muonroi-cli 1.3.4 → 1.4.1

package/src/mcp/research-onboarding.ts

@@ -1,143 +0,0 @@
-import { loadMcpServers, loadUserSettings, saveMcpServers, saveUserSettings } from "../utils/settings.js";
-import { ensureDefaultMcpServers } from "./auto-setup.js";
-import { setMcpKey } from "./mcp-keychain.js";
-
-export interface OnboardingIO {
-  askYesNo: (prompt: string) => Promise<string>;
-  askText: (prompt: string) => Promise<string>;
-  log: (msg: string) => void;
-}
-
-export interface MigrationIO {
-  askChoice: (prompt: string) => Promise<string>;
-  askText: (prompt: string) => Promise<string>;
-  log: (msg: string) => void;
-}
-
-export interface OnboardingResult {
-  tavilyEnabled: boolean;
-}
-
-export interface MigrationResult {
-  shown: boolean;
-  tavilyEnabled: boolean;
-}
-
-const TAVILY_VALIDATE_URL = "https://api.tavily.com/search";
-const MAX_RETRY = 3;
-const MIN_KEY_LEN = 16;
-
-export async function validateTavilyKey(key: string): Promise<boolean> {
-  try {
-    const res = await fetch(TAVILY_VALIDATE_URL, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ api_key: key, query: "ping", max_results: 1 }),
-      signal: AbortSignal.timeout(5000),
-    });
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-
-function setTavilyEnabled(enabled: boolean): void {
-  // Ensure DEFAULT_CONFIGS is materialized in settings before mutating.
-  // First-run wizard runs before the orchestrator's own ensureDefaultMcpServers
-  // call, so without this the tavily row may not yet exist and the toggle
-  // would silently no-op.
-  ensureDefaultMcpServers();
-  const servers = loadMcpServers();
-  const idx = servers.findIndex((s) => s.id === "tavily");
-  if (idx === -1) return;
-  if (servers[idx].enabled === enabled) return;
-  servers[idx] = { ...servers[idx], enabled };
-  saveMcpServers(servers);
-}
-
-async function promptForKeyWithRetry(io: {
-  askText: (p: string) => Promise<string>;
-  log: (m: string) => void;
-}): Promise<string | null> {
-  for (let attempt = 1; attempt <= MAX_RETRY; attempt++) {
-    const raw = await io.askText(
-      attempt === 1
-        ? "Tavily API key (free tier at https://tavily.com, leave blank to skip): "
-        : `Tavily key invalid. Try again (${attempt}/${MAX_RETRY}) or leave blank to skip: `,
-    );
-    const key = raw.trim();
-    if (!key) return null;
-    if (key.length < MIN_KEY_LEN) {
-      io.log(`Key looks too short (< ${MIN_KEY_LEN} chars).\n`);
-      continue;
-    }
-    const ok = await validateTavilyKey(key);
-    if (ok) return key;
-    io.log("Validation failed (HTTP 401 or network error).\n");
-  }
-  return null;
-}
-
-export async function runResearchOnboarding(io: OnboardingIO): Promise<OnboardingResult> {
-  io.log("\nWeb research is available via MCP servers:\n");
-  io.log("  - context7 - version-pinned library docs (free, no key)\n");
-  io.log("  - fetch - URL to markdown extraction (free, no key)\n");
-  io.log("  - tavily - LLM-tuned web search (free tier 1k/mo, needs API key)\n");
-  io.log("\nTip: if you keep keys in Bitwarden, run `muonroi-cli mcp import-bw tavily` instead.\n\n");
-  const yn = (await io.askYesNo("Enable Tavily web search now? [Y/n]: ")).trim().toLowerCase();
-  let tavilyEnabled = false;
-  if (yn !== "n" && yn !== "no") {
-    const key = await promptForKeyWithRetry(io);
-    if (key) {
-      try {
-        await setMcpKey("tavily", key);
-        setTavilyEnabled(true);
-        tavilyEnabled = true;
-        io.log("Tavily key stored. Web search enabled.\n");
-      } catch (err) {
-        io.log(`Could not store key: ${(err as Error).message}\n`);
-      }
-    } else {
-      io.log("Skipped Tavily setup. You can run `muonroi-cli mcp setup-research` later.\n");
-    }
-  }
