winter-super-cli 2026.5.26 → 2026.5.27

package/src/cli/config.js

@@ -6,24 +6,51 @@
 import { promises as fs } from 'fs';
 import path from 'path';
 import { homedir } from 'os';
+import { loadEnvFile, stripInlineSecrets } from './secret-env.js';
 
 export class ConfigLoader {
   constructor() {
     this.winterDir = path.join(homedir(), '.winter');
     this.configFile = path.join(this.winterDir, 'winter.json');
+    this.envFile = path.join(this.winterDir, 'secrets.env');
   }
 
   async load() {
     try {
       await fs.mkdir(this.winterDir, { recursive: true });
+      await loadEnvFile(this.envFile);
       const data = await fs.readFile(this.configFile, 'utf8');
-      return JSON.parse(data);
+      const config = JSON.parse(data);
+      return this.applyEnv(config);
     } catch {
       // Return defaults
-      return this.getDefaults();
+      await loadEnvFile(this.envFile);
+      return this.applyEnv(this.getDefaults());
     }
   }
 
+  applyEnv(config) {
+    const next = structuredClone(config || this.getDefaults());
+    for (const [provider, section] of Object.entries(next)) {
+      if (!section || typeof section !== 'object' || Array.isArray(section)) continue;
+      const apiKeyEnv = section.apiKeyEnv;
+      const authTokenEnv = section.authTokenEnv;
+      if (apiKeyEnv && process.env[apiKeyEnv]) {
+        section.apiKey = process.env[apiKeyEnv];
+      } else if (apiKeyEnv && typeof apiKeyEnv === 'string' && apiKeyEnv.trim() && !/^[A-Z_][A-Z0-9_]*$/i.test(apiKeyEnv.trim())) {
+        // Fallback: if apiKeyEnv contains a raw key value (not an env var name), use it directly
+        section.apiKey = apiKeyEnv;
+      }
+      if (authTokenEnv && process.env[authTokenEnv]) {
+        section.authToken = process.env[authTokenEnv];
+      } else if (authTokenEnv && typeof authTokenEnv === 'string' && authTokenEnv.trim() && !/^[A-Z_][A-Z0-9_]*$/i.test(authTokenEnv.trim())) {
+        // Fallback: if authTokenEnv contains a raw token value (not an env var name), use it directly
+        section.authToken = authTokenEnv;
+      }
+    }
+    return next;
+  }
+
   getDefaults() {
     return {
       defaultProvider: 'ollama',
@@ -31,12 +58,36 @@ export class ConfigLoader {
         current: '',
         lastOpenedAt: '',
       },
+      permissions: {
+        promptByDefault: true,
+        allowlist: {
+          tools: ['Read', 'Glob', 'Grep', 'LSP', 'TaskCreate', 'TaskUpdate', 'TaskList', 'WebFetch', 'WebSearch', 'Parallel'],
+          commands: [],
+          mcpServers: [],
+        },
+      },
+      mcp: {
+        servers: [],
+      },
+      routing: {
+        strategy: 'heuristic',
+        fastModel: '',
+        deepModel: '',
+      },
+      reliability: {
+        retryAttempts: 3,
+        retryBaseDelayMs: 100,
+      },
+      analytics: {
+        enabled: true,
+        toolUsage: true,
+      },
       anthropic: {
-        apiKey: '',
+        apiKeyEnv: 'ANTHROPIC_API_KEY',
         model: 'claude-sonnet-4-20250514',
       },
       openai: {
-        apiKey: '',
+        apiKeyEnv: 'OPENAI_API_KEY',
         model: 'gpt-4-turbo',
       },
       ollama: {
@@ -44,7 +95,7 @@ export class ConfigLoader {
         model: 'llama3',
       },
       groq: {
-        apiKey: '',
+        apiKeyEnv: 'GROQ_API_KEY',
         model: 'llama-3.1-70b-versatile',
       },
       sandbox: {
@@ -60,7 +111,7 @@ export class ConfigLoader {
 
   async save(config) {
     await fs.mkdir(this.winterDir, { recursive: true });
-    await fs.writeFile(this.configFile, JSON.stringify(config, null, 2));
+    await fs.writeFile(this.configFile, JSON.stringify(stripInlineSecrets(config), null, 2));
   }
 
   get(key, defaultValue = null) {
@@ -79,10 +130,76 @@ export class ConfigLoader {
   async setProviderApiKey(provider, apiKey) {
     const config = await this.load();
     config[provider] = config[provider] || {};
-    config[provider].apiKey = apiKey;
+    const envName = config[provider].apiKeyEnv || `WINTER_${String(provider).toUpperCase()}_API_KEY`;
+    config[provider].apiKeyEnv = envName;
+    await this.appendSecretEnv(envName, apiKey);
     await this.save(config);
   }
 
