muonroi-cli 1.2.0

package/src/ee/extract-session.test.ts

@@ -0,0 +1,236 @@
+/**
+ * Unit + integration tests for extractSession module.
+ *
+ * Tests:
+ *  1. Skip extraction when < 5 user messages
+ *  2. Skip when exactly 4 user messages (mixed with other roles)
+ *  3. Call client.extract() when >= 5 user messages
+ *  4. Pass compacted transcript (not raw messages) to extract
+ *  5. Pass AbortSignal.timeout(2000) to client.extract()
+ *  6. Pass correct meta.source ("cli-exit" or "cli-clear")
+ *  7. Swallow errors — never throws even if client.extract throws
+ *  8. buildExtractTranscript truncates tool result bodies > 500 chars
+ *  9. (integration) completes within 2s against stub with 3s latency
+ * 10. Resumed session with 3+3 user messages (6 total) triggers extraction (D-07)
+ */
+import type { ModelMessage } from "ai";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createEEClient } from "./client.js";
+import { setDefaultEEClient } from "./intercept.js";
+import { startStubEEServer } from "../__test-stubs__/ee-server.js";
+import { buildExtractTranscript, extractSession } from "./extract-session.js";
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+function makeUserMsg(text: string): ModelMessage {
+  return { role: "user", content: [{ type: "text", text }] } as unknown as ModelMessage;
+}
+
+function makeAssistantMsg(text: string): ModelMessage {
+  return { role: "assistant", content: [{ type: "text", text }] } as unknown as ModelMessage;
+}
+
+function makeToolResultMsg(result: string): ModelMessage {
+  return {
+    role: "tool",
+    content: [{ type: "tool-result", toolCallId: "x", output: result }],
+  } as unknown as ModelMessage;
+}
+
+function fiveUserMessages(): ModelMessage[] {
+  return [
+    makeUserMsg("msg 1"),
+    makeAssistantMsg("reply 1"),
+    makeUserMsg("msg 2"),
+    makeAssistantMsg("reply 2"),
+    makeUserMsg("msg 3"),
+    makeAssistantMsg("reply 3"),
+    makeUserMsg("msg 4"),
+    makeAssistantMsg("reply 4"),
+    makeUserMsg("msg 5"),
+    makeAssistantMsg("reply 5"),
+  ];
+}
+
+// ─── Mocked client ────────────────────────────────────────────────────────────
+
+describe("extractSession — unit (mocked client)", () => {
+  const mockExtract = vi.fn().mockResolvedValue({ ok: true, mistakes: 0 });
+  const mockClient = {
+    extract: mockExtract,
+    health: vi.fn(),
+    intercept: vi.fn(),
+    posttool: vi.fn(),
+    routeModel: vi.fn(),
+    coldRoute: vi.fn(),
+    feedback: vi.fn(),
+    touch: vi.fn(),
+    routeFeedback: vi.fn(),
+    promptStale: vi.fn(),
+    stats: vi.fn(),
+    graph: vi.fn(),
+    timeline: vi.fn(),
+    gates: vi.fn(),
+    evolve: vi.fn(),
+    sharePrinciple: vi.fn(),
+    importPrinciple: vi.fn(),
+    routeTask: vi.fn(),
+    search: vi.fn(),
+    user: vi.fn(),
+  } as any;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    setDefaultEEClient(mockClient);
+  });
+
+  afterEach(() => {
+    // Reset to null so other tests use real client
+    setDefaultEEClient(null as any);
+  });
+
+  // Test 1: fewer than 5 user messages → skip
+  it("Test 1: returns immediately when < 5 user messages", async () => {
+    const messages: ModelMessage[] = [
+      makeUserMsg("a"),
+      makeAssistantMsg("b"),
+      makeUserMsg("c"),
+      makeAssistantMsg("d"),
+    ];
+    await extractSession(messages, "/proj", "cli-exit");
