@cmetech/otto 1.1.1 → 1.2.4

package/src/resources/extensions/coworker-scratchpad/workspace-pointer.ts

@@ -0,0 +1,55 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export interface WorkspacePointer {
+  schema_version: 1;
+  workspace_hash: string;
+  workspace_root: string;
+  last_session_id: string;
+  last_current_name: string;
+  last_attached_at: string;
+}
+
+export const WORKSPACE_POINTER_STALE_MS = 7 * 24 * 60 * 60 * 1000;
+
+export function workspaceHash(workspaceRoot: string): string {
+  return createHash('sha256').update(workspaceRoot).digest('hex').slice(0, 16);
+}
+
+export function workspacePointerPath(rootDir: string, hash: string): string {
+  return join(rootDir, '_workspaces', `${hash}.json`);
+}
+
+export function readWorkspacePointer(path: string): WorkspacePointer | null {
+  if (!existsSync(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8')) as Partial<WorkspacePointer>;
+    if (
+      parsed.schema_version === 1 &&
+      typeof parsed.workspace_hash === 'string' &&
+      typeof parsed.workspace_root === 'string' &&
+      typeof parsed.last_session_id === 'string' &&
+      typeof parsed.last_current_name === 'string' &&
+      typeof parsed.last_attached_at === 'string'
+    ) {
+      return parsed as WorkspacePointer;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+export function writeWorkspacePointer(path: string, payload: WorkspacePointer): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.tmp`;
+  writeFileSync(tmp, JSON.stringify(payload, null, 2));
+  renameSync(tmp, path);
+}
+
+export function isPointerFresh(pointer: WorkspacePointer, now: number): boolean {
+  const attachedAt = Date.parse(pointer.last_attached_at);
+  if (Number.isNaN(attachedAt)) return false;
+  return (now - attachedAt) < WORKSPACE_POINTER_STALE_MS;
+}

package/src/resources/extensions/coworker-scratchpad/workspace-root.test.ts

@@ -0,0 +1,51 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
+import { execSync } from 'node:child_process';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { detectWorkspaceRoot } from './workspace-root.js';
+
+describe('detectWorkspaceRoot', () => {
+  it('returns git toplevel when invoked inside a git repo', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'wsr-git-'));
+    try {
+      execSync('git init -q', { cwd: dir });
+      const sub = join(dir, 'a', 'b');
+      mkdirSync(sub, { recursive: true });
+      const root = detectWorkspaceRoot(sub);
+      // On macOS, /tmp resolves through /private — compare resolved paths.
+      assert.equal(
+        execSync('pwd -P', { cwd: dir, encoding: 'utf8' }).trim(),
+        execSync('pwd -P', { cwd: root, encoding: 'utf8' }).trim(),
+      );
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('returns cwd when not in a git repo', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'wsr-nogit-'));
+    try {
+      assert.equal(detectWorkspaceRoot(dir), dir);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('returns cwd when git command fails (mocked via PATH override)', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'wsr-pathfail-'));
+    try {
+      // Run with PATH=/nonexistent so git isn't findable; detection should fall back to cwd.
+      const origPath = process.env.PATH;
+      process.env.PATH = '/nonexistent';
+      try {
+        assert.equal(detectWorkspaceRoot(dir), dir);
+      } finally {
+        process.env.PATH = origPath;
+      }
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/resources/extensions/coworker-scratchpad/workspace-root.ts

@@ -0,0 +1,16 @@
+import { execSync } from 'node:child_process';
+
+export function detectWorkspaceRoot(cwd: string): string {
+  try {
+    const out = execSync('git rev-parse --show-toplevel', {
+      cwd,
+      stdio: ['ignore', 'pipe', 'ignore'],
+      encoding: 'utf8',
+      timeout: 500,
+    }).trim();
+    if (out) return out;
+  } catch {
+    /* not a git repo, git not installed, or timeout — fall through */
+  }
+  return cwd;
+}

