@agentvault/agentvault 0.9.5 → 0.9.7

package/dist/openclaw-entry.js

@@ -108,7 +108,7 @@ async function handleInbound(params) {
         if (isRoomMessage) {
           await channel.sendToRoom(metadata.roomId, text);
         } else {
-          await channel.send(text);
+          await channel.send(text, { topicId: metadata.topicId });
         }
       },
       onError: (err, info) => {

package/dist/openclaw-entry.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/openclaw-entry.ts"],
-  "sourcesContent": ["/**\n * OpenClaw channel plugin entry point.\n *\n * Intentionally thin \u2014 no heavy imports (libsodium etc.) at module load time.\n * SecureChannel is dynamically imported inside gateway.startAccount (already async)\n * so libsodium's top-level await never runs during plugin registration.\n *\n * Loaded by OpenClaw via the `openclaw.extensions` field in package.json.\n */\n\nimport { resolve } from \"node:path\";\n\n// --- Runtime and active channels (set during register) ---\nlet _ocRuntime: any = null;\nconst _channels = new Map<string, any>();\nconst _messageQueue: Array<() => Promise<void>> = [];\n\nfunction _setRuntime(rt: any) {\n  _ocRuntime = rt;\n  // Flush any messages that arrived before runtime was ready\n  if (_messageQueue.length > 0) {\n    const pending = _messageQueue.splice(0);\n    for (const fn of pending) {\n      fn().catch(() => {});\n    }\n  }\n}\n\n// --- Channel config helpers ---\n\nfunction listAccountIds(cfg: any): string[] {\n  return cfg?.channels?.agentvault?.dataDir ? [\"default\"] : [];\n}\n\nfunction resolveAccount(cfg: any, accountId?: string) {\n  const av = cfg?.channels?.agentvault ?? {};\n  return {\n    accountId: accountId ?? \"default\",\n    dataDir: av.dataDir ?? \"~/.openclaw/agentvault\",\n    apiUrl: av.apiUrl ?? \"https://api.agentvault.chat\",\n    agentName: av.agentName ?? \"OpenClaw Agent\",\n    httpPort: av.httpPort ?? 18790,\n    configured: Boolean(av.dataDir),\n  };\n}\n\n// --- Inbound message dispatch ---\n\nasync function handleInbound(params: {\n  plaintext: string;\n  metadata: any;\n  channel: any;\n  account: any;\n  cfg: any;\n}): Promise<void> {\n  const { plaintext, metadata, channel, account, cfg } = params;\n\n  // Send typing indicator to owner (non-critical, best-effort)\n  try { channel.sendTyping(); } catch { /* ignore */ }\n\n  const core = _ocRuntime;\n  const isRoomMessage = Boolean(metadata.roomId);\n\n  const route = core.channel.routing.resolveAgentRoute({\n    cfg,\n    channel: \"agentvault\",\n    accountId: account.accountId,\n    peer: { kind: \"direct\", id: isRoomMessage ? `agentvault:room:${metadata.roomId}` : \"agentvault:owner\" },\n  });\n\n  const storePath = core.channel.session.resolveStorePath(cfg?.session?.store, {\n    agentId: route.agentId,\n  });\n\n  const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(cfg);\n  const previousTimestamp = core.channel.session.readSessionUpdatedAt({\n    storePath,\n    sessionKey: route.sessionKey,\n  });\n\n  const body = core.channel.reply.formatAgentEnvelope({\n    channel: \"AgentVault\",\n    from: isRoomMessage ? \"Room\" : \"Owner\",\n    timestamp: new Date(metadata.timestamp).getTime(),\n    previousTimestamp,\n    envelope: envelopeOptions,\n    body: plaintext,\n  });\n\n  // Build attachment fields for the context payload\n  const attachmentFields: Record<string, any> = {};\n  if (metadata.attachment) {\n    attachmentFields.AttachmentPath = metadata.attachment.filePath;\n    attachmentFields.AttachmentFilename = metadata.attachment.filename;\n    attachmentFields.AttachmentMime = metadata.attachment.mime;\n\n    // For images: include as MediaUrl so the LLM can see the visual content\n    if (metadata.attachment.base64) {\n      attachmentFields.MediaUrl = metadata.attachment.base64;\n      attachmentFields.NumMedia = \"1\";\n    }\n\n    // For text files: content is already inlined in plaintext body\n  }\n\n  const ctxPayload = core.channel.reply.finalizeInboundContext({\n    Body: body,\n    RawBody: plaintext,\n    CommandBody: plaintext,\n    From: isRoomMessage ? `agentvault:room:${metadata.roomId}` : \"agentvault:owner\",\n    To: `agentvault:agent:${account.accountId}`,\n    SessionKey: route.sessionKey,\n    AccountId: account.accountId,\n    ChatType: isRoomMessage ? \"room\" : \"direct\",\n    ConversationLabel: isRoomMessage ? \"AgentVault Room\" : \"AgentVault\",\n    SenderName: isRoomMessage ? \"Room\" : \"Owner\",\n    SenderId: isRoomMessage ? `agentvault:room:${metadata.roomId}` : \"agentvault:owner\",\n    Provider: \"agentvault\",\n    Surface: \"agentvault\",\n    MessageSid: metadata.messageId,\n    Timestamp: new Date(metadata.timestamp).getTime(),\n    OriginatingChannel: \"agentvault\",\n    OriginatingTo: `agentvault:agent:${account.accountId}`,\n    CommandAuthorized: true,\n    ...attachmentFields,\n  });\n\n  await core.channel.session.recordInboundSession({\n    storePath,\n    sessionKey: ctxPayload.SessionKey ?? route.sessionKey,\n    ctx: ctxPayload,\n    onRecordError: (err: Error) => {\n      core.error?.(`[AgentVault] session record failed: ${String(err)}`);\n    },\n  });\n\n  await core.channel.reply.dispatchReplyWithBufferedBlockDispatcher({\n    ctx: ctxPayload,\n    cfg,\n    dispatcherOptions: {\n      deliver: async (payload: { text?: string; kind?: string }) => {\n        // Filter out thinking/reasoning blocks \u2014 only deliver actual responses\n        if (payload.kind === \"thinking\" || payload.kind === \"reasoning\") return;\n        const text = (payload.text ?? \"\").trim();\n        if (!text) return;\n        // Heuristic: skip blocks that look like leaked chain-of-thought\n        if (/^(Reasoning|Thinking|Let me think|I need to|Let me check):/i.test(text)) return;\n\n        // Route reply: room messages go back to the room, 1:1 goes to owner\n        if (isRoomMessage) {\n          await channel.sendToRoom(metadata.roomId, text);\n        } else {\n          await channel.send(text);\n        }\n      },\n      onError: (err: Error, info?: { kind?: string }) => {\n        core.error?.(`[AgentVault] ${info?.kind ?? \"reply\"} error: ${String(err)}`);\n      },\n    },\n    replyOptions: {},\n  });\n}\n\n// --- Channel plugin definition ---\n\nconst agentVaultPlugin = {\n  id: \"agentvault\",\n  meta: {\n    id: \"agentvault\",\n    label: \"AgentVault\",\n    selectionLabel: \"AgentVault (E2E Encrypted)\",\n    docsPath: \"https://agentvault.chat/docs\",\n    blurb: \"Zero-knowledge, end-to-end encrypted messaging between owners and their AI agents.\",\n    aliases: [\"av\", \"agent-vault\"],\n  },\n  capabilities: { chatTypes: [\"direct\"] },\n  config: { listAccountIds, resolveAccount },\n\n  gateway: {\n    startAccount: async (ctx: any) => {\n      const { account, cfg, log, abortSignal } = ctx;\n\n      if (!account.configured) {\n        throw new Error(\n          \"AgentVault channel not configured. Run: npx @agentvault/agentvault setup --token=av_tok_...\\nThen restart OpenClaw.