muonroi-cli 1.8.4 → 1.9.0

package/dist/src/ee/client.js

@@ -1,6 +1,29 @@
+import * as os from "node:os";
 import { classifyEeError, logEeFailure } from "../utils/ee-logger.js";
+import { redactor } from "../utils/redactor.js";
 import { drainQueue, enqueue } from "./offline-queue.js";
 const DEFAULT_BASE = "http://localhost:8082";
+function relativizePath(p) {
+    if (!p)
+        return p;
+    let normalized = p.replace(/\\/g, "/");
+    const home = os.homedir().replace(/\\/g, "/");
+    const normalizedHome = home.endsWith("/") ? home.slice(0, -1) : home;
+    if (normalized.startsWith(normalizedHome)) {
+        normalized = "~" + normalized.slice(normalizedHome.length);
+    }
+    return normalized;
+}
+function redactPayload(payload) {
+    if (!payload)
+        return payload;
+    try {
+        return JSON.parse(redactor.redact(JSON.stringify(payload)));
+    }
+    catch {
+        return payload;
+    }
+}
 /**
  * Intercept timeout budget.
  * Local: 100ms (localhost p99 is <10ms, 100ms catches wedged server).
@@ -184,19 +207,33 @@ export function createEEClient(opts = {}) {
     }
     return {
         async health() {
+            const startedAt = Date.now();
             try {
                 const resp = await f(`${baseUrl}/health`, {
                     signal: AbortSignal.timeout(DEFAULT_HEALTH_TIMEOUT_MS),
                 });
                 return { ok: resp.ok, status: resp.status };
             }
-            catch {
+            catch (err) {
+                // status:0 means "no response" and says nothing about WHY. Timeout, DNS,
+                // refused connection and TLS failure all degrade to the same shape, so a
+                // bare catch here leaves an agent with an unfalsifiable symptom — exactly
+                // what happened on 2026-07-17, when status:0 was really the server
+                // blocking its event loop.
+                logEeFailure("client.health", classifyEeError(err), err, {
+                    elapsedMs: Date.now() - startedAt,
+                    budgetMs: DEFAULT_HEALTH_TIMEOUT_MS,
+                });
                 return { ok: false, status: 0 };
             }
         },
         async intercept(req) {
+            const redactedReq = {
+                ...req,
+                cwd: relativizePath(req.cwd),
+            };
             // 1. Cache hit — skip network entirely
-            const cached = getCached(req);
+            const cached = getCached(redactedReq);
             if (cached)
                 return cached;
             // 2. Circuit breaker — skip if open
@@ -207,7 +244,7 @@ export function createEEClient(opts = {}) {
                 const resp = await f(`${baseUrl}/api/intercept`, {
                     method: "POST",
                     headers: headers(),
-                    body: JSON.stringify({ ...req, skipRoute: true }),
+                    body: JSON.stringify(redactPayload({ ...redactedReq, skipRoute: true })),
                     signal: AbortSignal.timeout(interceptTimeoutMs),
                 });
                 if (!resp.ok) {
@@ -221,7 +258,7 @@ export function createEEClient(opts = {}) {
                 const raw = (await resp.json());
                 const result = normalizeInterceptResponse(raw);
                 recordCircuitSuccess({ fetchImpl: f, headers: headers(), baseUrl });
-                setCached(req, result);
+                setCached(redactedReq, result);
                 return result;
             }
             catch (err) {
@@ -231,10 +268,14 @@ export function createEEClient(opts = {}) {
             }
         },
         async posttool(payload) {
+            const redactedPayload = {
+                ...payload,
+                cwd: relativizePath(payload.cwd),
+            };
             await f(`${baseUrl}/api/posttool`, {
                 method: "POST",
                 headers: headers(),
-                body: JSON.stringify(payload),
+                body: JSON.stringify(redactPayload(redactedPayload)),
                 signal: AbortSignal.timeout(postToolTimeoutMs),
             }).catch((err) => {
                 logEeFailure("client.posttool", classifyEeError(err), err);
@@ -243,6 +284,10 @@ export function createEEClient(opts = {}) {
         },
         async routeModel(req, signal) {
             try {
+                const redactedReq = {
+                    ...req,
+                    cwd: relativizePath(req.cwd),
+                };
                 const ctrl = new AbortController();
                 const t = setTimeout(() => ctrl.abort(), 250);
                 if (signal)
