@cmetech/otto 1.1.0 → 1.2.4

package/packages/coworker-vault/src/errors.test.ts

@@ -0,0 +1,58 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  EngineNotFound,
+  EngineValidationError,
+  VaultEntryNotFound,
+  VaultEntryMalformed,
+  BindingRefMalformed,
+  BindingNotFound,
+} from './errors.js';
+
+describe('vault errors', () => {
+  it('EngineNotFound carries id and is named', () => {
+    const e = new EngineNotFound('servicenow');
+    assert.equal(e.id, 'servicenow');
+    assert.equal(e.name, 'EngineNotFound');
+    assert.ok(e.message.includes('servicenow'));
+  });
+
+  it('VaultEntryNotFound carries engine, entryName, and searched paths', () => {
+    const searched = ['/ws/.otto/vault/jira', '/home/u/.otto/vault/jira'];
+    const e = new VaultEntryNotFound('jira', 'prod', searched);
+    assert.equal(e.name, 'VaultEntryNotFound');
+    assert.equal(e.engine, 'jira');
+    assert.equal(e.entryName, 'prod');
+    assert.deepEqual(e.searched, searched);
+  });
+
+  it('BindingRefMalformed carries input and hints at jira:prod', () => {
+    const e = new BindingRefMalformed('jira-prod');
+    assert.equal(e.name, 'BindingRefMalformed');
+    assert.equal(e.input, 'jira-prod');
+    assert.ok(e.message.includes('jira:prod'));
+  });
+
+  it('BindingNotFound carries ref', () => {
+    const e = new BindingNotFound('jira:prod');
+    assert.equal(e.name, 'BindingNotFound');
+    assert.equal(e.ref, 'jira:prod');
+    assert.ok(e.message.includes('jira:prod'));
+  });
+
+  it('EngineValidationError carries yamlPath and issue', () => {
+    const e = new EngineValidationError('/engines/jira.yaml', 'missing field "label"');
+    assert.equal(e.name, 'EngineValidationError');
+    assert.equal(e.yamlPath, '/engines/jira.yaml');
+    assert.equal(e.issue, 'missing field "label"');
+    assert.ok(e.message.includes('/engines/jira.yaml'));
+    assert.ok(e.message.includes('missing field "label"'));
+  });
+
+  it('VaultEntryMalformed carries path', () => {
+    const e = new VaultEntryMalformed('/ws/.otto/vault/jira/prod.yaml', 'invalid YAML');
+    assert.equal(e.name, 'VaultEntryMalformed');
+    assert.equal(e.path, '/ws/.otto/vault/jira/prod.yaml');
+    assert.ok(e.message.includes('/ws/.otto/vault/jira/prod.yaml'));
+  });
+});

package/packages/coworker-vault/src/errors.ts

@@ -0,0 +1,50 @@
+// packages/coworker-vault/src/errors.ts
+export class EngineNotFound extends Error {
+  constructor(public readonly id: string) {
+    super(`Unknown engine: ${id}. Available engines can be listed with /datasource list.`);
+    this.name = 'EngineNotFound';
+  }
+}
+
+export class EngineValidationError extends Error {
+  constructor(public readonly yamlPath: string, public readonly issue: string) {
+    super(`Engine ${yamlPath}: ${issue}`);
+    this.name = 'EngineValidationError';
+  }
+}
+
+export class VaultEntryNotFound extends Error {
+  constructor(
+    public readonly engine: string,
+    public readonly entryName: string,
+    public readonly searched: string[],
+  ) {
+    super(
+      `Vault entry not found: ${engine}:${entryName}. Searched: ${searched.join(', ')}. Use /connect ${engine} ${entryName} to create.`,
+    );
+    this.name = 'VaultEntryNotFound';
+  }
+}
+
+export class VaultEntryMalformed extends Error {
+  constructor(public readonly path: string, public readonly reason: string) {
+    super(`Vault entry corrupt: ${path} (${reason}). Move it aside and re-create with /connect.`);
+    this.name = 'VaultEntryMalformed';
+  }
+}
+
+export class BindingRefMalformed extends Error {
+  constructor(public readonly input: string) {
+    super(`Bad binding: ${input}. Expected <engine>:<name>, e.g., jira:prod.`);
+    this.name = 'BindingRefMalformed';
+  }
+}
+
+export class BindingNotFound extends Error {
+  constructor(public readonly ref: string) {
+    super(
+      `Vault binding not resolvable: ${ref}. The entry may have been removed. Use /datasource list to inspect.`,
+    );
+    this.name = 'BindingNotFound';
+  }
+}