\",\n        );\n      }\n\n      const dataDir = resolve(account.dataDir.replace(/^~/, process.env.HOME ?? \"~\"));\n      log?.info(`[AgentVault] starting (dataDir=${dataDir})`);\n\n      // Lazy import \u2014 defers libsodium initialization until channel actually starts\n      const { SecureChannel } = await import(\"./index.js\");\n\n      // startAccount must STAY PENDING while the channel is running.\n      // Resolving signals \"channel stopped\" to the gateway health monitor,\n      // which triggers auto-restart. We block here until the abortSignal\n      // fires (gateway shutdown / config reload), then clean up.\n      await new Promise<void>((resolve, reject) => {\n        let channel: any;\n\n        const onAbort = async () => {\n          await channel?.stop();\n          _channels.delete(account.accountId);\n          resolve();\n        };\n\n        abortSignal?.addEventListener(\"abort\", () => void onAbort());\n\n        // Lazy import \u2014 defers libsodium initialization until channel starts\n        import(\"./index.js\").then(({ SecureChannel }) => {\n          channel = new SecureChannel({\n            inviteToken: \"\",\n            dataDir,\n            apiUrl: account.apiUrl,\n            agentName: account.agentName,\n            onMessage: async (plaintext: string, metadata: any) => {\n              if (!_ocRuntime) {\n                log?.info(\"[AgentVault] runtime not ready, queuing message\");\n                _messageQueue.push(async () => {\n                  await handleInbound({ plaintext, metadata, channel, account, cfg });\n                });\n                return;\n              }\n              try {\n                await handleInbound({ plaintext, metadata, channel, account, cfg });\n              } catch (err) {\n                log?.info(`[AgentVault] inbound error: ${String(err)}`);\n              }\n            },\n            onStateChange: (state: string) => {\n              log?.info(`[AgentVault] \u2192 ${state}`);\n              // \"error\" is a permanent failure \u2014 reject so gateway can restart\n              if (state === \"error\") reject(new Error(\"AgentVault channel permanent error\"));\n              // All other states (connecting/ready/disconnected) are handled\n              // internally by SecureChannel's reconnect logic \u2014 do NOT resolve.\n            },\n          });\n\n          _channels.set(account.accountId, channel);\n\n          // Prevent unhandled \"error\" events from crashing the process.\n          // Without this handler, Node.js EventEmitter throws on emit(\"error\").\n          channel.on(\"error\", (err: any) => {\n            log?.info(`[AgentVault] channel error (non-fatal): ${String(err)}`);\n          });\n\n          // Start local HTTP server for proactive sends\n          const httpPort = account.httpPort ?? 18790;\n          channel.on(\"ready\", () => {\n            channel.startHttpServer(httpPort);\n            log?.info(`[AgentVault] HTTP send server listening on http://127.0.0.1:${httpPort}`);\n          });\n\n          channel.start().catch(reject);\n        }).catch(reject);\n      });\n\n      return { stop: async () => {} }; // Channel already stopped via abortSignal by this point\n    },\n  },\n\n  outbound: {\n    deliveryMode: \"direct\" as const,\n\n    // Register valid send targets so OpenClaw's `message` tool can route\n    // proactive (agent-initiated) sends \u2014 not just replies to inbound messages.\n    targets: [\n      {\n        id: \"owner\",\n        label: \"AgentVault Owner\",\n        accountId: \"default\",\n      },\n      {\n        id: \"default\",\n        label: \"AgentVault Owner (default)\",\n        accountId: \"default\",\n      },\n    ],\n\n    sendText: async ({ to, text, accountId }: { to: string; text: string; accountId?: string }) => {\n      const resolvedId = accountId ?? \"default\";\n      const ch = _channels.get(resolvedId);\n      if (!ch) return { ok: false, error: \"AgentVault channel not connected\" };\n      try {\n        const wasReady = ch.state === \"ready\";\n        await ch.send(text);\n        return { ok: true, queued: !wasReady };\n      } catch (err) {\n        return { ok: false, error: String(err) };\n      }\n    },\n\n    sendMedia: async ({ to, text, mediaUrl, accountId }: { to: string; text?: string; mediaUrl: string; accountId?: string }) => {\n      const resolvedId = accountId ?? \"default\";\n      const ch = _channels.get(resolvedId);\n      if (!ch) return { ok: false, error: \"AgentVault channel not connected\" };\n      try {\n        // For now, send media URL as text \u2014 AgentVault handles attachments separately\n        const message = text ? `${text}\\n${mediaUrl}` : mediaUrl;\n        const wasReady = ch.state === \"ready\";\n        await ch.send(message);\n        return { ok: true, queued: !wasReady };\n      } catch (err) {\n        return { ok: false, error: String(err) };\n      }\n    },\n  },\n};\n\n// --- Plugin export ---\n\nexport default {\n  id: \"agentvault\",\n  name: \"AgentVault\",\n  description: \"End-to-end encrypted, zero-knowledge messaging between AI agent owners and their agents.\",\n  register(api: any) {\n    _setRuntime(api.runtime);\n    api.registerChannel({ plugin: agentVaultPlugin });\n  },\n};\n"],
-  "mappings": ";AAUA,SAAS,eAAe;AAGxB,IAAI,aAAkB;AACtB,IAAM,YAAY,oBAAI,IAAiB;AACvC,IAAM,gBAA4C,CAAC;AAEnD,SAAS,YAAY,IAAS;AAC5B,eAAa;AAEb,MAAI,cAAc,SAAS,GAAG;AAC5B,UAAM,UAAU,cAAc,OAAO,CAAC;AACtC,eAAW,MAAM,SAAS;AACxB,SAAG,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrB;AAAA,EACF;AACF;AAIA,SAAS,eAAe,KAAoB;AAC1C,SAAO,KAAK,UAAU,YAAY,UAAU,CAAC,SAAS,IAAI,CAAC;AAC7D;AAEA,SAAS,eAAe,KAAU,WAAoB;AACpD,QAAM,KAAK,KAAK,UAAU,cAAc,CAAC;AACzC,SAAO;AAAA,IACL,WAAW,aAAa;AAAA,IACxB,SAAS,GAAG,WAAW;AAAA,IACvB,QAAQ,GAAG,UAAU;AAAA,IACrB,WAAW,GAAG,aAAa;AAAA,IAC3B,UAAU,GAAG,YAAY;AAAA,IACzB,YAAY,QAAQ,GAAG,OAAO;AAAA,EAChC;AACF;AAIA,eAAe,cAAc,QAMX;AAChB,QAAM,EAAE,WAAW,UAAU,SAAS,SAAS,IAAI,IAAI;AAGvD,MAAI;AAAE,YAAQ,WAAW;AAAA,EAAG,QAAQ;AAAA,EAAe;AAEnD,QAAM,OAAO;AACb,QAAM,gBAAgB,QAAQ,SAAS,MAAM;AAE7C,QAAM,QAAQ,KAAK,QAAQ,QAAQ,kBAAkB;AAAA,IACnD;AAAA,IACA,SAAS;AAAA,IACT,WAAW,QAAQ;AAAA,IACnB,MAAM,EAAE,MAAM,UAAU,IAAI,gBAAgB,mBAAmB,SAAS,MAAM,KAAK,mBAAmB;AAAA,EACxG,CAAC;AAED,QAAM,YAAY,KAAK,QAAQ,QAAQ,iBAAiB,KAAK,SAAS,OAAO;AAAA,IAC3E,SAAS,MAAM;AAAA,EACjB,CAAC;AAED,QAAM,kBAAkB,KAAK,QAAQ,MAAM,6BAA6B,GAAG;AAC3E,QAAM,oBAAoB,KAAK,QAAQ,QAAQ,qBAAqB;AAAA,IAClE;AAAA,IACA,YAAY,MAAM;AAAA,EACpB,CAAC;AAED,QAAM,OAAO,KAAK,QAAQ,MAAM,oBAAoB;AAAA,IAClD,SAAS;AAAA,IACT,MAAM,gBAAgB,SAAS;AAAA,IAC/B,WAAW,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AAAA,IAChD;AAAA,IACA,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AAGD,QAAM,mBAAwC,CAAC;AAC/C,MAAI,SAAS,YAAY;AACvB,qBAAiB,iBAAiB,SAAS,WAAW;AACtD,qBAAiB,qBAAqB,SAAS,WAAW;AAC1D,qBAAiB,iBAAiB,SAAS,WAAW;AAGtD,QAAI,SAAS,WAAW,QAAQ;AAC9B,uBAAiB,WAAW,SAAS,WAAW;AAChD,uBAAiB,WAAW;AAAA,IAC9B;AAAA,EAGF;AAEA,QAAM,aAAa,KAAK,QAAQ,MAAM,uBAAuB;AAAA,IAC3D,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,MAAM,gBAAgB,mBAAmB,SAAS,MAAM,KAAK;AAAA,IAC7D,IAAI,oBAAoB,QAAQ,SAAS;AAAA,IACzC,YAAY,MAAM;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,UAAU,gBAAgB,SAAS;AAAA,IACnC,mBAAmB,gBAAgB,oBAAoB;AAAA,IACvD,YAAY,gBAAgB,SAAS;AAAA,IACrC,UAAU,gBAAgB,mBAAmB,SAAS,MAAM,KAAK;AAAA,IACjE,UAAU;AAAA,IACV,SAAS;AAAA,IACT,YAAY,SAAS;AAAA,IACrB,WAAW,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AAAA,IAChD,oBAAoB;AAAA,IACpB,eAAe,oBAAoB,QAAQ,SAAS;AAAA,IACpD,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL,CAAC;AAED,QAAM,KAAK,QAAQ,QAAQ,qBAAqB;AAAA,IAC9C;AAAA,IACA,YAAY,WAAW,cAAc,MAAM;AAAA,IAC3C,KAAK;AAAA,IACL,eAAe,CAAC,QAAe;AAC7B,WAAK,QAAQ,uCAAuC,OAAO,GAAG,CAAC,EAAE;AAAA,IACnE;AAAA,EACF,CAAC;AAED,QAAM,KAAK,QAAQ,MAAM,yCAAyC;AAAA,IAChE,KAAK;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,MACjB,SAAS,OAAO,YAA8C;AAE5D,YAAI,QAAQ,SAAS,cAAc,QAAQ,SAAS,YAAa;AACjE,cAAM,QAAQ,QAAQ,QAAQ,IAAI,KAAK;AACvC,YAAI,CAAC,KAAM;AAEX,YAAI,8DAA8D,KAAK,IAAI,EAAG;AAG9E,YAAI,eAAe;AACjB,gBAAM,QAAQ,WAAW,SAAS,QAAQ,IAAI;AAAA,QAChD,OAAO;AACL,gBAAM,QAAQ,KAAK,IAAI;AAAA,QACzB;AAAA,MACF;AAAA,MACA,SAAS,CAAC,KAAY,SAA6B;AACjD,aAAK,QAAQ,gBAAgB,MAAM,QAAQ,OAAO,WAAW,OAAO,GAAG,CAAC,EAAE;AAAA,MAC5E;AAAA,IACF;AAAA,IACA,cAAc,CAAC;AAAA,EACjB,CAAC;AACH;AAIA,IAAM,mBAAmB;AAAA,EACvB,IAAI;AAAA,EACJ,MAAM;AAAA,IACJ,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,OAAO;AAAA,IACP,SAAS,CAAC,MAAM,aAAa;AAAA,EAC/B;AAAA,EACA,cAAc,EAAE,WAAW,CAAC,QAAQ,EAAE;AAAA,EACtC,QAAQ,EAAE,gBAAgB,eAAe;AAAA,EAEzC,SAAS;AAAA,IACP,cAAc,OAAO,QAAa;AAChC,YAAM,EAAE,SAAS,KAAK,KAAK,YAAY,IAAI;AAE3C,UAAI,CAAC,QAAQ,YAAY;AACvB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,IAAI,QAAQ,GAAG,CAAC;AAC9E,WAAK,KAAK,kCAAkC,OAAO,GAAG;AAGtD,YAAM,EAAE,cAAc,IAAI,MAAM,OAAO,YAAY;AAMnD,YAAM,IAAI,QAAc,CAACA,UAAS,WAAW;AAC3C,YAAI;AAEJ,cAAM,UAAU,YAAY;AAC1B,gBAAM,SAAS,KAAK;AACpB,oBAAU,OAAO,QAAQ,SAAS;AAClC,UAAAA,SAAQ;AAAA,QACV;AAEA,qBAAa,iBAAiB,SAAS,MAAM,KAAK,QAAQ,CAAC;AAG3D,eAAO,YAAY,EAAE,KAAK,CAAC,EAAE,eAAAC,eAAc,MAAM;AAC/C,oBAAU,IAAIA,eAAc;AAAA,YAC1B,aAAa;AAAA,YACb;AAAA,YACA,QAAQ,QAAQ;AAAA,YAChB,WAAW,QAAQ;AAAA,YACnB,WAAW,OAAO,WAAmB,aAAkB;AACrD,kBAAI,CAAC,YAAY;AACf,qBAAK,KAAK,iDAAiD;AAC3D,8BAAc,KAAK,YAAY;AAC7B,wBAAM,cAAc,EAAE,WAAW,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,gBACpE,CAAC;AACD;AAAA,cACF;AACA,kBAAI;AACF,sBAAM,cAAc,EAAE,WAAW,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,cACpE,SAAS,KAAK;AACZ,qBAAK,KAAK,+BAA+B,OAAO,GAAG,CAAC,EAAE;AAAA,cACxD;AAAA,YACF;AAAA,YACA,eAAe,CAAC,UAAkB;AAChC,mBAAK,KAAK,uBAAkB,KAAK,EAAE;AAEnC,kBAAI,UAAU,QAAS,QAAO,IAAI,MAAM,oCAAoC,CAAC;AAAA,YAG/E;AAAA,UACF,CAAC;AAED,oBAAU,IAAI,QAAQ,WAAW,OAAO;AAIxC,kBAAQ,GAAG,SAAS,CAAC,QAAa;AAChC,iBAAK,KAAK,2CAA2C,OAAO,GAAG,CAAC,EAAE;AAAA,UACpE,CAAC;AAGD,gBAAM,WAAW,QAAQ,YAAY;AACrC,kBAAQ,GAAG,SAAS,MAAM;AACxB,oBAAQ,gBAAgB,QAAQ;AAChC,iBAAK,KAAK,+DAA+D,QAAQ,EAAE;AAAA,UACrF,CAAC;AAED,kBAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,QAC9B,CAAC,EAAE,MAAM,MAAM;AAAA,MACjB,CAAC;AAED,aAAO,EAAE,MAAM,YAAY;AAAA,MAAC,EAAE;AAAA,IAChC;AAAA,EACF;AAAA,EAEA,UAAU;AAAA,IACR,cAAc;AAAA;AAAA;AAAA,IAId,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,MACb;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,MACb;AAAA,IACF;AAAA,IAEA,UAAU,OAAO,EAAE,IAAI,MAAM,UAAU,MAAwD;AAC7F,YAAM,aAAa,aAAa;AAChC,YAAM,KAAK,UAAU,IAAI,UAAU;AACnC,UAAI,CAAC,GAAI,QAAO,EAAE,IAAI,OAAO,OAAO,mCAAmC;AACvE,UAAI;AACF,cAAM,WAAW,GAAG,UAAU;AAC9B,cAAM,GAAG,KAAK,IAAI;AAClB,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAC,SAAS;AAAA,MACvC,SAAS,KAAK;AACZ,eAAO,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE;AAAA,MACzC;AAAA,IACF;AAAA,IAEA,WAAW,OAAO,EAAE,IAAI,MAAM,UAAU,UAAU,MAA2E;AAC3H,YAAM,aAAa,aAAa;AAChC,YAAM,KAAK,UAAU,IAAI,UAAU;AACnC,UAAI,CAAC,GAAI,QAAO,EAAE,IAAI,OAAO,OAAO,mCAAmC;AACvE,UAAI;AAEF,cAAM,UAAU,OAAO,GAAG,IAAI;AAAA,EAAK,QAAQ,KAAK;AAChD,cAAM,WAAW,GAAG,UAAU;AAC9B,cAAM,GAAG,KAAK,OAAO;AACrB,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAC,SAAS;AAAA,MACvC,SAAS,KAAK;AACZ,eAAO,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAIA,IAAO,yBAAQ;AAAA,EACb,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,aAAa;AAAA,EACb,SAAS,KAAU;AACjB,gBAAY,IAAI,OAAO;AACvB,QAAI,gBAAgB,EAAE,QAAQ,iBAAiB,CAAC;AAAA,EAClD;AACF;",
+  "sourcesContent": ["/**\n * OpenClaw channel plugin entry point.\n *\n * Intentionally thin \u2014 no heavy imports (libsodium etc.) at module load time.\n * SecureChannel is dynamically imported inside gateway.startAccount (already async)\n * so libsodium's top-level await never runs during plugin registration.\n *\n * Loaded by OpenClaw via the `openclaw.extensions` field in package.json.\n */\n\nimport { resolve } from \"node:path\";\n\n// --- Runtime and active channels (set during register) ---\nlet _ocRuntime: any = null;\nconst _channels = new Map<string, any>();\nconst _messageQueue: Array<() => Promise<void>> = [];\n\nfunction _setRuntime(rt: any) {\n  _ocRuntime = rt;\n  // Flush any messages that arrived before runtime was ready\n  if (_messageQueue.length > 0) {\n    const pending = _messageQueue.splice(0);\n    for (const fn of pending) {\n      fn().catch(() => {});\n    }\n  }\n}\n\n// --- Channel config helpers ---\n\nfunction listAccountIds(cfg: any): string[] {\n  return cfg?.channels?.agentvault?.dataDir ? [\"default\"] : [];\n}\n\nfunction resolveAccount(cfg: any, accountId?: string) {\n  const av = cfg?.channels?.agentvault ?? {};\n  return {\n    accountId: accountId ?? \"default\",\n    dataDir: av.dataDir ?? \"~/.openclaw/agentvault\",\n    apiUrl: av.apiUrl ?? \"https://api.agentvault.chat\",\n    agentName: av.agentName ?? \"OpenClaw Agent\",\n    httpPort: av.httpPort ?? 18790,\n    configured: Boolean(av.dataDir),\n  };\n}\n\n// --- Inbound message dispatch ---\n\nasync function handleInbound(params: {\n  plaintext: string;\n  metadata: any;\n  channel: any;\n  account: any;\n  cfg: any;\n}): Promise<void> {\n  const { plaintext, metadata, channel, account, cfg } = params;\n\n  // Send typing indicator to owner (non-critical, best-effort)\n  try { channel.sendTyping(); } catch { /* ignore */ }\n\n  const core = _ocRuntime;\n  const isRoomMessage = Boolean(metadata.roomId);\n\n  const route = core.channel.routing.resolveAgentRoute({\n    cfg,\n    channel: \"agentvault\",\n    accountId: account.accountId,\n    peer: { kind: \"direct\", id: isRoomMessage ? `agentvault:room:${metadata.roomId}` : \"agentvault:owner\" },\n  });\n\n  const storePath = core.channel.session.resolveStorePath(cfg?.session?.store, {\n    agentId: route.agentId,\n  });\n\n  const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(cfg);\n  const previousTimestamp = core.channel.session.readSessionUpdatedAt({\n    storePath,\n    sessionKey: route.sessionKey,\n  });\n\n  const body = core.channel.reply.formatAgentEnvelope({\n    channel: \"AgentVault\",\n    from: isRoomMessage ? \"Room\" : \"Owner\",\n    timestamp: new Date(metadata.timestamp).getTime(),\n    previousTimestamp,\n    envelope: envelopeOptions,\n    body: plaintext,\n  });\n\n  // Build attachment fields for the context payload\n  const attachmentFields: Record<string, any> = {};\n  if (metadata.attachment) {\n    attachmentFields.AttachmentPath = metadata.attachment.filePath;\n    attachmentFields.AttachmentFilename = metadata.attachment.filename;\n    attachmentFields.AttachmentMime = metadata.attachment.mime;\n\n    // For images: include as MediaUrl so the LLM can see the visual content\n    if (metadata.attachment.base64) {\n      