+  async appendSecretEnv(key, value) {
+    await fs.mkdir(this.winterDir, { recursive: true });
+    let current = '';
+    try {
+      current = await fs.readFile(this.envFile, 'utf8');
+    } catch {}
+    const lines = current.split(/\r?\n/).filter(line => line.trim() && !line.startsWith(`${key}=`));
+    lines.push(`${key}=${String(value || '').replace(/\r?\n/g, '')}`);
+    await fs.writeFile(this.envFile, `${lines.join('\n')}\n`, 'utf8');
+    process.env[key] = String(value || '');
+  }
+
+  async backupConfig(label = 'manual') {
+    await fs.mkdir(path.join(this.winterDir, 'backups'), { recursive: true });
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const backupPath = path.join(this.winterDir, 'backups', `winter-${label}-${timestamp}.json`);
+    try {
+      const raw = await fs.readFile(this.configFile, 'utf8');
+      await fs.writeFile(backupPath, raw, 'utf8');
+      return backupPath;
+    } catch {
+      await fs.writeFile(backupPath, JSON.stringify(this.getDefaults(), null, 2), 'utf8');
+      return backupPath;
+    }
+  }
+
+  async restoreConfig(backupPath) {
+    if (!backupPath) throw new Error('backupPath is required');
+    const raw = await fs.readFile(backupPath, 'utf8');
+    JSON.parse(raw);
+    await fs.mkdir(this.winterDir, { recursive: true });
+    await fs.writeFile(this.configFile, raw, 'utf8');
+  }
+
+  async migrateSecrets() {
+    await fs.mkdir(this.winterDir, { recursive: true });
+    const backupPath = await this.backupConfig('pre-secret-migration');
+    let rawConfig;
+    try {
+      rawConfig = JSON.parse(await fs.readFile(this.configFile, 'utf8'));
+    } catch {
+      rawConfig = this.getDefaults();
+    }
+
+    for (const [provider, section] of Object.entries(rawConfig)) {
+      if (!section || typeof section !== 'object' || Array.isArray(section)) continue;
+      if (typeof section.apiKey === 'string' && section.apiKey) {
+        const envName = section.apiKeyEnv || `WINTER_${String(provider).toUpperCase()}_API_KEY`;
+        await this.appendSecretEnv(envName, section.apiKey);
+        section.apiKeyEnv = envName;
+        delete section.apiKey;
+      }
+      if (typeof section.authToken === 'string' && section.authToken) {
+        const envName = section.authTokenEnv || `WINTER_${String(provider).toUpperCase()}_AUTH_TOKEN`;
+        await this.appendSecretEnv(envName, section.authToken);
+        section.authTokenEnv = envName;
+        delete section.authToken;
+      }
+    }
+
+    await this.save(rawConfig);
+    return { backupPath, envFile: this.envFile };
+  }
+
   async setDefaultProvider(provider) {
     const config = await this.load();
     config.defaultProvider = provider;
@@ -103,4 +220,43 @@ export class ConfigLoader {
     config.project.lastOpenedAt = new Date().toISOString();
     await this.save(config);
   }
+
+  async setPermissionAllowlist(allowlist = {}) {
+    const config = await this.load();
+    config.permissions = config.permissions || { allowlist: {} };
+    config.permissions.allowlist = {
+      tools: [...new Set([...(config.permissions.allowlist.tools || []), ...(allowlist.tools || [])])],
+      commands: [...new Set([...(config.permissions.allowlist.commands || []), ...(allowlist.commands || [])])],
+      mcpServers: [...new Set([...(config.permissions.allowlist.mcpServers || []), ...(allowlist.mcpServers || [])])],
+    };
+    if (allowlist.promptByDefault !== undefined) {
+      config.permissions.promptByDefault = Boolean(allowlist.promptByDefault);
+    }
+    await this.save(config);
+  }
+
+  async setMcpServers(servers = []) {
+    const config = await this.load();
+    config.mcp = config.mcp || {};
+    config.mcp.servers = Array.isArray(servers) ? servers : [];
+    await this.save(config);
+  }
+
+  async setRoutingStrategy(routing = {}) {
+    const config = await this.load();
+    config.routing = {
+      ...(config.routing || {}),
+      ...routing,
+    };
+    await this.save(config);
+  }
+
+  async setReliability(reliability = {}) {
+    const config = await this.load();
+    config.reliability = {
+      ...(config.reliability || {}),
+      ...reliability,
+    };
+    await this.save(config);
+  }
 }

