@agenthippo-ai/agenthippo 0.1.0

package/out/gateway/outboundPaths.js

@@ -0,0 +1,72 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENTHIPPO_GATEWAY_OUTBOUND_FILE_ENV = exports.GATEWAY_OUTBOUND_FILENAME = void 0;
+exports.safeGatewaySessionDirId = safeGatewaySessionDirId;
+exports.getGatewayOutboundFilePath = getGatewayOutboundFilePath;
+exports.resolveGatewaySessionDirId = resolveGatewaySessionDirId;
+exports.resolveGatewayOutboundFilePath = resolveGatewayOutboundFilePath;
+const path = __importStar(require("path"));
+const branding_js_1 = require("../branding.js");
+exports.GATEWAY_OUTBOUND_FILENAME = 'gateway-outbound.json';
+exports.AGENTHIPPO_GATEWAY_OUTBOUND_FILE_ENV = 'AGENTHIPPO_GATEWAY_OUTBOUND_FILE';
+/** Sanitize gateway session keys for use as `.agent-hippo/sessions/<id>/` directory names. */
+function safeGatewaySessionDirId(value) {
+    return value.replace(/[<>:"/\\|?*\x00-\x1F]/g, '_').slice(0, 160) || 'session';
+}
+function getGatewayOutboundFilePath(workspaceRoot, sessionDirId) {
+    return path.join(workspaceRoot, branding_js_1.AGENTIDE_DIR_NAME, 'sessions', sessionDirId, exports.GATEWAY_OUTBOUND_FILENAME);
+}
+function resolveGatewaySessionDirId(options) {
+    const chatSessionId = options.chatSessionId?.trim();
+    if (chatSessionId) {
+        return safeGatewaySessionDirId(chatSessionId);
+    }
+    const gatewaySessionKey = options.gatewaySessionKey?.trim();
+    if (gatewaySessionKey) {
+        return safeGatewaySessionDirId(gatewaySessionKey);
+    }
+    return undefined;
+}
+function resolveGatewayOutboundFilePath(options) {
+    const sessionDirId = resolveGatewaySessionDirId(options);
+    if (!sessionDirId) {
+        return undefined;
+    }
+    return getGatewayOutboundFilePath(options.workspaceRoot, sessionDirId);
+}