attachmentFields.MediaUrl = metadata.attachment.base64;\n      attachmentFields.NumMedia = \"1\";\n    }\n\n    // For text files: content is already inlined in plaintext body\n  }\n\n  const ctxPayload = core.channel.reply.finalizeInboundContext({\n    Body: body,\n    RawBody: plaintext,\n    CommandBody: plaintext,\n    From: isRoomMessage ? `agentvault:room:${metadata.roomId}` : \"agentvault:owner\",\n    To: `agentvault:agent:${account.accountId}`,\n    SessionKey: route.sessionKey,\n    AccountId: account.accountId,\n    ChatType: isRoomMessage ? \"room\" : \"direct\",\n    ConversationLabel: isRoomMessage ? \"AgentVault Room\" : \"AgentVault\",\n    SenderName: isRoomMessage ? \"Room\" : \"Owner\",\n    SenderId: isRoomMessage ? `agentvault:room:${metadata.roomId}` : \"agentvault:owner\",\n    Provider: \"agentvault\",\n    Surface: \"agentvault\",\n    MessageSid: metadata.messageId,\n    Timestamp: new Date(metadata.timestamp).getTime(),\n    OriginatingChannel: \"agentvault\",\n    OriginatingTo: `agentvault:agent:${account.accountId}`,\n    CommandAuthorized: true,\n    ...attachmentFields,\n  });\n\n  await core.channel.session.recordInboundSession({\n    storePath,\n    sessionKey: ctxPayload.SessionKey ?? route.sessionKey,\n    ctx: ctxPayload,\n    onRecordError: (err: Error) => {\n      core.error?.(`[AgentVault] session record failed: ${String(err)}`);\n    },\n  });\n\n  await core.channel.reply.dispatchReplyWithBufferedBlockDispatcher({\n    ctx: ctxPayload,\n    cfg,\n    dispatcherOptions: {\n      deliver: async (payload: { text?: string; kind?: string }) => {\n        // Filter out thinking/reasoning blocks \u2014 only deliver actual responses\n        if (payload.kind === \"thinking\" || payload.kind === \"reasoning\") return;\n        const text = (payload.text ?? \"\").trim();\n        if (!text) return;\n        // Heuristic: skip blocks that look like leaked chain-of-thought\n        if (/^(Reasoning|Thinking|Let me think|I need to|Let me check):/i.test(text)) return;\n\n        // Route reply: room messages go back to the room, 1:1 goes to owner\n        if (isRoomMessage) {\n          await channel.sendToRoom(metadata.roomId, text);\n        } else {\n          await channel.send(text, { topicId: metadata.topicId });\n        }\n      },\n      onError: (err: Error, info?: { kind?: string }) => {\n        core.error?.(`[AgentVault] ${info?.kind ?? \"reply\"} error: ${String(err)}`);\n      },\n    },\n    replyOptions: {},\n  });\n}\n\n// --- Channel plugin definition ---\n\nconst agentVaultPlugin = {\n  id: \"agentvault\",\n  meta: {\n    id: \"agentvault\",\n    label: \"AgentVault\",\n    selectionLabel: \"AgentVault (E2E Encrypted)\",\n    docsPath: \"https://agentvault.chat/docs\",\n    blurb: \"Zero-knowledge, end-to-end encrypted messaging between owners and their AI agents.\",\n    aliases: [\"av\", \"agent-vault\"],\n  },\n  capabilities: { chatTypes: [\"direct\"] },\n  config: { listAccountIds, resolveAccount },\n\n  gateway: {\n    startAccount: async (ctx: any) => {\n      const { account, cfg, log, abortSignal } = ctx;\n\n      if (!account.configured) {\n        throw new Error(\n          \"AgentVault channel not configured. Run: npx @agentvault/agentvault setup --token=av_tok_...\\nThen restart OpenClaw.\",\n        );\n      }\n\n      const dataDir = resolve(account.dataDir.replace(/^~/, process.env.HOME ?? \"~\"));\n      log?.info(`[AgentVault] starting (dataDir=${dataDir})`);\n\n      // Lazy import \u2014 defers libsodium initialization until channel actually starts\n      const { SecureChannel } = await import(\"./index.js\");\n\n      // startAccount must STAY PENDING while the channel is running.\n      // Resolving signals \"channel stopped\" to the gateway health monitor,\n      // which triggers auto-restart. We block here until the abortSignal\n      // fires (gateway shutdown / config reload), then clean up.\n      await new Promise<void>((resolve, reject) => {\n        let channel: any;\n\n        const onAbort = async () => {\n          await channel?.stop();\n          _channels.delete(account.accountId);\n          resolve();\n        };\n\n        abortSignal?.addEventListener(\"abort\", () => void onAbort());\n\n        // Lazy import \u2014 defers libsodium initialization until channel starts\n        import(\"./index.js\").then(({ SecureChannel }) => {\n          channel = new SecureChannel({\n            inviteToken: \"\",\n            dataDir,\n            apiUrl: account.apiUrl,\n            agentName: account.agentName,\n            onMessage: async (plaintext: string, metadata: any) => {\n              if (!_ocRuntime) {\n                log?.info(\"[AgentVault] runtime not ready, queuing message\");\n                _messageQueue.push(async () => {\n                  await handleInbound({ plaintext, metadata, channel, account, cfg });\n                });\n                return;\n              }\n              try {\n                await handleInbound({ plaintext, metadata, channel, account, cfg });\n              } catch (err) {\n                log?.info(`[AgentVault] inbound error: ${String(err)}`);\n              }\n            },\n            onStateChange: (state: string) => {\n              log?.info(`[AgentVault] \u2192 ${state}`);\n              // \"error\" is a permanent failure \u2014 reject so gateway can restart\n              if (state === \"error\") reject(new Error(\"AgentVault channel permanent error\"));\n              // All other states (connecting/ready/disconnected) are handled\n              // internally by SecureChannel's reconnect logic \u2014 do NOT resolve.\n            },\n          });\n\n          _channels.set(account.accountId, channel);\n\n          // Prevent unhandled \"error\" events from crashing the process.\n          // Without this handler, Node.js EventEmitter throws on emit(\"error\").\n          channel.on(\"error\", (err: any) => {\n            log?.info(`[AgentVault] channel error (non-fatal): ${String(err)}`);\n          });\n\n          // Start local HTTP server for proactive sends\n          const httpPort = account.httpPort ?? 18790;\n          channel.on(\"ready\", () => {\n            channel.startHttpServer(httpPort);\n            log?.info(`[AgentVault] HTTP send server listening on http://127.0.0.1:${httpPort}`);\n          });\n\n          channel.start().catch(reject);\n        }).catch(reject);\n      });\n\n      return { stop: async () => {} }; // Channel already stopped via abortSignal by this point\n    },\n  },\n\n  outbound: {\n    deliveryMode: \"direct\" as const,\n\n    // Register valid send targets so OpenClaw's `message` tool can route\n    // proactive (agent-initiated) sends \u2014 not just replies to inbound messages.