muonroi-cli 1.4.0 → 1.5.0

package/src/ee/index.ts

@@ -1,33 +0,0 @@
-export { getCachedAuthToken, getEmbeddingModelVersion, loadEEAuthToken, refreshAuthToken } from "./auth.js";
-export type { EEPoint, EERouteResult } from "./bridge.js";
-export {
-  classifyViaBrain,
-  getEmbeddingRaw,
-  resetBridge,
-  routeFeedback,
-  routeModel,
-  searchByText,
-  searchCollection,
-} from "./bridge.js";
-export { type CreateEEClientOpts, createEEClient } from "./client.js";
-export { type EEHealthResult, health, healthDetailed } from "./health.js";
-export {
-  bootstrapEEClient,
-  getDefaultEEClient,
-  intercept,
-  interceptWithDefaults,
-  setDefaultEEClient,
-} from "./intercept.js";
-export { posttool } from "./posttool.js";
-export { emitMatches, getRenderSink, renderInterceptWarning, setRenderSink } from "./render.js";
-export { buildScope, resetScopeCache, scopeLabel } from "./scope.js";
-export type {
-  Classification,
-  EEClient,
-  FeedbackPayload,
-  InterceptMatch,
-  InterceptRequest,
-  InterceptResponse,
-  PostToolPayload,
-  Scope,
-} from "./types.js";

package/src/ee/intercept.test.ts

@@ -1,197 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { type StubHandle, startStubEEServer } from "../__test-stubs__/ee-server.js";
-import { createEEClient, resetEEClientState } from "./client.js";
-import {
-  getLastSurfacedState,
-  resetLastSurfacedState,
-  setDefaultEEClient,
-  updateLastSurfacedState,
-} from "./intercept.js";
-import { setRenderSink } from "./render.js";
-import type { InterceptMatch, InterceptRequest } from "./types.js";
-
-const baseReq: InterceptRequest = {
-  toolName: "bash",
-  toolInput: { command: "rm -rf /" },
-  cwd: "/tmp",
-  tenantId: "local",
-  scope: { kind: "global" },
-};
-
-const sampleMatch: InterceptMatch = {
-  principle_uuid: "p-uuid-001",
-  embedding_model_version: "nomic-embed-text-v1.5",
-  confidence: 0.85,
-  why: "Dangerous command detected",
-  message: "Avoid destructive commands",
-  scope_label: "global",
-  last_matched_at: "2026-04-30T00:00:00Z",
-};
-
-describe("updateLastSurfacedState / resetLastSurfacedState", () => {
-  afterEach(() => {
-    resetLastSurfacedState();
-  });
-
-  it("updateLastSurfacedState sets surfacedIds and timestamp", () => {
-    updateLastSurfacedState(["id-1", "id-2"]);
-    const state = getLastSurfacedState();
-    expect(state.surfacedIds).toEqual(["id-1", "id-2"]);
-    expect(typeof state.timestamp).toBe("string");
-    expect(state.timestamp).not.toBe("");
-  });
-
-  it("updateLastSurfacedState with empty array is a no-op", () => {
-    updateLastSurfacedState(["id-1"]);
-    updateLastSurfacedState([]);
-    const state = getLastSurfacedState();
-    // Should still have previous value
-    expect(state.surfacedIds).toEqual(["id-1"]);
-  });
-
-  it("resetLastSurfacedState clears surfacedIds to []", () => {
-    updateLastSurfacedState(["id-1"]);
-    resetLastSurfacedState();
-    const state = getLastSurfacedState();
-    expect(state.surfacedIds).toEqual([]);
-  });
-});
-
-describe("intercept integration", () => {
-  let stub: StubHandle;
-  let captured: Array<any>;
-
-  beforeEach(async () => {
-    captured = [];
-    setRenderSink((chunk) => captured.push(chunk));
-    resetEEClientState();
-  });
-
-  afterEach(async () => {
-    if (stub) await stub.stop();
-  });
-
