muonroi-cli 1.8.5 → 1.9.0

package/dist/src/product-loop/types.d.ts

@@ -32,6 +32,10 @@ export interface IterationState {
     criteriaMet: number;
     criteriaPartial: number;
     criteriaUnmet: number;
+    /** Total criteria evaluated this sprint. Optional for back-compat with older
+     * persisted iterations; when present it fixes the phase-runner exit ratio + the
+     * sprint-review "met X/Y" count that previously read undefined. */
+    totalCriteria?: number;
     costUsd: number;
     lastVerifyResult: string;
     /** Alias of costUsd kept for circuit-breaker history adapters (CB-1 reads actualCost). */
@@ -40,6 +44,16 @@ export interface IterationState {
     score?: number;
     crashed?: boolean;
     retryOf?: number;
+    /**
+     * Carry-over focus for the NEXT sprint when this one did not satisfy the
+     * done-gate: the failed-condition focus (feedback-routing) plus any plan
+     * deviations that survived the adherence review. The phase-runner adapter
+     * threads this into the next sprint's `carryOver` so each iteration continues
+     * the specific unmet / risky parts instead of restarting blind — the mechanism
+     * behind "spawn to continue the risk parts → finished product after N sprints".
+     * Absent when the sprint passed.
+     */
+    nextFocus?: string;
 }
 export interface DoneVerdict {
     pass: boolean;
@@ -278,6 +292,17 @@ export interface ProjectContext {
     idea: string;
     detection: ExistingProjectSignals;
     context: DiscoveryContext;
+    /**
+     * Agent-driven interview output. When the gather phase runs the unified
+     * clarifier (the same LLM-generates-its-own-questions engine `/council`
+     * uses — see runGatherPhase), it produces a rich `ClarifiedSpec` directly
+     * instead of the fixed-question `DiscoveryContext`. Stashed here (plain data,
+     * JSON round-trips through project-context.md) so `clarifiedSpecFromContext`
+     * can return the real LLM-synthesized successCriteria/constraints/scope
+     * verbatim rather than re-deriving a thin 2-item spec from persona+scale.
+     * Absent on the legacy fixed-question path (MUONROI_IDEAL_AGENT_INTERVIEW=0).
+     */
+    clarified?: import("../council/types.js").ClarifiedSpec;
     recommendations: {
         byField: Record<string, RecommendationEntry>;
         constraints: {

package/dist/src/providers/anthropic.d.ts

@@ -2,16 +2,15 @@
  * src/providers/anthropic.ts
  *
  * Anthropic-only provider shell for Phase 0.
- * Implements TUI-02 (stub conversation), PROV-03 (BYOK keychain), PROV-07 (log redaction).
+ * Implements TUI-02 (stub conversation), PROV-03 (BYOK), PROV-07 (log redaction).
  *
- * Key loading priority:
- *   1. OS keychain via keytar (service="muonroi-cli", account="anthropic") — B-2: dynamic import
- *   2. ANTHROPIC_API_KEY env var — fallback with redacted warning
- *   3. AnthropicKeyMissingError — user-facing error with remediation instructions
+ * Key loading:
+ *   1. ANTHROPIC_API_KEY env var (the env-store loads ~/.muonroi-cli/.env into
+ *      process.env at startup; the real OS env also applies)
+ *   2. AnthropicKeyMissingError — user-facing error with remediation instructions
  *
  * Security invariants:
  *   - redactor.enrollSecret(key) is called BEFORE any log line that might contain the key.
- *   - keytar is loaded via dynamic import() so a missing/broken native module cannot crash boot.
  *   - Keys shorter than 20 characters are rejected early.
  *
  * Streaming (AI SDK v6 with @ai-sdk/anthropic):
@@ -32,13 +31,15 @@ export declare class AnthropicKeyMissingError extends Error {
     constructor();
 }
 /**
- * Load the Anthropic API key from the OS keychain first, then env var fallback.
+ * Load the Anthropic API key from the environment (the env-store loads
+ * `~/.muonroi-cli/.env` into process.env at startup; the real OS env also
+ * applies).
  *
  * Security contract:
  *   - redactor.enrollSecret(key) is called BEFORE any subsequent log line.
  *   - Keys < 20 chars are rejected (T-00.05-05: truncated key guard).
  *
- * @throws {AnthropicKeyMissingError} when both keychain and env var are absent.
+ * @throws {AnthropicKeyMissingError} when no ANTHROPIC_API_KEY is present.
  */
 export declare function loadAnthropicKey(): Promise<string>;
 /**

