muonroi-cli 1.4.0 → 1.4.1

package/src/utils/llm-deadline.ts

@@ -1,80 +0,0 @@
-/**
- * src/utils/llm-deadline.ts
- *
- * Wall-clock guards for non-streaming LLM calls (generateObject / generateText).
- *
- * Root cause they address (observed live, 2026-06-03 driving OpenAI gpt-5.4-mini
- * via the agent harness): a provider connection can accept a request but never
- * send a response. The streaming path is covered by the time-to-next-chunk
- * stall watchdog (see orchestrator/stall-watchdog.ts), but **non-streaming**
- * pre-flight calls — debate planning, scope-ceiling finalize, etc. — had no
- * guard at all, so `await generateObject(...)` blocked forever and the agent
- * froze with ZERO feedback (no token, no toast).
- *
- * Two complementary helpers (extracted from council/llm.ts so every pre-flight
- * call site shares one implementation):
- *   - `withTimeoutSignal` — an AbortSignal combining a parent signal with a
- *     wall-clock deadline, so the SDK can abort the in-flight HTTP request.
- *   - `withDeadlineRace` — races the call against a deadline so the *caller*
- *     is guaranteed to unblock even when the SDK ignores its abort signal
- *     (observed with some providers mid-tool-execution).
- *
- * Use both together: pass the signal into the call for clean cancellation, and
- * wrap the await in the race for a hard caller-side guarantee.
- */
-
-/**
- * Combine an optional parent AbortSignal with a wall-clock deadline. Returns
- * the merged signal plus a `cleanup` thunk the caller must invoke once the
- * underlying request settles so the timeout timer doesn't keep the process
- * alive past the call.
- */
-export function withTimeoutSignal(
-  parent: AbortSignal | undefined,
-  timeoutMs: number,
-): { signal: AbortSignal; cleanup: () => void } {
-  const controller = new AbortController();
-  const timer = setTimeout(() => {
-    controller.abort(new Error(`LLM call exceeded ${timeoutMs}ms deadline (timeout)`));
-  }, timeoutMs);
-  let parentListener: (() => void) | null = null;
-  if (parent) {
-    if (parent.aborted) {
-      clearTimeout(timer);
-      controller.abort(parent.reason);
-    } else {
-      parentListener = () => controller.abort(parent.reason);
-      parent.addEventListener("abort", parentListener, { once: true });
-    }
-  }
-  return {
-    signal: controller.signal,
-    cleanup: () => {
-      clearTimeout(timer);
-      if (parent && parentListener) parent.removeEventListener("abort", parentListener);
-    },
-  };
-}
-
-/**
- * Race a promise against a wall-clock deadline. The AI SDK occasionally fails
- * to honour `abortSignal` mid-call (observed: a provider sitting on a stuck
- * HTTP request — the controller.abort fires but the call keeps awaiting). This
- * race guarantees the surrounding code receives an Error within `deadlineMs`,
- * regardless of what the SDK does internally. The in-flight request should
- * still be aborted via `withTimeoutSignal` for cleanup; this layer just ensures
- * the caller is never blocked past the deadline.
- */
-export async function withDeadlineRace<T>(fn: () => Promise<T>, deadlineMs: number, label: string): Promise<T> {
-  let timer: ReturnType<typeof setTimeout> | null = null;
-  const deadline = new Promise<never>((_, reject) => {
-    timer = setTimeout(() => {
-      reject(new Error(`${label} exceeded ${deadlineMs}ms deadline (timeout)`));
-    }, deadlineMs);
-  });
-  try {
-    return await Promise.race([fn(), deadline]);
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-}