-  it("decision=block returns response unchanged (caller aborts)", async () => {
-    stub = await startStubEEServer({
-      intercept: () => ({ decision: "block", reason: "too dangerous" }),
-    });
-    const client = createEEClient({
-      baseUrl: `http://127.0.0.1:${stub.port}`,
-      timeoutMs: 2000,
-    });
-    setDefaultEEClient(client);
-
-    // Use the full intercept function (from intercept.ts)
-    const { intercept } = await import("./intercept.js");
-    const resp = await intercept(baseReq);
-    expect(resp.decision).toBe("block");
-    expect(resp.reason).toBe("too dangerous");
-    // No matches emitted on block
-    expect(captured).toHaveLength(0);
-  });
-
-  it("decision=allow with matches[] emits rendered lines via sink", async () => {
-    stub = await startStubEEServer({
-      intercept: () => ({
-        decision: "allow",
-        matches: [sampleMatch],
-      }),
-    });
-    const client = createEEClient({
-      baseUrl: `http://127.0.0.1:${stub.port}`,
-      timeoutMs: 2000,
-    });
-    setDefaultEEClient(client);
-
-    const { intercept } = await import("./intercept.js");
-    const resp = await intercept(baseReq);
-    expect(resp.decision).toBe("allow");
-    expect(resp.matches).toHaveLength(1);
-    // The render sink captures StreamChunk objects; check rendered content
-    const getContent = (c: any): string => (typeof c === "string" ? c : (c?.content ?? JSON.stringify(c)));
-    expect(captured).toHaveLength(1);
-    expect(getContent(captured[0])).toContain("Avoid destructive commands");
-    expect(getContent(captured[0])).toContain("Dangerous command detected");
-    expect(getContent(captured[0])).toContain("global");
-  });
-
-  it("posttool carries tenantId + scope (awaitable Promise<void>)", async () => {
-    stub = await startStubEEServer({
-      posttool: () => {},
-    });
-    const client = createEEClient({
-      baseUrl: `http://127.0.0.1:${stub.port}`,
-      timeoutMs: 2000,
-    });
-    setDefaultEEClient(client);
-
-    const { posttool } = await import("./posttool.js");
-    // posttool is now async (Promise<void>) so it can be awaited by PostToolUse handler
-    const result = posttool({
-      toolName: "bash",
-      toolInput: { command: "ls" },
-      outcome: { success: true },
-      cwd: "/tmp",
-      tenantId: "local",
-      scope: { kind: "global" },
-    });
-    expect(result).toBeInstanceOf(Promise);
-    await result; // await to let HTTP settle
-
-    expect(stub.calls.posttool).toHaveLength(1);
-    expect(stub.calls.posttool[0].tenantId).toBe("local");
-    expect(stub.calls.posttool[0].scope).toEqual({ kind: "global" });
-  });
-});
-
-describe("401 refresh path", () => {
-  let stub: StubHandle;
-
-  beforeEach(() => {
-    resetEEClientState();
-  });
-
-  afterEach(async () => {
-    if (stub) await stub.stop();
-  });
-
-  it("retries once with refreshed token on 401", async () => {
-    let _callCount = 0;
-    stub = await startStubEEServer({
-      intercept: () => {
-        _callCount++;
-        // First call should be the retry after 401
-        return { decision: "allow", matches: [sampleMatch] };
-      },
-    });
-
-    // We need a custom intercept flow that handles 401.
-    // The 401 is surfaced by the client as reason='auth-required'.
-    // For this test, we'll mock the fetch to return 401 first, then succeed.