package/packages/coworker-vault/src/index.test.ts

@@ -0,0 +1,24 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+describe('coworker-vault barrel', () => {
+  it('barrel imports without throwing', async () => {
+    const mod = await import('./index.js');
+    assert.ok(mod, 'module namespace should load');
+  });
+
+  it('exposes expected public API', async () => {
+    const mod = await import('./index.js');
+    // Spot-check key exports from each submodule.
+    assert.equal(typeof mod.LocalDataVault, 'function', 'LocalDataVault class exported');
+    assert.equal(typeof mod.EngineRegistry, 'function', 'EngineRegistry class exported');
+    assert.equal(typeof mod.CredentialInjector, 'function', 'CredentialInjector class exported');
+    assert.equal(typeof mod.clearEnv, 'function', 'clearEnv function exported');
+    assert.equal(typeof mod.envVarName, 'function', 'envVarName helper exported');
+    assert.equal(typeof mod.BindingNotFound, 'function', 'BindingNotFound error exported');
+    assert.equal(typeof mod.BindingRefMalformed, 'function', 'BindingRefMalformed error exported');
+    assert.equal(typeof mod.VaultEntryNotFound, 'function', 'VaultEntryNotFound error exported');
+    assert.equal(typeof mod.mergeWithSentinel, 'function', 'mergeWithSentinel helper exported');
+    assert.equal(typeof mod.VAULT_KEEP, 'string', 'VAULT_KEEP sentinel exported');
+  });
+});

package/packages/coworker-vault/src/index.ts

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './errors.js';
+export * from './vault-keep.js';
+export * from './engine-registry.js';
+export * from './data-vault.js';
+export * from './injector.js';