-  saveUserSettings({ webResearchPrompted: true });
-  return { tavilyEnabled };
-}
-
-export async function runResearchMigrationPrompt(io: MigrationIO): Promise<MigrationResult> {
-  const settings = loadUserSettings();
-  if (settings.webResearchPrompted === true) {
-    return { shown: false, tavilyEnabled: false };
-  }
-  io.log("\nNew: web research is available.\n");
-  io.log("  - context7 (library docs) and fetch (URL extraction) - already enabled.\n");
-  io.log("  - Tavily web search needs a free API key (tavily.com).\n\n");
-  const choice = (await io.askChoice("Set up Tavily now? [Y/n/never]: ")).trim().toLowerCase();
-  let tavilyEnabled = false;
-  if (choice === "y" || choice === "yes" || choice === "") {
-    const key = await promptForKeyWithRetry(io);
-    if (key) {
-      try {
-        await setMcpKey("tavily", key);
-        setTavilyEnabled(true);
-        tavilyEnabled = true;
-        saveUserSettings({ webResearchPrompted: true });
-        io.log("Tavily key stored. Web search enabled.\n");
-      } catch (err) {
-        io.log(`Could not store key: ${(err as Error).message}\n`);
-      }
-    } else {
-      io.log("Skipped. You can run `muonroi-cli mcp setup-research` later.\n");
-    }
-  } else if (choice === "never") {
-    saveUserSettings({ webResearchPrompted: true });
-    io.log("Got it - won't ask again. Run `muonroi-cli mcp setup-research` if you change your mind.\n");
-  } else {
-    // Plain "n" or unrecognized input: deliberately do NOT set webResearchPrompted.
-    // The migration prompt will re-fire next session so users who decline once
-    // are not silently locked out of web research forever.
-    io.log("Skipped for this session.\n");
-  }
-  return { shown: true, tavilyEnabled };
-}

package/src/mcp/runtime.ts

@@ -1,171 +0,0 @@
-import { createMCPClient, type MCPClient } from "@ai-sdk/mcp";
-import { jsonSchema } from "@ai-sdk/provider-utils";
-import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
-import { getDefaultEnvironment, StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import type { ToolSet } from "ai";
-import type { McpServerConfig } from "../utils/settings.js";
-import { getMcpKey, type McpKeyId } from "./mcp-keychain.js";
-import { createOAuthProviderWithCallback } from "./oauth-provider.js";
-import { validateMcpServerConfig } from "./validate.js";
-
-// Map MCP server id → keychain id + env var name for env hydration at spawn.
-// When a server's env value is empty/missing, we look up the key from the
-// OS keychain (or its env-var fallback) and inject it into the spawned process.
-const MCP_ENV_HYDRATION: Record<string, { keyId: McpKeyId; envVar: string }> = {
-  tavily: { keyId: "tavily", envVar: "TAVILY_API_KEY" },
-};
-
-async function hydrateServerEnv(server: McpServerConfig): Promise<McpServerConfig> {
-  const hydration = MCP_ENV_HYDRATION[server.id];
-  if (!hydration) return server;
-  const existing = server.env?.[hydration.envVar];
-  if (existing && existing.length > 0) return server;
-  const key = await getMcpKey(hydration.keyId);
-  if (!key) return server;
-  return { ...server, env: { ...(server.env ?? {}), [hydration.envVar]: key } };
-}
-
-function mcpToolPrefix(server: McpServerConfig): string {
-  return `mcp_${server.id.replace(/[^a-zA-Z0-9_-]/g, "_")}`;
-}
-
-// Phase M1 — lazy schema loading.
-//
-// The AI SDK's MCP client returns tools whose `inputSchema` carries the full
-// JSON Schema advertised by the MCP server. That schema is serialized into the
-// provider tool definition for EVERY `streamText` call, regardless of which
-// MCP tools the model actually invokes. With 5+ servers × 20+ tools × 1-5 KB
-// per schema, this trivially adds 100-500 KB of overhead to every model call.