-    let fetchCallCount = 0;
-    const mockFetch = (async (input: string | URL | Request, init?: RequestInit) => {
-      fetchCallCount++;
-      if (fetchCallCount === 1) {
-        // First call: return 401
-        return new Response(JSON.stringify({ error: "unauthorized" }), {
-          status: 401,
-          headers: { "Content-Type": "application/json" },
-        });
-      }
-      // Subsequent calls: proxy to real stub
-      const url = typeof input === "string" ? input : (input as Request).url;
-      const stubUrl = url.replace(/http:\/\/[^/]+/, `http://127.0.0.1:${stub.port}`);
-      return fetch(stubUrl, init);
-    }) as unknown as typeof fetch;
-
-    const client = createEEClient({
-      baseUrl: `http://127.0.0.1:${stub.port}`,
-      timeoutMs: 2000,
-      fetchImpl: mockFetch,
-    });
-
-    // Test that the client returns auth-required on 401
-    const resp = await client.intercept(baseReq);
-    expect(resp.reason).toBe("auth-required");
-  });
-});

package/src/ee/intercept.ts

@@ -1,168 +0,0 @@
-import {
-  getCachedAuthToken,
-  getCachedServerBaseUrl,
-  getCachedServerTimeoutMs,
-  loadEEAuthToken,
-  refreshAuthToken,
-} from "./auth.js";
-import type { CreateEEClientOpts } from "./client.js";
-import { createEEClient } from "./client.js";
-import { emitMatches } from "./render.js";
-import { buildScope } from "./scope.js";
-import { getTenantId } from "./tenant.js";
-import type { InterceptRequest, InterceptResponse, Scope } from "./types.js";
-
-// ─── Surfaced-state tracking for prompt-stale reconciliation ─────────────────
-let _lastSurfacedIds: string[] = [];
-let _lastSurfacedTimestamp: string | null = null;
-
-// Most-recent match batch with collection info — drives Ctrl+N user feedback.
-// Separate from _lastSurfacedIds (which may include IDs from PIL Layer 3
-// injection where we don't have the collection).
-let _lastSurfacedMatches: Array<{ principleUuid: string; collection: string }> = [];
-
-export function getLastSurfacedMatches(): Array<{ principleUuid: string; collection: string }> {
-  return _lastSurfacedMatches.map((m) => ({ ...m }));
-}
-
-export function setLastSurfacedMatches(matches: Array<{ principleUuid: string; collection: string }>): void {
-  _lastSurfacedMatches = matches.filter((m) => m.principleUuid && m.collection).map((m) => ({ ...m }));
-}
-
-export function clearLastSurfacedMatches(): void {
-  _lastSurfacedMatches = [];
-}
-
-/**
- * Returns the last surfaced suggestion IDs and timestamp from the most recent
- * intercept call that returned matches. Used by prompt-stale reconciliation
- * callers (compact, clear, session-end).
- */
-export function getLastSurfacedState(): { surfacedIds: string[]; timestamp: string } {
-  return {
-    surfacedIds: [..._lastSurfacedIds],
-    timestamp: _lastSurfacedTimestamp ?? new Date().toISOString(),
-  };
-}
-
-/**
- * Allows non-HTTP code paths (e.g. PIL Layer 3 bridge search) to register
- * point IDs they injected into the prompt. These IDs join the HTTP-intercept
- * surfaced IDs for prompt-stale reconciliation.
- */
-export function updateLastSurfacedState(ids: string[]): void {
-  if (ids.length === 0) return;
-  _lastSurfacedIds = [...ids];
-  _lastSurfacedTimestamp = new Date().toISOString();
-}
-
-/**
- * Resets surfaced state to empty. Called after prompt-stale reconciliation
- * dispatches so the same IDs are not re-reported on the next turn.
- */
-export function resetLastSurfacedState(): void {
-  _lastSurfacedIds = [];
-  _lastSurfacedTimestamp = null;
-}
-
-/**
- * Module-level default EE client instance (lazy-initialized on first use).
- * Use setDefaultEEClient() to inject a custom client (e.g. in tests or at boot
- * after loading auth token from config).