package/dist/src/providers/anthropic.js

@@ -2,16 +2,15 @@
  * src/providers/anthropic.ts
  *
  * Anthropic-only provider shell for Phase 0.
- * Implements TUI-02 (stub conversation), PROV-03 (BYOK keychain), PROV-07 (log redaction).
+ * Implements TUI-02 (stub conversation), PROV-03 (BYOK), PROV-07 (log redaction).
  *
- * Key loading priority:
- *   1. OS keychain via keytar (service="muonroi-cli", account="anthropic") — B-2: dynamic import
- *   2. ANTHROPIC_API_KEY env var — fallback with redacted warning
- *   3. AnthropicKeyMissingError — user-facing error with remediation instructions
+ * Key loading:
+ *   1. ANTHROPIC_API_KEY env var (the env-store loads ~/.muonroi-cli/.env into
+ *      process.env at startup; the real OS env also applies)
+ *   2. AnthropicKeyMissingError — user-facing error with remediation instructions
  *
  * Security invariants:
  *   - redactor.enrollSecret(key) is called BEFORE any log line that might contain the key.
- *   - keytar is loaded via dynamic import() so a missing/broken native module cannot crash boot.
  *   - Keys shorter than 20 characters are rejected early.
  *
  * Streaming (AI SDK v6 with @ai-sdk/anthropic):
@@ -43,58 +42,25 @@ export class AnthropicKeyMissingError extends Error {
         this.name = "AnthropicKeyMissingError";
     }
 }
+// ---------------------------------------------------------------------------
+// Key loader
+// ---------------------------------------------------------------------------
 /**
- * Dynamic keytar loader — B-2 mitigation.
- * A missing or broken keytar native module (common on minimal Linux environments)
- * must NOT crash process boot. The env-var fallback path is always available.
- */
-async function loadKeytar() {
-    try {
-        // keytar exports named functions directly (no default export)
-        const mod = await import("keytar");
-        return mod;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Load the Anthropic API key from the OS keychain first, then env var fallback.
+ * Load the Anthropic API key from the environment (the env-store loads
+ * `~/.muonroi-cli/.env` into process.env at startup; the real OS env also
+ * applies).
  *
  * Security contract:
  *   - redactor.enrollSecret(key) is called BEFORE any subsequent log line.
  *   - Keys < 20 chars are rejected (T-00.05-05: truncated key guard).
  *
- * @throws {AnthropicKeyMissingError} when both keychain and env var are absent.
+ * @throws {AnthropicKeyMissingError} when no ANTHROPIC_API_KEY is present.
  */
 export async function loadAnthropicKey() {
-    // --- Primary: OS keychain via dynamic import (B-2) ---
-    const keytarMod = await loadKeytar();
-    if (keytarMod) {
-        try {
-            const key = await keytarMod.getPassword("muonroi-cli", "anthropic");
-            if (key && key.length >= 20) {
-                // Enroll BEFORE any log that might emit the key
-                redactor.enrollSecret(key);
-                return key;
-            }
-        }
-        catch (err) {
-            // keytar present but backend unavailable (e.g. Linux without libsecret/dbus)
-            console.warn("[muonroi-cli] keytar backend unavailable, falling back to env var:", redactor.redactError(err));
-        }
-    }
-    else {
-        console.warn("[muonroi-cli] keytar module not installed — using env-var path. " +
-            "Install keytar to enable OS keychain key storage.");
-    }
-    // --- Fallback: ANTHROPIC_API_KEY environment variable ---
     const envKey = process.env.ANTHROPIC_API_KEY;
     if (envKey && envKey.length >= 20) {
-        // Enroll BEFORE the warning that mentions we're using env path
+        // Enroll BEFORE any log that might mention the key path.
         redactor.enrollSecret(envKey);
-        console.warn("[muonroi-cli] Using ANTHROPIC_API_KEY from environment. " +
-            "Prefer storing the key in your OS keychain (Phase 1 `muonroi-cli login` helper).");
         return envKey;
     }
     throw new AnthropicKeyMissingError();

package/dist/src/providers/auth/grok-oauth.d.ts

@@ -49,6 +49,7 @@ export declare class GrokOAuthProvider implements ProviderOAuth {
     });
     login(opts?: {
         onUserCode?: (code: string, url: string) => void;
+        signal?: AbortSignal;
     }): Promise<OAuthTokens>;
     refresh(tokens: OAuthTokens): Promise<OAuthTokens>;
     revoke(tokens: OAuthTokens): Promise<void>;