package/src/utils/permission-mode.test.ts

@@ -1,121 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { AUTO_EDIT_ALLOWED, toolNeedsApproval } from "./permission-mode.js";
-
-describe("toolNeedsApproval", () => {
-  // safe mode: always requires approval for every tool
-  describe("safe mode", () => {
-    it("requires approval for read_file in safe mode", () => {
-      expect(toolNeedsApproval("read_file", "safe")).toBe(true);
-    });
-
-    it("requires approval for write_file in safe mode", () => {
-      expect(toolNeedsApproval("write_file", "safe")).toBe(true);
-    });
-
-    it("requires approval for edit_file in safe mode", () => {
-      expect(toolNeedsApproval("edit_file", "safe")).toBe(true);
-    });
-
-    it("requires approval for grep in safe mode", () => {
-      expect(toolNeedsApproval("grep", "safe")).toBe(true);
-    });
-
-    it("requires approval for list_directory in safe mode", () => {
-      expect(toolNeedsApproval("list_directory", "safe")).toBe(true);
-    });
-
-    it("requires approval for bash in safe mode", () => {
-      expect(toolNeedsApproval("bash", "safe")).toBe(true);
-    });
-
-    it("requires approval for task in safe mode", () => {
-      expect(toolNeedsApproval("task", "safe")).toBe(true);
-    });
-
-    it("requires approval for computer_click in safe mode", () => {
-      expect(toolNeedsApproval("computer_click", "safe")).toBe(true);
-    });
-
-    it("requires approval for an arbitrary MCP tool in safe mode", () => {
-      expect(toolNeedsApproval("mcp_some_tool", "safe")).toBe(true);
-    });
-  });
-
-  // auto-edit mode: file ops auto-approved, bash/task/computer_* require approval
-  describe("auto-edit mode", () => {
-    it("auto-approves read_file in auto-edit mode", () => {
-      expect(toolNeedsApproval("read_file", "auto-edit")).toBe(false);
-    });
-
-    it("auto-approves write_file in auto-edit mode", () => {
-      expect(toolNeedsApproval("write_file", "auto-edit")).toBe(false);
-    });
-
-    it("auto-approves edit_file in auto-edit mode", () => {
-      expect(toolNeedsApproval("edit_file", "auto-edit")).toBe(false);
-    });
-
-    it("auto-approves grep in auto-edit mode", () => {
-      expect(toolNeedsApproval("grep", "auto-edit")).toBe(false);
-    });
-
-    it("auto-approves list_directory in auto-edit mode", () => {
-      expect(toolNeedsApproval("list_directory", "auto-edit")).toBe(false);
-    });
-
-    it("requires approval for bash in auto-edit mode", () => {
-      expect(toolNeedsApproval("bash", "auto-edit")).toBe(true);
-    });
-
-    it("requires approval for task in auto-edit mode", () => {
-      expect(toolNeedsApproval("task", "auto-edit")).toBe(true);
-    });
-
-    it("requires approval for computer_click in auto-edit mode", () => {
-      expect(toolNeedsApproval("computer_click", "auto-edit")).toBe(true);
-    });
-
-    it("requires approval for an arbitrary MCP tool in auto-edit mode", () => {
-      expect(toolNeedsApproval("mcp_some_tool", "auto-edit")).toBe(true);
-    });
-  });
-
-  // yolo mode: auto-approves everything
-  describe("yolo mode", () => {
-    it("auto-approves bash in yolo mode", () => {
-      expect(toolNeedsApproval("bash", "yolo")).toBe(false);
-    });
-
-    it("auto-approves read_file in yolo mode", () => {
-      expect(toolNeedsApproval("read_file", "yolo")).toBe(false);
-    });
-
-    it("auto-approves computer_click in yolo mode", () => {
-      expect(toolNeedsApproval("computer_click", "yolo")).toBe(false);
-    });
-
-    it("auto-approves task in yolo mode", () => {
-      expect(toolNeedsApproval("task", "yolo")).toBe(false);
-    });
-
-    it("auto-approves any arbitrary tool name in yolo mode", () => {
-      expect(toolNeedsApproval("anything_at_all", "yolo")).toBe(false);
-    });
-  });
-});
-
-describe("AUTO_EDIT_ALLOWED", () => {
-  it("contains the expected auto-approved tools", () => {
-    expect(AUTO_EDIT_ALLOWED.has("read_file")).toBe(true);
-    expect(AUTO_EDIT_ALLOWED.has("write_file")).toBe(true);
-    expect(AUTO_EDIT_ALLOWED.has("edit_file")).toBe(true);
-    expect(AUTO_EDIT_ALLOWED.has("grep")).toBe(true);
-    expect(AUTO_EDIT_ALLOWED.has("list_directory")).toBe(true);
-  });
-
-  it("does NOT contain bash, task, or computer tools", () => {
-    expect(AUTO_EDIT_ALLOWED.has("bash")).toBe(false);
-    expect(AUTO_EDIT_ALLOWED.has("task")).toBe(false);
-    expect(AUTO_EDIT_ALLOWED.has("computer_click")).toBe(false);
-  });
-});

