0,0 +1,29 @@
+/**
+ * Set of tool names that are auto-approved in auto-edit mode.
+ * These are read/write file operations that are considered safe to run
+ * without manual confirmation when the user has opted into auto-edit mode.
+ */
+export const AUTO_EDIT_ALLOWED = new Set([
+    "read_file",
+    "write_file",
+    "edit_file",
+    "grep",
+    "list_directory",
+]);
+/**
+ * Returns true if the given tool call requires manual user approval
+ * under the specified permission mode.
+ *
+ * @param toolName - The name of the tool being invoked.
+ * @param mode     - The active PermissionMode.
+ * @returns true if the tool needs user approval, false if it should auto-approve.
+ */
+export function toolNeedsApproval(toolName, mode) {
+    if (mode === "yolo")
+        return false;
+    if (mode === "auto-edit")
+        return !AUTO_EDIT_ALLOWED.has(toolName);
+    // "safe" — always confirm
+    return true;
+}
+//# sourceMappingURL=permission-mode.js.map

package/dist/utils/permission-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-mode.js","sourceRoot":"","sources":["../../src/utils/permission-mode.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,WAAW;IACX,YAAY;IACZ,WAAW;IACX,MAAM;IACN,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,IAAoB;IACtE,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClE,0BAA0B;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/utils/permission-mode.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/permission-mode.test.js

@@ -0,0 +1,97 @@
+import { describe, expect, it } from "vitest";
+import { AUTO_EDIT_ALLOWED, toolNeedsApproval } from "./permission-mode.js";
+describe("toolNeedsApproval", () => {
+    // safe mode: always requires approval for every tool
+    describe("safe mode", () => {
+        it("requires approval for read_file in safe mode", () => {
+            expect(toolNeedsApproval("read_file", "safe")).toBe(true);
+        });
+        it("requires approval for write_file in safe mode", () => {
+            expect(toolNeedsApproval("write_file", "safe")).toBe(true);
+        });
+        it("requires approval for edit_file in safe mode", () => {
+            expect(toolNeedsApproval("edit_file", "safe")).toBe(true);
+        });
+        it("requires approval for grep in safe mode", () => {
+            expect(toolNeedsApproval("grep", "safe")).toBe(true);
+        });
+        it("requires approval for list_directory in safe mode", () => {
+            expect(toolNeedsApproval("list_directory", "safe")).toBe(true);
+        });
+        it("requires approval for bash in safe mode", () => {
+            expect(toolNeedsApproval("bash", "safe")).toBe(true);
+        });
+        it("requires approval for task in safe mode", () => {
+            expect(toolNeedsApproval("task", "safe")).toBe(true);
+        });
+        it("requires approval for computer_click in safe mode", () => {
+            expect(toolNeedsApproval("computer_click", "safe")).toBe(true);
+        });
+        it("requires approval for an arbitrary MCP tool in safe mode", () => {
+            expect(toolNeedsApproval("mcp_some_tool", "safe")).toBe(true);
+        });
+    });
+    // auto-edit mode: file ops auto-approved, bash/task/computer_* require approval
+    describe("auto-edit mode", () => {
+        it("auto-approves read_file in auto-edit mode", () => {
+            expect(toolNeedsApproval("read_file", "auto-edit")).toBe(false);
+        });
+        it("auto-approves write_file in auto-edit mode", () => {
+            expect(toolNeedsApproval("write_file", "auto-edit")).toBe(false);
+        });
+        it("auto-approves edit_file in auto-edit mode", () => {
+            expect(toolNeedsApproval("edit_file", "auto-edit")).toBe(false);
+        });
+        it("auto-approves grep in auto-edit mode", () => {
+            expect(toolNeedsApproval("grep", "auto-edit")).toBe(false);
+        });
+        it("auto-approves list_directory in auto-edit mode", () => {
+            expect(toolNeedsApproval("list_directory", "auto-edit")).toBe(false);
+        });
+        it("requires approval for bash in auto-edit mode", () => {
+            expect(toolNeedsApproval("bash", "auto-edit")).toBe(true);
+        });
+        it("requires approval for task in auto-edit mode", () => {
+            expect(toolNeedsApproval("task", "auto-edit")).toBe(true);
+        });
+        it("requires approval for computer_click in auto-edit mode", () => {
+            expect(toolNeedsApproval("computer_click", "auto-edit")).toBe(true);
+        });
+        it("requires approval for an arbitrary MCP tool in auto-edit mode", () => {
+            expect(toolNeedsApproval("mcp_some_tool", "auto-edit")).toBe(true);
+        });
+    });
+    // yolo mode: auto-approves everything
+    describe("yolo mode", () => {
+        it("auto-approves bash in yolo mode", () => {
+            expect(toolNeedsApproval("bash", "yolo")).toBe(false);
+        });
+        it("auto-approves read_file in yolo mode", () => {
+            expect(toolNeedsApproval("read_file", "yolo")).toBe(false);
+        });
+        it("auto-approves computer_click in yolo mode", () => {
+            expect(toolNeedsApproval("computer_click", "yolo")).toBe(false);
+        });
+        it("auto-approves task in yolo mode", () => {
+            expect(toolNeedsApproval("task", "yolo")).toBe(false);
+        });
+        it("auto-approves any arbitrary tool name in yolo mode", () => {
+            expect(toolNeedsApproval("anything_at_all", "yolo")).toBe(false);
+        });
+    });
+});
+describe("AUTO_EDIT_ALLOWED", () => {
+    it("contains the expected auto-approved tools", () => {
+        expect(AUTO_EDIT_ALLOWED.has("read_file")).toBe(true);
+        expect(AUTO_EDIT_ALLOWED.has("write_file")).toBe(true);
+        expect(AUTO_EDIT_ALLOWED.has("edit_file")).toBe(true);
+        expect(AUTO_EDIT_ALLOWED.has("grep")).toBe(true);
+        expect(AUTO_EDIT_ALLOWED.has("list_directory")).toBe(true);
+    });
+    it("does NOT contain bash, task, or computer tools", () => {
+        expect(AUTO_EDIT_ALLOWED.has("bash")).toBe(false);
+        expect(AUTO_EDIT_ALLOWED.has("task")).toBe(false);
+        expect(AUTO_EDIT_ALLOWED.has("computer_click")).toBe(false);
+    });
+});
+//# sourceMappingURL=permission-mode.test.js.map

