chatgpt-mcp/TASKS.md

TASKS.md

Phase 0 - Repository Setup

Task 0.1 - Create repository skeleton

Create:

• README.md
• ARCHITECTURE.md
• TASKS.md
• PROJECT_STATE.md
• AGENT_HANDOFF.md
• src/
• test/
• context/

Do not implement functionality yet.

Status: ✅ Complete

Task 0.2 - Add package.json and dependencies

Add package.json with MCP SDK, OpenAI SDK, Zod, Vitest.

Status: ✅ Complete

---

Phase 1 - Core Utilities

Task 1.1 - Configuration loader

Create src/config/env.js.

Requirements:

• Read environment variables and validate OPENAI_API_KEY exists.
• Apply defaults from ARCHITECTURE.md section 13.
• Return a structured config object.
• Throw clear configuration errors for missing or invalid values.
• Use plain JavaScript validation (no Zod yet).
• Single exported loadConfig() function.

Create test/config/env.test.js.

Requirements:

• Test all default values.
• Test all custom overrides (strings, numbers, booleans).
• Test error cases: missing API key, invalid numbers, invalid booleans.
• No external dependencies in the loader.

Status: ✅ Complete

Task 1.2 - Secret redaction utility

Create src/utils/redact.js.

Requirements:

• Detect likely secrets (API keys, tokens, passwords, Bearer tokens, private keys, SSH keys, PEM blocks, DB URLs with credentials).
• Replace detected secrets with [REDACTED].
• Return the redacted string.

Status: ✅ Complete

Task 1.3 - Context budget utility

Create src/utils/context-budget.js.

Requirements:

• Character limit checks (max total, per file, max files).
• Priority-based trimming when limits exceeded.
• Reject oversized input with safe message.

Status: ✅ Complete

Task 1.4 - Safe logging helper

Create src/utils/logging.js.

Requirements:

• Minimal logging to stderr only.
• Log safe metadata (tool name, timestamp, model, input/output size, duration, success/failure, error type).
• No stack traces in logs.
• No sensitive data in logs.
• Defensive redaction of secret field names and Bearer tokens in metadata values.
• Support levels: info, warn, error, silent (invalid levels throw).

Status: ✅ Complete

---

Phase 2 - OpenAI Integration

Task 2.1 - OpenAI client wrapper

Create src/openai/client.js.

Requirements:

• Create a minimal OpenAI API client using the OpenAI SDK.
• Accept API key from configuration (never hardcoded).
• Support configurable model and temperature.
• Implement streaming via the Responses API.

Status: ⏳ Pending

Task 2.2 - Response builder

Create src/openai/responses.js.

Requirements:

• Build structured OpenAI Responses API payloads from tool inputs.
• Apply character budget checks before sending.
• Redact secrets using redact() before constructing the request.
• Never include openaiApiKey in request logs or error messages.
• Handle OpenAI API errors gracefully (authentication, rate limits, timeouts).
• Return safe advisory-formatted text responses.

Status: ⏳ Pending