package/src/utils/permission-mode.ts

@@ -1,94 +0,0 @@
-/**
- * Permission mode controls which tool calls require manual approval before execution.
- *
- * safe      - Every tool call prompts the user for approval.
- * auto-edit - File operation tools (read/write/edit/grep/list) auto-approve;
- *             shell execution and computer tools still require confirmation.
- * yolo      - All tool calls auto-approve without any prompting.
- */
-import { appendDecisionLog } from "../usage/decision-log.js";
-
-export type PermissionMode = "safe" | "auto-edit" | "yolo";
-
-/**
- * Set of tool names that are auto-approved in auto-edit mode.
- * These are read/write file operations that are considered safe to run
- * without manual confirmation when the user has opted into auto-edit mode.
- */
-export const AUTO_EDIT_ALLOWED: ReadonlySet<string> = new Set([
-  "read_file",
-  "write_file",
-  "edit_file",
-  "grep",
-  "list_directory",
-]);
-
-/**
- * Returns true if the given tool call requires manual user approval
- * under the specified permission mode.
- *
- * @param toolName - The name of the tool being invoked.
- * @param mode     - The active PermissionMode.
- * @param context  - Optional context (command string for bash, path, isNetwork).
- *                   Backward compatible: old callers passing 2 args unchanged.
- * @returns true if the tool needs user approval, false if it should auto-approve.
- */
-export function toolNeedsApproval(
-  toolName: string,
-  mode: PermissionMode,
-  context?: { command?: string; path?: string; isNetwork?: boolean }
-): boolean {
-  const dangerous = (cmd?: string): boolean => {
-    if (!cmd) return false;
-    const patterns: RegExp[] = [
-      /rm\s+-rf?\s+\/(?!tmp|var\/tmp)/i,
-      /curl\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
-      /wget\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
-      /chmod\s+777/i,
-      /eval\s*\(/i,
-      /exec\s*\(/i,
-    ];
-    return patterns.some((p) => p.test(cmd));
-  };
-
-  if (mode === "yolo") {
-    if (dangerous(context?.command)) {
-      appendAudit({
-        kind: "yolo-override",
-        tool: toolName,
-        mode,
-        context,
-        ts: Date.now(),
-      });
-    }
-    return false;
-  }
-  if (mode === "auto-edit") {
-    if (toolName === "bash" && dangerous(context?.command)) return true;
-    return !AUTO_EDIT_ALLOWED.has(toolName);
-  }
-  // "safe" — always confirm; dangerous patterns explicitly require (no bypass)
-  if (dangerous(context?.command)) return true;
-  return true;
-}
-
-type AuditEvent = {
-  kind: "permission-override" | "yolo-override";
-  tool: string;
-  mode: PermissionMode;
-  context?: any;
-  ts: number;
-};
-
-export function appendAudit(event: AuditEvent): void {
-  // fire-and-forget; must not block sync approval decision path
-  appendDecisionLog({
-    ts: event.ts,
-    kind: event.kind as any,
-    taken: true,
-    reason: `${event.kind} for ${event.tool} under ${event.mode}`,
-    meta: { context: event.context },
-  }).catch(() => {
-    // swallow per decision-log contract
-  });
-}