package/dist/utils/permission-mode.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-mode.test.js","sourceRoot":"","sources":["../../src/utils/permission-mode.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE5E,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,CAAC,iBAAiB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACvE,MAAM,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/utils/redactor.d.ts

@@ -0,0 +1,57 @@
+/**
+ * src/utils/redactor.ts
+ *
+ * Process-wide log redactor singleton.
+ * Mitigates Pitfall 2 (HIGH severity API key leakage).
+ *
+ * Two-layer scrubbing strategy:
+ *   Layer 1 — Static regex patterns for known secret shapes (sk-*, JWT, Bearer, env vars)
+ *   Layer 2 — Enrolled live values registered at runtime (>=8 chars) via enrollSecret()
+ *
+ * Usage:
+ *   import { redactor } from "./utils/redactor.js";
+ *   redactor.installGlobalPatches(); // call FIRST at process boot
+ *   redactor.enrollSecret(loadedApiKey); // call immediately after key load
+ */
+declare class Redactor {
+    /** Set of enrolled live secret values (length >= 8). */
+    private enrolled;
+    /** Original console method references, saved before patching. */
+    private originals;
+    /**
+     * Enroll a live secret value for Layer 2 scrubbing.
+     * Values shorter than 8 characters are silently ignored to prevent
+     * accidentally redacting common short strings (Test 5 guard).
+     */
+    enrollSecret(value: string): void;
+    /**
+     * Scrub a string through both layers.
+     *
+     * Layer 1: apply all static regex patterns.
+     * Layer 2: replace all enrolled secret values.
+     */
+    redact(input: string): string;
+    /**
+     * Scrub an Error (or unknown thrown value) to a safe string.
+     * Runs redact() on both the stringified error and the stack trace.
+     */
+    redactError(err: unknown): string;
+    /**
+     * Stringify an argument for redaction.
+     * Returns the redacted string representation of any value.
+     */
+    private stringifyArg;
+    /**
+     * Install global patches on console.log/error/warn/info/debug.
+     * MUST be called exactly once at process start, before any other logging.
+     * Each patched method passes args through redact() before forwarding.
+     */
+    installGlobalPatches(): void;
+    /**
+     * Restore original console methods.
+     * Useful in tests to avoid cross-test contamination.
+     */
+    uninstallGlobalPatches(): void;
+}
+export declare const redactor: Redactor;
+export {};