package/dist/src/providers/auth/grok-oauth.js

@@ -114,6 +114,7 @@ export class GrokOAuthProvider {
         const state = randomBytes(16).toString("base64url");
         const nonce = randomBytes(16).toString("base64url");
         let callbackServer;
+        let manualPasteRl;
         let authCode;
         let receivedState = "";
         try {
@@ -125,6 +126,19 @@ export class GrokOAuthProvider {
                 const loginTimeout = setTimeout(() => {
                     reject(new Error("OAuth browser callback timed out"));
                 }, CALLBACK_TIMEOUT_MS);
+                // Cancelling must END the flow, not just abandon it: the `finally`
+                // below is what closes the loopback server (and the readline), and an
+                // abandoned server holds its port for the full callback timeout, so the
+                // next sign-in cannot bind.
+                const onAbort = () => {
+                    clearTimeout(loginTimeout);
+                    reject(new OAuthLoginError("xai", "Sign-in cancelled."));
+                };
+                if (opts.signal?.aborted) {
+                    onAbort();
+                    return;
+                }
+                opts.signal?.addEventListener("abort", onAbort, { once: true });
                 this.callbackServerFn({
                     onCode: (code, s) => {
                         receivedState = s;
@@ -146,15 +160,23 @@ export class GrokOAuthProvider {
                     });
                     opts.onUserCode?.(authorizeUrl, authorizeUrl);
                     this.openBrowserFn(authorizeUrl);
-                    // Simple manual token/code input fallback (when redirect fails and xAI page shows a code)
-                    if (process.stdin.isTTY) {
-                        const rl = readline.createInterface({ input: process.stdin });
+                    // Manual code-paste fallback (xAI's page sometimes shows a code
+                    // instead of redirecting to the loopback URI).
+                    //
+                    // CLI only. `isRaw` means another consumer already owns stdin —
+                    // inside the TUI that is OpenTUI's key handler. Attaching a readline
+                    // there stole every keystroke, and on the normal HTTP-callback path
+                    // it was never closed, so the TUI kept receiving nothing: Esc did
+                    // not dismiss the provider dialog and only restarting the session
+                    // recovered it. The console.log pair also printed into the TUI's
+                    // alternate screen. Both are correct for `keys login`, wrong here.
+                    if (process.stdin.isTTY && !process.stdin.isRaw) {
+                        manualPasteRl = readline.createInterface({ input: process.stdin });
                         console.log('  If the xAI page shows a code ("Could not establish connection") instead of redirecting,');
                         console.log("  copy the code and paste it here then press Enter:");
-                        rl.on("line", (line) => {
+                        manualPasteRl.on("line", (line) => {
                             const c = line.trim();
                             if (c.length > 30) {
-                                rl.close();
                                 clearTimeout(loginTimeout);
                                 resolve(c);
                             }
@@ -174,6 +196,9 @@ export class GrokOAuthProvider {
         }
         finally {
             callbackServer?.close();
+            // Unconditional: the old code only closed this when the user actually
+            // pasted a code, so the normal HTTP-callback path left stdin captured.
+            manualPasteRl?.close();
         }
         if (receivedState && receivedState !== state) {
             throw new OAuthLoginError("xai", "OAuth state mismatch — possible CSRF, aborting.");

package/dist/src/providers/auth/openai-oauth.d.ts

@@ -50,6 +50,7 @@ export declare class OpenAIOAuthProvider implements ProviderOAuth {
     });
     login(opts?: {
         onUserCode?: (code: string, url: string) => void;
+        signal?: AbortSignal;
     }): Promise<OAuthTokens>;
     refresh(tokens: OAuthTokens): Promise<OAuthTokens>;
     revoke(tokens: OAuthTokens): Promise<void>;