- */
-let _defaultClient: ReturnType<typeof createEEClient> | null = null;
-
-export function setDefaultEEClient(c: ReturnType<typeof createEEClient>): void {
-  _defaultClient = c;
-}
-
-export function getDefaultEEClient(): ReturnType<typeof createEEClient> {
-  if (!_defaultClient)
-    _defaultClient = createEEClient({
-      baseUrl: getCachedServerBaseUrl() ?? undefined,
-      authToken: getCachedAuthToken() ?? undefined,
-    });
-  return _defaultClient;
-}
-
-/**
- * Call the EE intercept endpoint using the default client.
- * Blocks until a decision is received or the timeout elapses (falls back to allow).
- *
- * Phase 1: requires tenantId + scope explicitly.
- * - On 401 (surfaced as reason='auth-required'): refreshes token, rebuilds client, retries once.
- * - On allow + matches[]: emits rendered ⚠ lines via render sink.
- */
-export async function intercept(req: InterceptRequest, opts?: CreateEEClientOpts): Promise<InterceptResponse> {
-  const client = opts ? createEEClient(opts) : getDefaultEEClient();
-  let resp = await client.intercept(req);
-
-  // 401 refresh path: client surfaces 401 as { decision: 'allow', reason: 'auth-required' }
-  if ((resp as any).reason === "auth-required") {
-    await refreshAuthToken();
-    _defaultClient = createEEClient({
-      baseUrl: getCachedServerBaseUrl() ?? undefined,
-      authToken: getCachedAuthToken() ?? undefined,
-      timeoutMs: getCachedServerTimeoutMs() ?? undefined,
-    });
-    resp = await getDefaultEEClient().intercept(req);
-  }
-
-  // Emit rendered warnings for allow + matches
-  if (resp.decision === "allow" && resp.matches) {
-    emitMatches(resp.matches);
-  }
-
-  // Track surfaced IDs for prompt-stale reconciliation
-  if (resp.surfacedIds && resp.surfacedIds.length > 0) {
-    _lastSurfacedIds = [...resp.surfacedIds];
-    _lastSurfacedTimestamp = new Date().toISOString();
-  } else if (resp.matches && resp.matches.length > 0) {
-    _lastSurfacedIds = resp.matches.map((m) => m.principle_uuid);
-    _lastSurfacedTimestamp = new Date().toISOString();
-  }
-  // Track matches with collection for user feedback (Ctrl+N noise).
-  if (resp.matches && resp.matches.length > 0) {
-    setLastSurfacedMatches(
-      resp.matches
-        .filter((m) => m.collection)
-        .map((m) => ({ principleUuid: m.principle_uuid, collection: m.collection as string })),
-    );
-  }
-
-  return resp;
-}
-
-/**
- * @deprecated — pass tenantId + scope explicitly. This helper fills defaults
- * for Phase 0 callers that haven't been migrated yet.
- *
- * Fills tenantId='local' and scope (computed via buildScope({ cwd })) when omitted.
- */
-export async function interceptWithDefaults(
-  req: Omit<InterceptRequest, "tenantId" | "scope"> & Partial<Pick<InterceptRequest, "tenantId" | "scope">>,
-): Promise<InterceptResponse> {
-  const tenantId = req.tenantId ?? getTenantId();
-  const scope: Scope = req.scope ?? (await buildScope({ cwd: req.cwd }));
-  return intercept({
-    toolName: req.toolName,
-    toolInput: req.toolInput,
-    cwd: req.cwd,
-    tenantId,
-    scope,
-    ...(req.context ? { context: req.context } : {}),
-  });
-}
-
-/**
- * Bootstrap the EE client with auth token from ~/.experience/config.json.
- * Called once at session boot.