package/dist/utils/redactor.js

@@ -0,0 +1,179 @@
+/**
+ * src/utils/redactor.ts
+ *
+ * Process-wide log redactor singleton.
+ * Mitigates Pitfall 2 (HIGH severity API key leakage).
+ *
+ * Two-layer scrubbing strategy:
+ *   Layer 1 — Static regex patterns for known secret shapes (sk-*, JWT, Bearer, env vars)
+ *   Layer 2 — Enrolled live values registered at runtime (>=8 chars) via enrollSecret()
+ *
+ * Usage:
+ *   import { redactor } from "./utils/redactor.js";
+ *   redactor.installGlobalPatches(); // call FIRST at process boot
+ *   redactor.enrollSecret(loadedApiKey); // call immediately after key load
+ */
+// ---------------------------------------------------------------------------
+// Static regex patterns for Layer 1 scrubbing
+// ---------------------------------------------------------------------------
+const STATIC_PATTERNS = [
+    // Anthropic sk-ant-* keys (most specific — checked first)
+    {
+        pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g,
+        replacement: "sk-ant-***REDACTED***",
+    },
+    // General sk-* keys (OpenAI and other providers)
+    {
+        pattern: /sk-[A-Za-z0-9_-]{20,}/g,
+        replacement: "sk-***REDACTED***",
+    },
+    // JWT triple-segment shape  eyJ<base64url>.<base64url>.<base64url>
+    {
+        pattern: /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+        replacement: "***REDACTED-JWT***",
+    },
+    // Environment variable assignments for common API keys
+    {
+        pattern: /(ANTHROPIC_API_KEY|OPENAI_API_KEY|GOOGLE_API_KEY|DEEPSEEK_API_KEY)\s*=\s*\S+/g,
+        replacement: "$1=***REDACTED***",
+    },
+    // Authorization Bearer header
+    {
+        pattern: /Authorization:\s*Bearer\s+\S+/gi,
+        replacement: "Authorization: Bearer ***REDACTED***",
+    },
+    // x-api-key header (case-insensitive)
+    {
+        pattern: /[Xx]-[Aa]pi-[Kk]ey:\s*\S+/g,
+        replacement: "x-api-key: ***REDACTED***",
+    },
+];
+// ---------------------------------------------------------------------------
+// Redactor class
+// ---------------------------------------------------------------------------
+class Redactor {
+    /** Set of enrolled live secret values (length >= 8). */
+    enrolled = new Set();
+    /** Original console method references, saved before patching. */
+    originals = null;
+    /**
+     * Enroll a live secret value for Layer 2 scrubbing.
+     * Values shorter than 8 characters are silently ignored to prevent
+     * accidentally redacting common short strings (Test 5 guard).
+     */
+    enrollSecret(value) {
+        if (!value || value.length < 8) {
+            return;
+        }
+        this.enrolled.add(value);
+    }
+    /**
+     * Scrub a string through both layers.
+     *
+     * Layer 1: apply all static regex patterns.
+     * Layer 2: replace all enrolled secret values.
+     */
+    redact(input) {
+        if (!input)
+            return input;
+        let result = input;
+        // Layer 1 — static regex
+        for (const { pattern, replacement } of STATIC_PATTERNS) {
+            // Reset lastIndex for global regexes before each call
+            pattern.lastIndex = 0;
+            result = result.replace(pattern, replacement);
+        }
+        // Layer 2 — enrolled live values
+        for (const secret of this.enrolled) {
+            // Only replace secrets that are still >= 8 chars (defensive)
+            if (secret.length >= 8) {
+                // Use a plain string replacement (not regex) to avoid regex special chars
+                // Replace ALL occurrences via split/join
+                result = result.split(secret).join("***REDACTED-ENROLLED***");
+            }
+        }
+        return result;
+    }
+    /**
+     * Scrub an Error (or unknown thrown value) to a safe string.
+     * Runs redact() on both the stringified error and the stack trace.
+     */
+    redactError(err) {
+        const errStr = String(err);
+        let result = this.redact(errStr);
+        if (err instanceof Error && err.stack) {
+            const redactedStack = this.redact(err.stack);
+            // If the stack contains more info than just the message, append it
+            if (redactedStack !== errStr) {
+                result = redactedStack;
+            }
+        }
+        return result;
+    }
+    /**
+     * Stringify an argument for redaction.
+     * Returns the redacted string representation of any value.
+     */
+    stringifyArg(arg) {
+        if (typeof arg === "string") {
+            return this.redact(arg);
+        }
+        try {
+            return this.redact(JSON.stringify(arg) ?? String(arg));
+        }
+        catch {
+            return this.redact(String(arg));
+        }
+    }
+    /**
+     * Install global patches on console.log/error/warn/info/debug.
+     * MUST be called exactly once at process start, before any other logging.
+     * Each patched method passes args through redact() before forwarding.
+     */
+    installGlobalPatches() {
+        if (this.originals) {
+            // Already patched — idempotent: no-op
+            return;
+        }
+        this.originals = {
+            log: console.log,
+            error: console.error,
+            warn: console.warn,
+            info: console.info,
+            debug: console.debug,
+        };
+        const { log: origLog, error: origError, warn: origWarn, info: origInfo, debug: origDebug } = this.originals;
+        console.log = (...args) => {
+            origLog.apply(console, args.map((a) => this.stringifyArg(a)));
+        };
+        console.error = (...args) => {
+            origError.apply(console, args.map((a) => this.stringifyArg(a)));
+        };
+        console.warn = (...args) => {
+            origWarn.apply(console, args.map((a) => this.stringifyArg(a)));
+        };
+        console.info = (...args) => {
+            origInfo.apply(console, args.map((a) => this.stringifyArg(a)));
+        };
+        console.debug = (...args) => {
+            origDebug.apply(console, args.map((a) => this.stringifyArg(a)));
+        };
+    }
+    /**
+     * Restore original console methods.
+     * Useful in tests to avoid cross-test contamination.
+     */
+    uninstallGlobalPatches() {
+        if (!this.originals)
+            return;
+        console.log = this.originals.log;
+        console.error = this.originals.error;
+        console.warn = this.originals.warn;
+        console.info = this.originals.info;
+        console.debug = this.originals.debug;
+        this.originals = null;
+    }
+}
+// Export singleton instance
+export const redactor = new Redactor();
+//# sourceMappingURL=redactor.js.map