-//
-// The fix: ship a minimal placeholder schema (`{ type: "object",
-// additionalProperties: true }`) to the model, and let the real MCP server
-// validate args downstream when the tool is actually called. The model
-// continues to know the tool's name + description so it can decide when to
-// call; the real schema only matters at execution time, which the MCP server
-// already enforces.
-//
-// Args validation: the AI SDK's `dynamicTool` factory only runs `validate()`
-// when present on the schema, and the MCP client never sets it (see
-// `jsonSchema(...)` in @ai-sdk/provider-utils — no `validate` arg). So this
-// change preserves the existing validation surface exactly (none on our side;
-// all enforced by the MCP server).
-// OpenAI Responses API rejects object schemas without a `properties` field
-// (HTTP 400 invalid_function_parameters). Anthropic/DeepSeek don't enforce
-// this. Always emit `properties: {}` alongside `additionalProperties: true`
-// so the schema is portable across providers.
-const LAZY_MCP_INPUT_SCHEMA = {
-  type: "object" as const,
-  properties: {} as Record<string, unknown>,
-  additionalProperties: true,
-};
-
-function stripMcpInputSchema<T extends { inputSchema?: unknown; description?: string }>(tool: T): T {
-  // Replace the full schema with a permissive placeholder. We keep `description`
-  // and `execute` (and any other fields) intact. Many MCP tools also have an
-  // `outputSchema`; we leave that alone since the AI SDK uses it only to parse
-  // structured tool results — it doesn't ship to the model.
-  return {
-    ...tool,
-    inputSchema: jsonSchema(LAZY_MCP_INPUT_SCHEMA),
-  };
-}
-
-function toTransport(server: McpServerConfig, authProvider?: OAuthClientProvider) {
-  if (server.transport === "stdio") {
-    return new StdioClientTransport({
-      command: server.command ?? "",
-      args: server.args,
-      env: server.env ? { ...getDefaultEnvironment(), ...server.env } : undefined,
-      cwd: server.cwd,
-      stderr: "pipe",
-    });
-  }
-
-  return {
-    type: server.transport,
-    url: server.url ?? "",
-    headers: server.headers,
-    ...(authProvider ? { authProvider: authProvider as any } : {}),
-  } as const;
-}
-
-export interface McpToolBundle {
-  tools: ToolSet;
-  errors: string[];
-  close(): Promise<void>;
-}
-
-export interface McpBuildOptions {
-  onOAuthRequired?: (serverId: string, url: URL) => void;
-}
-
-export async function buildMcpToolSet(servers: McpServerConfig[], opts?: McpBuildOptions): Promise<McpToolBundle> {
-  const tools: ToolSet = {};
-  const errors: string[] = [];
-  const clients: MCPClient[] = [];
-  const cleanups: (() => void)[] = [];
-
-  for (const rawServer of servers) {
-    if (!rawServer.enabled) continue;
-
-    const validation = validateMcpServerConfig(rawServer);
-    if (!validation.ok) {
-      errors.push(`${rawServer.label}: ${validation.error}`);
-      continue;
-    }
-
-    try {
-      // Hydrate env vars from the OS keychain before spawning — e.g. inject
-      // TAVILY_API_KEY for the tavily MCP if the user stored it via the
-      // research-onboarding wizard.
-      const server = await hydrateServerEnv(rawServer);
-
-      let authProvider: OAuthClientProvider | undefined;
-
-      if (server.transport !== "stdio" && opts?.onOAuthRequired) {
-        const oauthResult = await createOAuthProviderWithCallback({
-          serverId: server.id,
-          onAuthorizationUrl: (url: URL) => opts.onOAuthRequired!(server.id, url),
-        });
-        authProvider = oauthResult.provider;
-        cleanups.push(oauthResult.close);
-      }
-
-      const client = await createMCPClient({
-        transport: toTransport(server, authProvider),
-        name: `muonroi-cli-${server.id}`,
-        version: "1.0.0",
-      });
-      clients.push(client);
-
-      const mcpTools = await client.tools();
-      const prefix = mcpToolPrefix(server);
-
-      for (const [name, tool] of Object.entries(mcpTools)) {
-        // OpenAI/DeepSeek function-name regex: ^[a-zA-Z0-9_-]+$. MCP spec
-        // does not restrict server-side tool names, so we sanitize here.