\n    targets: [\n      {\n        id: \"owner\",\n        label: \"AgentVault Owner\",\n        accountId: \"default\",\n      },\n      {\n        id: \"default\",\n        label: \"AgentVault Owner (default)\",\n        accountId: \"default\",\n      },\n    ],\n\n    sendText: async ({ to, text, accountId }: { to: string; text: string; accountId?: string }) => {\n      const resolvedId = accountId ?? \"default\";\n      const ch = _channels.get(resolvedId);\n      if (!ch) return { ok: false, error: \"AgentVault channel not connected\" };\n      try {\n        const wasReady = ch.state === \"ready\";\n        await ch.send(text);\n        return { ok: true, queued: !wasReady };\n      } catch (err) {\n        return { ok: false, error: String(err) };\n      }\n    },\n\n    sendMedia: async ({ to, text, mediaUrl, accountId }: { to: string; text?: string; mediaUrl: string; accountId?: string }) => {\n      const resolvedId = accountId ?? \"default\";\n      const ch = _channels.get(resolvedId);\n      if (!ch) return { ok: false, error: \"AgentVault channel not connected\" };\n      try {\n        // For now, send media URL as text \u2014 AgentVault handles attachments separately\n        const message = text ? `${text}\\n${mediaUrl}` : mediaUrl;\n        const wasReady = ch.state === \"ready\";\n        await ch.send(message);\n        return { ok: true, queued: !wasReady };\n      } catch (err) {\n        return { ok: false, error: String(err) };\n      }\n    },\n  },\n};\n\n// --- Plugin export ---\n\nexport default {\n  id: \"agentvault\",\n  name: \"AgentVault\",\n  description: \"End-to-end encrypted, zero-knowledge messaging between AI agent owners and their agents.\",\n  register(api: any) {\n    _setRuntime(api.runtime);\n    api.registerChannel({ plugin: agentVaultPlugin });\n  },\n};\n"],
+  "mappings": ";AAUA,SAAS,eAAe;AAGxB,IAAI,aAAkB;AACtB,IAAM,YAAY,oBAAI,IAAiB;AACvC,IAAM,gBAA4C,CAAC;AAEnD,SAAS,YAAY,IAAS;AAC5B,eAAa;AAEb,MAAI,cAAc,SAAS,GAAG;AAC5B,UAAM,UAAU,cAAc,OAAO,CAAC;AACtC,eAAW,MAAM,SAAS;AACxB,SAAG,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrB;AAAA,EACF;AACF;AAIA,SAAS,eAAe,KAAoB;AAC1C,SAAO,KAAK,UAAU,YAAY,UAAU,CAAC,SAAS,IAAI,CAAC;AAC7D;AAEA,SAAS,eAAe,KAAU,WAAoB;AACpD,QAAM,KAAK,KAAK,UAAU,cAAc,CAAC;AACzC,SAAO;AAAA,IACL,WAAW,aAAa;AAAA,IACxB,SAAS,GAAG,WAAW;AAAA,IACvB,QAAQ,GAAG,UAAU;AAAA,IACrB,WAAW,GAAG,aAAa;AAAA,IAC3B,UAAU,GAAG,YAAY;AAAA,IACzB,YAAY,QAAQ,GAAG,OAAO;AAAA,EAChC;AACF;AAIA,eAAe,cAAc,QAMX;AAChB,QAAM,EAAE,WAAW,UAAU,SAAS,SAAS,IAAI,IAAI;AAGvD,MAAI;AAAE,YAAQ,WAAW;AAAA,EAAG,QAAQ;AAAA,EAAe;AAEnD,QAAM,OAAO;AACb,QAAM,gBAAgB,QAAQ,SAAS,MAAM;AAE7C,QAAM,QAAQ,KAAK,QAAQ,QAAQ,kBAAkB;AAAA,IACnD;AAAA,IACA,SAAS;AAAA,IACT,WAAW,QAAQ;AAAA,IACnB,MAAM,EAAE,MAAM,UAAU,IAAI,gBAAgB,mBAAmB,SAAS,MAAM,KAAK,mBAAmB;AAAA,EACxG,CAAC;AAED,QAAM,YAAY,KAAK,QAAQ,QAAQ,iBAAiB,KAAK,SAAS,OAAO;AAAA,IAC3E,SAAS,MAAM;AAAA,EACjB,CAAC;AAED,QAAM,kBAAkB,KAAK,QAAQ,MAAM,6BAA6B,GAAG;AAC3E,QAAM,oBAAoB,KAAK,QAAQ,QAAQ,qBAAqB;AAAA,IAClE;AAAA,IACA,YAAY,MAAM;AAAA,EACpB,CAAC;AAED,QAAM,OAAO,KAAK,QAAQ,MAAM,oBAAoB;AAAA,IAClD,SAAS;AAAA,IACT,MAAM,gBAAgB,SAAS;AAAA,IAC/B,WAAW,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AAAA,IAChD;AAAA,IACA,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AAGD,QAAM,mBAAwC,CAAC;AAC/C,MAAI,SAAS,YAAY;AACvB,qBAAiB,iBAAiB,SAAS,WAAW;AACtD,qBAAiB,qBAAqB,SAAS,WAAW;AAC1D,qBAAiB,iBAAiB,SAAS,WAAW;AAGtD,QAAI,SAAS,WAAW,QAAQ;AAC9B,uBAAiB,WAAW,SAAS,WAAW;AAChD,uBAAiB,WAAW;AAAA,IAC9B;AAAA,EAGF;AAEA,QAAM,aAAa,KAAK,QAAQ,MAAM,uBAAuB;AAAA,IAC3D,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,MAAM,gBAAgB,mBAAmB,SAAS,MAAM,KAAK;AAAA,IAC7D,IAAI,oBAAoB,QAAQ,SAAS;AAAA,IACzC,YAAY,MAAM;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,UAAU,gBAAgB,SAAS;AAAA,IACnC,mBAAmB,gBAAgB,oBAAoB;AAAA,IACvD,YAAY,gBAAgB,SAAS;AAAA,IACrC,UAAU,gBAAgB,mBAAmB,SAAS,MAAM,KAAK;AAAA,IACjE,UAAU;AAAA,IACV,SAAS;AAAA,IACT,YAAY,SAAS;AAAA,IACrB,WAAW,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AAAA,IAChD,oBAAoB;AAAA,IACpB,eAAe,oBAAoB,QAAQ,SAAS;AAAA,IACpD,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL,CAAC;AAED,QAAM,KAAK,QAAQ,QAAQ,qBAAqB;AAAA,IAC9C;AAAA,IACA,YAAY,WAAW,cAAc,MAAM;AAAA,IAC3C,KAAK;AAAA,IACL,eAAe,CAAC,QAAe;AAC7B,WAAK,QAAQ,uCAAuC,OAAO,GAAG,CAAC,EAAE;AAAA,IACnE;AAAA,EACF,CAAC;AAED,QAAM,KAAK,QAAQ,MAAM,yCAAyC;AAAA,IAChE,KAAK;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,MACjB,SAAS,OAAO,YAA8C;AAE5D,YAAI,QAAQ,SAAS,cAAc,QAAQ,SAAS,YAAa;AACjE,cAAM,QAAQ,QAAQ,QAAQ,IAAI,KAAK;AACvC,YAAI,CAAC,KAAM;AAEX,YAAI,8DAA8D,KAAK,IAAI,EAAG;AAG9E,YAAI,eAAe;AACjB,gBAAM,QAAQ,WAAW,SAAS,QAAQ,IAAI;AAAA,QAChD,OAAO;AACL,gBAAM,QAAQ,KAAK,MAAM,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,MACA,SAAS,CAAC,KAAY,SAA6B;AACjD,aAAK,QAAQ,gBAAgB,MAAM,QAAQ,OAAO,WAAW,OAAO,GAAG,CAAC,EAAE;AAAA,MAC5E;AAAA,IACF;AAAA,IACA,cAAc,CAAC;AAAA,EACjB,CAAC;AACH;AAIA,IAAM,mBAAmB;AAAA,EACvB,IAAI;AAAA,EACJ,MAAM;AAAA,IACJ,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,OAAO;AAAA,IACP,SAAS,CAAC,MAAM,aAAa;AAAA,EAC/B;AAAA,EACA,cAAc,EAAE,WAAW,CAAC,QAAQ,EAAE;AAAA,EACtC,QAAQ,EAAE,gBAAgB,eAAe;AAAA,EAEzC,SAAS;AAAA,IACP,cAAc,OAAO,QAAa;AAChC,YAAM,EAAE,SAAS,KAAK,KAAK,YAAY,IAAI;AAE3C,UAAI,CAAC,QAAQ,YAAY;AACvB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,IAAI,QAAQ,GAAG,CAAC;AAC9E,WAAK,KAAK,kCAAkC,OAAO,GAAG;AAGtD,YAAM,EAAE,cAAc,IAAI,MAAM,OAAO,YAAY;AAMnD,YAAM,IAAI,QAAc,CAACA,UAAS,WAAW;AAC3C,YAAI;AAEJ,cAAM,UAAU,YAAY;AAC1B,gBAAM,SAAS,KAAK;AACpB,oBAAU,OAAO,QAAQ,SAAS;AAClC,UAAAA,SAAQ;AAAA,QACV;AAEA,qBAAa,iBAAiB,SAAS,MAAM,KAAK,QAAQ,CAAC;AAG3D,eAAO,YAAY,EAAE,KAAK,CAAC,EAAE,eAAAC,eAAc,MAAM;AAC/C,oBAAU,IAAIA,eAAc;AAAA,YAC1B,aAAa;AAAA,YACb;AAAA,YACA,QAAQ,QAAQ;AAAA,YAChB,WAAW,QAAQ;AAAA,YACnB,WAAW,OAAO,WAAmB,aAAkB;AACrD,kBAAI,CAAC,YAAY;AACf,qBAAK,KAAK,iDAAiD;AAC3D,8BAAc,KAAK,YAAY;AAC7B,wBAAM,cAAc,EAAE,WAAW,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,gBACpE,CAAC;AACD;AAAA,cACF;AACA,kBAAI;AACF,sBAAM,cAAc,EAAE,WAAW,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,cACpE,SAAS,KAAK;AACZ,qBAAK,KAAK,+BAA+B,OAAO,GAAG,CAAC,EAAE;AAAA,cACxD;AAAA,YACF;AAAA,YACA,eAAe,CAAC,UAAkB;AAChC,mBAAK,KAAK,uBAAkB,KAAK,EAAE;AAEnC,kBAAI,UAAU,QAAS,QAAO,IAAI,MAAM,oCAAoC,CAAC;AAAA,YAG/E;AAAA,UACF,CAAC;AAED,oBAAU,IAAI,QAAQ,WAAW,OAAO;AAIxC,kBAAQ,GAAG,SAAS,CAAC,QAAa;AAChC,iBAAK,KAAK,2CAA2C,OAAO,GAAG,CAAC,EAAE;AAAA,UACpE,CAAC;AAGD,gBAAM,WAAW,QAAQ,YAAY;AACrC,kBAAQ,GAAG,SAAS,MAAM;AACxB,oBAAQ,gBAAgB,QAAQ;AAChC,iBAAK,KAAK,+DAA+D,QAAQ,EAAE;AAAA,UACrF,CAAC;AAED,kBAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,QAC9B,CAAC,EAAE,MAAM,MAAM;AAAA,MACjB,CAAC;AAED,aAAO,EAAE,MAAM,YAAY;AAAA,MAAC,EAAE;AAAA,IAChC;AAAA,EACF;AAAA,EAEA,UAAU;AAAA,IACR,cAAc;AAAA;AAAA;AAAA,IAId,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,MACb;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,MACb;AAAA,IACF;AAAA,IAEA,UAAU,OAAO,EAAE,IAAI,MAAM,UAAU,MAAwD;AAC7F,YAAM,aAAa,aAAa;AAChC,YAAM,KAAK,UAAU,IAAI,UAAU;AACnC,UAAI,CAAC,GAAI,QAAO,EAAE,IAAI,OAAO,OAAO,mCAAmC;AACvE,UAAI;AACF,cAAM,WAAW,GAAG,UAAU;AAC9B,cAAM,GAAG,KAAK,IAAI;AAClB,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAC,SAAS;AAAA,MACvC,SAAS,KAAK;AACZ,eAAO,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE;AAAA,MACzC;AAAA,IACF;AAAA,IAEA,WAAW,OAAO,EAAE,IAAI,MAAM,UAAU,UAAU,MAA2E;AAC3H,YAAM,aAAa,aAAa;AAChC,YAAM,KAAK,UAAU,IAAI,UAAU;AACnC,UAAI,CAAC,GAAI,QAAO,EAAE,IAAI,OAAO,OAAO,mCAAmC;AACvE,UAAI;AAEF,cAAM,UAAU,OAAO,GAAG,IAAI;AAAA,EAAK,QAAQ,KAAK;AAChD,cAAM,WAAW,GAAG,UAAU;AAC9B,cAAM,GAAG,KAAK,OAAO;AACrB,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAC,SAAS;AAAA,MACvC,SAAS,KAAK;AACZ,eAAO,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAIA,IAAO,yBAAQ;AAAA,EACb,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,aAAa;AAAA,EACb,SAAS,KAAU;AACjB,gBAAY,IAAI,OAAO;AACvB,QAAI,gBAAgB,EAAE,QAAQ,iBAAiB,CAAC;AAAA,EAClD;AACF;",
