muonroi-cli 1.8.4 → 1.9.0

package/dist/src/mcp/ee-tools.js

@@ -1,193 +0,0 @@
-/**
- * src/mcp/ee-tools.ts
- *
- * EE (Experience Engine) MCP tools: ee_query (semantic recall) + ee_health +
- * ee_feedback (rate a recalled entry). Read-mostly; ee_feedback POSTs a verdict.
- *
- * Anti-mù: ee_query supports explicit "recent task checkpoint" / "Progress DONE" queries
- * so the agent (or sub-agent) can deliberately confirm finished subtasks after compactions.
- * collections: prefer "experience-behavioral" for compaction checkpoints (see layer3).
- *
- * Feedback gate: ee_query stamps every returned `[id col]` into a session-scoped
- * pending ledger (recall-ledger.ts). Subsequent ee_query calls surface (soft) or
- * refuse on (hard) accumulated unrated debt, so useful recalls actually get a
- * verdict via ee_feedback — the signal the brain needs to keep the good entries
- * and prune the rest. Mode via EXPERIENCE_RECALL_FEEDBACK_GATE = off|soft|hard
- * (default soft); hard-mode threshold via EXPERIENCE_RECALL_FEEDBACK_THRESHOLD.
- *
- * Dependencies are injected (deps) so unit tests never touch the network/singleton.
- */
-import { z } from "zod";
-import { sessionRecallLedger } from "../ee/recall-ledger.js";
-import { formatRecallForAgent, healthEE, recallEE, } from "../ee/search.js";
-function ok(data) {
-    return { content: [{ type: "text", text: JSON.stringify(data) }] };
-}
-function okText(text) {
-    return { content: [{ type: "text", text }] };
-}
-function fail(error, message) {
-    return {
-        content: [{ type: "text", text: JSON.stringify({ error, message }) }],
-        isError: true,
-    };
-}
-/** Resolve the feedback-gate policy from env at call time (so tests can vary it). */
-function resolveGate() {
-    const raw = String(process.env.EXPERIENCE_RECALL_FEEDBACK_GATE ?? "soft")
-        .trim()
-        .toLowerCase();
-    const mode = raw === "off" || raw === "hard" ? raw : "soft";
-    const parsed = Number.parseInt(process.env.EXPERIENCE_RECALL_FEEDBACK_THRESHOLD ?? "", 10);
-    const threshold = Number.isFinite(parsed) && parsed > 0 ? parsed : 3;
-    return { mode, threshold };
-}
-/** One readable block naming the still-unrated recalls + how to clear them. */
-function formatPendingBlock(pending, hard, max = 8) {
-    const shown = pending.slice(0, max);
-    const lines = shown.map((p) => `  - [${p.id} ${p.collection ?? "?"}]  (from recall: "${p.query}")`);
-    const more = pending.length > max ? `\n  …and ${pending.length - max} more` : "";
-    const head = hard
-        ? `⚠️ FEEDBACK GATE — ${pending.length} earlier recall(s) are still unrated. Rate them with ` +
-            `ee_feedback(id, collection, verdict) before pulling new recalls:`
-        : `⚠️ ${pending.length} earlier recall(s) still unrated — call ` +
-            `ee_feedback(id, collection, verdict=followed|ignored|noise) so the brain keeps what helped and prunes the rest:`;
-    return `${head}\n${lines.join("\n")}${more}`;
-}
-export function registerEETools(server, deps = {}) {
-    // Default to the shared EE recall/health/feedback helpers (src/ee/search.ts) so
-    // the MCP tools and the in-CLI builtin tools resolve auth/baseUrl the same way.
-    // Tests inject `deps` to avoid the network and a fresh `ledger` to stay isolated.