package/out/gateway/outboundSend.js

@@ -0,0 +1,254 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GATEWAY_OUTBOUND_RPC_METHOD = void 0;
+exports.stageLocalMediaIfNeeded = stageLocalMediaIfNeeded;
+exports.buildGatewayOutboundSendArgs = buildGatewayOutboundSendArgs;
+exports.buildGatewaySendParams = buildGatewaySendParams;
+exports.buildGatewayRpcCommand = buildGatewayRpcCommand;
+exports.sendGatewayOutboundMessage = sendGatewayOutboundMessage;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_js_1 = require("../cli/runtime.js");
+const client_js_1 = require("./client.js");
+const DEFAULT_GATEWAY_PORT = 18789;
+/** OpenClaw gateway RPC method for proactive delivery (SendParamsSchema in openclaw gateway protocol). */
+exports.GATEWAY_OUTBOUND_RPC_METHOD = 'send';
+function resolveGatewayCli(explicit) {
+    return explicit?.trim() || process.env.AGENTHIPPO_GATEWAY_CLI?.trim() || 'hippoclaw';
+}
+const OPENCLAW_STATE_DIRNAME = '.openclaw';
+/** Pre-rename state dirs OpenClaw still falls back to when `.openclaw` is absent. */
+const LEGACY_OPENCLAW_STATE_DIRNAMES = ['.clawdbot', '.moldbot', '.moltbot'];
+/**
+ * Resolve the OpenClaw state dir the same way the gateway does, so our staging dir
+ * lands inside the gateway's allowed media roots on every platform and install layout.
+ * Mirrors openclaw's `resolveStateDir`: env override (`OPENCLAW_STATE_DIR` /
+ * `CLAWDBOT_STATE_DIR`, with `~` expansion), else `~/.openclaw`, else an existing
+ * legacy dir. Default is `<home>/.openclaw` on macOS, Linux, and Windows alike.
+ */
+function resolveOpenClawStateDir() {
+    const home = os.homedir();
+    const override = process.env.OPENCLAW_STATE_DIR?.trim() || process.env.CLAWDBOT_STATE_DIR?.trim();
+    if (override) {
+        if (override === '~' || override.startsWith('~/') || override.startsWith('~\\')) {
+            return path.join(home, override.slice(1));
+        }
+        return path.resolve(override);
+    }
+    const newDir = path.join(home, OPENCLAW_STATE_DIRNAME);
+    if (fs.existsSync(newDir)) {
+        return newDir;
+    }
+    for (const legacy of LEGACY_OPENCLAW_STATE_DIRNAMES) {
+        const legacyDir = path.join(home, legacy);
+        if (fs.existsSync(legacyDir)) {
+            return legacyDir;
+        }
+    }
+    return newDir;
+}
+function isUrlLike(value) {
+    // http://, https://, file://, etc. (and data: — the gateway rejects those itself).
+    return /^[a-z][a-z0-9+.-]*:\/\//i.test(value) || value.startsWith('data:');
+}
+/**
+ * The gateway only reads local media from an allowlist of roots (its
+ * `buildMediaLocalRoots`: the temp dir + `<state>/{media,agents,workspace,sandboxes}`);
+ * anything else fails the RPC with `LocalMediaAccessError`. So when `--media` is a local
+ * file outside that allowlist, copy it into `<state>/media` and send the staged path.
+ *
+ * URLs and missing/already-staged paths pass through unchanged.
+ */
+function stageLocalMediaIfNeeded(media) {
+    const value = media?.trim();
+    if (!value || isUrlLike(value)) {
+        return media;
+    }
+    let resolved;
+    try {
+        resolved = fs.realpathSync(value);
+    }
+    catch {
+        // Missing file: let the gateway/CLI surface the not-found error rather than guess.
+        return value;
+    }
+    const stagingDir = path.join(resolveOpenClawStateDir(), 'media');
+    // Compare against the realpath'd staging dir so a symlinked root (e.g. macOS
+    // /tmp -> /private/tmp) doesn't make an already-staged file look out-of-sandbox.
+    let stagingDirReal = path.resolve(stagingDir);
+    try {
+        stagingDirReal = fs.realpathSync(stagingDir);
+    }
+    catch {
+        // Staging dir not created yet — the resolved fallback is fine for the check.
+    }
+    const rel = path.relative(stagingDirReal, resolved);
+    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) {
+        return resolved; // already inside the allowed staging dir
+    }
+    // Disambiguate by source path so distinct files with the same basename don't collide.
+    const ext = path.extname(resolved);
+    const stem = path.basename(resolved, ext);
+    const hash = (0, crypto_1.createHash)('sha256').update(resolved).digest('hex').slice(0, 8);
+    const dest = path.join(stagingDir, `${stem}-${hash}${ext}`);
+    fs.mkdirSync(stagingDir, { recursive: true });
+    fs.copyFileSync(resolved, dest);
+    return dest;
+}
+/** Build hippoclaw/openclaw `message send` argv from a stored handle. */