@@ -250,7 +295,7 @@ export function createEEClient(opts = {}) {
                 const resp = await f(`${baseUrl}/api/route-model`, {
                     method: "POST",
                     headers: headers(),
-                    body: JSON.stringify(req),
+                    body: JSON.stringify(redactPayload(redactedReq)),
                     signal: ctrl.signal,
                 });
                 clearTimeout(t);
@@ -264,6 +309,10 @@ export function createEEClient(opts = {}) {
         },
         async coldRoute(req, signal) {
             try {
+                const redactedReq = {
+                    ...req,
+                    cwd: relativizePath(req.cwd),
+                };
                 const ctrl = new AbortController();
                 const t = setTimeout(() => ctrl.abort(), 1000);
                 if (signal)
@@ -271,7 +320,7 @@ export function createEEClient(opts = {}) {
                 const resp = await f(`${baseUrl}/api/cold-route`, {
                     method: "POST",
                     headers: headers(),
-                    body: JSON.stringify(req),
+                    body: JSON.stringify(redactPayload(redactedReq)),
                     signal: ctrl.signal,
                 });
                 clearTimeout(t);
@@ -284,13 +333,14 @@ export function createEEClient(opts = {}) {
             }
         },
         feedback(payload) {
+            const redactedPayload = redactPayload(payload);
             f(`${baseUrl}/api/feedback`, {
                 method: "POST",
                 headers: headers(),
-                body: JSON.stringify(payload),
+                body: JSON.stringify(redactedPayload),
             }).catch((err) => {
                 logEeFailure("client.feedback", classifyEeError(err), err);
-                void enqueue({ endpoint: "/api/feedback", body: payload, enqueuedAt: Date.now() });
+                void enqueue({ endpoint: "/api/feedback", body: redactedPayload, enqueuedAt: Date.now() });
             });
         },
         /**
@@ -300,7 +350,7 @@ export function createEEClient(opts = {}) {
          * stale_rule). Fire-and-forget; queued offline like standard feedback.
          */
         noiseFeedback(payload) {
-            const body = { ...payload, verdict: "IRRELEVANT" };
+            const body = redactPayload({ ...payload, verdict: "IRRELEVANT" });
             f(`${baseUrl}/api/feedback`, {
                 method: "POST",
                 headers: headers(),
@@ -322,10 +372,11 @@ export function createEEClient(opts = {}) {
         },
         // ─── P0: Route feedback (fire-and-forget) ─────────────────────────────────
         routeFeedback(payload) {
+            const redactedPayload = redactPayload(payload);
             f(`${baseUrl}/api/route-feedback`, {
                 method: "POST",
                 headers: headers(),
-                body: JSON.stringify(payload),
+                body: JSON.stringify(redactedPayload),
             }).catch((err) => {
                 logEeFailure("client.routeFeedback", classifyEeError(err), err);
                 /* fire-and-forget */
@@ -333,41 +384,54 @@ export function createEEClient(opts = {}) {
         },
         // ─── P1: Prompt-stale reconciliation ──────────────────────────────────────
         async promptStale(req) {
+            const redactedReq = redactPayload({
+                ...req,
+                nextPromptMeta: req.nextPromptMeta
+                    ? {
+                        ...req.nextPromptMeta,
+                        cwd: req.nextPromptMeta.cwd ? relativizePath(req.nextPromptMeta.cwd) : undefined,
+                    }
+                    : undefined,
+            });
             try {
                 const resp = await f(`${baseUrl}/api/prompt-stale`, {
                     method: "POST",
                     headers: headers(),
-                    body: JSON.stringify(req),
+                    body: JSON.stringify(redactedReq),
                     signal: AbortSignal.timeout(2000),
                 });
                 if (!resp.ok) {
-                    void enqueue({ endpoint: "/api/prompt-stale", body: req, enqueuedAt: Date.now() });
+                    void enqueue({ endpoint: "/api/prompt-stale", body: redactedReq, enqueuedAt: Date.now() });
                     return null;
                 }
                 return (await resp.json());
             }
             catch {
-                void enqueue({ endpoint: "/api/prompt-stale", body: req, enqueuedAt: Date.now() });
+                void enqueue({ endpoint: "/api/prompt-stale", body: redactedReq, enqueuedAt: Date.now() });