   "names": ["resolve", "SecureChannel"]
 }

package/dist/openclaw-plugin.js

@@ -0,0 +1,222 @@
+/**
+ * AgentVault OpenClaw Channel Plugin
+ *
+ * Registers AgentVault as a first-class OpenClaw messaging channel.
+ * Messages from the AgentVault UI are decrypted and routed into the
+ * OpenClaw agent loop; agent replies are encrypted and sent back.
+ *
+ * Installation (one-time):
+ *   npx @agentvault/agentvault setup --token=av_tok_...
+ *
+ * After setup, restart OpenClaw — no further configuration needed.
+ */
+import { resolve } from "node:path";
+import { SecureChannel } from "./channel.js";
+// Runtime injected by register() — used in inbound handler
+let _ocRuntime = null;
+// Active channel instances keyed by accountId
+const _channels = new Map();
+export function setOcRuntime(runtime) {
+    _ocRuntime = runtime;
+}
+export function getActiveChannel(accountId = "default") {
+    return _channels.get(accountId);
+}
+// ---------------------------------------------------------------------------
+// Channel plugin definition
+// ---------------------------------------------------------------------------
+export const agentVaultPlugin = {
+    id: "agentvault",
+    meta: {
+        id: "agentvault",
+        label: "AgentVault",
+        selectionLabel: "AgentVault (E2E Encrypted)",
+        docsPath: "https://agentvault.chat/docs",
+        blurb: "Zero-knowledge, end-to-end encrypted messaging between owners and their AI agents.",
+        aliases: ["av", "agent-vault"],
+    },
+    capabilities: {
+        chatTypes: ["direct"],
+    },
+    config: {
+        listAccountIds: (cfg) => {
+            const av = cfg?.channels?.agentvault;
+            return av?.dataDir ? ["default"] : [];
+        },
+        resolveAccount: (cfg, accountId) => {
+            const av = cfg?.channels?.agentvault ?? {};
+            return {
+                accountId: accountId ?? "default",
+                dataDir: av.dataDir ?? "~/.openclaw/agentvault",
+                apiUrl: av.apiUrl ?? "https://api.agentvault.chat",
+                agentName: av.agentName ?? "OpenClaw Agent",
+                httpPort: av.httpPort ?? 18790,
+                configured: Boolean(av.dataDir),
+            };
+        },
+    },
+    gateway: {
+        startAccount: async (ctx) => {
+            const { account, cfg, log, abortSignal } = ctx;
+            if (!account.configured) {
+                throw new Error("AgentVault channel is not configured.\n" +
+                    "Run the one-time setup: npx @agentvault/agentvault setup --token=av_tok_...\n" +
+                    "Then restart OpenClaw: openclaw gateway restart");
+            }
+            const dataDir = resolve(account.dataDir.replace(/^~/, process.env.HOME ?? "~"));
+            log?.(`[AgentVault] starting channel (dataDir=${dataDir})`);
+            const channel = new SecureChannel({
+                // No invite token needed — resuming from persisted enrolled state
+                inviteToken: "",
+                dataDir,
+                apiUrl: account.apiUrl,
+                agentName: account.agentName,
+                onMessage: async (plaintext, metadata) => {
+                    if (!_ocRuntime) {
+                        log?.("[AgentVault] runtime not ready — dropping inbound message");
+                        return;
+                    }
+                    try {
+                        await _handleInbound({ plaintext, metadata, channel, account, cfg });
+                    }
+                    catch (err) {
+                        log?.(`[AgentVault] inbound dispatch error: ${String(err)}`);
+                    }
+                },
+                onStateChange: (state) => {
+                    log?.(`[AgentVault] state → ${state}`);
+                },
+            });
+            _channels.set(account.accountId, channel);
+            // Start local HTTP server for proactive sends when channel is ready
+            const httpPort = account.httpPort;
+            channel.on("ready", () => {
+                channel.startHttpServer(httpPort);
+                log?.(`[AgentVault] HTTP send server listening on http://127.0.0.1:${httpPort}`);
+            });
+            // Respect gateway abort signal (OpenClaw gateway shutdown)
+            abortSignal?.addEventListener("abort", () => {
+                _channels.delete(account.accountId);
+            });
+            await channel.start();
+            return {
+                stop: async () => {
+                    await channel.stop();
+                    _channels.delete(account.accountId);
+                },
+            };
+        },
+    },
+    outbound: {
+        deliveryMode: "direct",
+        targets: [
+            {
+                id: "owner",
+                label: "AgentVault Owner",
+                accountId: "default",
+            },
+            {
+                id: "default",
+                label: "AgentVault Owner (default)",
+                accountId: "default",
+            },
+        ],
+        sendText: async ({ text, accountId, targetId, }) => {
+            const resolvedId = accountId ?? (targetId === "owner" ? "default" : (targetId ?? "default"));
+            const channel = _channels.get(resolvedId);
+            if (!channel) {
+                return { ok: false, error: "AgentVault channel is not connected" };
+            }
+            try {
+                await channel.send(text);
+                return { ok: true };
+            }
+            catch (err) {
+                return { ok: false, error: String(err) };
+            }
+        },
+    },
+};
+// ---------------------------------------------------------------------------
+// Inbound message handler — routes decrypted messages into the agent loop
+// ---------------------------------------------------------------------------
+async function _handleInbound(params) {
+    const { plaintext, metadata, channel, account, cfg } = params;
+    const core = _ocRuntime;
+    // Stable session key scoped to this AgentVault conversation
+    const sessionKey = `agentvault:${account.accountId}:${(metadata.conversationId ?? "default").slice(0, 8)}`;
+    const senderId = `agentvault:owner`;
+    // Resolve agent routing (respects agents.list routing rules if configured)
+    const route = core.channel.routing.resolveAgentRoute({
+        cfg,
+        channel: "agentvault",
+        accountId: account.accountId,
+        peer: { kind: "direct", id: senderId },
+    });
+    const storePath = core.channel.session.resolveStorePath(cfg?.session?.store, {
+        agentId: route.agentId,
+    });
+    const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(cfg);
+    const previousTimestamp = core.channel.session.readSessionUpdatedAt({
+        storePath,
+        sessionKey: route.sessionKey,
+    });
+    // Format the message body with standard OpenClaw envelope (channel label, timestamps, etc.)