-        // The tool's execute() closure still calls the MCP server with the
-        // original name — we only rename what the LLM sees.
-        const safeName = name.replace(/[^a-zA-Z0-9_-]/g, "_");
-        const prefixedName = `${prefix}__${safeName}`;
-        const stripped = stripMcpInputSchema(tool as { inputSchema?: unknown; description?: string });
-        tools[prefixedName] = {
-          ...(stripped as object),
-          description: `[MCP ${server.label}] ${tool.description ?? name}`,
-        } as ToolSet[string];
-      }
-    } catch (error: unknown) {
-      const message = error instanceof Error ? error.message : String(error);
-      errors.push(`${rawServer.label}: ${message}`);
-    }
-  }
-
-  return {
-    tools,
-    errors,
-    async close() {
-      for (const fn of cleanups) fn();
-      await Promise.all(clients.map((client) => client.close().catch(() => {})));
-    },
-  };
-}

package/src/mcp/smoke.test.ts

@@ -1,170 +0,0 @@
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { describe, expect, it } from "vitest";
-import { buildMcpToolSet } from "./runtime.js";
-
-/**
- * MCP smoke tests — unit-level coverage for buildMcpToolSet.
- *
- * Note: Full stdio stub integration was attempted but StdioClientTransport from
- * @modelcontextprotocol/sdk closes stdin immediately on Windows+Bun, preventing
- * real server handshake. Tests cover all code paths reachable without a live
- * transport connection (empty list, disabled servers, validation failures).
- *
- * The stdio handshake test (discovers tools from stdio MCP echo stub) runs on
- * Linux/macOS only — it is skipped on Windows where StdioClientTransport hangs on Bun.
- */
-describe("MCP smoke test — buildMcpToolSet", () => {
-  it("returns empty tools and no errors for empty server list", async () => {
-    const bundle = await buildMcpToolSet([]);
-    expect(bundle.errors).toHaveLength(0);
-    expect(Object.keys(bundle.tools)).toHaveLength(0);
-    await bundle.close();
-  });
-
-  it("skips disabled servers without errors", async () => {
-    const bundle = await buildMcpToolSet([
-      {
-        id: "disabled-server",
-        label: "disabled-server",
-        enabled: false,
-        transport: "stdio",
-        command: "node",
-        args: ["--version"],
-      },
-    ]);
-    // Disabled server should be skipped — no errors, no tools
-    expect(bundle.errors).toHaveLength(0);
-    expect(Object.keys(bundle.tools)).toHaveLength(0);
-    await bundle.close();
-  });
-
-  it("reports validation error for stdio server without command", async () => {
-    const bundle = await buildMcpToolSet([
-      {
-        id: "bad-stdio",
-        label: "bad-stdio",
-        enabled: true,
-        transport: "stdio",
-        command: "",
-        args: [],
-      },
-    ]);
-    // Should have a validation error, not throw
-    expect(bundle.errors.length).toBeGreaterThan(0);
-    expect(bundle.errors[0]).toContain("bad-stdio");
-    await bundle.close();
-  });
-
-  it("reports validation error for http server without url", async () => {
-    const bundle = await buildMcpToolSet([
-      {
-        id: "bad-http",
-        label: "bad-http",
-        enabled: true,
-        transport: "sse",
-        url: "",
-      },
-    ]);
-    expect(bundle.errors.length).toBeGreaterThan(0);
-    expect(bundle.errors[0]).toContain("bad-http");
-    await bundle.close();
-  });
-
-  it("buildMcpToolSet signature contract — accepts McpServerConfig[] and returns McpToolBundle shape", () => {
-    // Structural type check: buildMcpToolSet must be a function accepting server configs
-    // and returning a promise of { tools, errors, close }.
-    // This verifies the public API without spawning a subprocess.
