@agenthippo-ai/agenthippo 0.1.0

package/out/auth-broker/store.js

@@ -0,0 +1,273 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthBrokerStore = void 0;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_js_1 = require("./config.js");
+const jwt_js_1 = require("./jwt.js");
+class AuthBrokerStore {
+    config;
+    users = new Map();
+    codes = new Map();
+    refreshTokens = new Map();
+    persistPath;
+    constructor(config, persistPath) {
+        this.config = config;
+        this.persistPath = persistPath;
+        if (persistPath) {
+            this.loadFromDisk(persistPath);
+        }
+    }
+    loadFromDisk(filePath) {
+        try {
+            if (!fs.existsSync(filePath)) {
+                return;
+            }
+            const raw = fs.readFileSync(filePath, 'utf8');
+            const data = JSON.parse(raw);
+            for (const user of data.users ?? []) {
+                this.users.set(user.id, user);
+            }
+            const now = Date.now();
+            for (const record of data.refreshTokens ?? []) {
+                // Defensive: skip anything no longer usable so reload can't resurrect a dead token.
+                if (record.revoked || record.expiresAt < now) {
+                    continue;
+                }
+                this.refreshTokens.set(record.token, record);
+            }
+        }
+        catch {
+            // start fresh on corrupt file
+        }
+    }
+    persist() {
+        if (!this.persistPath) {
+            return;
+        }
+        const dir = path.dirname(this.persistPath);
+        fs.mkdirSync(dir, { recursive: true });
+        const now = Date.now();
+        // Only persist live tokens: a revoked/expired token absent from disk is
+        // correctly treated as invalid after restart (rotation + revocation survive).
+        const liveTokens = [...this.refreshTokens.values()].filter((r) => !r.revoked && r.expiresAt > now);
+        const data = { users: [...this.users.values()], refreshTokens: liveTokens };
+        const tmp = `${this.persistPath}.tmp.${process.pid}`;
+        try {
+            fs.writeFileSync(tmp, JSON.stringify(data, null, 2), 'utf8');
+            fs.renameSync(tmp, this.persistPath);
+        }
+        catch (e) {
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch { /* ignore */ }
+            throw e;
+        }
+    }
+    /** Remove revoked and expired refresh tokens to keep the in-memory Map bounded. */
+    pruneRefreshTokens() {
+        const now = Date.now();
+        for (const [token, record] of this.refreshTokens) {
+            if (record.revoked || record.expiresAt < now) {
+                this.refreshTokens.delete(token);
+            }
+        }
+    }
+    /** Remove expired unconsumed auth codes so an authorize-without-token flood can't grow memory. */
+    pruneAuthCodes() {
+        const now = Date.now();
+        for (const [code, record] of this.codes) {
+            if (record.expiresAt < now) {
+                this.codes.delete(code);
+            }
+        }
+    }
+    upsertUser(email, displayName) {
+        const normalized = email.trim().toLowerCase();
+        if (!(0, config_js_1.emailDomainAllowed)(normalized, this.config.allowedEmailDomains)) {
+            throw new Error(`Email domain not allowed for sign-in: ${normalized}`);
+        }
+        for (const user of this.users.values()) {
+            if (user.email === normalized) {
+                return user;
+            }
+        }
+        const user = {
+            id: `usr_${crypto.randomBytes(8).toString('hex')}`,
+            email: normalized,
+            displayName: displayName?.trim() || normalized.split('@')[0] || normalized,
+            teamId: this.config.team.id,
+        };
+        this.users.set(user.id, user);
+        this.persist();
+        return user;
+    }
+    getUser(userId) {
+        return this.users.get(userId);
+    }
+    createAuthCode(input) {
+        this.pruneAuthCodes();
+        const code = crypto.randomBytes(24).toString('base64url');
+        this.codes.set(code, {