+    expect(mockExtract).not.toHaveBeenCalled();
+  });
+
+  // Test 2: exactly 4 user messages mixed with other roles → skip
+  it("Test 2: skips with exactly 4 user messages mixed with assistant/tool", async () => {
+    const messages: ModelMessage[] = [
+      makeUserMsg("u1"),
+      makeAssistantMsg("a1"),
+      makeToolResultMsg("result1"),
+      makeUserMsg("u2"),
+      makeAssistantMsg("a2"),
+      makeUserMsg("u3"),
+      makeAssistantMsg("a3"),
+      makeUserMsg("u4"),
+    ];
+    await extractSession(messages, "/proj", "cli-exit");
+    expect(mockExtract).not.toHaveBeenCalled();
+  });
+
+  // Test 3: 5+ user messages → call extract
+  it("Test 3: calls client.extract() when >= 5 user messages", async () => {
+    await extractSession(fiveUserMessages(), "/proj", "cli-exit");
+    expect(mockExtract).toHaveBeenCalledOnce();
+  });
+
+  // Test 4: passes compacted transcript (string) not raw messages
+  it("Test 4: passes compacted transcript string to extract", async () => {
+    await extractSession(fiveUserMessages(), "/proj", "cli-exit");
+    const call = mockExtract.mock.calls[0];
+    expect(typeof call[0].transcript).toBe("string");
+    expect(call[0].transcript.length).toBeGreaterThan(0);
+    // Should be serialized text format (e.g. "[User]: ..."), NOT a JSON array string like '[{"role":...'
+    expect(call[0].transcript).not.toMatch(/^\[\{"role"/);
+  });
+
+  // Test 5: passes AbortSignal.timeout(2000) as second arg
+  it("Test 5: passes AbortSignal.timeout(2000) to client.extract()", async () => {
+    await extractSession(fiveUserMessages(), "/proj", "cli-exit");
+    const call = mockExtract.mock.calls[0];
+    const signal = call[1] as AbortSignal;
+    expect(signal).toBeInstanceOf(AbortSignal);
+    // The signal should not be aborted immediately (we have 2s budget)
+    expect(signal.aborted).toBe(false);
+  });
+
+  // Test 6: passes correct meta.source
+  it("Test 6a: passes meta.source='cli-exit' correctly", async () => {
+    await extractSession(fiveUserMessages(), "/proj", "cli-exit");
+    expect(mockExtract.mock.calls[0][0].meta?.source).toBe("cli-exit");
+  });
+
+  it("Test 6b: passes meta.source='cli-clear' correctly", async () => {
+    await extractSession(fiveUserMessages(), "/proj", "cli-clear");
+    expect(mockExtract.mock.calls[0][0].meta?.source).toBe("cli-clear");
+  });
+
+  // Test 7: swallows errors — never throws
+  it("Test 7: swallows errors from client.extract() and never throws", async () => {
+    mockExtract.mockRejectedValueOnce(new Error("EE server down"));
+    await expect(extractSession(fiveUserMessages(), "/proj", "cli-exit")).resolves.toBeUndefined();
+  });
+
+  // Test 10: resumed session (3 prior + 3 new = 6 total) triggers extraction (D-07)
+  it("Test 10: resumed session with 6 total user msgs triggers extraction", async () => {
+    // Simulate: 3 prior session user msgs + 3 new session user msgs = 6 total
+    const messages: ModelMessage[] = [
+      makeUserMsg("prior 1"),
+      makeAssistantMsg("prior reply 1"),
+      makeUserMsg("prior 2"),
+      makeAssistantMsg("prior reply 2"),
+      makeUserMsg("prior 3"),
+      makeAssistantMsg("prior reply 3"),
+      makeUserMsg("new 1"),
+      makeAssistantMsg("new reply 1"),
+      makeUserMsg("new 2"),
+      makeAssistantMsg("new reply 2"),
+      makeUserMsg("new 3"),