-    expect(typeof buildMcpToolSet).toBe("function");
-    // The function must return a promise
-    const result = buildMcpToolSet([]);
-    expect(result).toBeInstanceOf(Promise);
-    // Resolve the promise and verify shape
-    return result.then((bundle) => {
-      expect(bundle).toHaveProperty("tools");
-      expect(bundle).toHaveProperty("errors");
-      expect(typeof bundle.close).toBe("function");
-      return bundle.close();
-    });
-  });
-
-  it.skipIf(process.platform === "win32" || !!process.env.CI)(
-    "discovers tools from stdio MCP echo stub",
-    async () => {
-      // Inline MCP echo server script — handles initialize, notifications/initialized,
-      // and tools/list using Content-Length framing per the MCP JSON-RPC spec.
-      const echoServerScript = `
-const { stdin, stdout } = require('process');
-let buf = '';
-stdin.setEncoding('utf8');
-stdin.on('data', (chunk) => {
-  buf += chunk;
-  while (true) {
-    const headerEnd = buf.indexOf('\\r\\n\\r\\n');
-    if (headerEnd === -1) break;
-    const header = buf.slice(0, headerEnd);
-    const match = header.match(/Content-Length:\\s*(\\d+)/i);
-    if (!match) { buf = buf.slice(headerEnd + 4); continue; }
-    const len = parseInt(match[1], 10);
-    const bodyStart = headerEnd + 4;
-    if (buf.length < bodyStart + len) break;
-    const body = buf.slice(bodyStart, bodyStart + len);
-    buf = buf.slice(bodyStart + len);
-    handleMessage(JSON.parse(body));
-  }
-});
-function send(obj) {
-  const s = JSON.stringify(obj);
-  stdout.write('Content-Length: ' + Buffer.byteLength(s) + '\\r\\n\\r\\n' + s);
-}
-function handleMessage(msg) {
-  if (msg.method === 'initialize') {
-    send({ jsonrpc: '2.0', id: msg.id, result: {
-      protocolVersion: '2024-11-05',
-      capabilities: { tools: { listChanged: false } },
-      serverInfo: { name: 'echo-stub', version: '1.0.0' }
-    }});
-  } else if (msg.method === 'notifications/initialized') {
-    // no response needed
-  } else if (msg.method === 'tools/list') {
-    send({ jsonrpc: '2.0', id: msg.id, result: {
-      tools: [{
-        name: 'echo',
-        description: 'Echoes input',
-        inputSchema: { type: 'object', properties: { message: { type: 'string' } }, required: ['message'] }
-      }]
-    }});
-  }
-}
-`;
-
-      const tmpDir = await mkdtemp(join(tmpdir(), "mcp-echo-stub-"));
-      const scriptPath = join(tmpDir, "echo-server.js");
-      let bundle: Awaited<ReturnType<typeof buildMcpToolSet>> | undefined;
-
-      try {
-        await writeFile(scriptPath, echoServerScript, "utf8");
-
-        bundle = await buildMcpToolSet([
-          {
-            id: "test_echo",
-            label: "test_echo",
-            enabled: true,
-            transport: "stdio",
-            command: "node",
-            args: [scriptPath],
-          },
-        ]);
-
-        expect(bundle.errors).toHaveLength(0);
-        expect(Object.keys(bundle.tools).length).toBeGreaterThanOrEqual(1);
-        expect(Object.keys(bundle.tools)).toContain("mcp_test_echo__echo");
-      } finally {
-        if (bundle) await bundle.close();
-        await rm(tmpDir, { recursive: true, force: true });
-      }
-    },
-    15000,
-  );
-});

package/src/mcp/validate.ts

@@ -1,48 +0,0 @@
-import type { McpRemoteTransport, McpServerConfig } from "../utils/settings";
-
-export function isRemoteTransport(value: string): value is McpRemoteTransport {
-  return value === "http" || value === "sse";
-}
-
-export function toMcpServerId(label: string): string {
-  const base = label
-    .toLowerCase()
-    .trim()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "");
-
-  return base || "mcp-server";
-}
-
-export function validateMcpServerConfig(server: McpServerConfig): { ok: true } | { ok: false; error: string } {