- */
-export async function bootstrapEEClient(home?: string): Promise<void> {
-  await loadEEAuthToken({ home });
-  _defaultClient = createEEClient({
-    baseUrl: getCachedServerBaseUrl() ?? undefined,
-    authToken: getCachedAuthToken() ?? undefined,
-    timeoutMs: getCachedServerTimeoutMs() ?? undefined,
-  });
-}

package/src/ee/judge.test.ts

@@ -1,213 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { fireFeedback, type JudgeContext, judge } from "./judge.js";
-import type { InterceptMatch } from "./types.js";
-
-// Mock the intercept module to control getDefaultEEClient
-const mockFeedback = vi.fn();
-const mockTouch = vi.fn();
-vi.mock("./intercept.js", () => ({
-  getDefaultEEClient: () => ({
-    feedback: mockFeedback,
-    touch: mockTouch,
-  }),
-}));
-
-function makeMatch(overrides: Partial<InterceptMatch> = {}): InterceptMatch {
-  return {
-    principle_uuid: "P1",
-    embedding_model_version: "v1",
-    confidence: 0.9,
-    why: "test reason",
-    message: "test message",
-    scope_label: "global",
-    last_matched_at: new Date().toISOString(),
-    ...overrides,
-  };
-}
-
-function makeCtx(overrides: Partial<JudgeContext> = {}): JudgeContext {
-  return {
-    warningResponse: {
-      decision: "allow",
-      matches: [makeMatch()],
-    },
-    toolName: "Edit",
-    outcome: { success: true, durationMs: 50 },
-    cwdMatchedAtPretool: true,
-    diffPresent: false,
-    tenantId: "local",
-    ...overrides,
-  };
-}
-
-describe("judge() deterministic classifier", () => {
-  it("no warningResponse.matches returns IRRELEVANT", () => {
-    const ctx = makeCtx({ warningResponse: { decision: "allow" } });
-    expect(judge(ctx)).toBe("IRRELEVANT");
-  });
-
-  it("empty matches array returns IRRELEVANT", () => {
-    const ctx = makeCtx({
-      warningResponse: { decision: "allow", matches: [] },
-    });
-    expect(judge(ctx)).toBe("IRRELEVANT");
-  });
-
-  it("cwdMatchedAtPretool=false returns IRRELEVANT", () => {
-    const ctx = makeCtx({ cwdMatchedAtPretool: false });
-    expect(judge(ctx)).toBe("IRRELEVANT");
-  });
-
-  it("successful outcome with matches returns FOLLOWED", () => {
-    const ctx = makeCtx();
-    expect(judge(ctx)).toBe("FOLLOWED");
-  });
-
-  it("failed outcome with matches returns IGNORED", () => {
-    const ctx = makeCtx({
-      outcome: { success: false, durationMs: 10 },
-    });
-    expect(judge(ctx)).toBe("IGNORED");
-  });
-
-  it("expectedBehavior=should-not-edit AND diffPresent=true returns IGNORED even with success", () => {
-    const ctx = makeCtx({
-      warningResponse: {
-        decision: "allow",
-        matches: [makeMatch({ expectedBehavior: "should-not-edit" })],
-      },
-      diffPresent: true,
-    });
-    expect(judge(ctx)).toBe("IGNORED");
-  });
-
-  it("expectedBehavior=should-not-edit AND diffPresent=false returns FOLLOWED", () => {
-    const ctx = makeCtx({
-      warningResponse: {
-        decision: "allow",
-        matches: [makeMatch({ expectedBehavior: "should-not-edit" })],
-      },
-      diffPresent: false,
-    });
-    expect(judge(ctx)).toBe("FOLLOWED");
-  });
-
-  it("null warningResponse returns IRRELEVANT", () => {
-    const ctx = makeCtx({ warningResponse: null });
-    expect(judge(ctx)).toBe("IRRELEVANT");
-  });
-
-  it("all matches below noise threshold returns IRRELEVANT", () => {
-    const ctx = makeCtx({
-      warningResponse: {
-        decision: "allow",