+      makeAssistantMsg("new reply 3"),
+    ];
+    await extractSession(messages, "/proj", "cli-exit", "session-123");
+    expect(mockExtract).toHaveBeenCalledOnce();
+    expect(mockExtract.mock.calls[0][0].meta?.sessionId).toBe("session-123");
+  });
+});
+
+// ─── buildExtractTranscript unit tests ───────────────────────────────────────
+
+describe("buildExtractTranscript", () => {
+  // Test 8: truncates tool result bodies > 500 chars
+  it("Test 8: truncates tool result bodies longer than 500 chars", () => {
+    const longResult = "x".repeat(1000);
+    const messages: ModelMessage[] = [
+      makeUserMsg("question"),
+      makeAssistantMsg("answer"),
+      makeToolResultMsg(longResult),
+    ];
+    const output = buildExtractTranscript(messages);
+    expect(output).toContain("[truncated]");
+    // The output should be shorter than the raw concatenation would be
+    expect(output.length).toBeLessThan(longResult.length + 200);
+  });
+
+  it("does not truncate tool results <= 500 chars", () => {
+    const shortResult = "y".repeat(499);
+    const messages: ModelMessage[] = [
+      makeUserMsg("question"),
+      makeAssistantMsg("answer"),
+      makeToolResultMsg(shortResult),
+    ];
+    const output = buildExtractTranscript(messages);
+    expect(output).not.toContain("[truncated]");
+  });
+});
+
+// ─── Integration test (real stub server) ─────────────────────────────────────
+
+describe("extractSession — integration (real stub server)", () => {
+  it("Test 9: completes within 2s against stub with 3s latency (D-04)", async () => {
+    // Start stub with 3s artificial latency
+    const stub = await startStubEEServer({ latencyMs: 3000 });
+    const client = createEEClient({ baseUrl: `http://127.0.0.1:${stub.port}` });
+    setDefaultEEClient(client as any);
+
+    try {
+      const start = Date.now();
+      await extractSession(fiveUserMessages(), "/proj", "cli-exit");
+      const elapsed = Date.now() - start;
+
+      // AbortSignal.timeout(2000) fires, error is swallowed, function returns
+      expect(elapsed).toBeLessThan(2500);
+    } finally {
+      setDefaultEEClient(null as any);
+      await stub.stop();
+    }
+  });
+});

package/src/ee/extract-session.ts

@@ -0,0 +1,69 @@
+import type { ModelMessage } from "ai";
+import { serializeConversation } from "../orchestrator/compaction.js";
+import { getDefaultEEClient } from "./intercept.js";
+import { buildScope, scopeLabel } from "./scope.js";
+
+const USER_MSG_THRESHOLD = 5;
+const EXTRACT_TIMEOUT_MS = 2000;
+const TOOL_OUTPUT_MAX_CHARS = 500;
+
+/**
+ * Build a compacted transcript suitable for EE extraction.
+ * Uses serializeConversation() as base (per D-01), then truncates
+ * tool result bodies > 500 chars while keeping tool name + status (per D-02).
+ */
+export function buildExtractTranscript(messages: ModelMessage[]): string {
+  const serialized = serializeConversation(messages);
+  // Truncate [Tool result] entries that exceed TOOL_OUTPUT_MAX_CHARS
+  return serialized.replace(
+    /(\[Tool result\]: )([\s\S]{500,}?)(?=\n\n\[(?:User|Assistant|Tool|System|Previous)|$)/g,
+    (_, prefix, body) => `${prefix}${body.slice(0, TOOL_OUTPUT_MAX_CHARS)}... [truncated]`,
+  );
+}
+
+/**
+ * Extract session transcript to EE for learning.
+ *
+ * Called from Agent.cleanup() (cli-exit) and clearHistory() (cli-clear).
