muonroi-cli 1.2.0

package/dist/utils/redactor.test.js

@@ -0,0 +1,84 @@
+import { afterEach, describe, expect, it } from "vitest";
+// Import the module under test — will fail until src/utils/redactor.ts is created
+import { redactor } from "./redactor";
+describe("Redactor — Layer 1: static regex scrubbing", () => {
+    it("Test 1: redacts sk-ant-* bearer token from string", () => {
+        const input = "Bearer sk-ant-1234567890abcdefghij";
+        const result = redactor.redact(input);
+        expect(result).not.toContain("sk-ant-1234567890abcdefghij");
+        expect(result).toContain("***REDACTED***");
+    });
+    it("Test 2: redacts JWT triple-segment shape from Authorization header", () => {
+        const input = "Authorization: Bearer eyJabc.def.ghi";
+        const result = redactor.redact(input);
+        expect(result).not.toContain("eyJabc.def.ghi");
+    });
+    it("Test 3: redacts ANTHROPIC_API_KEY env var pattern", () => {
+        const input = "ANTHROPIC_API_KEY=sk-ant-real-key-here-1234567890";
+        const result = redactor.redact(input);
+        expect(result).toContain("***REDACTED***");
+        // Value should be gone; variable name may remain
+        expect(result).not.toContain("sk-ant-real-key-here-1234567890");
+    });
+});
+describe("Redactor — Layer 2: enrolled live values", () => {
+    afterEach(() => {
+        // Clear enrolled secrets between tests by creating a fresh state
+        // The redactor is a singleton — we test idempotency elsewhere
+    });
+    it("Test 4: redacts enrolled live secret value", () => {
+        redactor.enrollSecret("sk-customformat-abcdefghij");
+        const result = redactor.redact("...sk-customformat-abcdefghij...");
+        expect(result).not.toContain("sk-customformat-abcdefghij");
+    });
+    it("Test 5: does NOT redact short enrolled values (< 8 chars)", () => {
+        redactor.enrollSecret("ab");
+        const result = redactor.redact("absolute");
+        // Short secret 'ab' must NOT cause 'absolute' to be redacted
+        expect(result).toBe("absolute");
+        expect(result).toContain("absolute");
+    });
+});
+describe("Redactor — error redaction", () => {
+    it("Test 6: redactError removes secrets from Error message and stack", () => {
+        const err = new Error("Failed with key sk-ant-shouldredact1234567890");
+        const result = redactor.redactError(err);
+        expect(result).not.toContain("sk-ant-shouldredact1234567890");
+    });
+});
+describe("Redactor — global patches", () => {
+    it("Test 7: installGlobalPatches patches console.log to redact secrets", () => {
+        const captured = [];
+        // Intercept the original console.log BEFORE installGlobalPatches wraps it
+        // so we capture what the PATCHED version actually forwards.
+        const originalLog = console.log;
+        console.log = (...args) => {
+            captured.push(args.map(String).join(" "));
+        };
+        // Now install global patches — they will wrap the spy above
+        redactor.installGlobalPatches();
+        // Call through the patched console.log
+        console.log("test sk-ant-1234567890abcdefghij");
+        // Restore
+        redactor.uninstallGlobalPatches();
+        console.log = originalLog;
+        // The captured string should have been redacted by the patch
+        const output = captured.join(" ");
+        expect(output).not.toContain("sk-ant-1234567890abcdefghij");
+        expect(output).toContain("***REDACTED***");
+    });
+});
+describe("Redactor — idempotency", () => {
+    it("Test 8: enrolling the same secret twice produces identical redacted output", () => {
+        const secret = "sk-ant-idempotent-test-abcdefghijklm";
+        redactor.enrollSecret(secret);
+        redactor.enrollSecret(secret); // enroll same value again
+        const result1 = redactor.redact(`key is ${secret}`);
+        // Enroll again for safety
+        redactor.enrollSecret(secret);
+        const result2 = redactor.redact(`key is ${secret}`);
+        expect(result1).toBe(result2);
+        expect(result1).not.toContain(secret);
+    });
+});
+//# sourceMappingURL=redactor.test.js.map