package/src/resources/extensions/coworker-vault/audit-command.test.ts

@@ -0,0 +1,109 @@
+// src/resources/extensions/coworker-vault/audit-command.test.ts
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { AuditRecord } from '@otto/coworker-utils';
+import { createVaultBundle, type VaultBundle } from './vault-singleton.js';
+import { runAudit } from './audit-command.js';
+
+async function freshBundle(): Promise<VaultBundle> {
+  const root = mkdtempSync(join(tmpdir(), 'audit-cmd-'));
+  return createVaultBundle({ globalDir: join(root, 'global') });
+}
+
+function record(overrides: Partial<AuditRecord> & { ts: string }): AuditRecord {
+  return {
+    _schema: 1,
+    producer: 'vault',
+    action: 'set',
+    detail: {},
+    ...overrides,
+  };
+}
+
+describe('/audit', () => {
+  it('returns last 50 records by default, newest first', async () => {
+    const bundle = await freshBundle();
+    const base = Date.now();
+    for (let i = 0; i < 60; i++) {
+      bundle.audit.append(
+        record({ ts: new Date(base + i * 1000).toISOString() }),
+      );
+    }
+    const out = await runAudit(bundle, {});
+    assert.equal(out.length, 50);
+    // newest first → ts strictly decreasing
+    for (let i = 1; i < out.length; i++) {
+      assert.ok(out[i - 1]!.ts > out[i]!.ts, `expected ${out[i - 1]!.ts} > ${out[i]!.ts}`);
+    }
+    // Newest record overall must be first
+    const expectedNewest = new Date(base + 59 * 1000).toISOString();
+    assert.equal(out[0]!.ts, expectedNewest);
+  });
+
+  it('filters by producer', async () => {
+    const bundle = await freshBundle();
+    const now = Date.now();
+    bundle.audit.append(
+      record({
+        ts: new Date(now).toISOString(),
+        producer: 'vault',
+        action: 'set',
+      }),
+    );
+    bundle.audit.append(
+      record({
+        ts: new Date(now + 1000).toISOString(),
+        producer: 'secret-scanner',
+        action: 'redact',
+      }),
+    );
+    const out = await runAudit(bundle, { producer: 'secret-scanner' });
+    assert.equal(out.length, 1);
+    assert.equal(out[0]!.producer, 'secret-scanner');
+    assert.equal(out[0]!.action, 'redact');
+  });
+
+  it('filters by engine via detail.engine', async () => {
+    const bundle = await freshBundle();
+    const now = Date.now();
+    bundle.audit.append(
+      record({
+        ts: new Date(now).toISOString(),
+        producer: 'vault',
+        action: 'set',
+        detail: { engine: 'jira' },
+      }),
+    );
+    bundle.audit.append(
+      record({
+        ts: new Date(now + 1000).toISOString(),
+        producer: 'vault',
+        action: 'set',
+        detail: { engine: 'datadog' },
+      }),
+    );
+    const out = await runAudit(bundle, { engine: 'jira' });
+    assert.equal(out.length, 1);
+    assert.equal((out[0]!.detail as { engine?: string }).engine, 'jira');
+  });
+
+  it('--since filter accepts duration tokens (1h, 24h, 7d)', async () => {
+    const bundle = await freshBundle();
+    const now = Date.now();
+    const twoHoursAgo = new Date(now - 2 * 60 * 60 * 1000).toISOString();
+    const thirtySecondsAgo = new Date(now - 30 * 1000).toISOString();
+    bundle.audit.append(
+      record({ ts: twoHoursAgo, action: 'old' }),
+    );
+    bundle.audit.append(
+      record({ ts: thirtySecondsAgo, action: 'recent' }),
+    );
+    const out = await runAudit(bundle, { since: '1h' });
+    assert.equal(out.length, 1);
+    assert.equal(out[0]!.action, 'recent');
+    assert.equal(out[0]!.ts, thirtySecondsAgo);
+  });
+});