+    const body = core.channel.reply.formatAgentEnvelope({
+        channel: "AgentVault",
+        from: "Owner",
+        timestamp: new Date(metadata.timestamp).getTime(),
+        previousTimestamp,
+        envelope: envelopeOptions,
+        body: plaintext,
+    });
+    // Build the inbound context payload OpenClaw expects
+    const ctxPayload = core.channel.reply.finalizeInboundContext({
+        Body: body,
+        RawBody: plaintext,
+        CommandBody: plaintext,
+        From: senderId,
+        To: `agentvault:agent:${account.accountId}`,
+        SessionKey: route.sessionKey,
+        AccountId: account.accountId,
+        ChatType: "direct",
+        ConversationLabel: "AgentVault",
+        SenderName: "Owner",
+        SenderId: senderId,
+        Provider: "agentvault",
+        Surface: "agentvault",
+        MessageSid: metadata.messageId,
+        Timestamp: new Date(metadata.timestamp).getTime(),
+        OriginatingChannel: "agentvault",
+        OriginatingTo: `agentvault:agent:${account.accountId}`,
+        // Owner is cryptographically verified via X3DH + Double Ratchet enrollment
+        CommandAuthorized: true,
+    });
+    // Record session metadata for context continuity
+    await core.channel.session.recordInboundSession({
+        storePath,
+        sessionKey: ctxPayload.SessionKey ?? route.sessionKey,
+        ctx: ctxPayload,
+        onRecordError: (err) => {
+            core.error?.(`[AgentVault] session record failed: ${String(err)}`);
+        },
+    });
+    // Dispatch to the OpenClaw agent loop; deliver replies back through the channel
+    await core.channel.reply.dispatchReplyWithBufferedBlockDispatcher({
+        ctx: ctxPayload,
+        cfg,
+        dispatcherOptions: {
+            deliver: async (payload) => {
+                const text = (payload.text ?? "").trim();
+                if (text) {
+                    await channel.send(text);
+                }
+            },
+            onError: (err, info) => {
+                core.error?.(`[AgentVault] ${info?.kind ?? "reply"} error: ${String(err)}`);
+            },
+        },
+        replyOptions: {},
+    });
+}
+//# sourceMappingURL=openclaw-plugin.js.map

package/dist/openclaw-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw-plugin.js","sourceRoot":"","sources":["../src/openclaw-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,2DAA2D;AAC3D,IAAI,UAAU,GAAQ,IAAI,CAAC;AAC3B,8CAA8C;AAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEnD,MAAM,UAAU,YAAY,CAAC,OAAY;IACvC,UAAU,GAAG,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAS,GAAG,SAAS;IACpD,OAAO,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAeD,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE;QACJ,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,cAAc,EAAE,4BAA4B;QAC5C,QAAQ,EAAE,8BAA8B;QACxC,KAAK,EAAE,oFAAoF;QAC3F,OAAO,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC;KAC/B;IACD,YAAY,EAAE;QACZ,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD,MAAM,EAAE;QACN,cAAc,EAAE,CAAC,GAAQ,EAAY,EAAE;YACrC,MAAM,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC;YACrC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC;QACD,cAAc,EAAE,CAAC,GAAQ,EAAE,SAAkB,EAAqB,EAAE;YAClE,MAAM,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC;YAC3C,OAAO;gBACL,SAAS,EAAE,SAAS,IAAI,SAAS;gBACjC,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,wBAAwB;gBAC/C,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,6BAA6B;gBAClD,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,gBAAgB;gBAC3C,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,KAAK;gBAC9B,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC;aAChC,CAAC;QACJ,CAAC;KACF;IACD,OAAO,EAAE;QACP,YAAY,EAAE,KAAK,EAAE,GAAQ,EAAE,EAAE;YAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,GAK1C,CAAC;YAEF,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,yCAAyC;oBACvC,+EAA+E;oBAC/E,iDAAiD,CACpD,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;YAEhF,GAAG,EAAE,CAAC,0CAA0C,OAAO,GAAG,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;gBAChC,kEAAkE;gBAClE,WAAW,EAAE,EAAE;gBACf,OAAO;gBACP,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAE5B,SAAS,EAAE,KAAK,EAAE,SAAiB,EAAE,QAAyB,EAAE,EAAE;oBAChE,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,GAAG,EAAE,CAAC,2DAA2D,CAAC,CAAC;wBACnE,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,cAAc,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;oBACvE,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,GAAG,EAAE,CAAC,wCAAwC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBAED,aAAa,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,GAAG,EAAE,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;gBACzC,CAAC;aACF,CAAC,CAAC;YAEH,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAE1C,oEAAoE;YACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAClC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACvB,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAClC,GAAG,EAAE,CAAC,+DAA+D,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC,CAAC,CAAC;YAEH,2DAA2D;YAC3D,WAAW,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC1C,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YAEtB,OAAO;gBACL,IAAI,EAAE,KAAK,IAAI,EAAE;oBACf,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;oBACrB,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACtC,CAAC;aACF,CAAC;QACJ,CAAC;KACF;IACD,QAAQ,EAAE;QACR,YAAY,EAAE,QAAiB;QAC/B,OAAO,EAAE;YACP;gBACE,EAAE,EAAE,OAAO;gBACX,KAAK,EAAE,kBAAkB;gBACzB,SAAS,EAAE,SAAS;aACrB;YACD;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,4BAA4B;gBACnC,SAAS,EAAE,SAAS;aACrB;SACF;QACD,QAAQ,EAAE,KAAK,EAAE,EACf,IAAI,EACJ,SAAS,EACT,QAAQ,GAKT,EAA4C,EAAE;YAC7C,MAAM,UAAU,GAAG,SAAS,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC;YAC7F,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;YACrE,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;KACF;CACF,CAAC;AAEF,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E,KAAK,UAAU,cAAc,CAAC,MAM7B;IACC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC;IAExB,4DAA4D;IAC5D,MAAM,UAAU,GAAG,cAAc,OAAO,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3G,MAAM,QAAQ,GAAG,kBAAkB,CAAC;IAEpC,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACnD,GAAG;QACH,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE;KACvC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3E,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAClE,SAAS;QACT,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,4FAA4F;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAClD,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACjD,iBAAiB;QACjB,QAAQ,EAAE,eAAe;QACzB,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC;IAEH,qDAAqD;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC3D,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,SAAS;QAClB,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,oBAAoB,OAAO,CAAC,SAAS,EAAE;QAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,QAAQ;QAClB,iBAAiB,EAAE,YAAY;QAC/B,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,QAAQ,CAAC,SAAS;QAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACjD,kBAAkB,EAAE,YAAY;QAChC,aAAa,EAAE,oBAAoB,OAAO,CAAC,SAAS,EAAE;QACtD,2EAA2E;QAC3E,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IAEH,iDAAiD;IACjD,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC9C,SAAS;QACT,UAAU,EAAE,UAAU,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU;QACrD,GAAG,EAAE,UAAU;QACf,aAAa,EAAE,CAAC,GAAU,EAAE,EAAE;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC,uCAAuC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;KACF,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC;QAChE,GAAG,EAAE,UAAU;QACf,GAAG;QACH,iBAAiB,EAAE;YACjB,OAAO,EAAE,KAAK,EAAE,OAAgD,EAAE,EAAE;gBAClE,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,GAAU,EAAE,IAAwB,EAAE,EAAE;gBAChD,IAAI,CAAC,KAAK,EAAE,CACV,gBAAgB,IAAI,EAAE,IAAI,IAAI,OAAO,WAAW,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAC;YACJ,CAAC;SACF;QACD,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;AACL,CAAC"}

package/dist/setup.js

@@ -0,0 +1,329 @@
+/**
+ * AgentVault one-time setup command.
+ *
+ * Runs enrollment + waits for owner approval + persists state,
+ * then auto-registers the agentvault channel in openclaw config.
+ *
+ * Usage: npx @agentvault/agentvault setup --token=av_tok_...