-  if (!server.id.trim()) {
-    return { ok: false, error: "Server id is required." };
-  }
-
-  if (!server.label.trim()) {
-    return { ok: false, error: "Server label is required." };
-  }
-
-  if (isRemoteTransport(server.transport)) {
-    if (!server.url?.trim()) {
-      return { ok: false, error: "URL is required for HTTP/SSE MCP servers." };
-    }
-
-    try {
-      const url = new URL(server.url);
-      if (url.protocol !== "http:" && url.protocol !== "https:") {
-        return { ok: false, error: "URL must start with http:// or https://." };
-      }
-    } catch {
-      return { ok: false, error: "URL is invalid." };
-    }
-
-    return { ok: true };
-  }
-
-  if (!server.command?.trim()) {
-    return { ok: false, error: "Command is required for stdio MCP servers." };
-  }
-
-  return { ok: true };
-}

package/src/models/__tests__/registry.test.ts

@@ -1,95 +0,0 @@
-import { beforeAll, describe, expect, test } from "vitest";
-import {
-  getEffectiveReasoningEffort,
-  getModelIds,
-  getModelInfo,
-  getSupportedReasoningEfforts,
-  loadCatalog,
-  MODELS,
-  normalizeModelId,
-} from "../registry";
-
-beforeAll(async () => {
-  await loadCatalog();
-});
-
-describe("MODELS catalog", () => {
-  test("has at least one model", () => {
-    expect(MODELS.length).toBeGreaterThan(0);
-  });
-
-  test("every model has required fields", () => {
-    for (const m of MODELS) {
-      expect(m.id).toBeTruthy();
-      expect(m.name).toBeTruthy();
-      expect(m.contextWindow).toBeGreaterThan(0);
-      expect(typeof m.inputPrice).toBe("number");
-      expect(typeof m.outputPrice).toBe("number");
-      expect(typeof m.reasoning).toBe("boolean");
-      expect(m.description).toBeTruthy();
-    }
-  });
-
-  test("no duplicate IDs", () => {
-    const ids = MODELS.map((m) => m.id);
-    expect(new Set(ids).size).toBe(ids.length);
-  });
-});
-
-describe("getModelIds", () => {
-  test("returns array of all model IDs", () => {
-    const ids = getModelIds();
-    expect(ids.length).toBe(MODELS.length);
-    expect(ids).toContain("deepseek-v4-flash");
-  });
-});
-
-describe("getModelInfo", () => {
-  test("returns info for known model", () => {
-    const info = getModelInfo("deepseek-v4-flash");
-    expect(info).toBeDefined();
-    expect(info!.name).toBe("DeepSeek V4 Flash (native)");
-    expect(info!.contextWindow).toBe(128_000);
-  });
-
-  test("returns info via alias", () => {
-    const info = getModelInfo("deepseek-flash-native");
-    expect(info).toBeDefined();
-    expect(info!.id).toBe("deepseek-v4-flash");
-  });
-
-  test("returns undefined for unknown model", () => {
-    expect(getModelInfo("nonexistent-model")).toBeUndefined();
-  });
-});
-
-describe("normalizeModelId", () => {
-  test("resolves alias to canonical ID", () => {
-    expect(normalizeModelId("deepseek-flash-native")).toBe("deepseek-v4-flash");
-  });
-
-  test("passes through unknown IDs unchanged", () => {
-    expect(normalizeModelId("custom-model-123")).toBe("custom-model-123");
-  });
-
-  test("passes through canonical IDs unchanged", () => {
-    expect(normalizeModelId("deepseek-v4-flash")).toBe("deepseek-v4-flash");
-  });
-});
-
-describe("getEffectiveReasoningEffort", () => {
-  test("returns provided effort for reasoning model", () => {
-    expect(getEffectiveReasoningEffort("deepseek-v4-flash", "high")).toBe("high");
-  });
-
-  test("returns undefined when no effort provided", () => {
-    expect(getEffectiveReasoningEffort("deepseek-v4-flash", undefined)).toBeUndefined();
-  });
-});
-
-describe("getSupportedReasoningEfforts", () => {
-  test("returns efforts for reasoning-capable model", () => {
-    const efforts = getSupportedReasoningEfforts("deepseek-v4-flash");
-    expect(efforts.length).toBeGreaterThan(0);
-  });
-});