package/src/resources/extensions/coworker-vault/audit-command.ts

@@ -0,0 +1,56 @@
+// src/resources/extensions/coworker-vault/audit-command.ts
+//
+// Programmatic reader for the audit log. Resolves duration tokens like
+// '1h', '24h', '7d' into ISO-8601 lower bounds, delegates filtering to
+// AuditLog.read, and caps the result at `limit` (default 50). Records are
+// returned newest-first because AuditLog yields in descending ts order.
+import type { AuditRecord } from '@otto/coworker-utils';
+import type { VaultBundle } from './vault-singleton.js';
+
+export interface AuditQuery {
+  since?: string;                     // '1h' | '24h' | '7d' | ISO-8601
+  producer?: string;
+  engine?: string;
+  action?: string;
+  severity?: 'info' | 'warn';
+  limit?: number;                     // default 50
+}
+
+const DURATION_RE = /^(\d+)([smhd])$/;
+const MS: Record<string, number> = {
+  s: 1000,
+  m: 60_000,
+  h: 3_600_000,
+  d: 86_400_000,
+};
+
+function resolveSince(token: string | undefined): string | undefined {
+  if (!token) return undefined;
+  const m = DURATION_RE.exec(token);
+  if (m) {
+    const n = parseInt(m[1]!, 10);
+    const unit = m[2]!;
+    return new Date(Date.now() - n * MS[unit]!).toISOString();
+  }
+  return token; // treat as ISO-8601
+}
+
+export async function runAudit(
+  bundle: VaultBundle,
+  q: AuditQuery,
+): Promise<AuditRecord[]> {
+  const since = resolveSince(q.since);
+  const limit = q.limit ?? 50;
+  const out: AuditRecord[] = [];
+  for await (const r of bundle.audit.read({
+    since,
+    producer: q.producer,
+    action: q.action,
+    severity: q.severity,
+    engineId: q.engine,
+  })) {
+    out.push(r);
+    if (out.length >= limit) break;
+  }
+  return out;
+}

package/src/resources/extensions/coworker-vault/connect-command.test.ts

@@ -0,0 +1,103 @@
+// src/resources/extensions/coworker-vault/connect-command.test.ts
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createVaultBundle } from './vault-singleton.js';
+import { runConnect } from './connect-command.js';
+import { VAULT_KEEP } from '@otto/coworker-vault';
+
+function answers(map: Record<string, string>): (field: string) => Promise<string> {
+  return async (field: string) => map[field] ?? '';
+}
+
+async function freshBundle() {
+  const root = mkdtempSync(join(tmpdir(), 'connect-cmd-'));
+  return createVaultBundle({ globalDir: join(root, 'global') });
+}
+
+describe('/connect', () => {
+  it('creates a new entry from field prompts', async () => {
+    const bundle = await freshBundle();
+    await runConnect(bundle, {
+      engineId: 'jira',
+      entryName: 'prod',
+      forceWorkspace: false,
+      promptProvider: answers({
+        url: 'https://x',
+        email: 'a@b',
+        token: 'tok',
+      }),
+    });
+    const got = await bundle.vault.get({ engine: 'jira', name: 'prod' });
+    assert.deepEqual(got.fields, { url: 'https://x', email: 'a@b', token: 'tok' });
+  });
+
+  it('edits an existing entry; sentinel preserves the stored secret', async () => {
+    const bundle = await freshBundle();
+    await bundle.vault.set(
+      { engine: 'jira', name: 'prod' },
+      { url: 'u', email: 'e', token: 'OLD' },
+    );
+    await runConnect(bundle, {
+      engineId: 'jira',
+      entryName: 'prod',
+      forceWorkspace: false,
+      promptProvider: answers({
+        url: 'NEW_URL',
+        email: 'NEW_EMAIL',
+        token: VAULT_KEEP,
+      }),
+    });
+    const got = await bundle.vault.get({ engine: 'jira', name: 'prod' });
+    assert.deepEqual(got.fields, { url: 'NEW_URL', email: 'NEW_EMAIL', token: 'OLD' });
+  });
+
+  it('rejects unknown engine', async () => {
+    const bundle = await freshBundle();
+    await assert.rejects(
+      runConnect(bundle, {
+        engineId: 'nope',
+        entryName: 'prod',
+        forceWorkspace: false,
+        promptProvider: answers({}),
+      }),
+      /Unknown engine/,
+    );
+  });
+
+  it('rejects sentinel in create-mode secret field', async () => {
+    const bundle = await freshBundle();
+    await assert.rejects(
+      runConnect(bundle, {
+        engineId: 'jira',
+        entryName: 'prod',
+        forceWorkspace: false,
+        promptProvider: answers({
+          url: 'https://x',
+          email: 'a@b',
+          token: VAULT_KEEP,
+        }),
+      }),
+      /VAULT_KEEP is reserved/,
+    );
+  });
+
+  it('errors when a required field is empty', async () => {
+    const bundle = await freshBundle();
+    await assert.rejects(
+      runConnect(bundle, {
+        engineId: 'jira',
+        entryName: 'prod',
+        forceWorkspace: false,
+        promptProvider: answers({
+          url: '',
+          email: 'a@b',
+          token: 'tok',
+        }),
+      }),
+      /required/i,
+    );
+  });
+});