-        matches: [makeMatch({ confidence: 0.1 }), makeMatch({ confidence: 0.2 })],
-      },
-    });
-    expect(judge(ctx)).toBe("IRRELEVANT");
-  });
-
-  it("mix of low and high confidence returns FOLLOWED", () => {
-    const ctx = makeCtx({
-      warningResponse: {
-        decision: "allow",
-        matches: [makeMatch({ confidence: 0.1 }), makeMatch({ confidence: 0.8 })],
-      },
-    });
-    expect(judge(ctx)).toBe("FOLLOWED");
-  });
-
-  it("match exactly at noise threshold returns FOLLOWED", () => {
-    const ctx = makeCtx({
-      warningResponse: {
-        decision: "allow",
-        matches: [makeMatch({ confidence: 0.3 })],
-      },
-    });
-    expect(judge(ctx)).toBe("FOLLOWED");
-  });
-
-  it("match just below noise threshold returns IRRELEVANT", () => {
-    const ctx = makeCtx({
-      warningResponse: {
-        decision: "allow",
-        matches: [makeMatch({ confidence: 0.29 })],
-      },
-    });
-    expect(judge(ctx)).toBe("IRRELEVANT");
-  });
-});
-
-describe("fireFeedback()", () => {
-  beforeEach(() => {
-    mockFeedback.mockClear();
-    mockTouch.mockClear();
-  });
-
-  it("FOLLOWED: calls feedback() once per match AND touch() once per match", () => {
-    const ctx = makeCtx({
-      warningResponse: {
-        decision: "allow",
-        matches: [makeMatch({ principle_uuid: "P1" })],
-      },
-    });
-    fireFeedback(ctx);
-    expect(mockFeedback).toHaveBeenCalledOnce();
-    expect(mockFeedback).toHaveBeenCalledWith(
-      expect.objectContaining({
-        principle_uuid: "P1",
-        classification: "FOLLOWED",
-        tool_name: "Edit",
-      }),
-    );
-    expect(mockTouch).toHaveBeenCalledOnce();
-    expect(mockTouch).toHaveBeenCalledWith("P1", "local");
-  });
-
-  it("IGNORED: calls feedback() but NOT touch()", () => {
-    const ctx = makeCtx({
-      outcome: { success: false, durationMs: 10 },
-    });
-    fireFeedback(ctx);
-    expect(mockFeedback).toHaveBeenCalledOnce();
-    expect(mockFeedback).toHaveBeenCalledWith(expect.objectContaining({ classification: "IGNORED" }));
-    expect(mockTouch).not.toHaveBeenCalled();
-  });
-
-  it("IRRELEVANT (no matches): does not call feedback or touch", () => {
-    const ctx = makeCtx({ warningResponse: null });
-    fireFeedback(ctx);
-    expect(mockFeedback).not.toHaveBeenCalled();
-    expect(mockTouch).not.toHaveBeenCalled();
-  });
-
-  it("multiple matches: calls feedback and touch for each", () => {
-    const ctx = makeCtx({
-      warningResponse: {
-        decision: "allow",
-        matches: [makeMatch({ principle_uuid: "P1" }), makeMatch({ principle_uuid: "P2" })],
-      },
-    });
-    fireFeedback(ctx);
-    expect(mockFeedback).toHaveBeenCalledTimes(2);
-    expect(mockTouch).toHaveBeenCalledTimes(2);
-    expect(mockTouch).toHaveBeenCalledWith("P1", "local");
-    expect(mockTouch).toHaveBeenCalledWith("P2", "local");
-  });
-
-  it("noise matches (all below threshold): sends IRRELEVANT feedback, no touch", () => {
-    const ctx = makeCtx({
-      warningResponse: {
-        decision: "allow",
-        matches: [
-          makeMatch({ principle_uuid: "P1", confidence: 0.1 }),
-          makeMatch({ principle_uuid: "P2", confidence: 0.2 }),
-        ],
-      },
-    });
-    fireFeedback(ctx);
-    expect(mockFeedback).toHaveBeenCalledTimes(2);
-    expect(mockFeedback).toHaveBeenCalledWith(expect.objectContaining({ classification: "IRRELEVANT" }));
-    expect(mockTouch).not.toHaveBeenCalled();
-  });
-});