                 return null;
             }
         },
         // ─── P1: Session extract ──────────────────────────────────────────────────
         async extract(req, signal) {
+            const redactedReq = redactPayload({
+                ...req,
+                projectPath: relativizePath(req.projectPath),
+            });
             try {
                 const resp = await f(`${baseUrl}/api/extract`, {
                     method: "POST",
                     headers: headers(),
-                    body: JSON.stringify(req),
+                    body: JSON.stringify(redactedReq),
                     signal: signal ?? AbortSignal.timeout(10_000),
                 });
                 if (!resp.ok) {
-                    void enqueue({ endpoint: "/api/extract", body: req, enqueuedAt: Date.now() });
+                    void enqueue({ endpoint: "/api/extract", body: redactedReq, enqueuedAt: Date.now() });
                     return null;
                 }
                 return (await resp.json());
             }
             catch {
-                void enqueue({ endpoint: "/api/extract", body: req, enqueuedAt: Date.now() });
+                void enqueue({ endpoint: "/api/extract", body: redactedReq, enqueuedAt: Date.now() });
                 return null;
             }
         },
@@ -527,29 +591,51 @@ export function createEEClient(opts = {}) {
         async recall(query, opts = {}) {
             const body = { query };
             if (opts.cwd)
-                body.cwd = opts.cwd;
+                body.cwd = relativizePath(opts.cwd);
             if (opts.project)
                 body.project_slug = opts.project;
             if (opts.sourceSession)
                 body.sourceSession = opts.sourceSession;
+            // Per-stance recall weighting (item 3): forward the council stance/role so
+            // the server weights recall collections toward what this stance cares about.
+            if (opts.stance)
+                body.stance = opts.stance;
+            if (opts.role)
+                body.role = opts.role;
+            const redactedBody = redactPayload(body);
             // Server bounds the recall pipeline at ~8s internally (handleRecall's
             // AbortSignal.timeout(8000)); embedding + 3-leg search + network push real
             // wall-time past that (measured ~9.3s on a warm VPS). An 8s client ceiling
             // races the server and loses → spurious ee_unavailable. 15s gives margin
             // so a slow-but-valid recall still lands rather than being dropped.
             const timeoutMs = opts.timeoutMs ?? 15000;
+            const startedAt = Date.now();
             try {
                 const resp = await f(`${baseUrl}/api/recall`, {
                     method: "POST",
                     headers: headers(),
-                    body: JSON.stringify(body),
+                    body: JSON.stringify(redactedBody),
                     signal: opts.signal ?? AbortSignal.timeout(timeoutMs),
                 });
-                if (!resp.ok)
+                if (!resp.ok) {
+                    // Keep returning null — callers map it to "EE unavailable" — but never
+                    // discard the status. Collapsing 429/401/500 into the same null a
+                    // timeout produces is what made the 2026-07-17 incident unfalsifiable
+                    // from the client: "is the server rate-limiting us?" could not be
+                    // answered without reading the server's source.
+                    logEeFailure("client.recall", "error", new Error(`HTTP ${resp.status}`), {
+                        status: resp.status,
+                        elapsedMs: Date.now() - startedAt,
+                    });
                     return null;
+                }
                 return (await resp.json());
             }
-            catch {
+            catch (err) {
+                logEeFailure("client.recall", classifyEeError(err), err, {
+                    elapsedMs: Date.now() - startedAt,
+                    budgetMs: timeoutMs,
+                });
                 return null;
             }
         },
@@ -588,6 +674,8 @@ export function createEEClient(opts = {}) {
                         body.maxTokens = options.maxTokens;
                     if (options.provider)
                         body.provider = options.provider;
+                    if (options.useExtractModel)
+                        body.useExtractModel = true;
                 }
                 const resp = await f(`${baseUrl}/api/brain`, {
                     method: "POST",