+ * - D-06: Only counts user-role messages for threshold
+ * - D-04: Uses 2s AbortSignal timeout
+ * - D-05: All errors swallowed silently
+ * - D-11: Debug logging only (console.debug)
+ */
+export async function extractSession(
+  messages: ModelMessage[],
+  projectPath: string,
+  source: "cli-exit" | "cli-clear",
+  sessionId?: string | null,
+): Promise<void> {
+  try {
+    // D-06: count user messages only
+    const userMsgCount = messages.filter((m) => m.role === "user").length;
+    if (userMsgCount < USER_MSG_THRESHOLD) return; // EXTRACT-04
+
+    // D-01/D-02: compact transcript
+    const transcript = buildExtractTranscript(messages);
+
+    // Resolve scope for ecosystem-aware extraction
+    const scope = await buildScope({ cwd: projectPath });
+
+    // D-04: 2s hard deadline via signal override
+    await getDefaultEEClient().extract(
+      {
+        transcript,
+        projectPath,
+        meta: {
+          source,
+          sessionId: sessionId ?? undefined,
+          scope: scopeLabel(scope),
+        },
+      },
+      AbortSignal.timeout(EXTRACT_TIMEOUT_MS),
+    );
+
+    // Trigger evolve after successful extraction — fire-and-forget
+    getDefaultEEClient().evolve("post-extract").catch(() => {});
+  } catch {
+    // D-05: swallow all errors silently
+  }
+}

package/src/ee/health.ts

@@ -0,0 +1,83 @@
+import { getCachedAuthToken, getCachedServerBaseUrl } from "./auth.js";
+import { getDefaultEEClient } from "./intercept.js";
+import { getCircuitState } from "./client.js";
+
+export interface EEHealthResult {
+  ok: boolean;
+  status: number;
+  mode: "local" | "thin-client";
+  circuit: "closed" | "open" | "half-open";
+  components: {
+    server: { ok: boolean; status: number };
+    gates: { ok: boolean; status: number } | null;
+  };
+}
+
+const HEALTH_TIMEOUT_MS = 3000;
+
+/**
+ * Simple health check — backwards compatible.
+ */
+export async function health(): Promise<{ ok: boolean; status: number }> {
+  return getDefaultEEClient().health();
+}
+
+/**
+ * Detailed health check that respects thin-client mode.
+ * For thin-client: checks VPS /health AND /api/gates (matching health-check.sh reference).
+ * For local: checks localhost /health.
+ */
+export async function healthDetailed(): Promise<EEHealthResult> {
+  const serverBaseUrl = getCachedServerBaseUrl();
+  const authToken = getCachedAuthToken();
+  const circuit = getCircuitState();
+  const mode = serverBaseUrl ? "thin-client" : "local";
+
+  if (mode === "thin-client" && serverBaseUrl) {
+    const [serverResult, gatesResult] = await Promise.all([
+      checkEndpoint(serverBaseUrl, "/health"),
+      checkEndpoint(serverBaseUrl, "/api/gates", authToken),
+    ]);
+
+    return {
+      ok: serverResult.ok && gatesResult.ok,
+      status: serverResult.status,
+      mode,
+      circuit,
+      components: {
+        server: serverResult,
+        gates: gatesResult,
+      },
+    };
+  }
+
+  const serverResult = await getDefaultEEClient().health();
+  return {
+    ok: serverResult.ok,
+    status: serverResult.status,
+    mode,
+    circuit,
+    components: {
+      server: serverResult,
+      gates: null,
+    },
+  };
+}
+
+async function checkEndpoint(
+  baseUrl: string,
+  path: string,
+  token?: string | null,
+): Promise<{ ok: boolean; status: number }> {
+  try {
+    const headers: Record<string, string> = {};
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const resp = await fetch(`${baseUrl}${path}`, {
+      headers,
+      signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS),
+    });
+    return { ok: resp.ok, status: resp.status };
+  } catch {
+    return { ok: false, status: 0 };
+  }
+}

package/src/ee/index.ts