package/dist/utils/redactor.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.test.js","sourceRoot":"","sources":["../../src/utils/redactor.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,kFAAkF;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,oCAAoC,CAAC;QACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,KAAK,GAAG,sCAAsC,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,mDAAmD,CAAC;QAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC3C,iDAAiD;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,SAAS,CAAC,GAAG,EAAE;QACb,iEAAiE;QACjE,8DAA8D;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,QAAQ,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,6DAA6D;QAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;QAChC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;YACnC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC;QAEF,4DAA4D;QAC5D,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QAEhC,uCAAuC;QACvC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAEhD,UAAU;QACV,QAAQ,CAAC,sBAAsB,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;QAE1B,6DAA6D;QAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,MAAM,GAAG,sCAAsC,CAAC;QACtD,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B;QAEzD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;QACpD,0BAA0B;QAC1B,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;QAEpD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/utils/settings.d.ts

@@ -0,0 +1,179 @@
+import type { HooksConfig } from "../hooks/types";
+import type { LspSettings, NormalizedLspSettings } from "../lsp/types";
+import type { AgentMode, ReasoningEffort } from "../types/index";
+export type ModelRole = "leader" | "implement" | "verify" | "research";
+export type TelegramStreamingMode = "off" | "partial";
+export type SandboxMode = "off" | "shuru";
+/** @deprecated Phase 4 will replace with LemonSqueezy billing. Wallet UI only. */
+export type PaymentChain = "base" | "base-sepolia";
+/** @deprecated Phase 4 will replace with LemonSqueezy billing. Wallet UI only. */
+export interface PaymentApprovalSettings {
+    autoApprove?: boolean;
+}
+/** @deprecated Phase 4 will replace with LemonSqueezy billing. Wallet UI only. */
+export interface PaymentSettings {
+    enabled?: boolean;
+    chain?: PaymentChain;
+    approval?: PaymentApprovalSettings;
+}
+export interface SandboxSecretConfig {
+    name: string;
+    fromEnv: string;
+    hosts: string[];
+}
+export interface SandboxSettings {
+    allowNet?: boolean;
+    allowedHosts?: string[];
+    ports?: string[];
+    cpus?: number;
+    memory?: number;
+    diskSize?: number;
+    secrets?: SandboxSecretConfig[];
+    from?: string;
+    allowEphemeralInstall?: boolean;
+    guestWorkdir?: string;
+    syncHostWorkspace?: boolean;
+    verifyBaseFrom?: string;
+    shellInit?: string[];
+    hostBrowserCommandsOnHost?: boolean;
+}
+export interface TelegramAudioInputSettings {
+    /** Enable Telegram voice/audio transcription before sending text to the agent. Default: true. */
+    enabled?: boolean;
+    /** Language code (e.g. `en`, `fr`) forwarded to the STT endpoint. Default: en. */
+    language?: string;
+}
+export interface TelegramSettings {
+    botToken?: string;
+    approvedUserIds?: number[];
+    sessionsByUserId?: Record<string, string>;
+    /** Live preview while generating. Default: partial (send + edit). Use `off` for buffer-then-send only. */
+    streaming?: TelegramStreamingMode;
+    /** Send `typing` chat action on an interval while the agent runs. Default: true. */
+    typingIndicator?: boolean;
+    /** Reserved: Bot API `sendMessageDraft` for private DMs (not implemented yet). */
+    nativeDrafts?: boolean;
+    audioInput?: TelegramAudioInputSettings;
+}
+export type McpRemoteTransport = "http" | "sse";
+export interface McpServerConfig {
+    id: string;
+    label: string;
+    enabled: boolean;
+    transport: McpRemoteTransport | "stdio";
+    url?: string;
+    headers?: Record<string, string>;
+    command?: string;
+    args?: string[];
+    env?: Record<string, string>;
+    cwd?: string;
+}
+export interface McpSettings {
+    servers?: McpServerConfig[];
+}
+export interface CustomSubagentConfig {
+    name: string;
+    model: string;
+    instruction: string;
+}
+export declare function isReservedSubagentName(name: string): boolean;
+export declare function parseSubAgentsRawList(raw: unknown): CustomSubagentConfig[];
+export declare function loadValidSubAgents(): CustomSubagentConfig[];
+export interface ProviderKeyConfig {
+    apiKey: string;
+    baseURL?: string;
+}
+export interface UserSettings {
+    apiKey?: string;