package/src/resources/extensions/coworker-vault/connect-command.ts

@@ -0,0 +1,69 @@
+// src/resources/extensions/coworker-vault/connect-command.ts
+//
+// Programmatic /connect wizard. Walks an engine's fields via a `promptProvider`
+// callback, handles VAULT_KEEP sentinel for edits, validates required fields,
+// and writes through LocalDataVault.set. No TUI dependencies — the TUI binding
+// (clack/prompts) is wired separately and passes a clack-based provider.
+import {
+  mergeWithSentinel,
+  assertNoSentinelInCreate,
+  VAULT_KEEP,
+  VaultEntryNotFound,
+} from '@otto/coworker-vault';
+import type { VaultBundle } from './vault-singleton.js';
+
+export interface PromptFieldOptions {
+  label: string;
+  secret: boolean;
+  required: boolean;
+  defaultValue?: string;
+}
+
+export interface ConnectOptions {
+  engineId: string;
+  entryName: string;
+  forceWorkspace: boolean;
+  promptProvider: (field: string, opts: PromptFieldOptions) => Promise<string>;
+}
+
+export async function runConnect(bundle: VaultBundle, opts: ConnectOptions): Promise<void> {
+  const engine = bundle.registry.require(opts.engineId);
+
+  let existing: Record<string, string> | undefined;
+  try {
+    const got = await bundle.vault.get({ engine: opts.engineId, name: opts.entryName });
+    existing = got.fields;
+  } catch (err) {
+    if (!(err instanceof VaultEntryNotFound)) throw err;
+  }
+
+  const submitted: Record<string, string> = {};
+  for (const f of engine.fields) {
+    const defaultValue = existing && f.secret
+      ? VAULT_KEEP
+      : (existing?.[f.name] ?? f.default ?? '');
+    const value = await opts.promptProvider(f.name, {
+      label: f.label,
+      secret: f.secret,
+      required: f.required,
+      defaultValue,
+    });
+    if (f.required && value.trim() === '') {
+      throw new Error(`Field "${f.name}" is required.`);
+    }
+    submitted[f.name] = value;
+  }
+
+  if (!existing) {
+    assertNoSentinelInCreate(engine.fields, submitted);
+  }
+  const merged = existing
+    ? mergeWithSentinel(engine.fields, existing, submitted)
+    : submitted;
+
+  await bundle.vault.set(
+    { engine: opts.engineId, name: opts.entryName },
+    merged,
+    { forceWorkspace: opts.forceWorkspace },
+  );
+}

package/src/resources/extensions/coworker-vault/datasource-command.test.ts

@@ -0,0 +1,80 @@
+// src/resources/extensions/coworker-vault/datasource-command.test.ts
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createVaultBundle } from './vault-singleton.js';
+import {
+  runDatasourceList,
+  runDatasourceRemove,
+  runDatasourceTest,
+} from './datasource-command.js';
+
+async function freshBundle() {
+  const root = mkdtempSync(join(tmpdir(), 'datasource-cmd-'));
+  const globalDir = join(root, 'global');
+  const bundle = await createVaultBundle({ globalDir });
+  return { bundle, globalDir };
+}
+
+describe('/datasource', () => {
+  it('list returns rows with engine, name, scope, fields_set (secret fields marked)', async () => {
+    const { bundle } = await freshBundle();
+    await bundle.vault.set(
+      { engine: 'jira', name: 'prod' },
+      { url: 'u', email: 'e', token: 't' },
+    );
+    const rows = await runDatasourceList(bundle, {});
+    assert.equal(rows.length, 1);
+    const row = rows[0]!;
+    assert.equal(row.engine, 'jira');
+    assert.equal(row.name, 'prod');
+    assert.equal(row.scope, 'global');
+    const sortedFields = [...row.fields].sort((a, b) => a.name.localeCompare(b.name));
+    assert.deepEqual(sortedFields, [
+      { name: 'email', secret: false, display: 'e' },
+      { name: 'token', secret: true, display: '••••••' },
+      { name: 'url', secret: false, display: 'u' },
+    ]);
+  });
+
+  it('list filters by --engine', async () => {
+    const { bundle } = await freshBundle();
+    await bundle.vault.set(
+      { engine: 'jira', name: 'prod' },
+      { url: 'u', email: 'e', token: 't' },
+    );
+    const jiraRows = await runDatasourceList(bundle, { engine: 'jira' });
+    assert.equal(jiraRows.length, 1);
+    const datadogRows = await runDatasourceList(bundle, { engine: 'datadog' });
+    assert.equal(datadogRows.length, 0);
+  });
+
+  it('remove deletes entry file', async () => {
+    const { bundle, globalDir } = await freshBundle();
+    await bundle.vault.set(
+      { engine: 'jira', name: 'prod' },
+      { url: 'u', email: 'e', token: 't' },
+    );
+    const path = join(globalDir, 'data_vault', 'jira-prod.json');
+    assert.equal(existsSync(path), true);
+    await runDatasourceRemove(bundle, { ref: 'jira:prod' });
+    assert.equal(existsSync(path), false);
+  });
+
+  it('test returns OTTO_DS_* env-var names that would inject (no network)', async () => {
+    const { bundle } = await freshBundle();
+    await bundle.vault.set(
+      { engine: 'jira', name: 'prod' },
+      { url: 'u', email: 'e', token: 't' },
+    );
+    const preview = await runDatasourceTest(bundle, { ref: 'jira:prod' });
+    const sorted = [...preview.envVarNames].sort();
+    assert.deepEqual(sorted, [
+      'OTTO_DS_JIRA_PROD__EMAIL',
+      'OTTO_DS_JIRA_PROD__TOKEN',
+      'OTTO_DS_JIRA_PROD__URL',
+    ]);
+  });
+});