package/src/utils/rate-limit.ts

@@ -1,21 +0,0 @@
-export async function withRateLimitBackoff<T>(
-  fn: () => Promise<T>,
-  opts: { delays?: number[]; maxRetries?: number } = {},
-): Promise<T> {
-  const delays = opts.delays ?? [1000, 4000, 16000];
-  const maxRetries = opts.maxRetries ?? 3;
-  let lastErr: unknown;
-  for (let attempt = 0; attempt < maxRetries; attempt++) {
-    try {
-      return await fn();
-    } catch (e: any) {
-      lastErr = e;
-      const msg = String(e?.message ?? e ?? "");
-      const is429 = e?.status === 429 || /429|rate.?limit/i.test(msg);
-      if (!is429 || attempt === maxRetries - 1) throw e;
-      const ms = delays[Math.min(attempt, delays.length - 1)];
-      await new Promise((r) => setTimeout(r, ms));
-    }
-  }
-  throw lastErr;
-}

package/src/utils/redactor.test.ts

@@ -1,100 +0,0 @@
-import { afterEach, describe, expect, it } from "vitest";
-
-// Import the module under test — will fail until src/utils/redactor.ts is created
-import { redactor } from "./redactor";
-
-describe("Redactor — Layer 1: static regex scrubbing", () => {
-  it("Test 1: redacts sk-ant-* bearer token from string", () => {
-    const input = "Bearer sk-ant-1234567890abcdefghij";
-    const result = redactor.redact(input);
-    expect(result).not.toContain("sk-ant-1234567890abcdefghij");
-    expect(result).toContain("***REDACTED***");
-  });
-
-  it("Test 2: redacts JWT triple-segment shape from Authorization header", () => {
-    const input = "Authorization: Bearer eyJabc.def.ghi";
-    const result = redactor.redact(input);
-    expect(result).not.toContain("eyJabc.def.ghi");
-  });
-
-  it("Test 3: redacts ANTHROPIC_API_KEY env var pattern", () => {
-    const input = "ANTHROPIC_API_KEY=sk-ant-real-key-here-1234567890";
-    const result = redactor.redact(input);
-    expect(result).toContain("***REDACTED***");
-    // Value should be gone; variable name may remain
-    expect(result).not.toContain("sk-ant-real-key-here-1234567890");
-  });
-});
-
-describe("Redactor — Layer 2: enrolled live values", () => {
-  afterEach(() => {
-    // Clear enrolled secrets between tests by creating a fresh state
-    // The redactor is a singleton — we test idempotency elsewhere
-  });
-
-  it("Test 4: redacts enrolled live secret value", () => {
-    redactor.enrollSecret("sk-customformat-abcdefghij");
-    const result = redactor.redact("...sk-customformat-abcdefghij...");
-    expect(result).not.toContain("sk-customformat-abcdefghij");
-  });
-
-  it("Test 5: does NOT redact short enrolled values (< 8 chars)", () => {
-    redactor.enrollSecret("ab");
-    const result = redactor.redact("absolute");
-    // Short secret 'ab' must NOT cause 'absolute' to be redacted
-    expect(result).toBe("absolute");
-    expect(result).toContain("absolute");
-  });
-});
-
-describe("Redactor — error redaction", () => {
-  it("Test 6: redactError removes secrets from Error message and stack", () => {
-    const err = new Error("Failed with key sk-ant-shouldredact1234567890");
-    const result = redactor.redactError(err);
-    expect(result).not.toContain("sk-ant-shouldredact1234567890");
-  });
-});
-
-describe("Redactor — global patches", () => {
-  it("Test 7: installGlobalPatches patches console.log to redact secrets", () => {
-    const captured: string[] = [];
-
-    // Intercept the original console.log BEFORE installGlobalPatches wraps it
-    // so we capture what the PATCHED version actually forwards.
-    const originalLog = console.log;
-    console.log = (...args: unknown[]) => {
-      captured.push(args.map(String).join(" "));
-    };
-
-    // Now install global patches — they will wrap the spy above
-    redactor.installGlobalPatches();
-
-    // Call through the patched console.log
-    console.log("test sk-ant-1234567890abcdefghij");
-
-    // Restore
-    redactor.uninstallGlobalPatches();
-    console.log = originalLog;
-
-    // The captured string should have been redacted by the patch
-    const output = captured.join(" ");
-    expect(output).not.toContain("sk-ant-1234567890abcdefghij");
-    expect(output).toContain("***REDACTED***");
-  });
-});
-
-describe("Redactor — idempotency", () => {
-  it("Test 8: enrolling the same secret twice produces identical redacted output", () => {
-    const secret = "sk-ant-idempotent-test-abcdefghijklm";
-    redactor.enrollSecret(secret);
-    redactor.enrollSecret(secret); // enroll same value again
-
-    const result1 = redactor.redact(`key is ${secret}`);
-    // Enroll again for safety
-    redactor.enrollSecret(secret);
-    const result2 = redactor.redact(`key is ${secret}`);
-
-    expect(result1).toBe(result2);
-    expect(result1).not.toContain(secret);
-  });
-});