package/src/cli/context-loader.js

@@ -0,0 +1,277 @@
+import { promises as fs } from 'fs';
+import path from 'path';
+import { homedir } from 'os';
+
+/**
+ * ContextLoader — Loads project context, resource paths, and instruction files.
+ * Extracted from WinterREPL to reduce repl.js size.
+ */
+export class ContextLoader {
+  constructor({ projectPath, session, tools } = {}) {
+    this.projectPath = projectPath;
+    this.session = session;
+    this.tools = tools;
+  }
+
+  getProjectInstructionFiles() {
+    return ['winter.md', 'WINTER.md', 'CLAUDE.md', '.claude/CLAUDE.md'];
+  }
+
+  async readProjectInstructionFiles() {
+    const files = [];
+    const seen = new Set();
+
+    for (const relativePath of this.getProjectInstructionFiles()) {
+      const filePath = path.join(this.projectPath, relativePath);
+      const normalizedPath = path.normalize(filePath).toLowerCase();
+
+      if (seen.has(normalizedPath)) continue;
+      seen.add(normalizedPath);
+
+      try {
+        const stat = await fs.stat(filePath).catch(() => null);
+        if (!stat || !stat.isFile()) continue;
+
+        const content = await fs.readFile(filePath, 'utf8');
+        files.push({ relativePath, filePath, content });
+      } catch {
+        // Ignore unreadable instruction files.
+      }
+    }
+
+    return files;
+  }
+
+  getResourcePaths() {
+    const localRoot = path.join(this.projectPath, 'resources', 'local');
+    return {
+      codex: {
+        root: path.join(localRoot, 'codex'),
+        skills: path.join(localRoot, 'codex', 'skills'),
+        plugins: path.join(localRoot, 'codex', 'plugins'),
+        models: path.join(localRoot, 'codex', 'models_cache.json'),
+        rules: path.join(localRoot, 'codex', 'rules'),
+        memories: path.join(localRoot, 'codex', 'memories'),
+      },
+      claude: {
+        root: path.join(localRoot, 'claude'),
+        skills: path.join(localRoot, 'claude', 'skills'),
+        plugins: path.join(localRoot, 'claude', 'plugins'),
+        projects: path.join(localRoot, 'claude', 'projects'),
+        settings: path.join(localRoot, 'claude', 'settings.json'),
+      },
+      karpathy: path.join(localRoot, 'karpathy-tools'),
+      designs: path.join(localRoot, 'awesome-design-md', 'design-md'),
+      agents: path.join(localRoot, 'agents.md'),
+      manifest: path.join(localRoot, 'manifest.json'),
+      localRoot,
+    };
+  }
+
+  getUserResourcePaths() {
+    const home = homedir();
+    return {
+      codexRoot: path.join(home, '.codex'),
+      codexSkills: path.join(home, '.codex', 'skills'),
+      codexPlugins: path.join(home, '.codex', 'plugins'),
+      codexRules: path.join(home, '.codex', 'rules'),
+      codexMemories: path.join(home, '.codex', 'memories'),
+      claudeRoot: path.join(home, '.claude'),
+      claudeSkills: path.join(home, '.claude', 'skills'),
+      claudePlugins: path.join(home, '.claude', 'plugins'),
+      claudeRules: path.join(home, '.claude', 'rules'),
+      claudeMemories: path.join(home, '.claude', 'memories'),
+    };
+  }
+
+  async listPathEntries(target, limit = 100) {
+    try {
+      const entries = await fs.readdir(target, { withFileTypes: true });
+      const items = entries
+        .filter(entry => entry.isDirectory() || entry.isFile())
+        .map(entry => ({
+          name: entry.name,
+          isDirectory: entry.isDirectory(),
+        }))
+        .sort((a, b) => {
+          if (a.isDirectory && !b.isDirectory) return -1;
+          if (!a.isDirectory && b.isDirectory) return 1;
+          return a.name.localeCompare(b.name);
+        });
+
+      return items.slice(0, limit);
+    } catch {
+      return [];
+    }
+  }
+
+  async getLocalResourceContext() {
+    try {
+      const manifestPath = this.getResourcePaths().manifest;