@@ -0,0 +1,32 @@
+export { getCachedAuthToken, getEmbeddingModelVersion, loadEEAuthToken, refreshAuthToken } from "./auth.js";
+export { type CreateEEClientOpts, createEEClient } from "./client.js";
+export { health, healthDetailed, type EEHealthResult } from "./health.js";
+export {
+  bootstrapEEClient,
+  getDefaultEEClient,
+  intercept,
+  interceptWithDefaults,
+  setDefaultEEClient,
+} from "./intercept.js";
+export { posttool } from "./posttool.js";
+export { emitMatches, getRenderSink, renderInterceptWarning, setRenderSink } from "./render.js";
+export { buildScope, resetScopeCache, scopeLabel } from "./scope.js";
+export type {
+  Classification,
+  EEClient,
+  FeedbackPayload,
+  InterceptMatch,
+  InterceptRequest,
+  InterceptResponse,
+  PostToolPayload,
+  Scope,
+} from "./types.js";
+export {
+  classifyViaBrain,
+  getEmbeddingRaw,
+  resetBridge,
+  routeFeedback,
+  routeModel,
+  searchCollection,
+} from "./bridge.js";
+export type { EEPoint, EERouteResult } from "./bridge.js";

package/src/ee/intercept.test.ts

@@ -0,0 +1,191 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { type StubHandle, startStubEEServer } from "../__test-stubs__/ee-server.js";
+import { createEEClient, resetEEClientState } from "./client.js";
+import { getLastSurfacedState, resetLastSurfacedState, setDefaultEEClient, updateLastSurfacedState } from "./intercept.js";
+import { setRenderSink } from "./render.js";
+import type { InterceptMatch, InterceptRequest } from "./types.js";
+
+const baseReq: InterceptRequest = {
+  toolName: "bash",
+  toolInput: { command: "rm -rf /" },
+  cwd: "/tmp",
+  tenantId: "local",
+  scope: { kind: "global" },
+};
+
+const sampleMatch: InterceptMatch = {
+  principle_uuid: "p-uuid-001",
+  embedding_model_version: "nomic-embed-text-v1.5",
+  confidence: 0.85,
+  why: "Dangerous command detected",
+  message: "Avoid destructive commands",
+  scope_label: "global",
+  last_matched_at: "2026-04-30T00:00:00Z",
+};
+
+describe("updateLastSurfacedState / resetLastSurfacedState", () => {
+  afterEach(() => {
+    resetLastSurfacedState();
+  });
+
+  it("updateLastSurfacedState sets surfacedIds and timestamp", () => {
+    updateLastSurfacedState(["id-1", "id-2"]);
+    const state = getLastSurfacedState();
+    expect(state.surfacedIds).toEqual(["id-1", "id-2"]);
+    expect(typeof state.timestamp).toBe("string");
+    expect(state.timestamp).not.toBe("");
+  });
+
+  it("updateLastSurfacedState with empty array is a no-op", () => {
+    updateLastSurfacedState(["id-1"]);
+    updateLastSurfacedState([]);
+    const state = getLastSurfacedState();
+    // Should still have previous value
+    expect(state.surfacedIds).toEqual(["id-1"]);
+  });
+
+  it("resetLastSurfacedState clears surfacedIds to []", () => {
+    updateLastSurfacedState(["id-1"]);
+    resetLastSurfacedState();
+    const state = getLastSurfacedState();
+    expect(state.surfacedIds).toEqual([]);
+  });
+});
+
+describe("intercept integration", () => {
+  let stub: StubHandle;
+  let captured: string[];
+
+  beforeEach(async () => {
+    captured = [];
+    setRenderSink((line) => captured.push(line));
+    resetEEClientState();
+  });
+
+  afterEach(async () => {
+    if (stub) await stub.stop();
+  });
+
+  it("decision=block returns response unchanged (caller aborts)", async () => {
+    stub = await startStubEEServer({
+      intercept: () => ({ decision: "block", reason: "too dangerous" }),
+    });
+    const client = createEEClient({
+      baseUrl: `http://127.0.0.1:${stub.port}`,
+      timeoutMs: 2000,
+    });
+    setDefaultEEClient(client);
+
+    // Use the full intercept function (from intercept.ts)
+    const { intercept } = await import("./intercept.js");
