feat(config): JSON5 parse, hot reload fs.watch, SecretRef in types

io.ts: parseJson5 (strip comments + trailing commas), scrittura atomica
tmp+rename, onConfigChange con fs.watch debounced. types.ts: aggiunto
api_key_ref SecretRef. index.ts: re-export nuovi simboli.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: leopu00

shared/config/index.ts

@@ -30,6 +30,21 @@ export {
   writeConfig,
   configExists,
   redactConfig,
+  parseJson5,
+  onConfigChange,
   JHT_CONFIG_DIR,
   JHT_CONFIG_PATH,
 } from "./io";
+
+export {
+  resolveSecret,
+  createSecretRef,
+  describeSecret,
+} from "./secret-ref";
+export type {
+  SecretRef,
+  SecretPlaintext,
+  SecretEnvRef,
+  SecretFileRef,
+  SecretExecRef,
+} from "./secret-ref";

shared/config/io.ts

@@ -1,7 +1,8 @@
 /**
- * JHT Config — IO utilities per ~/.jht/jht.config.json
+ * JHT Config — IO utilities per ~/.jht/config.json
  *
- * Lettura, scrittura e validazione del file di configurazione.
+ * Lettura (JSON5-compatibile), scrittura, validazione e hot reload.
+ * Pattern copiato da OpenClaw (openclaw/src/config/io.ts).
  */
 
 import * as fs from "node:fs";
@@ -17,11 +18,27 @@ export const JHT_CONFIG_DIR = path.join(os.homedir(), ".jht");
 export const JHT_CONFIG_PATH = path.join(JHT_CONFIG_DIR, "jht.config.json");
 
 /** Campi sensibili da mascherare nei log */
-const SENSITIVE_FIELDS = ["api_key", "bot_token", "session_token"];
+const SENSITIVE_FIELDS = ["api_key", "bot_token", "session_token", "value"];
+
+// --- JSON5 leggero: strip commenti e trailing commas ---
+
+/**
+ * Parsa JSON5 leggero: rimuove commenti // e /* e trailing commas.
+ * Non richiede dipendenze esterne.
+ */
+export function parseJson5(raw: string): unknown {
+  let cleaned = raw;
+  // Rimuovi commenti single-line (// ...) fuori da stringhe
+  cleaned = cleaned.replace(/("(?:[^"\\]|\\.)*")|\/\/[^\n]*/g, (_, str) => str ?? "");
+  // Rimuovi commenti multi-line (/* ... */)
+  cleaned = cleaned.replace(/("(?:[^"\\]|\\.)*")|\/\*[\s\S]*?\*\//g, (_, str) => str ?? "");
+  // Rimuovi trailing commas prima di } o ]
+  cleaned = cleaned.replace(/,(\s*[}\]])/g, "$1");
+  return JSON.parse(cleaned);
+}
 
 /**
- * Legge e valida jht.config.json.
- * Ritorna { success, data, error }.
+ * Legge e valida il config. Supporta JSON e JSON5 (commenti, trailing commas).
  */
 export function readConfig(): {
   success: boolean;
@@ -41,9 +58,9 @@ export function readConfig(): {
 
   let parsed: unknown;
   try {
-    parsed = JSON.parse(raw);
+    parsed = parseJson5(raw);
   } catch {
-    return { success: false, error: "JSON non valido in jht.config.json" };
+    return { success: false, error: "JSON non valido in config" };
   }
 
   const result = validateConfig(parsed);
@@ -56,8 +73,8 @@ export function readConfig(): {
 }
 
 /**
- * Scrive jht.config.json dopo validazione.
- * Crea la directory ~/.jht/ se non esiste.
+ * Scrive config dopo validazione. Crea ~/.jht/ se non esiste.
+ * Scrive JSON formattato (non JSON5 — i commenti si perderebbero).
  */
 export function writeConfig(config: unknown): {
   success: boolean;
@@ -72,25 +89,28 @@ export function writeConfig(config: unknown): {
 
   try {
     fs.mkdirSync(JHT_CONFIG_DIR, { recursive: true });
-    fs.writeFileSync(JHT_CONFIG_PATH, JSON.stringify(result.data, null, 2) + "\n", "utf-8");
+    // Scrittura atomica: tmp + rename
+    const tmpPath = JHT_CONFIG_PATH + ".tmp";
+    fs.writeFileSync(tmpPath, JSON.stringify(result.data, null, 2) + "\n", "utf-8");
+    fs.renameSync(tmpPath, JHT_CONFIG_PATH);
   } catch (err) {
     return { success: false, error: `Errore scrittura file: ${(err as Error).message}` };
   }
 
+  // Notifica listener hot reload
+  for (const cb of configChangeListeners) {
+    try { cb(result.data!); } catch { /* ignora errori listener */ }
+  }
+
   return { success: true, data: result.data };
 }
 
-/**
- * Verifica se il file config esiste.
- */
+/** Verifica se il file config esiste. */
 export function configExists(): boolean {
   return fs.existsSync(JHT_CONFIG_PATH);
 }
 
-/**
- * Ritorna una copia del config con i campi sensibili mascherati.
- * Utile per logging e debug.
- */
+/** Copia config con campi sensibili mascherati. */
 export function redactConfig(config: Record<string, unknown>): Record<string, unknown> {
   return JSON.parse(JSON.stringify(config), (key, value) => {
     if (SENSITIVE_FIELDS.includes(key) && typeof value === "string" && value.length > 0) {
@@ -99,3 +119,41 @@ export function redactConfig(config: Record<string, unknown>): Record<string, un
     return value;
   });
 }
+
+// --- Hot Reload ---
+
+type ConfigChangeCallback = (config: JHTConfigParsed) => void;
+const configChangeListeners: ConfigChangeCallback[] = [];
+let watcher: fs.FSWatcher | null = null;
+
+/** Registra un callback per hot reload del config. */
+export function onConfigChange(callback: ConfigChangeCallback): () => void {
+  configChangeListeners.push(callback);
+
+  // Avvia watcher al primo listener
+  if (!watcher && fs.existsSync(JHT_CONFIG_PATH)) {
+    let debounce: ReturnType<typeof setTimeout> | null = null;
+    watcher = fs.watch(JHT_CONFIG_PATH, () => {
+      if (debounce) clearTimeout(debounce);
+      debounce = setTimeout(() => {
+        const result = readConfig();
+        if (result.success && result.data) {
+          for (const cb of configChangeListeners) {
+            try { cb(result.data); } catch { /* ignora */ }
+          }
+        }
+      }, 200);
+    });
+    if (watcher.unref) watcher.unref();
+  }
+
+  // Ritorna funzione di unsubscribe
+  return () => {
+    const idx = configChangeListeners.indexOf(callback);
+    if (idx >= 0) configChangeListeners.splice(idx, 1);
+    if (configChangeListeners.length === 0 && watcher) {
+      watcher.close();
+      watcher = null;
+    }
+  };
+}

shared/config/types.ts

@@ -14,8 +14,10 @@ export type AuthMethod = "api_key" | "subscription";
 export interface AIProviderConfig {
   name: AIProviderName;
   auth_method: AuthMethod;
-  /** Obbligatorio se auth_method = "api_key" */
+  /** Obbligatorio se auth_method = "api_key" (plaintext legacy) */
   api_key?: string;
+  /** SecretRef per API key (env/file/exec) — preferito a api_key plaintext */
+  api_key_ref?: import("./secret-ref").SecretRef;
   /** Obbligatorio se auth_method = "subscription" */
   subscription?: SubscriptionConfig;
   /** Modello da usare (es. "claude-opus-4-6", "gpt-4o", "minimax-01") */