package/src/utils/redactor.ts

@@ -1,223 +0,0 @@
-/**
- * src/utils/redactor.ts
- *
- * Process-wide log redactor singleton.
- * Mitigates Pitfall 2 (HIGH severity API key leakage).
- *
- * Two-layer scrubbing strategy:
- *   Layer 1 — Static regex patterns for known secret shapes (sk-*, JWT, Bearer, env vars)
- *   Layer 2 — Enrolled live values registered at runtime (>=8 chars) via enrollSecret()
- *
- * Usage:
- *   import { redactor } from "./utils/redactor.js";
- *   redactor.installGlobalPatches(); // call FIRST at process boot
- *   redactor.enrollSecret(loadedApiKey); // call immediately after key load
- */
-
-// ---------------------------------------------------------------------------
-// Static regex patterns for Layer 1 scrubbing
-// ---------------------------------------------------------------------------
-
-const STATIC_PATTERNS: Array<{ pattern: RegExp; replacement: string }> = [
-  // Anthropic sk-ant-* keys (most specific — checked first)
-  {
-    pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g,
-    replacement: "sk-ant-***REDACTED***",
-  },
-  // General sk-* keys (OpenAI and other providers)
-  {
-    pattern: /sk-[A-Za-z0-9_-]{20,}/g,
-    replacement: "sk-***REDACTED***",
-  },
-  // JWT triple-segment shape  eyJ<base64url>.<base64url>.<base64url>
-  {
-    pattern: /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
-    replacement: "***REDACTED-JWT***",
-  },
-  // Environment variable assignments for common API keys
-  {
-    pattern: /(ANTHROPIC_API_KEY|OPENAI_API_KEY|GOOGLE_API_KEY|DEEPSEEK_API_KEY)\s*=\s*\S+/g,
-    replacement: "$1=***REDACTED***",
-  },
-  // Authorization Bearer header
-  {
-    pattern: /Authorization:\s*Bearer\s+\S+/gi,
-    replacement: "Authorization: Bearer ***REDACTED***",
-  },
-  // x-api-key header (case-insensitive)
-  {
-    pattern: /[Xx]-[Aa]pi-[Kk]ey:\s*\S+/g,
-    replacement: "x-api-key: ***REDACTED***",
-  },
-];
-
-// ---------------------------------------------------------------------------
-// Redactor class
-// ---------------------------------------------------------------------------
-
-class Redactor {
-  /** Set of enrolled live secret values (length >= 8). */
-  private enrolled = new Set<string>();
-
-  /** Original console method references, saved before patching. */
-  private originals: {
-    log: typeof console.log;
-    error: typeof console.error;
-    warn: typeof console.warn;
-    info: typeof console.info;
-    debug: typeof console.debug;
-  } | null = null;
-
-  /**
-   * Enroll a live secret value for Layer 2 scrubbing.
-   * Values shorter than 8 characters are silently ignored to prevent
-   * accidentally redacting common short strings (Test 5 guard).
-   */
-  enrollSecret(value: string): void {
-    if (!value || value.length < 8) {
-      return;
-    }
-    this.enrolled.add(value);
-  }
-
-  /**
-   * Scrub a string through both layers.
-   *
-   * Layer 1: apply all static regex patterns.
-   * Layer 2: replace all enrolled secret values.
-   */
-  redact(input: string): string {
-    if (!input) return input;
-
-    let result = input;
-
-    // Layer 1 — static regex
-    for (const { pattern, replacement } of STATIC_PATTERNS) {
-      // Reset lastIndex for global regexes before each call
-      pattern.lastIndex = 0;
-      result = result.replace(pattern, replacement);