+            code,
+            userId: input.userId,
+            clientId: input.clientId,
+            redirectUri: input.redirectUri,
+            codeChallenge: input.codeChallenge,
+            expiresAt: Date.now() + 10 * 60 * 1000,
+        });
+        return code;
+    }
+    consumeAuthCode(code) {
+        const record = this.codes.get(code);
+        if (!record) {
+            return undefined;
+        }
+        this.codes.delete(code);
+        if (record.expiresAt < Date.now()) {
+            return undefined;
+        }
+        return record;
+    }
+    createRefreshToken(userId, clientId) {
+        const token = crypto.randomBytes(32).toString('base64url');
+        this.refreshTokens.set(token, {
+            token,
+            userId,
+            clientId,
+            expiresAt: Date.now() + this.config.refreshTokenTtlSec * 1000,
+            revoked: false,
+        });
+        this.persist();
+        return token;
+    }
+    consumeRefreshToken(token) {
+        const record = this.refreshTokens.get(token);
+        if (!record || record.revoked || record.expiresAt < Date.now()) {
+            return undefined;
+        }
+        record.revoked = true;
+        // Durably revoke the rotated token so it can't be replayed after a restart.
+        this.persist();
+        return record;
+    }
+    revokeRefreshTokensForUser(userId) {
+        let changed = false;
+        for (const record of this.refreshTokens.values()) {
+            if (record.userId === userId && !record.revoked) {
+                record.revoked = true;
+                changed = true;
+            }
+        }
+        if (changed) {
+            this.persist();
+        }
+    }
+    issueTokens(user, clientId, scope) {
+        this.pruneRefreshTokens();
+        this.pruneAuthCodes();
+        const accessToken = (0, jwt_js_1.signJwt)({
+            sub: user.id,
+            email: user.email,
+            name: user.displayName,
+            team_id: user.teamId,
+            scope,
+        }, this.config.jwtSecret, this.config.accessTokenTtlSec);
+        const refreshToken = this.createRefreshToken(user.id, clientId);
+        return {
+            accessToken,
+            refreshToken,
+            expiresIn: this.config.accessTokenTtlSec,
+        };
+    }
+    buildBootstrap(user) {
+        const expiresAt = new Date(Date.now() + this.config.accessTokenTtlSec * 1000).toISOString();
+        return {
+            version: 1,
+            user: {
+                id: user.id,
+                email: user.email,
+                displayName: user.displayName,
+            },
+            team: {
+                id: this.config.team.id,
+                name: this.config.team.name,
+                role: 'member',
+            },
+            store: {
+                repo: this.config.team.storeRepo,
+                indexUrl: this.config.team.storeIndexUrl,
+                githubOrg: this.config.team.githubOrg,
+            },
+            routing: {
+                litellmBaseUrl: this.config.team.litellmBaseUrl,
+                litellmApiKey: this.config.team.litellmApiKey,
+                litellmApiKeyExpiresAt: expiresAt,
+            },
+            policy: {
+                byokAllowed: true,
+                teamManagedSettings: ['store', 'routing'],
+            },
+        };
+    }
+    refreshRoutingCredentials() {
+        const litellmApiKeyExpiresAt = new Date(Date.now() + this.config.accessTokenTtlSec * 1000).toISOString();
+        return {
+            litellmApiKey: this.config.team.litellmApiKey,
+            litellmApiKeyExpiresAt,
+        };
+    }
+    buildMe(user) {
+        return {
+            user: {
+                id: user.id,
+                email: user.email,
+                displayName: user.displayName,
+            },
+            team: {
+                id: this.config.team.id,
+                name: this.config.team.name,
+                role: 'member',
+            },
+        };
+    }
+}
+exports.AuthBrokerStore = AuthBrokerStore;

