@inline-chat/hermes-agent-adapter 0.0.6 → 0.0.8-alpha.0

package/plugin/inline/cli.py

@@ -20,6 +20,8 @@ _SIDECAR_ENTRY = Path(__file__).parent / "sidecar" / "index.mjs"
 _MIN_NODE_MAJOR = 20
 _BOT_USERNAME_RE = re.compile(r"^[A-Za-z0-9_]+bot$", re.IGNORECASE)
 _CLI_INSTALL_URL = "https://inline.chat/cli/install.sh"
+_MAX_TOKEN_BYTES = 16 * 1024
+_MACHINE_SETUP_PROTOCOL_VERSION = 1
 
 
 def gateway_setup() -> None:
@@ -205,6 +207,11 @@ def _install_inline_cli(hermes_setup) -> str | None:
 
 
 def _find_inline_cli() -> str | None:
+    configured = os.getenv("INLINE_CLI_BIN", "").strip()
+    if configured:
+        candidate = Path(configured).expanduser()
+        if candidate.is_file() and os.access(candidate, os.X_OK):
+            return str(candidate)
     discovered = shutil.which("inline")
     if discovered:
         return discovered
@@ -242,25 +249,56 @@ def _configure_access(hermes_gateway, hermes_setup, owner_user_id: str | None) -
             allowed.append(value)
 
     if allowed:
-        value = ",".join(allowed)
-        hermes_gateway.save_env_value("INLINE_ALLOW_ALL_USERS", "false")
-        hermes_gateway.save_env_value("INLINE_ALLOWED_USERS", value)
-        hermes_gateway.save_env_value("INLINE_GROUP_ALLOW_FROM", value)
-        hermes_gateway.save_env_value("INLINE_DM_POLICY", "allowlist")
-        hermes_gateway.save_env_value("INLINE_GROUP_POLICY", "allowlist")
+        _apply_access(hermes_gateway, "allowlist", owner_user_id, allowed)
         hermes_setup.print_success("Only the listed Inline users can invoke Hermes.")
         return
 
     if hermes_setup.prompt_yes_no("Allow any Inline user who can reach the bot?", False):
+        _apply_access(hermes_gateway, "open", owner_user_id, [])
+        hermes_setup.print_warning("Open access enabled. Any reachable Inline user can invoke Hermes.")
+    else:
+        _apply_access(hermes_gateway, "disabled", owner_user_id, [])
+        hermes_setup.print_warning("Messaging is disabled until you add allowed user IDs and re-run setup.")
+
+
+def _apply_access(
+    hermes_gateway,
+    access: str,
+    owner_user_id: str | None,
+    allowed_user_ids: list[str],
+) -> list[str]:
+    normalized: list[str] = []
+    if access in ("owner", "allowlist"):
+        for value in [owner_user_id, *allowed_user_ids]:
+            candidate = str(value or "").strip()
+            if not candidate or not candidate.isdigit() or int(candidate) <= 0:
+                continue
+            if candidate not in normalized:
+                normalized.append(candidate)
+        if not normalized:
+            raise ValueError("owner or allowlist access requires a positive owner user ID")
+        joined = ",".join(normalized)
+        hermes_gateway.save_env_value("INLINE_ALLOW_ALL_USERS", "false")
+        hermes_gateway.save_env_value("INLINE_ALLOWED_USERS", joined)
+        hermes_gateway.save_env_value("INLINE_GROUP_ALLOW_FROM", joined)
+        hermes_gateway.save_env_value("INLINE_DM_POLICY", "allowlist")
+        hermes_gateway.save_env_value("INLINE_GROUP_POLICY", "allowlist")
+        return normalized
+    if access == "open":
         hermes_gateway.save_env_value("INLINE_ALLOW_ALL_USERS", "true")
+        hermes_gateway.save_env_value("INLINE_ALLOWED_USERS", "")
+        hermes_gateway.save_env_value("INLINE_GROUP_ALLOW_FROM", "")
         hermes_gateway.save_env_value("INLINE_DM_POLICY", "open")
         hermes_gateway.save_env_value("INLINE_GROUP_POLICY", "open")
-        hermes_setup.print_warning("Open access enabled. Any reachable Inline user can invoke Hermes.")
-    else:
+        return normalized
+    if access == "disabled":
         hermes_gateway.save_env_value("INLINE_ALLOW_ALL_USERS", "false")
+        hermes_gateway.save_env_value("INLINE_ALLOWED_USERS", "")
+        hermes_gateway.save_env_value("INLINE_GROUP_ALLOW_FROM", "")
         hermes_gateway.save_env_value("INLINE_DM_POLICY", "disabled")
         hermes_gateway.save_env_value("INLINE_GROUP_POLICY", "disabled")
-        hermes_setup.print_warning("Messaging is disabled until you add allowed user IDs and re-run setup.")
+        return normalized
+    raise ValueError(f"unsupported Inline access mode: {access}")
 