+    const resp = await intercept(baseReq);
+    expect(resp.decision).toBe("block");
+    expect(resp.reason).toBe("too dangerous");
+    // No matches emitted on block
+    expect(captured).toHaveLength(0);
+  });
+
+  it("decision=allow with matches[] emits rendered lines via sink", async () => {
+    stub = await startStubEEServer({
+      intercept: () => ({
+        decision: "allow",
+        matches: [sampleMatch],
+      }),
+    });
+    const client = createEEClient({
+      baseUrl: `http://127.0.0.1:${stub.port}`,
+      timeoutMs: 2000,
+    });
+    setDefaultEEClient(client);
+
+    const { intercept } = await import("./intercept.js");
+    const resp = await intercept(baseReq);
+    expect(resp.decision).toBe("allow");
+    expect(resp.matches).toHaveLength(1);
+    // The render sink should have captured the warning
+    expect(captured).toHaveLength(1);
+    expect(captured[0]).toContain("Avoid destructive commands");
+    expect(captured[0]).toContain("Dangerous command detected");
+    expect(captured[0]).toContain("global");
+  });
+
+  it("posttool carries tenantId + scope (awaitable Promise<void>)", async () => {
+    stub = await startStubEEServer({
+      posttool: () => {},
+    });
+    const client = createEEClient({
+      baseUrl: `http://127.0.0.1:${stub.port}`,
+      timeoutMs: 2000,
+    });
+    setDefaultEEClient(client);
+
+    const { posttool } = await import("./posttool.js");
+    // posttool is now async (Promise<void>) so it can be awaited by PostToolUse handler
+    const result = posttool({
+      toolName: "bash",
+      toolInput: { command: "ls" },
+      outcome: { success: true },
+      cwd: "/tmp",
+      tenantId: "local",
+      scope: { kind: "global" },
+    });
+    expect(result).toBeInstanceOf(Promise);
+    await result; // await to let HTTP settle
+
+    expect(stub.calls.posttool).toHaveLength(1);
+    expect(stub.calls.posttool[0].tenantId).toBe("local");
+    expect(stub.calls.posttool[0].scope).toEqual({ kind: "global" });
+  });
+});
+
+describe("401 refresh path", () => {
+  let stub: StubHandle;
+
+  beforeEach(() => {
+    resetEEClientState();
+  });
+
+  afterEach(async () => {
+    if (stub) await stub.stop();
+  });
+
+  it("retries once with refreshed token on 401", async () => {
+    let _callCount = 0;
+    stub = await startStubEEServer({
+      intercept: () => {
+        _callCount++;
+        // First call should be the retry after 401
+        return { decision: "allow", matches: [sampleMatch] };
+      },
+    });
+
+    // We need a custom intercept flow that handles 401.
+    // The 401 is surfaced by the client as reason='auth-required'.
+    // For this test, we'll mock the fetch to return 401 first, then succeed.
+    let fetchCallCount = 0;
+    const mockFetch: typeof fetch = async (input, init) => {
+      fetchCallCount++;
+      if (fetchCallCount === 1) {
+        // First call: return 401
+        return new Response(JSON.stringify({ error: "unauthorized" }), {
+          status: 401,
+          headers: { "Content-Type": "application/json" },
+        });
+      }
+      // Subsequent calls: proxy to real stub
+      const url = typeof input === "string" ? input : (input as Request).url;
+      const stubUrl = url.replace(/http:\/\/[^/]+/, `http://127.0.0.1:${stub.port}`);
+      return fetch(stubUrl, init);
+    };
+
+    const client = createEEClient({
+      baseUrl: `http://127.0.0.1:${stub.port}`,
+      timeoutMs: 2000,
+      fetchImpl: mockFetch,
+    });
+
+    // Test that the client returns auth-required on 401
+    const resp = await client.intercept(baseReq);
+    expect(resp.reason).toBe("auth-required");
+  });
+});