+ */
+import { execSync, spawnSync } from "node:child_process";
+import * as readline from "node:readline";
+import { resolve } from "node:path";
+import { SecureChannel } from "./channel.js";
+import { VERSION } from "./index.js";
+export async function runSetupCommand(options) {
+    const { token, name, apiUrl } = options;
+    const dataDir = resolve(options.dataDir.replace(/^~/, process.env.HOME ?? "~"));
+    console.log(`
+╔══════════════════════════════════════════════╗
+║         AgentVault — First-Time Setup        ║
+╚══════════════════════════════════════════════╝
+
+  Agent name : ${name}
+  Data dir   : ${dataDir}
+  API        : ${apiUrl}
+`);
+    let enrollDone = false;
+    const channel = new SecureChannel({
+        inviteToken: token,
+        dataDir,
+        apiUrl,
+        agentName: name,
+        onMessage: () => { }, // Not handling messages during setup
+        onStateChange: (state) => {
+            switch (state) {
+                case "enrolling":
+                    console.log("  Enrolling with AgentVault server...");
+                    break;
+                case "polling":
+                    console.log("  Waiting for approval in your AgentVault dashboard...");
+                    if (channel.fingerprint) {
+                        console.log(`\n  Fingerprint: ${channel.fingerprint}`);
+                        console.log("  Verify this fingerprint matches the one shown in your dashboard");
+                        console.log("  before clicking Approve.\n");
+                    }
+                    break;
+                case "activating":
+                    console.log("  Approved! Setting up encryption...");
+                    break;
+                case "ready":
+                    enrollDone = true;
+                    console.log("  ✅ Enrollment complete! Secure channel established.\n");
+                    break;
+                case "error":
+                    console.error("  ❌ Setup encountered an error.");
+                    break;
+            }
+        },
+    });
+    channel.on("error", (err) => {
+        console.error(`\n  ❌ Setup failed: ${err.message}\n`);
+        process.exit(1);
+    });
+    // Start enrollment — blocks until ready or error
+    await new Promise((res, rej) => {
+        const check = setInterval(() => {
+            if (enrollDone) {
+                clearInterval(check);
+                res();
+            }
+        }, 500);
+        channel.start().catch((err) => {
+            clearInterval(check);
+            rej(err);
+        });
+    });
+    // Stop the live connection — OpenClaw's gateway will own it after restart
+    await channel.stop();
+    // --- Install plugin + register in OpenClaw config ---
+    console.log("  Installing AgentVault plugin in OpenClaw...\n");
+    // Extend PATH to find openclaw regardless of how npx was invoked
+    const home = process.env.HOME ?? "";
+    const extraPaths = [
+        `${home}/.local/bin`,
+        `${home}/.pnpm/bin`,
+        `${home}/Library/pnpm/bin`,
+        "/usr/local/bin",
+        "/opt/homebrew/bin",
+    ].join(":");
+    const env = { ...process.env, PATH: `${extraPaths}:${process.env.PATH ?? ""}` };
+    const pluginInstalled = installPlugin(env);
+    if (!pluginInstalled) {
+        // openclaw not in PATH — print full manual instructions and bail
+        console.log(`
+  ⚠️  Could not auto-configure OpenClaw (is 'openclaw' in your PATH?).
+
+  1. Install the plugin:
+     openclaw plugins install @agentvault/agentvault
+
+  2. Register the plugin in the allow list:
+     openclaw config set plugins.allow '["agentvault"]'
+
+  3. Add this to your OpenClaw config (openclaw.yaml or openclaw.json):
+     channels:
+       agentvault:
+         dataDir: "${dataDir}"
+         apiUrl: "${apiUrl}"
+         agentName: "${name}"
+
+  4. (Recommended) Install pm2 for auto-restart and crash recovery:
+     npm install -g pm2
+     pm2 start "openclaw gateway start" --name openclaw-gateway
+     pm2 startup
+     pm2 save
+
+  5. Restart the gateway:
+     openclaw gateway restart
+`);
+        return;
+    }
+    console.log("\n  Registering AgentVault channel in OpenClaw config...\n");
+    const patchCommands = [
+        `openclaw config set channels.agentvault.dataDir "${dataDir}"`,
+        `openclaw config set channels.agentvault.apiUrl "${apiUrl}"`,
+        `openclaw config set channels.agentvault.agentName "${name}"`,
+        `openclaw config set plugins.allow '["agentvault"]'`,
+    ];
+    let configPatched = false;
+    for (const cmd of patchCommands) {
+        try {
+            execSync(cmd, { stdio: "pipe", env });
+            configPatched = true;
+        }
+        catch {
+            // config write failed — fall through to manual
+            configPatched = false;
+            break;
+        }
+    }
+    if (configPatched) {
+        console.log(`  ✅ Channel registered in OpenClaw config.\n`);
+        // --- Step 6: Configure pm2 process management ---
+        console.log("  Configuring pm2 process management...\n");
+        configurePm2(env);
+        await promptAndRestart(env);
+    }
+    else {
+        console.log(`  ⚠️  Could not auto-configure OpenClaw channel.
+  Add this to your OpenClaw config (openclaw.yaml or openclaw.json) manually:
+
+  channels:
+    agentvault:
+      dataDir: "${dataDir}"
+      apiUrl: "${apiUrl}"
+      agentName: "${name}"
+
+  Then restart OpenClaw:
+    openclaw gateway restart
+`);
+    }
+}
+/**
+ * Install/update the plugin in OpenClaw's extensions directory.
+ * Returns true if the plugin is installed (or was already up-to-date).
+ */
+export function installPlugin(env) {
+    // Check if already installed
+    try {
+        const info = execSync("openclaw plugins info agentvault", {
+            stdio: "pipe",
+            env,
+        });
+        const infoStr = info.toString();
+        const versionMatch = infoStr.match(/version[:\s]+(\S+)/i);
+        const installedVersion = versionMatch?.[1];
+        if (installedVersion && installedVersion !== VERSION) {
+            console.log(`  Updating plugin ${installedVersion} → ${VERSION}...`);
+            spawnSync("openclaw", ["plugins", "uninstall", "agentvault"], {
+                stdio: "pipe",
+                input: "y\n",
+                env,
+            });
+            execSync("openclaw plugins install @agentvault/agentvault", {
+                stdio: "pipe",
+                env,
+            });
+            console.log("  ✅ Plugin updated.");
+        }
+        else {
+            console.log(`  Plugin already installed (v${installedVersion ?? "unknown"}).`);
+        }
+        return true;
+    }
+    catch {
+        // Not installed — install fresh
+    }
+    try {
+        execSync("openclaw plugins install @agentvault/agentvault", {
+            stdio: "pipe",
+            env,
+        });
+        console.log("  ✅ Plugin installed in OpenClaw.");
+        return true;
+    }
+    catch {
+        console.log("  ⚠️  Could not auto-install plugin.");
+        return false;
+    }
+}
+/**
+ * Configure pm2 to manage the OpenClaw gateway process.
+ * Returns true if pm2 was configured (or already configured).
+ */
+export function configurePm2(env) {
+    // Check if pm2 is available
+    try {
+        execSync("pm2 --version", { stdio: "pipe", env });
+    }
+    catch {
+        console.log(`
+  ℹ️  pm2 not found. For best reliability, install pm2:
+     npm install -g pm2
+
+  Then configure the gateway to auto-restart:
+     pm2 start "openclaw gateway start" --name openclaw-gateway
+     pm2 startup
+     pm2 save
+`);
+        return false;
+    }
+    // Check if already configured
+    try {
+        const info = execSync("pm2 describe openclaw-gateway", { stdio: "pipe", env });
+        const infoStr = info.toString();
+        if (infoStr.includes("online") || infoStr.includes("stopped")) {
+            console.log("  pm2 process 'openclaw-gateway' already exists.");
+            return true;
+        }
+    }
+    catch {
+        // Not configured yet — continue
+    }
+    // Determine platform-specific command
+    const isMac = process.platform === "darwin";
+    const startCmd = isMac
+        ? "caffeinate -i openclaw gateway start"
+        : "openclaw gateway start";
+    try {
+        execSync(`pm2 start "${startCmd}" --name openclaw-gateway`, { stdio: "pipe", env });
+        console.log("  ✅ Gateway registered with pm2.");
+    }
+    catch (err) {
+        console.log(`  ⚠️  Failed to register with pm2: ${err}`);
+        return false;
+    }
+    // Generate startup script
+    try {
+        execSync("pm2 startup", { stdio: "pipe", env });
+        console.log("  ✅ pm2 startup configured (auto-start on boot).");
+    }
+    catch {
+        console.log("  ⚠️  pm2 startup failed — you may need to run 'pm2 startup' manually with sudo.");
+    }
+    // Save process list
+    try {
+        execSync("pm2 save", { stdio: "pipe", env });
+        console.log("  ✅ pm2 process list saved.");
+    }
+    catch {
+        console.log("  ⚠️  pm2 save failed.");
+    }
+    return true;
+}
+/**
+ * Prompt the user to restart the OpenClaw gateway now or later.
+ * Runs `openclaw gateway restart` synchronously if they confirm.
+ */
+async function promptAndRestart(env) {
+    const answer = await ask("  ⚠️  OpenClaw gateway will restart, briefly interrupting any active conversations.\n" +
+        "  Restart now? [y/N] ");
+    if (answer.trim().toLowerCase() === "y") {
+        console.log("\n  Restarting OpenClaw gateway...");
+        const result = spawnSync("openclaw", ["gateway", "restart"], {
+            stdio: "inherit",
+            env,
+        });
+        if (result.status === 0) {
+            console.log(`
+  ✅ Gateway restarted. AgentVault is now active.
+  Your AgentVault UI will route encrypted messages
+  directly into your agent.
+`);
+        }
+        else {
+            console.log(`
+  ⚠️  Restart command failed (exit ${result.status ?? "unknown"}).
+  Please restart manually:
+
+    openclaw gateway restart
+`);
+        }
+    }
+    else {
+        console.log(`
+  ──────────────────────────────────────────────
+  Run this when you're ready to activate:
+
+    openclaw gateway restart
+
+  After restart, your AgentVault UI will route
+  encrypted messages directly into your agent.
+  ──────────────────────────────────────────────
+`);
+    }
+}
+/** Prompt helper — resolves with the user's input line. */
+function ask(question) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+            terminal: true,
+        });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+//# sourceMappingURL=setup.js.map