package/dist/src/ee/ee-onboarding.js

@@ -8,27 +8,7 @@
  * health probe is reported, not hidden, and never blocks setup.
  */
 import { createInterface } from "node:readline";
-import { writeExperienceConfig } from "./auth.js";
-/** Best-effort reachability probe — returns true/false, never throws. */
-async function probeHealth(baseUrl, token) {
-    try {
-        const ac = new AbortController();
-        const timer = setTimeout(() => ac.abort(), 4000);
-        try {
-            const res = await fetch(`${baseUrl}/health`, {
-                signal: ac.signal,
-                headers: token ? { authorization: `Bearer ${token}` } : undefined,
-            });
-            return res.ok;
-        }
-        finally {
-            clearTimeout(timer);
-        }
-    }
-    catch {
-        return false;
-    }
-}
+import { probeEEHealth, writeExperienceConfig } from "./auth.js";
 /**
  * Returns true when a config was written (so the caller can reload EE auth).
  * Returns false when skipped or invalid.
@@ -38,8 +18,8 @@ export async function firstRunEESetup() {
     const ask = (q) => new Promise((resolve) => rl.question(q, (a) => resolve(a)));
     try {
         process.stderr.write("\nExperience Engine (optional) — a shared brain that recalls past decisions, gotchas,\n" +
-            "and recipes so the agent works like a senior on your stack. You can set this up later\n" +
-            "by editing ~/.experience/config.json or setting MUONROI_EE_BASE_URL.\n\n");
+            "and recipes so the agent works like a senior on your stack. Skipping is fine: you can\n" +
+            "connect one at any time with `/ee config <url> [token]`.\n\n");
         const url = (await ask("EE server URL (blank to skip): ")).trim();
         if (!url) {
             process.stderr.write("Skipped Experience Engine setup.\n");
@@ -59,10 +39,10 @@ export async function firstRunEESetup() {
             ...(token ? { serverAuthToken: token } : {}),
         });
         process.stderr.write(`Wrote Experience Engine config → ~/.experience/config.json (serverBaseUrl=${normalized}).\n`);
-        const reachable = await probeHealth(normalized, token || undefined);
-        process.stderr.write(reachable
+        const health = await probeEEHealth(normalized, token || undefined);
+        process.stderr.write(health.ok
             ? "  ✓ EE server reachable.\n"
-            : "  ⚠ Could not reach the EE server right now (saved anyway — run 'muonroi-cli doctor' to recheck).\n");
+            : `  ⚠ Could not reach the EE server right now — ${health.detail} (saved anyway; recheck with '/ee config').\n`);
         return true;
     }
     catch (err) {

package/dist/src/ee/export-transcripts.d.ts

@@ -15,6 +15,7 @@ export interface ExportOptions {
     dryRun?: boolean;
     /** Minimum messages per session to bother emitting (default 4 — skip noise). */
     minMessages?: number;
+    dbOverride?: any;
 }
 export interface ExportResult {
     totalSessions: number;

package/dist/src/ee/export-transcripts.js

@@ -10,9 +10,7 @@
  * recover lessons from sessions that pre-date the transcript-emit feature.
  * Idempotent: re-running overwrites the same per-session JSONL.
  */
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
+import { getDatabase } from "../storage/db.js";
 import { emitTranscriptToDisk, getEmitRoot } from "./transcript-emit.js";
 async function openDb(dbPath) {
     // Prefer better-sqlite3 (sync), fall back to bun:sqlite when running under Bun.
@@ -52,17 +50,15 @@ export async function exportTranscripts(opts = {}) {
     const maxAgeDays = opts.maxAgeDays ?? 30;
     const minMessages = opts.minMessages ?? 4;
     const dryRun = opts.dryRun ?? false;
-    const dbPath = path.join(os.homedir(), ".muonroi-cli", "muonroi.db");
-    if (!fs.existsSync(dbPath)) {
-        throw new Error(`muonroi.db not found at ${dbPath}`);
-    }
-    const db = await openDb(dbPath);
+    const db = opts.dbOverride ?? getDatabase();
     try {
         const cutoff = Date.now() - maxAgeDays * 86400_000;
         const cutoffIso = new Date(cutoff).toISOString();
         // Pull sessions touched in window. cwd_last is the cwd at session-end —
         // critical for EE scope detection so framework/lang resolve correctly.
-        const sessions = db.all(`SELECT id, updated_at, cwd_last FROM sessions WHERE updated_at >= '${cutoffIso}' ORDER BY updated_at DESC`);
+        const sessions = db
+            .prepare(`SELECT id, updated_at, cwd_last FROM sessions WHERE updated_at >= '${cutoffIso}' ORDER BY updated_at DESC`)
+            .all();
         const out = {
             totalSessions: sessions.length,
             written: 0,
@@ -71,7 +67,9 @@ export async function exportTranscripts(opts = {}) {
             outputRoot: getEmitRoot(),
         };
         for (const s of sessions) {
-            const rows = db.all(`SELECT session_id, seq, role, message_json FROM messages WHERE session_id = '${s.id.replace(/'/g, "''")}' ORDER BY seq ASC`);
+            const rows = db
+                .prepare(`SELECT session_id, seq, role, message_json FROM messages WHERE session_id = '${s.id.replace(/'/g, "''")}' ORDER BY seq ASC`)
+                .all();
             if (rows.length === 0) {
                 out.skippedEmpty++;
                 continue;