package/dist/src/providers/auth/openai-oauth.js

@@ -117,6 +117,20 @@ export class OpenAIOAuthProvider {
                 const loginTimeout = setTimeout(() => {
                     reject(new Error("OAuth browser callback timed out"));
                 }, CALLBACK_TIMEOUT_MS);
+                // Cancelling used to abandon this promise rather than end it: the
+                // loopback server then held its port for the full CALLBACK_TIMEOUT_MS
+                // (5 min) across only two ports, so the next sign-in could not bind and
+                // the user had to restart the CLI. Rejecting here runs the `finally`
+                // below, which closes the server and frees the port immediately.
+                const onAbort = () => {
+                    clearTimeout(loginTimeout);
+                    reject(new OAuthLoginError("openai", "Sign-in cancelled."));
+                };
+                if (opts.signal?.aborted) {
+                    onAbort();
+                    return;
+                }
+                opts.signal?.addEventListener("abort", onAbort, { once: true });
                 const tryPorts = async () => {
                     let bindError;
                     for (const port of CODEX_PORTS) {

package/dist/src/providers/auth/token-store.d.ts

@@ -2,10 +2,8 @@
  * src/providers/auth/token-store.ts
  *
  * Persistent store for provider OAuth tokens.
- * Primary:  OS keychain via keytar (same loader as keychain.ts).
- *           Account key: `oauth:<provider>`, service: "muonroi-cli".
- *           Value: JSON-serialized OAuthTokens.
- * Fallback: ~/.muonroi-cli/auth/<provider>.json, mode 0600.
+ * Storage: ~/.muonroi-cli/auth/<provider>.json, mode 0600 (JSON-serialized
+ *          OAuthTokens). The OS keychain (keytar) has been removed.
  *
  * All token fields are enrolled in the redactor immediately after load.
  */
@@ -14,15 +12,17 @@ import type { OAuthTokens } from "./types.js";
  * Enroll all token secrets so they are scrubbed from logs.
  */
 export declare function enrollTokensInRedactor(tokens: OAuthTokens): void;
+/**
+ * Persist OAuth tokens for a provider to ~/.muonroi-cli/auth/<provider>.json
+ * (mode 0600).
+ */
 export declare function saveTokens(provider: string, tokens: OAuthTokens): Promise<void>;
 /**
- * Load OAuth tokens for a provider.
- * Returns null if no tokens are stored.
- * Enrolled in redactor on load.
+ * Load OAuth tokens for a provider from the 0600 file store.
+ * Returns null if no tokens are stored. Enrolled in redactor on load.
  */
 export declare function loadTokens(provider: string): Promise<OAuthTokens | null>;
 /**
- * Delete stored OAuth tokens for a provider.
- * Attempts both keychain and file removal (either may or may not exist).
+ * Delete stored OAuth tokens for a provider (removes the 0600 file).
  */
 export declare function deleteTokens(provider: string): Promise<void>;