-    const recall = deps.recall ?? ((q, o) => recallEE(q, o));
-    const health = deps.health ?? (() => healthEE());
-    const ledger = deps.ledger ?? sessionRecallLedger;
-    server.registerTool("ee_query", {
-        description: "Active recall over the Experience Engine brain — prior decisions, gotchas, learned warnings/recipes, and " +
-            "task checkpoints for this codebase — via the recallMode pipeline (same path as exp-recall.js). " +
-            "CALL THIS PROACTIVELY, before acting: when starting work in an unfamiliar area, when unsure how something " +
-            "is done in this stack, before a risky or hard-to-reverse step, or to recall finished work after a " +
-            "compaction (e.g. query='recent compaction checkpoint Progress DONE for <subtask>'). A deliberate query " +
-            "here is cheaper than re-deriving or repeating a past mistake. Returns a formatted index whose entries " +
-            "carry `[id col]` handles — after you act on a recall, rate each entry you used or judged with the " +
-            "ee_feedback tool (followed/ignored/noise) so the brain keeps what helped and prunes the rest; unrated " +
-            "recalls are surfaced back to you on the next ee_query. Optional project scopes the recall. Returns a " +
-            "compact ranked index (cosine-ranked, strongest first), capped at maxChars (default 6000, range " +
-            "500-20000) and truncated from the tail; raise maxChars to see more. Returns ee_unavailable if EE is " +
-            "down (then proceed without it).",
-        inputSchema: {
-            query: z.string().min(1).max(1000),
-            project: z.string().max(200).optional(),
-            maxChars: z.number().int().min(500).max(20_000).optional(),
-        },
-    }, async ({ query, project, maxChars }) => {
-        const gate = resolveGate();
-        const pendingBefore = gate.mode === "off" ? [] : ledger.pending();
-        // Hard gate: refuse a NEW recall while unrated debt is at/over threshold —
-        // do not even spend the brain call. Below threshold, fall through to soft.
-        if (gate.mode === "hard" && pendingBefore.length >= gate.threshold) {
-            return fail("feedback_required", formatPendingBlock(pendingBefore, true));
-        }
-        try {
-            const resp = await recall(query, { project });
-            if (resp === null) {
-                return fail("ee_unavailable", "EE recall returned no response (server down, timeout, or circuit open)");
-            }
-            // Stamp the new entries as pending debt (unless the gate is off).
-            if (gate.mode !== "off")
-                ledger.record(resp.entries, query);
-            // Return the compact `[id col]` index (capped) rather than JSON.stringify
-            // of the whole response — the wide-net recall text (~30k) otherwise blows
-            // the MCP per-result token cap and spills to a file. See formatRecallForAgent.
-            const index = formatRecallForAgent(resp, { query, maxChars });
-            if (gate.mode !== "off" && pendingBefore.length > 0) {
-                return okText(`${formatPendingBlock(pendingBefore, false)}\n\n${index}`);
-            }
-            return okText(index);
-        }
-        catch (e) {
-            return fail("ee_unavailable", e instanceof Error ? e.message : String(e));
-        }
-    });
-    server.registerTool("ee_feedback", {
-        description: "Rate an Experience Engine recall entry so the brain keeps what helped and prunes the rest. Call after " +
-            "acting on an ee_query result — once per `[id col]` you used or judged. verdict: 'followed' (you changed " +
-            "your approach because of it), 'ignored' (topical but did not apply this time), 'noise' (wrong by category — " +
-            "REQUIRES reason: wrong_repo | wrong_language | wrong_task | stale_rule). id may be a short prefix; the " +
-            "server resolves it. Clears the entry from this session's pending-feedback gate.",
-        inputSchema: {
-            id: z.string().min(1).max(200),
-            collection: z.string().min(1).max(200),
-            verdict: z.enum(["followed", "ignored", "noise"]),
-            reason: z.enum(["wrong_repo", "wrong_language", "wrong_task", "stale_rule"]).optional(),
-        },
-    }, async ({ id, collection, verdict, reason }) => {
-        if (verdict === "noise" && !reason) {
-            return fail("reason_required", "verdict 'noise' requires reason: wrong_repo | wrong_language | wrong_task | stale_rule");
-        }
-        const feedback = deps.feedback ?? ((pid, col, v, r) => import("../ee/search.js").then((m) => m.feedbackEE(pid, col, v, r)));
-        try {
-            const result = await feedback(id, collection, verdict, reason);
-            if (!result.ok) {
-                return fail("feedback_failed", result.error ?? "feedback POST failed");
-            }
-            // Clear by the server-resolved full id AND the (possibly short) id the
-            // agent passed, so a prefix-based call still settles the ledger debt.
