praxis-agent 0.43.1 → 0.45.0

package/dist/maintenance/doctor.js

@@ -7,9 +7,13 @@ import { validateClaudeHooks } from '../hooks/claude-hooks.js';
 import { validateClaudeMcpConfiguration } from '../mcp/claude-mcp-tools.js';
 import { loadClaudeAutoModeConfig } from '../permissions/claude-auto-classifier.js';
 import { ClaudePermissionResolver, validateClaudePermissionSettings, } from '../permissions/claude-permission-resolver.js';
-import { readPluginRegistry, validateClaudePlugin, } from '../plugins/claude-plugin-runtime.js';
+import { loadClaudePlugins, readPluginRegistry, validateClaudePlugin, } from '../plugins/claude-plugin-runtime.js';
+import { assessWorkspaceTrust, hasWorkspaceProviderSelection, workspaceTrustInventory, } from '../security/workspace-trust.js';
 import { loadNativeContextResources, loadNativeSettings, loadNativeSharedResources, } from '../persistence/native-resources.js';
 import { parseContextEnvironment, parseProviderEnvironment, } from '../providers/environment.js';
+import { resolveProviderCredential } from '../providers/provider-auth.js';
+import { ProviderCredentialVault } from '../persistence/provider-credential-vault.js';
+import { resolveProviderTarget } from '../providers/provider-settings.js';
 import { ContextBudget } from '../core/context-budget.js';
 import { ModelPricingRegistry } from '../core/usage.js';
 import { redactSensitiveText, sensitiveEnvironmentValues, } from '../platform/sensitive-data.js';
@@ -127,6 +131,7 @@ async function capture(id, operation) {
 export async function runDoctor(options) {
     const configRoot = resolve(options.configRoot);
     const cwd = resolve(options.cwd);
+    const claudeStatePath = resolve(options.claudeStatePath ?? resolve(configRoot, 'state.json'));
     const sensitiveValues = sensitiveEnvironmentValues(options.environment);
     const diagnosticOptions = {
         version: options.version,
@@ -163,6 +168,32 @@ export async function runDoctor(options) {
         });
         return nativeResources;
     };
+    const providerTrustAssessment = async () => {
+        const shared = await loadNativeSharedResources({
+            root: configRoot,
+            cwd,
+            environment: options.environment,
+            includeProjectMemory: false,
+        });
+        const plugins = await loadClaudePlugins({
+            configRoot,
+            cwd,
+            pluginDirectories: [],
+            pluginUrls: [],
+            loadInstalled: true,
+            readOnlyExecutables: true,
+            environment: options.environment,
+        });
+        const settings = [...shared.settings, ...plugins.settings];
+        if (!hasWorkspaceProviderSelection(settings))
+            return false;
+        const assessment = await assessWorkspaceTrust(await workspaceTrustInventory({
+            cwd,
+            settings,
+            mcp: [...shared.mcp, ...plugins.mcp],
+        }), claudeStatePath);
+        return assessment.status === 'trusted';
+    };
     const checks = [];
     checks.push(await capture('installation', async () => {
         const executablePath = await canonicalExecutable(options.executablePath);
@@ -197,17 +228,19 @@ export async function runDoctor(options) {
         };
     }));
     checks.push(await capture('provider', async () => {
-        const provider = parseProviderEnvironment(options.environment);
+        const target = await resolveProviderTarget({
+            configRoot,
+            cwd,
+            environment: options.environment,
+            includeProjectSettings: await providerTrustAssessment(),
+        });
+        const controlsEnvironment = {
+            ...options.environment,
+            PRAXIS_PROVIDER: target.protocol === 'anthropic-messages' ? 'anthropic' : 'openai',
+            PRAXIS_BASE_URL: target.baseUrl,
+        };
+        const provider = parseProviderEnvironment(controlsEnvironment);
         parseContextEnvironment(options.environment);
-        const apiKey = options.environment.PRAXIS_API_KEY;
-        const model = options.environment.PRAXIS_MODEL;
-        if (!apiKey || apiKey.trim().length === 0) {
-            throw new Error('PRAXIS_API_KEY is required');
-        }
-        if (!model || model.trim().length === 0) {
-            throw new Error('PRAXIS_MODEL is required');
-        }
-        const baseUrl = safeBaseUrl(provider.baseUrl);
         const contextWindow = options.environment.PRAXIS_CONTEXT_WINDOW_TOKENS;
         const contextReserve = options.environment.PRAXIS_CONTEXT_RESERVE_TOKENS;
         if (contextWindow !== undefined) {
@@ -220,19 +253,64 @@ export async function runDoctor(options) {
                     : { reserveTokens: parsedReserve }),
             });
         }
-        const pricing = ModelPricingRegistry.fromEnvironment(options.environment.PRAXIS_PRICING_JSON);
-        const pricingDiagnosis = pricing.diagnose(model.trim());
-        const knownPricing = pricingDiagnosis.source !== 'unknown';
+        const vault = new ProviderCredentialVault({
+            configRoot,
+            environment: options.environment,
+        });
+        const credential = await resolveProviderCredential({
+            target,
+            environment: options.environment,
+            vault,
+            commandRunner: async () => ({
+                stdout: '__praxis_doctor_credential_placeholder__',
+                exitCode: 0,
+            }),
+        });
+        const pricingDiagnosis = (() => {
+            if (target.billingMode !== 'api')
+                return undefined;
+            return ModelPricingRegistry.fromEnvironment(options.environment.PRAXIS_PRICING_JSON).diagnose(target.modelId);
+        })();
+        const helperSkipped = credential.source.source === 'command';
+        const safeCredential = {
+            type: credential.type,
+            source: credential.source.source,
+            ...(credential.source.source === 'env'
+                ? { name: credential.source.name }
+                : {}),
+            ...(credential.type === 'oauth'
+                ? {
+                    expiry: credential.expiresAt > Date.now()
+                        ? 'valid'
+                        : 'expired',
+                }
+                : {}),
+        };
+        const warnings = [
+            ...(helperSkipped
+                ? ['credential helper execution was intentionally skipped']
+                : []),
+            ...(pricingDiagnosis?.source === 'unknown'
+                ? ['model pricing is unavailable and fail-closed']
+                : []),
+        ];
         return {
-            ...(knownPricing ? {} : { status: 'warn' }),
-            summary: knownPricing
-                ? `${provider.provider} provider environment is valid; model pricing is ${pricingDiagnosis.source}`
-                : `${provider.provider} provider environment is valid; model pricing is unavailable and fail-closed`,
+            ...(warnings.length === 0 ? {} : { status: 'warn' }),
+            summary: warnings.length === 0
+                ? `${target.providerId} provider target is valid`
+                : `${target.providerId} provider target is valid; ${warnings.join('; ')}`,
             details: {
-                provider: provider.provider,
-                model,
-                baseUrl,
-                pricing: pricingDiagnosis,
+                provider: target.providerId,
+                profile: target.profileId,
+                model: target.modelId,
+                protocol: target.protocol,
+                baseUrl: safeBaseUrl(provider.baseUrl),
+                billingMode: target.billingMode,
+                experimental: target.experimental,
+                credential: safeCredential,
+                ...(pricingDiagnosis === undefined
+                    ? {}
+                    : { pricing: pricingDiagnosis }),
             },
         };
     }));