+      const raw = await fs.readFile(manifestPath, 'utf8');
+      const manifest = JSON.parse(raw.replace(/^\uFEFF/, ''));
+      const paths = this.getResourcePaths();
+      const userPaths = this.getUserResourcePaths();
+      const [claudeSkills, codexSkills, claudePlugins, codexMemories] = await Promise.all([
+        this.listPathEntries(paths.claude.skills, 20),
+        this.listPathEntries(paths.codex.skills, 20),
+        this.listPathEntries(paths.claude.plugins, 20),
+        this.listPathEntries(paths.codex.memories, 20),
+      ]);
+      const [userCodexSkills, userCodexPlugins, userCodexRules, userCodexMemories, userClaudeSkills, userClaudePlugins] = await Promise.all([
+        this.listPathEntries(userPaths.codexSkills, 20),
+        this.listPathEntries(userPaths.codexPlugins, 20),
+        this.listPathEntries(userPaths.codexRules, 20),
+        this.listPathEntries(userPaths.codexMemories, 20),
+        this.listPathEntries(userPaths.claudeSkills, 20),
+        this.listPathEntries(userPaths.claudePlugins, 20),
+      ]);
+
+      const lines = [];
+      lines.push('[Local Resources]');
+      lines.push(`- Root: ${manifest.root || paths.localRoot}`);
+
+      for (const resource of manifest.localResources || []) {
+        lines.push(`- ${resource.name}: ${resource.files} files, ${(resource.bytes / 1024 / 1024).toFixed(2)} MB`);
+      }
+
+      if (manifest.redacted?.length) {
+        lines.push(`- Redacted: ${manifest.redacted.join('; ')}`);
+      }
+
+      lines.push('- Use Read/Grep/Glob to inspect any local resource when it matters for the task.');
+      lines.push('- Local resource families: agents.md, awesome-design-md, claude, codex, karpathy-tools.');
+      lines.push(`- User resource roots: ${userPaths.codexRoot}, ${userPaths.claudeRoot}`);
+
+      if (claudeSkills.length > 0) {
+        lines.push(`- Claude skills: ${claudeSkills.slice(0, 10).map(item => item.name).join(', ')}${claudeSkills.length > 10 ? ', ...' : ''}`);
+      }
+      if (claudePlugins.length > 0) {
+        lines.push(`- Claude plugin roots: ${claudePlugins.slice(0, 10).map(item => item.name).join(', ')}${claudePlugins.length > 10 ? ', ...' : ''}`);
+      }
+      if (codexSkills.length > 0) {
+        lines.push(`- Codex skills: ${codexSkills.slice(0, 10).map(item => item.name).join(', ')}${codexSkills.length > 10 ? ', ...' : ''}`);
+      }
+      if (codexMemories.length > 0) {
+        lines.push(`- Codex memories: ${codexMemories.slice(0, 10).map(item => item.name).join(', ')}${codexMemories.length > 10 ? ', ...' : ''}`);
+      }
+      if (userCodexSkills.length > 0) {
+        lines.push(`- Home Codex skills: ${userCodexSkills.slice(0, 10).map(item => item.name).join(', ')}${userCodexSkills.length > 10 ? ', ...' : ''}`);
+      }
+      if (userCodexPlugins.length > 0) {
+        lines.push(`- Home Codex plugins: ${userCodexPlugins.slice(0, 10).map(item => item.name).join(', ')}${userCodexPlugins.length > 10 ? ', ...' : ''}`);
+      }
+      if (userCodexRules.length > 0) {
+        lines.push(`- Home Codex rules: ${userCodexRules.slice(0, 10).map(item => item.name).join(', ')}${userCodexRules.length > 10 ? ', ...' : ''}`);
+      }
+      if (userCodexMemories.length > 0) {
+        lines.push(`- Home Codex memories: ${userCodexMemories.slice(0, 10).map(item => item.name).join(', ')}${userCodexMemories.length > 10 ? ', ...' : ''}`);
+      }
+      if (userClaudeSkills.length > 0) {
+        lines.push(`- Home Claude skills: ${userClaudeSkills.slice(0, 10).map(item => item.name).join(', ')}${userClaudeSkills.length > 10 ? ', ...' : ''}`);
+      }
+      if (userClaudePlugins.length > 0) {
+        lines.push(`- Home Claude plugins: ${userClaudePlugins.slice(0, 10).map(item => item.name).join(', ')}${userClaudePlugins.length > 10 ? ', ...' : ''}`);