package/packages/coworker-vault/src/injector.test.ts

@@ -0,0 +1,109 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { AuditLog } from '@otto/coworker-utils';
+import { LocalDataVault } from './data-vault.js';
+import { CredentialInjector, clearEnv } from './injector.js';
+import { BindingNotFound, BindingRefMalformed } from './errors.js';
+
+function ctx() {
+  const root = mkdtempSync(join(tmpdir(), 'vault-inj-'));
+  const audit = new AuditLog({ path: join(root, 'audit.jsonl') });
+  const vault = new LocalDataVault({ globalDir: join(root, 'global'), workspaceDir: undefined, audit });
+  return { root, audit, vault };
+}
+
+function injCtx() {
+  return { scratchpadName: 'sp-test', sessionId: 'sess-test', pid: 1234 };
+}
+
+describe('CredentialInjector', () => {
+  it('returns OTTO_DS_<ENGINE>_<NAME>__<FIELD> for each field', async () => {
+    const { vault, audit } = ctx();
+    await vault.set({ engine: 'jira', name: 'prod' }, { url: 'https://x', email: 'a@b', token: 't' });
+    const injector = new CredentialInjector({ vault, audit });
+    const out = await injector.injectEnv({ PATH: '/bin' }, ['jira:prod'], injCtx());
+    assert.equal(out['OTTO_DS_JIRA_PROD__URL'], 'https://x');
+    assert.equal(out['OTTO_DS_JIRA_PROD__EMAIL'], 'a@b');
+    assert.equal(out['OTTO_DS_JIRA_PROD__TOKEN'], 't');
+    assert.equal(out['PATH'], '/bin');
+  });
+
+  it('uppercases entry name and replaces hyphens with underscores in env var name', async () => {
+    const { vault, audit } = ctx();
+    await vault.set({ engine: 'jira', name: 'prod-east-1' }, { url: 'https://x' });
+    const injector = new CredentialInjector({ vault, audit });
+    const out = await injector.injectEnv({}, ['jira:prod-east-1'], injCtx());
+    assert.equal(out['OTTO_DS_JIRA_PROD_EAST_1__URL'], 'https://x');
+  });
+
+  it('does not mutate baseEnv', async () => {
+    const { vault, audit } = ctx();
+    await vault.set({ engine: 'jira', name: 'prod' }, { url: 'https://x' });
+    const injector = new CredentialInjector({ vault, audit });
+    const baseEnv = { PATH: '/bin' };
+    const snapshot = { ...baseEnv };
+    await injector.injectEnv(baseEnv, ['jira:prod'], injCtx());
+    assert.deepEqual(baseEnv, snapshot);
+  });
+
+  it('strict mode (default) throws BindingNotFound for missing binding', async () => {
+    const { vault, audit } = ctx();
+    const injector = new CredentialInjector({ vault, audit });
+    await assert.rejects(
+      () => injector.injectEnv({}, ['jira:missing'], injCtx()),
+      (err: unknown) => err instanceof BindingNotFound,
+    );
+  });
+
+  it('loose mode (OTTO_VAULT_MISSING_OK=1) skips missing binding and warns', async () => {
+    const { vault, audit } = ctx();
+    await vault.set({ engine: 'jira', name: 'prod' }, { url: 'https://x' });
+    const injector = new CredentialInjector({ vault, audit });
+    const prev = process.env.OTTO_VAULT_MISSING_OK;
+    process.env.OTTO_VAULT_MISSING_OK = '1';
+    try {
+      const out = await injector.injectEnv({}, ['jira:prod', 'jira:missing'], injCtx());
+      assert.equal(out['OTTO_DS_JIRA_PROD__URL'], 'https://x');
+      assert.equal(out['OTTO_DS_JIRA_MISSING__URL'], undefined);
+    } finally {
+      if (prev === undefined) delete process.env.OTTO_VAULT_MISSING_OK;
+      else process.env.OTTO_VAULT_MISSING_OK = prev;
+    }
+  });
+
+  it('throws BindingRefMalformed on bad ref', async () => {
+    const { vault, audit } = ctx();
+    const injector = new CredentialInjector({ vault, audit });
+    await assert.rejects(
+      () => injector.injectEnv({}, ['jira/prod'], injCtx()),
+      (err: unknown) => err instanceof BindingRefMalformed,
+    );
+  });
+
+  it("emits one audit 'inject' record per binding with fields_injected (names only)", async () => {
+    const { vault, audit } = ctx();
+    await vault.set({ engine: 'jira', name: 'prod' }, { url: 'https://x', token: 't' });
+    const injector = new CredentialInjector({ vault, audit });
+    await injector.injectEnv({}, ['jira:prod'], injCtx());
+    const records: { action: string; detail: { fields_injected?: string[] } }[] = [];
+    for await (const r of audit.read({ producer: 'vault', action: 'inject' })) {
+      records.push(r as never);
+    }
+    assert.equal(records.length, 1);
+    assert.deepEqual(records[0]!.detail.fields_injected!.slice().sort(), ['token', 'url']);
+  });
+});
+
+describe('clearEnv', () => {
+  it('removes OTTO_DS_* keys, preserves others, returns count', () => {
+    const env: NodeJS.ProcessEnv = { PATH: '/bin', OTTO_DS_JIRA_PROD__URL: 'x', FOO: 'bar' };
+    const n = clearEnv(env);
+    assert.equal(n, 1);
+    assert.equal(env['OTTO_DS_JIRA_PROD__URL'], undefined);
+    assert.equal(env['PATH'], '/bin');
+    assert.equal(env['FOO'], 'bar');
+  });
+});

