131 lines
3.4 KiB
Markdown
131 lines
3.4 KiB
Markdown
# TASKS.md
|
|
|
|
## Phase 0 - Repository Setup
|
|
|
|
### Task 0.1 - Create repository skeleton
|
|
|
|
Create:
|
|
|
|
- README.md
|
|
- ARCHITECTURE.md
|
|
- TASKS.md
|
|
- PROJECT_STATE.md
|
|
- AGENT_HANDOFF.md
|
|
- src/
|
|
- test/
|
|
- context/
|
|
|
|
Do not implement functionality yet.
|
|
|
|
Status: ✅ Complete
|
|
|
|
### Task 0.2 - Add package.json and dependencies
|
|
|
|
Add `package.json` with MCP SDK, OpenAI SDK, Zod, Vitest.
|
|
|
|
Status: ✅ Complete
|
|
|
|
---
|
|
|
|
## Phase 1 - Core Utilities
|
|
|
|
### Task 1.1 - Configuration loader
|
|
|
|
Create `src/config/env.js`.
|
|
|
|
Requirements:
|
|
- Read environment variables and validate OPENAI_API_KEY exists.
|
|
- Apply defaults from ARCHITECTURE.md section 13.
|
|
- Return a structured config object.
|
|
- Throw clear configuration errors for missing or invalid values.
|
|
- Use plain JavaScript validation (no Zod yet).
|
|
- Single exported `loadConfig()` function.
|
|
|
|
Create `test/config/env.test.js`.
|
|
|
|
Requirements:
|
|
- Test all default values.
|
|
- Test all custom overrides (strings, numbers, booleans).
|
|
- Test error cases: missing API key, invalid numbers, invalid booleans.
|
|
- No external dependencies in the loader.
|
|
|
|
Status: ✅ Complete
|
|
|
|
### Task 1.2 - Secret redaction utility
|
|
|
|
Create `src/utils/redact.js`.
|
|
|
|
Requirements:
|
|
- Detect likely secrets (API keys, tokens, passwords, Bearer tokens, private keys, SSH keys, PEM blocks, DB URLs with credentials).
|
|
- Replace detected secrets with `[REDACTED]`.
|
|
- Return the redacted string.
|
|
|
|
Status: ✅ Complete
|
|
|
|
### Task 1.3 - Context budget utility
|
|
|
|
Create `src/utils/context-budget.js`.
|
|
|
|
Requirements:
|
|
- Character limit checks (max total, per file, max files).
|
|
- Priority-based trimming when limits exceeded.
|
|
- Reject oversized input with safe message.
|
|
|
|
Status: ✅ Complete
|
|
|
|
### Task 1.4 - Safe logging helper
|
|
|
|
Create `src/utils/logging.js`.
|
|
|
|
Requirements:
|
|
- Minimal logging to stderr only.
|
|
- Log safe metadata (tool name, timestamp, model, input/output size, duration, success/failure, error type).
|
|
- No stack traces in logs.
|
|
- No sensitive data in logs.
|
|
- Defensive redaction of secret field names and Bearer tokens in metadata values.
|
|
- Support levels: info, warn, error, silent (invalid levels throw).
|
|
|
|
Status: ✅ Complete
|
|
|
|
---
|
|
|
|
## Phase 2 - OpenAI Integration
|
|
|
|
### Task 2.1 - OpenAI client wrapper
|
|
|
|
Create `src/openai/client.js`.
|
|
|
|
Requirements:
|
|
- Create a minimal OpenAI API client using the OpenAI SDK.
|
|
- Accept API key from configuration (never hardcoded).
|
|
- Support configurable model and temperature.
|
|
- Implement streaming via the Responses API.
|
|
|
|
Status: ✅ Complete
|
|
|
|
### Task 2.2 - Response builder
|
|
|
|
Create `src/openai/responses.js`.
|
|
|
|
Requirements:
|
|
- Build structured OpenAI Responses API payloads from tool inputs.
|
|
- Apply character budget checks before sending.
|
|
- Redact secrets using `redact()` before constructing the request.
|
|
- Never include openaiApiKey in request logs or error messages.
|
|
- Handle OpenAI API errors gracefully (authentication, rate limits, timeouts).
|
|
- Return safe advisory-formatted text responses.
|
|
|
|
Status: ✅ Complete
|
|
|
|
### Task 2.3 - Error handling and edge cases for OpenAI integration
|
|
|
|
Update `src/openai/responses.js` test coverage.
|
|
|
|
Requirements:
|
|
- Add tests for additional error kinds (timeout, unknown API status, empty response body).
|
|
- Test boundary conditions for maxOutputTokens validation (non-positive floats, non-integers, zero).
|
|
- Mock OpenAI SDK network timeout errors separately from rate-limit errors.
|
|
- Verify that no API keys or secrets are ever leaked in error messages across all tested paths.
|
|
|
|
Status: ⏳ Pending
|