+function buildGatewayOutboundSendArgs(handle, message, media) {
+    const args = [
+        'message', 'send',
+        '--channel', handle.channel,
+        '--target', handle.target,
+        '--message', message,
+    ];
+    if (media?.trim()) {
+        args.push('--media', media.trim());
+    }
+    if (handle.accountId) {
+        args.push('--account', handle.accountId);
+    }
+    if (handle.threadId) {
+        args.push('--thread-id', handle.threadId);
+    }
+    return args;
+}
+/** Build gateway `send` RPC params from a stored handle. */
+function buildGatewaySendParams(handle, message, media) {
+    return {
+        to: handle.target,
+        message,
+        channel: handle.channel,
+        accountId: handle.accountId,
+        threadId: handle.threadId,
+        sessionKey: handle.sessionKey,
+        agentId: handle.agentId,
+        idempotencyKey: `proactive:${handle.agentId}:${Date.now()}`,
+        // Gateway resolves the channel secret from its runtime snapshot, so media sent
+        // over RPC avoids the unresolved-SecretRef error that a standalone CLI hits.
+        ...(media?.trim() ? { mediaUrl: media.trim() } : {}),
+    };
+}
+function buildGatewayRpcCommand(handle, message, media) {
+    return [exports.GATEWAY_OUTBOUND_RPC_METHOD, JSON.stringify(buildGatewaySendParams(handle, message, media))];
+}
+async function sendViaGatewayRpc(handle, message, media) {
+    const gatewayUrl = process.env.OPENCLAW_GATEWAY_URL?.trim() || `ws://127.0.0.1:${DEFAULT_GATEWAY_PORT}`;
+    const token = (0, runtime_js_1.readOpenClawGatewayToken)();
+    if (token && !process.env.OPENCLAW_GATEWAY_TOKEN?.trim()) {
+        process.env.OPENCLAW_GATEWAY_TOKEN = token;
+    }
+    const { client, clientInfo } = (0, client_js_1.createEphemeralGatewayClient)(gatewayUrl, token);
+    await client.connect(clientInfo);
+    try {
+        const payload = await client.request(exports.GATEWAY_OUTBOUND_RPC_METHOD, buildGatewaySendParams(handle, message, media), 60_000);
+        return { stdout: JSON.stringify(payload), stderr: '' };
+    }
+    finally {
+        client.close();
+    }
+}
+function sendViaHippoclawCli(cli, args) {
+    const result = (0, child_process_1.spawnSync)(cli, args, {
+        encoding: 'utf-8',
+        env: process.env,
+    });
+    return {
+        stdout: (result.stdout ?? '').trim(),
+        stderr: (result.stderr ?? '').trim(),
+        exitCode: result.status,
+    };
+}
+async function sendGatewayOutboundMessage(handle, options) {
+    const cli = resolveGatewayCli(options.cli);
+    if (options.dryRun) {
+        // Preview only: report the original media path and skip staging (no file copy side effect).
+        return {
+            ok: true,
+            via: 'dry-run',
+            command: buildGatewayRpcCommand(handle, options.message, options.media),
+            stdout: '',
+            stderr: '',
+            exitCode: 0,
+        };
+    }
+    // Copy out-of-sandbox local media into an allowed gateway root before sending.
+    const media = stageLocalMediaIfNeeded(options.media);
+    const cliArgs = buildGatewayOutboundSendArgs(handle, options.message, media);
+    const cliCommand = [cli, ...cliArgs];
+    const rpcCommand = buildGatewayRpcCommand(handle, options.message, media);
+    try {
+        const rpc = await sendViaGatewayRpc(handle, options.message, media);
+        return {
+            ok: true,
+            via: 'gateway-rpc',
+            command: rpcCommand,
+            stdout: rpc.stdout,
+            stderr: rpc.stderr,
+            exitCode: 0,
+        };
+    }
+    catch (rpcErr) {
+        const rpcError = rpcErr instanceof Error ? rpcErr.message : String(rpcErr);
+        const cliResult = sendViaHippoclawCli(cli, cliArgs);
+        if (cliResult.exitCode === 0) {
+            return {
+                ok: true,
+                via: 'hippoclaw',
+                command: cliCommand,
+                stdout: cliResult.stdout,
+                stderr: cliResult.stderr,
+                exitCode: cliResult.exitCode,
+            };
+        }
+        const cliFailure = cliResult.stderr || cliResult.stdout || 'unknown error';
+        return {
+            ok: false,
+            via: 'gateway-rpc',
+            command: rpcCommand,
+            stdout: cliResult.stdout,
+            stderr: `Gateway RPC failed: ${rpcError}\nHippoClaw CLI fallback failed (exit ${cliResult.exitCode ?? 'unknown'}): ${cliFailure}`.trim(),
+            exitCode: cliResult.exitCode,
+        };
+    }
+}