package/packages/coworker-vault/src/injector.ts

@@ -0,0 +1,98 @@
+// packages/coworker-vault/src/injector.ts
+import { AuditLog } from '@otto/coworker-utils';
+import { LocalDataVault } from './data-vault.js';
+import { BindingNotFound, VaultEntryNotFound } from './errors.js';
+import type { VaultEntry } from './types.js';
+
+export interface CredentialInjectorOptions {
+  vault: LocalDataVault;
+  audit: AuditLog;
+}
+
+export interface InjectionContext {
+  scratchpadName: string;
+  sessionId: string;
+  pid: number;
+}
+
+export class CredentialInjector {
+  constructor(private readonly opts: CredentialInjectorOptions) {}
+
+  async injectEnv(
+    baseEnv: NodeJS.ProcessEnv,
+    bindings: string[],
+    ctx: InjectionContext,
+  ): Promise<NodeJS.ProcessEnv> {
+    const out: NodeJS.ProcessEnv = { ...baseEnv };
+    const loose = process.env.OTTO_VAULT_MISSING_OK === '1';
+    for (const refStr of bindings) {
+      const ref = LocalDataVault.parseRef(refStr);
+      let entry: VaultEntry;
+      try {
+        entry = await this.opts.vault.get(ref);
+      } catch (err) {
+        if (err instanceof VaultEntryNotFound) {
+          if (loose) {
+            process.stderr.write(
+              `vault: binding ${refStr} missing — skipped (OTTO_VAULT_MISSING_OK=1)\n`,
+            );
+            this.opts.audit.append({
+              _schema: 1,
+              ts: new Date().toISOString(),
+              producer: 'vault',
+              action: 'inject-skipped',
+              severity: 'warn',
+              sessionId: ctx.sessionId,
+              scratchpadName: ctx.scratchpadName,
+              pid: ctx.pid,
+              detail: { ref: refStr, reason: 'not-found' },
+            });
+            continue;
+          }
+          throw new BindingNotFound(refStr);
+        }
+        throw err;
+      }
+      for (const [field, value] of Object.entries(entry.fields)) {
+        out[envVarName(ref.engine, ref.name, field)] = value;
+      }
+      this.opts.audit.append({
+        _schema: 1,
+        ts: new Date().toISOString(),
+        producer: 'vault',
+        action: 'inject',
+        sessionId: ctx.sessionId,
+        scratchpadName: ctx.scratchpadName,
+        pid: ctx.pid,
+        detail: {
+          engine: ref.engine,
+          name: ref.name,
+          fields_injected: Object.keys(entry.fields),
+        },
+      });
+    }
+    return out;
+  }
+
+  async loadForBinding(_serviceName: string): Promise<null> {
+    return null; // Phase 3+
+  }
+}
+
+export function envVarName(engineId: string, entryName: string, fieldName: string): string {
+  const e = engineId.replace(/-/g, '_').toUpperCase();
+  const n = entryName.replace(/-/g, '_').toUpperCase();
+  const f = fieldName.toUpperCase();
+  return `OTTO_DS_${e}_${n}__${f}`;
+}
+
+export function clearEnv(env: NodeJS.ProcessEnv = process.env): number {
+  let n = 0;
+  for (const key of Object.keys(env)) {
+    if (key.startsWith('OTTO_DS_')) {
+      delete env[key];
+      n++;
+    }
+  }
+  return n;
+}

package/packages/coworker-vault/src/types.ts

@@ -0,0 +1,33 @@
+// packages/coworker-vault/src/types.ts
+export interface EntryRef {
+  engine: string;
+  name: string;
+}
+
+export interface EngineField {
+  name: string;
+  label: string;
+  secret: boolean;
+  required: boolean;
+  default?: string;
+}
+
+export interface EngineDefinition {
+  schema_version: 1;
+  id: string;
+  label: string;
+  description?: string;
+  fields: EngineField[];
+}
+
+export interface VaultEntry {
+  _schema: 1;
+  engine: string;
+  name: string;
+  fields: Record<string, string>;
+  created_at: string;
+  last_modified_at: string;
+}
+
+export type EngineSource = 'builtin' | 'user' | 'workspace';
+export type VaultScope = 'global' | 'workspace';