-            const clearedId = result.resolvedId ?? id;
-            ledger.clear(clearedId);
-            ledger.clear(id);
-            return ok({
-                ok: true,
-                id: clearedId,
-                verdict: result.verdict,
-                ...(result.reason ? { reason: result.reason } : {}),
-                pendingRemaining: ledger.pendingCount(),
-            });
-        }
-        catch (e) {
-            return fail("feedback_failed", e instanceof Error ? e.message : String(e));
-        }
-    });
-    server.registerTool("ee_health", { description: "Check Experience Engine server reachability.", inputSchema: {} }, async () => {
-        try {
-            return ok(await health());
-        }
-        catch (e) {
-            return fail("ee_unavailable", e instanceof Error ? e.message : String(e));
-        }
-    });
-    server.registerTool("ee_write", {
-        description: "Save a NEW lesson to the Experience Engine brain so you and future sessions recall it. Call the MOMENT you " +
-            "hit a mistake / error / dead-end and find the working fix: record the pitfall AND the fix in one concise, " +
-            "generalizable lesson (1-3 sentences — what to do or avoid next time, NOT a play-by-play of this turn). The " +
-            "lesson is embedded immediately (via /api/import-memory: dense + sparse) and becomes recallable via ee_query " +
-            "in this and future sessions. Use ee_query first if unsure a lesson already exists. collection defaults to " +
-            "experience-behavioral (use experience-principles only for a broad, project-independent principle); project " +
-            "scopes the lesson.",
-        inputSchema: {
-            lesson: z.string().min(12).max(4000),
-            title: z.string().max(200).optional(),
-            collection: z.enum(["experience-behavioral", "experience-principles"]).optional(),
-            project: z.string().max(200).optional(),
-        },
-    }, async ({ lesson, title, collection, project }) => {
-        const trimmed = lesson.trim();
-        const text = trimmed.length > 1500 ? `${trimmed.slice(0, 1497)}...` : trimmed;
-        const targetCollection = collection ?? "experience-behavioral";
-        const write = deps.write ?? ((l, o) => import("../ee/search.js").then((m) => m.writeExperienceEE(l, o)));
-        try {
-            const result = await write(text, {
-                collection: targetCollection,
-                title,
-                projectSlug: project,
-                confidence: 0.65,
-            });
-            if (!result.ok)
-                return fail("write_failed", result.error ?? "import-memory POST failed");
-            return ok({ ok: true, id: result.id, collection: targetCollection, recallable: "now via ee_query" });
-        }
-        catch (e) {
-            return fail("write_failed", e instanceof Error ? e.message : String(e));
-        }
-    });
-}
-//# sourceMappingURL=ee-tools.js.map

package/dist/src/providers/auth/gcloud.d.ts

@@ -1,28 +0,0 @@
-/**
- * src/providers/auth/gcloud.ts
- *
- * Reads and refreshes tokens from Google Cloud SDK credentials
- * (~/.config/gcloud/application_default_credentials.json).
- *
- * The gcloud ADC token uses GCP's official OAuth client with cloud-platform
- * scopes, which IS accepted by generativelanguage.googleapis.com (unlike the
- * Agy OAuth token whose scope is restricted to cloudcode-pa).
- *
- * Usage:
- *   1. User runs `gcloud auth application-default login` once.
- *   2. This file reads the resulting credentials file, extracts the token,
- *      and returns it as an OAuthTokens-compatible object.
- *   3. The token auto-refreshes when expired (using the refresh_token inside
- *      the credentials file).