package/src/resources/extensions/coworker-vault/datasource-command.ts

@@ -0,0 +1,81 @@
+// src/resources/extensions/coworker-vault/datasource-command.ts
+//
+// Programmatic /datasource list|remove|test commands. `edit` is wired at the
+// routing layer (Task 16) as an alias for runConnect and does not need its own
+// function here. No TUI dependencies.
+import { LocalDataVault, envVarName } from '@otto/coworker-vault';
+import type { VaultBundle } from './vault-singleton.js';
+
+export interface ListedField {
+  name: string;
+  secret: boolean;
+  display: string;
+}
+
+export interface ListedRow {
+  engine: string;
+  name: string;
+  scope: 'global' | 'workspace';
+  fields: ListedField[];
+  last_modified_at: string;
+}
+
+export async function runDatasourceList(
+  bundle: VaultBundle,
+  filter: { engine?: string },
+): Promise<ListedRow[]> {
+  const all = await bundle.vault.list();
+  const out: ListedRow[] = [];
+  for (const row of all) {
+    if (filter.engine && row.engine !== filter.engine) continue;
+    const engine = bundle.registry.get(row.engine);
+    let fields: ListedField[] = [];
+    if (engine) {
+      const entry = await bundle.vault.get({ engine: row.engine, name: row.name });
+      fields = engine.fields
+        .map((f) => ({
+          name: f.name,
+          secret: f.secret,
+          display: f.secret ? '••••••' : (entry.fields[f.name] ?? ''),
+        }))
+        .filter((f) => row.fields_set.includes(f.name));
+    } else {
+      fields = row.fields_set.map((n) => ({ name: n, secret: false, display: '' }));
+    }
+    out.push({
+      engine: row.engine,
+      name: row.name,
+      scope: row.scope,
+      fields,
+      last_modified_at: row.last_modified_at,
+    });
+  }
+  return out;
+}
+
+export async function runDatasourceRemove(
+  bundle: VaultBundle,
+  args: { ref: string },
+): Promise<void> {
+  const ref = LocalDataVault.parseRef(args.ref);
+  await bundle.vault.remove(ref);
+}
+
+export interface TestPreview {
+  ref: string;
+  engine: string;
+  envVarNames: string[];
+}
+
+export async function runDatasourceTest(
+  bundle: VaultBundle,
+  args: { ref: string },
+): Promise<TestPreview> {
+  const ref = LocalDataVault.parseRef(args.ref);
+  const entry = await bundle.vault.get(ref);
+  return {
+    ref: args.ref,
+    engine: ref.engine,
+    envVarNames: Object.keys(entry.fields).map((f) => envVarName(ref.engine, ref.name, f)),
+  };
+}

package/src/resources/extensions/coworker-vault/extension-manifest.json

@@ -0,0 +1,12 @@
+{
+  "id": "coworker-vault",
+  "name": "Co-worker Vault",
+  "version": "1.0.0",
+  "description": "Credential vault: /connect wizard, /datasource manager, /audit reader",
+  "tier": "bundled",
+  "requires": { "platform": ">=2.29.0" },
+  "provides": {
+    "commands": ["connect", "datasource", "audit"],
+    "hooks": ["session_shutdown"]
+  }
+}