package/dist/src/providers/auth/token-store.js

@@ -2,10 +2,8 @@
  * src/providers/auth/token-store.ts
  *
  * Persistent store for provider OAuth tokens.
- * Primary:  OS keychain via keytar (same loader as keychain.ts).
- *           Account key: `oauth:<provider>`, service: "muonroi-cli".
- *           Value: JSON-serialized OAuthTokens.
- * Fallback: ~/.muonroi-cli/auth/<provider>.json, mode 0600.
+ * Storage: ~/.muonroi-cli/auth/<provider>.json, mode 0600 (JSON-serialized
+ *          OAuthTokens). The OS keychain (keytar) has been removed.
  *
  * All token fields are enrolled in the redactor immediately after load.
  */
@@ -13,10 +11,6 @@ import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { redactor } from "../../utils/redactor.js";
-const KEYCHAIN_SERVICE = "muonroi-cli";
-function oauthAccount(provider) {
-    return `oauth:${provider}`;
-}
 /**
  * Override for tests — set process.env.MUONROI_AUTH_DIR to point at a temp dir.
  */
@@ -38,71 +32,24 @@ export function enrollTokensInRedactor(tokens) {
     if (tokens.idToken)
         redactor.enrollSecret(tokens.idToken);
 }
-async function loadKeytar() {
-    try {
-        return (await import("keytar"));
-    }
-    catch {
-        return null;
-    }
-}
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
 /**
- * Persist OAuth tokens for a provider.
- * Tries keychain first; falls back to filesystem (0600).
+ * Persist OAuth tokens for a provider to ~/.muonroi-cli/auth/<provider>.json
+ * (mode 0600).
  */
-// Windows Credential Manager's stub rejects credentials larger than ~2.5 KiB
-// with "The stub received bad data" — OAuth blobs routinely exceed that, so
-// for anything over this threshold we skip keytar and go straight to the
-// file fallback (mode 0600).
-const KEYCHAIN_BLOB_LIMIT_BYTES = 2000;
 export async function saveTokens(provider, tokens) {
     enrollTokensInRedactor(tokens);
     const json = JSON.stringify(tokens);
-    // Try keytar only for payloads small enough that Credential Manager will
-    // accept them. For larger blobs, write to the 0600 file fallback directly.
-    if (json.length <= KEYCHAIN_BLOB_LIMIT_BYTES) {
-        const kt = await loadKeytar();
-        if (kt) {
-            try {
-                await kt.setPassword(KEYCHAIN_SERVICE, oauthAccount(provider), json);
-                return;
-            }
-            catch {
-                // Keychain write failed (locked keyring, Credential Manager stub, etc.)
-                // — fall through to the 0600 file fallback below. Never console.* here:
-                // the TUI captures console output and OpenTUI's openConsoleOnError would
-                // pop an un-dismissable overlay.
-            }
-        }
-    }
     await mkdir(fallbackDir(), { recursive: true });
     await writeFile(fallbackPath(provider), json, { mode: 0o600, encoding: "utf8" });
 }
 /**
- * Load OAuth tokens for a provider.
- * Returns null if no tokens are stored.
- * Enrolled in redactor on load.
+ * Load OAuth tokens for a provider from the 0600 file store.
+ * Returns null if no tokens are stored. Enrolled in redactor on load.
  */
 export async function loadTokens(provider) {
-    // Try keychain first
-    const kt = await loadKeytar();
-    if (kt) {
-        try {
-            const raw = await kt.getPassword(KEYCHAIN_SERVICE, oauthAccount(provider));
-            if (raw) {
-                const tokens = JSON.parse(raw);
-                enrollTokensInRedactor(tokens);
-                return tokens;
-            }
-        }
-        catch {
-            // fall through to file
-        }
-    }
-    // Try file fallback
     try {
         const raw = await readFile(fallbackPath(provider), "utf8");
         const tokens = JSON.parse(raw);
@@ -110,23 +57,14 @@ export async function loadTokens(provider) {
         return tokens;
     }
     catch {
+        // Missing/unreadable file → no tokens stored.
         return null;
     }
 }
 /**
- * Delete stored OAuth tokens for a provider.
- * Attempts both keychain and file removal (either may or may not exist).
+ * Delete stored OAuth tokens for a provider (removes the 0600 file).
  */
 export async function deleteTokens(provider) {
-    const kt = await loadKeytar();
-    if (kt) {
-        try {
-            await kt.deletePassword(KEYCHAIN_SERVICE, oauthAccount(provider));
-        }
-        catch {
-            // ignore
-        }
-    }
     try {
         await unlink(fallbackPath(provider));
     }

package/dist/src/providers/auth/types.d.ts

@@ -26,8 +26,16 @@ export interface ProviderOAuth {
      * Calls onUserCode with the human-readable code + verification URL so the
      * caller can display them to the user before polling.
      */
+    /**
+     * `signal` aborts an in-flight sign-in. Browser flows bind a loopback
+     * callback server on a fixed, tiny port set; without an abort the server
+     * outlives a cancelled sign-in for the full callback timeout and the next
+     * attempt cannot bind — which reads to the user as "OAuth is broken until I
+     * restart the CLI".
+     */
     login(opts: {
         onUserCode?: (code: string, url: string) => void;
+        signal?: AbortSignal;
     }): Promise<OAuthTokens>;
     /**
      * Exchange a refresh token for new tokens.

package/dist/src/providers/env-store.d.ts

@@ -0,0 +1,17 @@
+export declare function envFilePath(): string;
+/**
+ * Upsert `name=value` in the `.env` store, set `process.env[name]` for the
+ * current process, and (on Windows) mirror to the User registry env.
+ */
+export declare function persistEnvVar(name: string, value: string): void;
+/** Remove `name` from the `.env` store, `process.env`, and Windows registry. */
+export declare function clearEnvVar(name: string): void;
+/**
+ * Load the `.env` store into `process.env` at startup.
+ *
+ * For ordinary variables the ambient OS environment stays authoritative and
+ * `.env` only fills gaps. For `*_API_KEY` credentials the CLI writes itself,
+ * `.env` wins and the conflict is logged — see {@link ambientWinsForSecrets}
+ * for why, and `MUONROI_ENV_PRECEDENCE=ambient` to opt out.
+ */
+export declare function loadEnvFileIntoProcess(): void;