package/dist/utils/redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.js","sourceRoot":"","sources":["../../src/utils/redactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,MAAM,eAAe,GAAoD;IACvE,0DAA0D;IAC1D;QACE,OAAO,EAAE,4BAA4B;QACrC,WAAW,EAAE,uBAAuB;KACrC;IACD,iDAAiD;IACjD;QACE,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,mBAAmB;KACjC;IACD,mEAAmE;IACnE;QACE,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EAAE,oBAAoB;KAClC;IACD,uDAAuD;IACvD;QACE,OAAO,EAAE,+EAA+E;QACxF,WAAW,EAAE,mBAAmB;KACjC;IACD,8BAA8B;IAC9B;QACE,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,sCAAsC;KACpD;IACD,sCAAsC;IACtC;QACE,OAAO,EAAE,4BAA4B;QACrC,WAAW,EAAE,2BAA2B;KACzC;CACF,CAAC;AAEF,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,QAAQ;IACZ,wDAAwD;IAChD,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,iEAAiE;IACzD,SAAS,GAMN,IAAI,CAAC;IAEhB;;;;OAIG;IACH,YAAY,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,yBAAyB;QACzB,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,eAAe,EAAE,CAAC;YACvD,sDAAsD;YACtD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAChD,CAAC;QAED,iCAAiC;QACjC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,6DAA6D;YAC7D,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvB,0EAA0E;gBAC1E,yCAAyC;gBACzC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,GAAY;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEjC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7C,mEAAmE;YACnE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,GAAG,aAAa,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,GAAY;QAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,oBAAoB;QAClB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,sCAAsC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,SAAS,GAAG;YACf,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC;QAEF,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAE5G,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;YACnC,OAAO,CAAC,KAAK,CACX,OAAO,EACP,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CACtC,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;YACrC,SAAS,CAAC,KAAK,CACb,OAAO,EACP,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CACtC,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;YACpC,QAAQ,CAAC,KAAK,CACZ,OAAO,EACP,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CACtC,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;YACpC,QAAQ,CAAC,KAAK,CACZ,OAAO,EACP,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CACtC,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;YACrC,SAAS,CAAC,KAAK,CACb,OAAO,EACP,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CACtC,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,sBAAsB;QACpB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAE5B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QACjC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACrC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACnC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACnC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAErC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;CACF;AAED,4BAA4B;AAC5B,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC"}

package/dist/utils/redactor.test.d.ts

@@ -0,0 +1 @@
+export {};