package/dist/src/ee/extract-session.js

@@ -47,9 +47,38 @@ export async function extractSession(messages, projectPath, source, sessionId) {
         getDefaultEEClient()
             .evolve("post-extract")
             .catch(() => { });
+        // WRITE arm of the who-am-i loop — fire-and-forget. Mine the user's working style from
+        // this transcript and persist it to experience-behavioral, which who-am-i-brain reads
+        // back next session (READ arm). Deliberately NOT awaited: the classify is a ~9s brain
+        // call and must not block cli-exit (same rationale as the async extract). It completes on
+        // cli-clear (process stays alive) and is best-effort on cli-exit — style converges over
+        // sessions, so a missed teardown is harmless. Fail-open, gated behind its own flag.
+        void writeStyleSignalsFireAndForget(transcript);
     }
     catch {
         // D-05: swallow all errors silently
     }
 }
+/**
+ * Fire-and-forget bridge from extractSession into the style WRITE arm. Kept separate so the
+ * bridge/search imports stay lazy (only paid when a real session ends) and so every failure
+ * mode — flag off, EE unreachable, classifier null, write error — degrades to a no-op.
+ */
+async function writeStyleSignalsFireAndForget(transcript) {
+    try {
+        const { isStyleExtractEnabled, writeStyleSignals } = await import("./extract-style.js");
+        if (!isStyleExtractEnabled())
+            return;
+        const { classifyViaBrain } = await import("./bridge.js");
+        const { writeExperienceEE } = await import("./search.js");
+        // No projectSlug: working style is a cross-repo property of the user, so style rules are
+        // written GLOBAL (unscoped) — who-am-i-brain searches experience-behavioral broadly and a
+        // repo-scoped style rule would be needlessly narrow. (Contrast the technical-lesson extract,
+        // which IS repo-scoped because a bug fix is repo-specific.)
+        await writeStyleSignals({ classifyViaBrain, writeExperience: writeExperienceEE }, transcript);
+    }
+    catch {
+        // swallow — style extraction is strictly best-effort
+    }
+}
 //# sourceMappingURL=extract-session.js.map

package/dist/src/ee/extract-style.d.ts

@@ -0,0 +1,58 @@
+import type { WriteExperienceResult } from "./search.js";
+/** Feature flag — default ON, opt out with MUONROI_STYLE_EXTRACT=0. */
+export declare function isStyleExtractEnabled(): boolean;
+/**
+ * PURE: build the style-mining prompt. Asks the brain to emit 0..N natural-language style
+ * rules about the USER (never the task), each standalone and reusable as future guidance,
+ * with a self-reported confidence. Emitting NOTHING when the transcript shows no clear style
+ * is explicitly the right answer — we would rather miss a session than pollute the brain.
+ */
+export declare function buildStyleExtractPrompt(transcript: string): string;
+export interface StyleRule {
+    rule: string;
+    confidence: number;
+}
+/**
+ * PURE: coerce a brain reply (JSON string, fenced block, or already-parsed object) into a
+ * gated list of style rules. Applies the confidence floor, length bounds, dedup by normalized
+ * text, and the per-session cap. Returns [] when nothing usable survives (fail-open).
+ */
+export declare function parseStyleRules(raw: unknown): StyleRule[];
+/**
+ * PURE: a stable title for a style rule so repeated sessions MERGE server-side instead of
+ * accreting near-duplicates. Derived deterministically from the rule text (lowercased, first
+ * few significant words) — same recurring preference → same title → storeImportedExperience
+ * can collapse them. Marked with a "user-style:" prefix so the entries are identifiable and
+ * prunable as a class.
+ */
+export declare function styleRuleTitle(rule: string): string;
+export interface StyleExtractDeps {
+    classifyViaBrain: (prompt: string, timeoutMs?: number, options?: {
+        systemPrompt?: string;
+        responseFormat?: {
+            type: string;
+        };
+        maxTokens?: number;
+        useExtractModel?: boolean;
+    }) => Promise<string | null>;
+    writeExperience: (lesson: string, opts: {
+        collection?: string;
+        title?: string;
+        projectSlug?: string;
+        confidence?: number;
+    }) => Promise<WriteExperienceResult>;
+}
+/**
+ * Classify the transcript into gated style rules. Fail-open []: a degraded brain must never
+ * break session teardown.
+ */
+export declare function extractStyleSignals(deps: StyleExtractDeps, transcript: string): Promise<StyleRule[]>;
+/**
+ * End-to-end WRITE arm: mine style rules from the transcript and persist each to
+ * experience-behavioral. Returns the number written. Fire-and-forget from extractSession —
+ * fail-open, never throws. `projectSlug` scopes the rule; confidence carries through so the
+ * brain can weight it.
+ */
+export declare function writeStyleSignals(deps: StyleExtractDeps, transcript: string, opts?: {
+    projectSlug?: string;
+}): Promise<number>;