-    }
-
-    // Layer 2 — enrolled live values
-    for (const secret of this.enrolled) {
-      // Only replace secrets that are still >= 8 chars (defensive)
-      if (secret.length >= 8) {
-        // Use a plain string replacement (not regex) to avoid regex special chars
-        // Replace ALL occurrences via split/join
-        result = result.split(secret).join("***REDACTED-ENROLLED***");
-      }
-    }
-
-    return result;
-  }
-
-  /**
-   * Scrub an Error (or unknown thrown value) to a safe string.
-   * Runs redact() on both the stringified error and the stack trace.
-   */
-  redactError(err: unknown): string {
-    const errStr = String(err);
-    let result = this.redact(errStr);
-
-    if (err instanceof Error && err.stack) {
-      const redactedStack = this.redact(err.stack);
-      // If the stack contains more info than just the message, append it
-      if (redactedStack !== errStr) {
-        result = redactedStack;
-      }
-    }
-
-    return result;
-  }
-
-  /**
-   * Stringify an argument for redaction.
-   * Returns the redacted string representation of any value.
-   */
-  private stringifyArg(arg: unknown): string {
-    if (typeof arg === "string") {
-      return this.redact(arg);
-    }
-    try {
-      return this.redact(JSON.stringify(arg) ?? String(arg));
-    } catch {
-      return this.redact(String(arg));
-    }
-  }
-
-  /**
-   * Install global patches on console.log/error/warn/info/debug.
-   * MUST be called exactly once at process start, before any other logging.
-   * Each patched method passes args through redact() before forwarding.
-   */
-  installGlobalPatches(): void {
-    if (this.originals) {
-      // Already patched — idempotent: no-op
-      return;
-    }
-
-    this.originals = {
-      log: console.log,
-      error: console.error,
-      warn: console.warn,
-      info: console.info,
-      debug: console.debug,
-    };
-
-    const { log: origLog, error: origError, warn: origWarn, info: origInfo, debug: origDebug } = this.originals;
-
-    console.log = (...args: unknown[]) => {
-      origLog.apply(
-        console,
-        args.map((a) => this.stringifyArg(a)),
-      );
-    };
-
-    console.error = (...args: unknown[]) => {
-      origError.apply(
-        console,
-        args.map((a) => this.stringifyArg(a)),
-      );
-    };
-
-    console.warn = (...args: unknown[]) => {
-      origWarn.apply(
-        console,
-        args.map((a) => this.stringifyArg(a)),
-      );
-    };
-
-    console.info = (...args: unknown[]) => {
-      origInfo.apply(
-        console,
-        args.map((a) => this.stringifyArg(a)),
-      );
-    };
-
-    console.debug = (...args: unknown[]) => {
-      origDebug.apply(
-        console,
-        args.map((a) => this.stringifyArg(a)),
-      );
-    };
-  }
-
-  /**
-   * Restore original console methods.
-   * Useful in tests to avoid cross-test contamination.
-   */
-  uninstallGlobalPatches(): void {
-    if (!this.originals) return;
-
-    console.log = this.originals.log;
-    console.error = this.originals.error;
-    console.warn = this.originals.warn;
-    console.info = this.originals.info;
-    console.debug = this.originals.debug;
-
-    this.originals = null;
-  }
-}
-
-// Export singleton instance
-export const redactor = new Redactor();