+    defaultModel?: string;
+    sandboxMode?: SandboxMode;
+    sandbox?: SandboxSettings;
+    lsp?: LspSettings;
+    reasoningEffortByModel?: Record<string, ReasoningEffort>;
+    telegram?: TelegramSettings;
+    mcp?: McpSettings;
+    subAgents?: CustomSubagentConfig[];
+    hooks?: HooksConfig;
+    /** @deprecated Phase 4 will replace with LemonSqueezy billing. */
+    payments?: PaymentSettings;
+    modeModels?: Partial<Record<AgentMode, string>>;
+    ecosystem?: {
+        name: string;
+        patterns: string[];
+    };
+    autoCompactAfterTurn?: boolean;
+    roleModels?: Partial<Record<ModelRole, string>>;
+    councilRounds?: number;
+    autoCouncil?: boolean;
+    providers?: {
+        anthropic?: ProviderKeyConfig;
+        openai?: ProviderKeyConfig;
+        google?: ProviderKeyConfig;
+        deepseek?: ProviderKeyConfig;
+        siliconflow?: ProviderKeyConfig;
+        xai?: ProviderKeyConfig;
+        ollama?: {
+            baseURL?: string;
+        };
+    };
+}
+export interface ProjectSettings {
+    model?: string;
+    sandboxMode?: SandboxMode;
+    sandbox?: SandboxSettings;
+    lsp?: LspSettings;
+}
+export declare function loadUserSettings(): UserSettings;
+export declare function saveUserSettings(partial: Partial<UserSettings>): void;
+export declare function loadProjectSettings(): ProjectSettings;
+export declare function saveProjectSettings(partial: Partial<ProjectSettings>): void;
+export declare function getApiKey(): string | undefined;
+export declare function getBaseURL(provider?: string): string;
+/**
+ * Build provider configs for adapter creation.
+ * Reads env vars + user-settings.json providers section.
+ * Anthropic uses the main apiKey; others use providers.* keys.
+ */
+export declare function getProviderConfigs(mainApiKey?: string): Record<string, {
+    apiKey?: string;
+    baseURL?: string;
+    model?: string;
+}>;
+export declare function getCurrentModel(mode?: AgentMode): string;
+/**
+ * Returns the explicitly configured model for a mode, or undefined if none is set.
+ * Only MUONROI_MODEL env var suppresses this (absolute override). Project-level model
+ * does NOT suppress — modeModels is an explicit per-mode config that applies on mode switch.
+ */
+export declare function getModeSpecificModel(mode: AgentMode): string | undefined;
+export declare function normalizeSandboxMode(value: unknown): SandboxMode;
+export declare function normalizeSandboxSettings(raw: unknown): SandboxSettings;
+export declare function mergeSandboxSettings(base: SandboxSettings | undefined, override: SandboxSettings | undefined): SandboxSettings;
+export declare function normalizeLspSettings(raw: unknown): NormalizedLspSettings;
+export declare function mergeLspSettings(base: LspSettings | undefined, override: LspSettings | undefined): NormalizedLspSettings;
+export declare function getCurrentSandboxMode(): SandboxMode;
+export declare function getCurrentSandboxSettings(): SandboxSettings;
+export declare function getCurrentLspSettings(): NormalizedLspSettings;
+export declare function getReasoningEffortForModel(modelId: string): ReasoningEffort | undefined;
+export declare function getTelegramBotToken(): string | undefined;
+export declare function saveApprovedTelegramUserId(userId: number): void;
+export declare function resolveTelegramStreamSettings(t: TelegramSettings | undefined): {
+    streaming: TelegramStreamingMode;
+    typingIndicator: boolean;
+    nativeDrafts: boolean;
+};
+export declare function resolveTelegramAudioInputSettings(t: TelegramSettings | undefined): {
+    enabled: boolean;
+    language: string;
+};
+export declare function loadMcpServers(): McpServerConfig[];
+export declare function saveMcpServers(servers: McpServerConfig[]): void;
+/** @deprecated Phase 4 will replace with LemonSqueezy billing. Wallet UI only. */
+export declare function loadPaymentSettings(): Required<PaymentSettings>;
+/** @deprecated Phase 4 will replace with LemonSqueezy billing. Wallet UI only. */
+export declare function savePaymentSettings(partial: PaymentSettings): void;
+export declare function isAutoCompactAfterTurnEnabled(): boolean;
+export declare function getRoleModel(role: ModelRole): string | undefined;
+export declare function getRoleModels(): Partial<Record<ModelRole, string>>;
+export declare function getCouncilRounds(): number;
+export declare function isAutoCouncilEnabled(): boolean;