package/dist/persistence/provider-credential-vault.d.ts

@@ -0,0 +1,72 @@
+export declare class ProviderKeychainUnavailableError extends Error {
+    constructor();
+}
+export interface ProviderCredentialKey {
+    providerId: string;
+    profileId: string;
+}
+export interface ApiKeyCredential {
+    type: 'api-key';
+    secret: string;
+    revision: number;
+    updatedAt: string;
+}
+export interface ApiKeyCredentialInput {
+    type: 'api-key';
+    secret: string;
+}
+export interface OAuthCredential {
+    type: 'oauth';
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    accountId?: string;
+    revision: number;
+    updatedAt: string;
+}
+export interface OAuthCredentialInput {
+    type: 'oauth';
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    accountId?: string;
+}
+export type ProviderCredentialRecord = ApiKeyCredential | OAuthCredential;
+export type ProviderCredentialInput = ApiKeyCredentialInput | OAuthCredentialInput;
+export interface ProviderCredentialMetadata {
+    key: ProviderCredentialKey;
+    type: ProviderCredentialRecord['type'];
+    revision: number;
+    updatedAt: string;
+    expiresAt?: number;
+}
+export interface ProviderCredentialKeychainAdapter {
+    read(service: string): Promise<string | undefined>;
+    write(service: string, serializedEnvelope: string): Promise<void>;
+    delete(service: string): Promise<void>;
+}
+export interface ProviderCredentialVaultOptions {
+    configRoot: string;
+    useKeychain?: boolean;
+    keychain?: ProviderCredentialKeychainAdapter;
+    environment?: Readonly<Record<string, string | undefined>>;
+}
+export declare function providerCredentialFilePath(configRoot: string): string;
+export declare function providerCredentialService(configRoot: string): string;
+export declare class ProviderCredentialVault {
+    private readonly root;
+    private readonly file;
+    private readonly useKeychain;
+    private readonly service;
+    private readonly keychain;
+    private readonly lease;
+    constructor(options: ProviderCredentialVaultOptions);
+    read(key: ProviderCredentialKey): Promise<ProviderCredentialRecord | undefined>;
+    list(): Promise<ProviderCredentialMetadata[]>;
+    modify(key: ProviderCredentialKey, callback: (current: ProviderCredentialRecord | undefined) => ProviderCredentialInput | undefined | Promise<ProviderCredentialInput | undefined>): Promise<ProviderCredentialRecord | undefined>;
+    delete(key: ProviderCredentialKey): Promise<void>;
+    private readReconciled;
+    private persist;
+    private acquire;
+}
+//# sourceMappingURL=provider-credential-vault.d.ts.map