package/packages/coworker-vault/src/vault-keep.test.ts

@@ -0,0 +1,49 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { VAULT_KEEP, mergeWithSentinel, assertNoSentinelInCreate } from './vault-keep.js';
+import type { EngineField } from './types.js';
+
+const FIELDS: EngineField[] = [
+  { name: 'url',   label: 'URL',   secret: false, required: true },
+  { name: 'token', label: 'Token', secret: true,  required: true },
+  { name: 'email', label: 'Email', secret: false, required: false },
+];
+
+describe('VAULT_KEEP', () => {
+  it('is the literal string "[VAULT_KEEP]"', () => {
+    assert.equal(VAULT_KEEP, '[VAULT_KEEP]');
+  });
+
+  describe('mergeWithSentinel (edit mode)', () => {
+    it('preserves stored secret when submitted value is the sentinel', () => {
+      const stored = { url: 'https://old', token: 'SECRET', email: 'a@b' };
+      const submitted = { url: 'https://new', token: VAULT_KEEP, email: 'c@d' };
+      const out = mergeWithSentinel(FIELDS, stored, submitted);
+      assert.deepEqual(out, { url: 'https://new', token: 'SECRET', email: 'c@d' });
+    });
+
+    it('replaces stored secret when submitted value differs from the sentinel', () => {
+      const stored = { url: 'u', token: 'OLD', email: 'e' };
+      const submitted = { url: 'u', token: 'NEW', email: 'e' };
+      const out = mergeWithSentinel(FIELDS, stored, submitted);
+      assert.equal(out.token, 'NEW');
+    });
+
+    it('ignores sentinel for non-secret fields (treats it as literal new value)', () => {
+      const stored = { url: 'u', token: 't', email: 'e' };
+      const submitted = { url: VAULT_KEEP, token: 't', email: 'e' };
+      const out = mergeWithSentinel(FIELDS, stored, submitted);
+      assert.equal(out.url, VAULT_KEEP);
+    });
+  });
+
+  describe('assertNoSentinelInCreate', () => {
+    it('throws when a secret field input equals the sentinel', () => {
+      assert.throws(() => assertNoSentinelInCreate(FIELDS, { url: 'u', token: VAULT_KEEP, email: 'e' }), /VAULT_KEEP is reserved/);
+    });
+
+    it('passes when no secret field equals the sentinel', () => {
+      assert.doesNotThrow(() => assertNoSentinelInCreate(FIELDS, { url: 'u', token: 'real', email: 'e' }));
+    });
+  });
+});

package/packages/coworker-vault/src/vault-keep.ts

@@ -0,0 +1,31 @@
+import type { EngineField } from './types.js';
+
+export const VAULT_KEEP = '[VAULT_KEEP]' as const;
+
+export function mergeWithSentinel(
+  fields: EngineField[],
+  stored: Record<string, string>,
+  submitted: Record<string, string>,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const f of fields) {
+    const sub = submitted[f.name];
+    if (f.secret && sub === VAULT_KEEP) {
+      out[f.name] = stored[f.name] ?? '';
+    } else {
+      out[f.name] = sub ?? '';
+    }
+  }
+  return out;
+}
+
+export function assertNoSentinelInCreate(
+  fields: EngineField[],
+  submitted: Record<string, string>,
+): void {
+  for (const f of fields) {
+    if (f.secret && submitted[f.name] === VAULT_KEEP) {
+      throw new Error(`VAULT_KEEP is reserved; pick a real value for field "${f.name}".`);
+    }
+  }
+}

package/packages/coworker-vault/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "target": "ES2022",
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "declaration": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  },
+  "include": ["src"],
+  "exclude": ["src/**/*.test.ts"]
+}

package/packages/coworker-vault/tsconfig.publish.json

@@ -0,0 +1,4 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": { "incremental": false }
+}

package/packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/daemon",
-  "version": "1.1.0",
+  "version": "1.2.4",
   "description": "OTTO daemon — background process for project monitoring and Discord integration",
   "license": "MIT",
   "repository": {
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.52.0",
-    "@otto-build/contracts": "^1.1.0",
-    "@otto-build/rpc-client": "^1.1.0",
+    "@otto-build/contracts": "^1.2.0",
+    "@otto-build/rpc-client": "^1.2.0",
     "discord.js": "^14.25.1",
     "yaml": "^2.8.0",
     "zod": "^3.24.0"

package/packages/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/mcp-server",
-  "version": "1.1.0",
+  "version": "1.2.4",
   "description": "MCP server exposing OTTO orchestration tools for compatible clients",
   "license": "MIT",
   "otto": {
@@ -34,8 +34,8 @@
     "test": "npm run build:test && node --test dist/mcp-server.test.js dist/remote-questions.test.js"
   },
   "dependencies": {
-    "@otto-build/contracts": "^1.1.0",
-    "@otto-build/rpc-client": "^1.1.0",
+    "@otto-build/contracts": "^1.2.0",
+    "@otto-build/rpc-client": "^1.2.0",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "zod": "^4.0.0"
   },