package/out/base-prompts/gateway/openclaw-starter.json5

@@ -0,0 +1,144 @@
+// OpenClaw Gateway Configuration (JSON5 — comments are OK)
+// Docs: https://docs.openclaw.ai/configuration
+//
+// This file was created by Agent Hippo → Agent Anywhere.
+// Uncomment the channel sections below and add your credentials to get started.
+{
+  "gateway": {
+    "mode": "local",
+
+    // Auth token for the gateway WebSocket.
+    // Auto-generated during setup. The IDE reads this automatically.
+    "auth": {
+      "token": "__GENERATED_TOKEN__"
+    }
+  },
+
+  // Agent Anywhere managed mode:
+  // - Disable gateway startup update checks
+  // - Hide Control UI update banner/button to avoid upstream upgrade drift
+  "update": {
+    "checkOnStart": false,
+    "managedMode": true
+  },
+
+  // --- Agent Routing ---
+  // Bindings route incoming messages to your IDE agents.
+  // Agent IDs are auto-generated by the IDE: ide-{workspace} or ide-{workspace}-{pack}
+  // Check your agent IDs via: Agent Hippo → Agent Anywhere Status
+  "bindings": [
+    // Route all Telegram messages to your IDE agent
+    // { "agentId": "ide-myproject", "match": { "channel": "telegram" } },
+
+    // Route all WhatsApp messages to your IDE agent
+    // { "agentId": "ide-myproject", "match": { "channel": "whatsapp" } },
+
+    // Route Slack messages to a specific pack or IDE agent
+    // { "agentId": "ide-myproject-code-reviewer", "match": { "channel": "slack", "accountId": "default" } },
+
+    // Route Discord messages
+    // { "agentId": "ide-myproject", "match": { "channel": "discord" } }
+  ],
+
+  // --- Channels ---
+  // Uncomment and configure the channels you want to use.
+  "channels": {
+
+    // --- Telegram ---
+    // 1. Message @BotFather on Telegram → /newbot → copy the token
+    // 2. Paste it below and uncomment
+    // "telegram": {
+    //   "botToken": "YOUR_TELEGRAM_BOT_TOKEN",
+    //   "dmPolicy": "open",
+    //   "allowFrom": ["*"],
+    //   "groupPolicy": "open",
+    //
+    //   // Stream one Telegram message in place, edited as the agent works. Telegram
+    //   // auto-disables block streaming, so no blockStreaming flag is needed here.
+    //   "streaming": "partial"
+    // },
+
+    // --- WhatsApp ---
+    // Requires WhatsApp Web pairing. Start the gateway, then scan the QR code.
+    // "whatsapp": {
+    //   "dmPolicy": "pairing",
+    //   "allowFrom": ["+1234567890"],
+    //   "groupPolicy": "open"
+    // },
+
+    // --- Discord ---
+    // 1. Create a bot at https://discord.com/developers → Bot → copy token
+    // 2. Invite bot to your server with Message Content Intent enabled
+    // "discord": {
+    //   "botToken": "YOUR_DISCORD_BOT_TOKEN",
+    //   "dmPolicy": "open",
+    //   "allowFrom": ["*"]
+    // },
+
+    // --- Slack ---
+    // Requires a Slack App with Socket Mode.
+    //
+    // 1. Create a Slack App from:
+    //    base-prompts/gateway/slack-socket-mode-minimal.manifest.json
+    // 2. Install it to the workspace.
+    // 3. Copy the App-Level Token (xapp-...) and Bot User OAuth Token (xoxb-...).
+    // 4. Enable the Slack plugin below and restart the gateway after token/policy changes.
+    //
+    // The minimal manifest intentionally does not include /openclaw slash commands or Slack
+    // assistant threads. Use app DMs and @mentions first; slash command routing is separate.
+    // "slack": {
+    //   "enabled": true,
+    //   "mode": "socket",
+    //   "appToken": "xapp-...",
+    //   "botToken": "xoxb-...",
+    //
+    //   // Quick-start access policy. Tighten this after initial validation.
+    //   "dmPolicy": "open",
+    //   "allowFrom": ["*"],
+    //   "groupPolicy": "open",
+    //
+    //   // Stream one Slack message in place (edited as the agent works), finalized there.
+    //   // blockStreaming:false is REQUIRED: unlike Telegram, Slack does not auto-disable block
+    //   // streaming, and block replies carry cumulative text — so leaving it on posts messages
+    //   // that repeat earlier text (the "duplicated Slack message" bug). Prefer a single final
+    //   // reply with no live preview? Use "streaming": "off" with "blockStreaming": false.
+    //   "streaming": "partial",
+    //   "blockStreaming": false,
+    //   "nativeStreaming": false,
+    //
+    //   // Keep slash commands off unless you explicitly wire slash-command routing.
+    //   "slashCommand": {
+    //     "enabled": false
+    //   }
+    // }
+  },
+
+  // --- Plugins ---
+  // Enable the channel plugins you configured above.
+  "plugins": {
+    "entries": {
+      // "telegram": { "enabled": true },
+      // "whatsapp": { "enabled": true },
+      // "discord": { "enabled": true },
+      // "slack": { "enabled": true }
+    }
+  },
+
+  // --- Commands ---
+  // Minimal command menu for AgentHippo (status, new, stop only).
+  // Skill commands and advanced commands are disabled to keep the UX simple.
+  "commands": {
+    "nativeSkills": false
+  },
+
+  // --- Session Defaults ---
+  "session": {
+    "dmScope": "per-peer"
+  },
+
+  "agents": {
+    "defaults": {
+      "maxConcurrent": 4
+    }
+  }
+}

package/out/base-prompts/gateway/slack-socket-mode-minimal.manifest.json

@@ -0,0 +1,44 @@
+{
+  "display_information": {
+    "name": "OpenClaw",
+    "description": "Minimal Socket Mode Slack connector for OpenClaw"
+  },
+  "features": {
+    "bot_user": {
+      "display_name": "OpenClaw",
+      "always_online": false
+    },
+    "app_home": {
+      "home_tab_enabled": false,
+      "messages_tab_enabled": true,
+      "messages_tab_read_only_enabled": false
+    }
+  },
+  "oauth_config": {
+    "scopes": {
+      "bot": [
+        "app_mentions:read",
+        "channels:history",
+        "channels:read",
+        "chat:write",
+        "files:read",
+        "files:write",
+        "im:history",
+        "im:read",
+        "users:read"
+      ]
+    }
+  },
+  "settings": {
+    "socket_mode_enabled": true,
+    "event_subscriptions": {
+      "bot_events": [
+        "app_mention",
+        "message.channels",
+        "message.im"
+      ]
+    },
+    "org_deploy_enabled": false,
+    "token_rotation_enabled": false
+  }
+}