+      }
+
+      return lines.join('\n');
+    } catch {
+      return '';
+    }
+  }
+
+  async getProjectSignals() {
+    const signals = [];
+
+    try {
+      const packageJsonPath = path.join(this.projectPath, 'package.json');
+      const raw = await fs.readFile(packageJsonPath, 'utf8');
+      const pkg = JSON.parse(raw);
+
+      signals.push(String(pkg.name || '').toLowerCase());
+      signals.push(String(pkg.description || '').toLowerCase());
+
+      for (const key of ['dependencies', 'devDependencies', 'peerDependencies']) {
+        const deps = pkg[key] || {};
+        for (const depName of Object.keys(deps)) {
+          signals.push(depName.toLowerCase());
+        }
+      }
+
+      for (const script of Object.values(pkg.scripts || {})) {
+        signals.push(String(script).toLowerCase());
+      }
+    } catch {
+      // Ignore package.json parsing issues.
+    }
+
+    try {
+      const entries = await fs.readdir(this.projectPath, { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isFile()) continue;
+        signals.push(path.extname(entry.name).toLowerCase().slice(1));
+        signals.push(entry.name.toLowerCase());
+      }
+    } catch {
+      // Ignore directory scan issues.
+    }
+
+    return signals.filter(Boolean);
+  }
+
+  async getStartupSkillCatalog() {
+    const catalog = new Set(['coding', 'design', 'debug', 'refactor', 'test', 'security', 'performance']);
+    const resourcePaths = this.getResourcePaths();
+    const userPaths = this.getUserResourcePaths();
+    const folders = [resourcePaths.claude.skills, resourcePaths.codex.skills, userPaths.claudeSkills, userPaths.codexSkills];
+
+    for (const folder of folders) {
+      const entries = await this.listPathEntries(folder, 200);
+      for (const entry of entries) {
+        catalog.add(entry.name);
+      }
+    }
+
+    return catalog;
+  }
+
+  async inferStartupSkills() {
+    const catalog = await this.getStartupSkillCatalog();
+    const signals = await this.getProjectSignals();
+    const normalizedSignals = new Set(signals.map(value => value.toLowerCase()));
+
+    const hasAny = (...items) => items.some(item => normalizedSignals.has(item));
+    const activeSkills = new Set(['coding', 'debug', 'refactor', 'test']);
+
+    if (hasAny('react', 'next', 'nextjs', 'tsx', 'jsx', 'vue', 'svelte', 'vite')) {
+      ['vercel-react-best-practices', 'web-design-guidelines', 'frontend-design', 'design'].forEach(skill => activeSkills.add(skill));
+    }
+
+    if (hasAny('design', 'ui', 'ux', 'css', 'tailwind', 'styled-components', 'scss', 'style', 'component')) {
+      ['web-design-guidelines', 'frontend-design', 'design'].forEach(skill => activeSkills.add(skill));
+    }
+
+    if (hasAny('claude', 'agent', 'mcp', 'plugin', 'skill', 'automation', 'workflow')) {
+      ['skill-creator', 'claude-automation-recommender', 'claude-md-improver', 'agent-development', 'hook-development', 'command-development', 'plugin-dev'].forEach(skill => activeSkills.add(skill));
+    }
+
+    if (hasAny('docs', 'markdown', 'md', 'readme', 'documentation')) {
+      ['claude-md-improver', 'docs', 'writing-rules'].forEach(skill => activeSkills.add(skill));
+    }
+
+    if (hasAny('figma', 'design-md', 'brand', 'brand-guidelines', 'style-guide')) {
+      ['vibefigma', 'web-design-guidelines'].forEach(skill => activeSkills.add(skill));
+    }
+
+    const filtered = [...activeSkills].filter(skill => catalog.has(skill));
+    return {
+      availableSkills: [...catalog],
+      activeSkills: filtered,
+    };
+  }
+
+  compactText(text, maxChars = 1200, label = 'text') {
+    if (!text || text.length <= maxChars) return text || '';
+    return text.slice(0, maxChars) + `\n\n[... ${label} truncated at ${maxChars} chars]`;
+  }
+}