- */
-import type { OAuthTokens } from "./types.js";
-/**
- * Try to load a token from gcloud ADC.
- * Returns null if gcloud is not installed or no credentials exist.
- */
-export declare function loadGcloudToken(): Promise<OAuthTokens | null>;
-/**
- * Obtain auth headers from a gcloud-derived OAuthTokens.
- * Compatible with ProviderOAuth.authHeaders() signature.
- */
-export declare function gcloudAuthHeaders(tokens: OAuthTokens): Record<string, string>;

package/dist/src/providers/auth/gcloud.js

@@ -1,102 +0,0 @@
-/**
- * src/providers/auth/gcloud.ts
- *
- * Reads and refreshes tokens from Google Cloud SDK credentials
- * (~/.config/gcloud/application_default_credentials.json).
- *
- * The gcloud ADC token uses GCP's official OAuth client with cloud-platform
- * scopes, which IS accepted by generativelanguage.googleapis.com (unlike the
- * Agy OAuth token whose scope is restricted to cloudcode-pa).
- *
- * Usage:
- *   1. User runs `gcloud auth application-default login` once.
- *   2. This file reads the resulting credentials file, extracts the token,
- *      and returns it as an OAuthTokens-compatible object.
- *   3. The token auto-refreshes when expired (using the refresh_token inside
- *      the credentials file).
- */
-import { readFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { OAuthRefreshError } from "./types.js";
-// ---------------------------------------------------------------------------
-// Paths
-// ---------------------------------------------------------------------------
-const GCLOUD_ADC_PATH = join(homedir(), ".config", "gcloud", "application_default_credentials.json");
-// ---------------------------------------------------------------------------
-// Loader
-// ---------------------------------------------------------------------------
-/**
- * Load gcloud Application Default Credentials file.
- */
-async function loadADC() {
-    try {
-        const raw = await readFile(GCLOUD_ADC_PATH, "utf8");
-        const creds = JSON.parse(raw);
-        if (creds.type !== "authorized_user") {
-            // service-account keys have a different shape; skip
-            return null;
-        }
-        return creds;
-    }
-    catch {
-        return null;
-    }
-}
-// ---------------------------------------------------------------------------
-// Token exchange
-// ---------------------------------------------------------------------------
-/**
- * Exchange a gcloud refresh_token for a fresh access_token.
- * Google's OAuth token endpoint accepts gcloud ADC credentials.
- */
-async function exchangeRefreshToken(clientId, clientSecret, refreshToken) {
-    const body = new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        refresh_token: refreshToken,
-        grant_type: "refresh_token",
-    });
-    let res;
-    try {
-        res = await fetch("https://oauth2.googleapis.com/token", {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body,
-        });
-    }
-    catch (err) {
-        throw new OAuthRefreshError("google", `gcloud ADC refresh network error: ${err.message}`);
-    }
-    if (!res.ok) {
-        const text = await res.text().catch(() => "");
-        throw new OAuthRefreshError("google", `gcloud ADC refresh failed (${res.status}): ${text}`);
-    }
-    const data = (await res.json());
-    return {
-        accessToken: data.access_token,
-        refreshToken,
-        expiresAt: Date.now() + data.expires_in * 1000,
-    };
-}
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-/**
- * Try to load a token from gcloud ADC.
- * Returns null if gcloud is not installed or no credentials exist.
- */
-export async function loadGcloudToken() {
-    const creds = await loadADC();
-    if (!creds)
-        return null;
-    return exchangeRefreshToken(creds.client_id, creds.client_secret, creds.refresh_token);
-}
-/**
- * Obtain auth headers from a gcloud-derived OAuthTokens.
- * Compatible with ProviderOAuth.authHeaders() signature.
- */
-export function gcloudAuthHeaders(tokens) {
-    return { Authorization: `Bearer ${tokens.accessToken}` };
-}
-//# sourceMappingURL=gcloud.js.map

package/dist/src/providers/auth/gemini-oauth.d.ts

@@ -1,82 +0,0 @@
-/**
- * src/providers/auth/gemini-oauth.ts
- *
- * Agy (Antigravity) Google OAuth implementation.