package/out/base-prompts/mcp-servers/.mcp.json

@@ -0,0 +1,13 @@
+{
+  "mcpServers": {
+    "langfuse-analytics": {
+      "command": "disable-bundled",
+      "env": {
+        "LANGFUSE_SECRET_KEY": "${env:LANGFUSE_SECRET_KEY}",
+        "LANGFUSE_PUBLIC_KEY": "${env:LANGFUSE_PUBLIC_KEY}",
+        "LANGFUSE_BASE_URL": "${env:LANGFUSE_BASE_URL}"
+      }
+    }
+  }
+}
+

package/out/base-prompts/mcp-servers/langfuse-analytics/README.md

@@ -0,0 +1,142 @@
+# Langfuse Analytics MCP Server
+
+MCP server that provides tools for querying Langfuse analytics data (costs, latencies, errors).
+
+## Tools
+
+| Tool | Description |
+|------|-------------|
+| `langfuse_list_sessions` | List recent sessions with filtering |
+| `langfuse_list_traces` | List traces with filtering |
+| `langfuse_get_trace` | Get detailed trace information |
+| `langfuse_cost_summary` | Aggregate costs by model/session/user |
+| `langfuse_latency_summary` | Latency statistics by model/name/session |
+| `langfuse_error_patterns` | Find error patterns in traces |
+
+## Setup
+
+### 1. Install dependencies
+
+```bash
+cd extensions/agentide/base-prompts/mcp-servers/langfuse-analytics
+npm install
+```
+
+### 2. Build
+
+```bash
+npm run build
+```
+
+### 3. Configure environment
+
+Create a `.env` file in your workspace root:
+
+```bash
+LANGFUSE_BASE_URL=http://localhost:3000
+LANGFUSE_SECRET_KEY=sk-lf-your-secret-key
+LANGFUSE_PUBLIC_KEY=pk-lf-your-public-key
+```
+
+Or export them directly:
+
+```bash
+export LANGFUSE_BASE_URL=http://localhost:3000
+export LANGFUSE_SECRET_KEY=sk-lf-your-secret-key
+export LANGFUSE_PUBLIC_KEY=pk-lf-your-public-key
+```
+
+### 4. Enable in Agent Hippo
+
+The bundled `.mcp.json` is automatically synced to `.agent-hippo/agents/default/mcp/.mcp.json` on first run:
+
+```json
+{
+  "mcpServers": {
+    "langfuse-analytics": {
+      "command": "enable-bundled",
+      "env": {
+        "LANGFUSE_SECRET_KEY": "${env:LANGFUSE_SECRET_KEY}",
+        "LANGFUSE_PUBLIC_KEY": "${env:LANGFUSE_PUBLIC_KEY}",
+        "LANGFUSE_BASE_URL": "${env:LANGFUSE_BASE_URL}"
+      }
+    }
+  }
+}
+```
+
+## Testing
+
+### Test Langfuse API connection (without MCP)
+
+```bash
+node scripts/test-client.js
+```
+
+### Test MCP server
+
+```bash
+npm test
+# or
+node scripts/test-server.js
+```
+
+## Development
+
+Watch mode for development:
+
+```bash
+npm run dev
+```
+
+## Usage
+
+The server runs via stdio and follows the MCP protocol. It's designed to be:
+1. Started by Agent Hippo's MCP infrastructure
+2. Configured via `.mcp.json` with `enable-bundled` command
+3. Automatically passed to Claude and Codex SDKs
+
+### Manual testing with MCP Inspector
+
+```bash
+npx @modelcontextprotocol/inspector node dist/index.js
+```
+
+## Example Queries
+
+### Get cost breakdown by model
+
+```json
+{
+  "name": "langfuse_cost_summary",
+  "arguments": {
+    "groupBy": "model",
+    "limit": 20
+  }
+}
+```
+
+### Find slow operations
+
+```json
+{
+  "name": "langfuse_latency_summary",
+  "arguments": {
+    "groupBy": "name",
+    "fromDate": "2026-01-01"
+  }
+}
+```
+
+### List recent errors
+
+```json
+{
+  "name": "langfuse_error_patterns",
+  "arguments": {
+    "groupBy": "error",
+    "limit": 50
+  }
+}
+```
+

package/out/base-prompts/mcp-servers/langfuse-analytics/mcp.json

@@ -0,0 +1,13 @@
+{
+  "name": "langfuse-analytics",
+  "label": "Langfuse Analytics",
+  "description": "Query session costs, latencies, and error patterns from Langfuse",
+  "command": "node",
+  "args": ["${serverDir}/dist/index.js"],
+  "env": {
+    "LANGFUSE_BASE_URL": "${env:LANGFUSE_BASE_URL}",
+    "LANGFUSE_SECRET_KEY": "${env:LANGFUSE_SECRET_KEY}",
+    "LANGFUSE_PUBLIC_KEY": "${env:LANGFUSE_PUBLIC_KEY}"
+  }
+}
+