package/out/gateway/protocol.js

@@ -0,0 +1,48 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROTOCOL_VERSION = exports.DEFAULT_GATEWAY_OPERATOR_SCOPES = exports.GATEWAY_CLIENT_CAPS = exports.GATEWAY_CLIENT_MODES = exports.GATEWAY_CLIENT_IDS = void 0;
+// ============================================================================
+// Connect Params
+// ============================================================================
+/**
+ * Values must match OpenClaw `GATEWAY_CLIENT_MODES` / `GATEWAY_CLIENT_IDS`
+ * (`openclaw` gateway validates connect params against those enums).
+ */
+exports.GATEWAY_CLIENT_IDS = {
+    GATEWAY_CLIENT: "gateway-client",
+};
+exports.GATEWAY_CLIENT_MODES = {
+    WEBCHAT: "webchat",
+    CLI: "cli",
+    UI: "ui",
+    BACKEND: "backend",
+    /** External agent backends (IDE bridge) — required for `agents.register` on OpenClaw gateway. */
+    AGENT_BACKEND: "agent-backend",
+    NODE: "node",
+    PROBE: "probe",
+    TEST: "test",
+};
+/** OpenClaw `GATEWAY_CLIENT_CAPS` — advertise capabilities the gateway understands. */
+exports.GATEWAY_CLIENT_CAPS = {
+    TOOL_EVENTS: "tool-events",
+};
+/**
+ * Must stay aligned with OpenClaw `CLI_DEFAULT_OPERATOR_SCOPES` (`method-scopes.ts`).
+ * The gateway default-denies RPCs unless these scopes are present on the connection.
+ * Device-less token clients on the trusted local path may keep self-declared scopes;
+ * if we omit this array, `agents.register` / `channels.status` etc. fail with `missing scope`.
+ */
+exports.DEFAULT_GATEWAY_OPERATOR_SCOPES = [
+    "operator.admin",
+    "operator.read",
+    "operator.write",
+    "operator.approvals",
+    "operator.pairing",
+];
+// ============================================================================
+// Protocol Version
+// ============================================================================
+exports.PROTOCOL_VERSION = 3;

package/out/gateway/resetMappings.js

@@ -0,0 +1,52 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetAgentMappings = resetAgentMappings;
+/**
+ * "Reset mappings" orchestrator for Agent Anywhere.
+ *
+ * Forgets an agent's learned inbound routing so every Slack/Telegram peer/thread starts a fresh
+ * chat (in both directions) on its next message. Backs up — never deletes — the three learned
+ * stores by renaming each to a timestamped `.bk` sibling:
+ *   - `gateway/route-index.json`            inbound route -> chat session map
+ *   - `gateway/agents/<agentId>.json`       default chat for unmatched inbound
+ *   - `sessions/<sid>/gateway-outbound.json` outbound reply targets per affected chat
+ *
+ * Channel bindings are left untouched (the agent stays reachable), and chats/history are kept.
+ */
+const gatewayBackup_js_1 = require("./gatewayBackup.js");
+const gatewayRouteIndex_js_1 = require("./gatewayRouteIndex.js");
+const outboundHandles_js_1 = require("./outboundHandles.js");
+const outboundPaths_js_1 = require("./outboundPaths.js");
+/**
+ * Reset learned inbound/outbound mappings for one agent. Idempotent: when nothing is mapped it
+ * returns all-zero and writes no backups.
+ */
+async function resetAgentMappings(workspaceRoot, agentId) {
+    const ts = (0, gatewayBackup_js_1.backupTimestamp)();
+    const routeResult = await (0, gatewayRouteIndex_js_1.backupAndClearAgentRouteIndex)(workspaceRoot, agentId, ts);
+    const defaultResult = await (0, gatewayRouteIndex_js_1.backupAndClearAgentDefault)(workspaceRoot, agentId, ts);
+    // Outbound stores live under each affected chat session: the sessions the removed routes
+    // pointed at, plus the (one-shot) default published session.
+    const sessionIds = new Set(routeResult.removedSessionIds);
+    if (defaultResult.defaultSessionId) {
+        sessionIds.add(defaultResult.defaultSessionId);
+    }
+    let sessions = 0;
+    for (const sessionId of sessionIds) {
+        const dirId = (0, outboundPaths_js_1.safeGatewaySessionDirId)(sessionId);
+        const storePath = (0, outboundPaths_js_1.getGatewayOutboundFilePath)(workspaceRoot, dirId);
+        const cleared = await (0, outboundHandles_js_1.backupAndClearOutboundHandlesForAgent)(storePath, agentId, ts);
+        if (cleared.removed > 0 || cleared.backupPath) {
+            sessions++;
+        }
+    }
+    return {
+        agentId,
+        routes: routeResult.removedRouteKeys.length,
+        hadDefault: defaultResult.hadDefault,
+        sessions,
+    };
+}