- * Replaces the old abandoned public gemini-cli OAuth client.
- *
- * Uses client credentials extracted from the local agy.exe binary
- * (registered for agy's "oauth-personal" / Code Assist flow).
- *
- * Agy stores tokens in ~/.gemini/oauth_creds.json (legacy path).
- * We auto-import so existing agy logins continue to work.
- *
- * Override with MUONROI_GOOGLE_* env vars if needed.
- *
- * Note: Even though the provider ID is "google" (for model routing),
- * the OAuth registration and naming is now Agy.
- */
-import type { OAuthCallbackServer } from "../../mcp/oauth-callback.js";
-import type { FetchFn } from "./device-flow.js";
-import type { OAuthTokens, ProviderOAuth } from "./types.js";
-export type CallbackServerFn = (opts: {
-    onCode: (code: string, state: string) => void;
-    timeoutMs?: number;
-    host?: string;
-}) => Promise<OAuthCallbackServer>;
-export type OpenBrowserFn = (url: string) => void;
-export declare class AgyOAuthProvider implements ProviderOAuth {
-    readonly providerId: "google";
-    private clientId;
-    private clientSecret;
-    private readonly fetchFn;
-    private readonly callbackServerFn;
-    private readonly openBrowserFn;
-    private readonly mutex;
-    constructor(opts?: {
-        clientId?: string;
-        clientSecret?: string;
-        fetchFn?: FetchFn;
-        callbackServerFn?: CallbackServerFn;
-        openBrowserFn?: OpenBrowserFn;
-    });
-    login(opts?: {
-        onUserCode?: (code: string, url: string) => void;
-    }): Promise<OAuthTokens>;
-    refresh(tokens: OAuthTokens): Promise<OAuthTokens>;
-    revoke(tokens: OAuthTokens): Promise<void>;
-    authHeaders(tokens: OAuthTokens): Record<string, string>;
-    private _fetchUserEmail;
-}
-/** Back-compat for tests that still reference the old class name. */
-export { AgyOAuthProvider as GeminiOAuthProvider };
-/** Default Agy OAuth provider singleton (uses agy's Google client registration). */
-export declare const agyOAuth: AgyOAuthProvider;
-/** Back-compat alias (some code still references the old name). */
-export declare const geminiOAuth: AgyOAuthProvider;
-/**
- * Load stored OAuth tokens for the Google provider using Agy's registration.
- * - Auto-imports from ~/.gemini/oauth_creds.json (agy storage).
- * - Refreshes using the agy client/secret when near expiry.
- */
-export declare function loadAgyTokensWithRefresh(oauthProvider?: AgyOAuthProvider): Promise<OAuthTokens | null>;
-/** Back-compat alias for older call sites. */
-export declare const loadGeminiTokensWithRefresh: typeof loadAgyTokensWithRefresh;
-/**
- * Load a custom OAuth token using user-provided GCP OAuth client credentials.
- * Users register their own OAuth client in GCP Console → use these credentials
- * to obtain tokens with the `generativelanguage` scope (not restricted to
- * cloudcode-pa like the Agy client).
- *
- * Settings sources (in priority order):
- *   1. settings.json → providers → google → oauthClientId / oauthClientSecret
- *   2. MUONROI_GOOGLE_CLIENT_ID / MUONROI_GOOGLE_CLIENT_SECRET env vars
- *
- * Returns null when no custom client is configured.
- */
-export declare function loadCustomOAuthTokens(): Promise<OAuthTokens | null>;
-/**
- * Perform a full OAuth login with a custom client (Approach C).
- * Users run `keys login google` with their own GCP OAuth client configured
- * in settings → this opens the browser with the right scopes.
- */
-export declare function loginWithCustomClient(): Promise<OAuthTokens | null>;