 
 def _inline_cli_user_id(inline_bin: str | None) -> str | None:
@@ -297,28 +335,178 @@ def _run_inline_json(inline_bin: str, args: list[str]) -> tuple[dict | None, str
 
 def register_cli(parser: argparse.ArgumentParser) -> None:
     subs = parser.add_subparsers(dest="inline_command", required=False)
-    subs.add_parser("setup", help="Configure Inline interactively")
-    subs.add_parser("status", help="Show Inline adapter status")
+    setup = subs.add_parser("setup", help="Configure Inline", description="Configure the Inline platform and its access policy.")
+    setup.add_argument("--non-interactive", action="store_true", help="Run prompt-free machine setup; requires the token on stdin.")
+    setup.add_argument("--token-stdin", action="store_true", help="Read one bounded Inline token from stdin instead of argv.")
+    setup.add_argument("--owner-user-id", help="Positive Inline user ID that owns the configured bot.")
+    setup.add_argument("--access", choices=["owner", "allowlist", "open", "disabled"], default="owner", help="Who may invoke Hermes through Inline (default: owner).")
+    setup.add_argument("--allow-user", action="append", default=[], type=_positive_user_id, help="Additional positive Inline user ID to allow; repeatable.")
+    setup.add_argument("--json", action="store_true", help="Print compact machine-readable setup output.")
+    status = subs.add_parser("status", help="Show Inline adapter status", description="Check Inline configuration, sidecar, Node runtime, and optional credential identity.")
+    status.add_argument("--json", action="store_true", help="Print compact machine-readable status output.")
+    status.add_argument("--probe", action="store_true", help="Verify the configured Inline credential and bot identity.")
     parser.set_defaults(func=dispatch)
 
 
+def _positive_user_id(value: str) -> str:
+    value = str(value or "").strip()
+    if not value.isdigit() or int(value) <= 0:
+        raise argparse.ArgumentTypeError("Inline user IDs must be positive integers")
+    return value
+
+
 def dispatch(args) -> int:
     command = getattr(args, "inline_command", None)
     if command is None:
         command = "status"
     if command == "setup":
+        if getattr(args, "non_interactive", False):
+            return _machine_setup(args)
         gateway_setup()
         return 0
     if command == "status":
-        configured = _env_token_configured()
+        return _status(args)
+    raise SystemExit(f"unknown inline command: {command}")
+
+
+def _machine_setup(args) -> int:
+    if not getattr(args, "token_stdin", False):
+        raise SystemExit("non-interactive Inline setup requires --token-stdin")
+    owner_user_id = str(getattr(args, "owner_user_id", "") or "").strip()
+    if not owner_user_id.isdigit() or int(owner_user_id) <= 0:
+        raise SystemExit("non-interactive Inline setup requires a positive --owner-user-id")
+    token = sys.stdin.read(_MAX_TOKEN_BYTES + 1)
+    if len(token.encode("utf-8")) > _MAX_TOKEN_BYTES:
+        raise SystemExit("Inline bot token exceeds the input limit")
+    token = token.strip()
+    if not token:
+        raise SystemExit("Inline bot token from stdin is empty")
+    from hermes_cli import gateway as hermes_gateway
+
+    hermes_gateway.save_env_value("INLINE_TOKEN", token)
+    allowed = _apply_access(
+        hermes_gateway,
+        getattr(args, "access", "owner"),
+        owner_user_id,
+        list(getattr(args, "allow_user", []) or []),
+    )
+    hermes_gateway.write_platform_config_field("inline", "enabled", True, raw=True)
+    result = {
+        "ok": True,
+        "action": "inline.setup",
+        "setupProtocolVersion": _MACHINE_SETUP_PROTOCOL_VERSION,
+        "pluginVersion": _plugin_version(),
+        "configured": True,
+        "access": getattr(args, "access", "owner"),
+        "ownerUserId": owner_user_id,
+        "allowedUserIds": allowed,
+    }
+    if getattr(args, "json", False):
+        print(json.dumps(result, separators=(",", ":")))
+    else:
+        print("Inline configured: yes")
+    return 0
+
+
+def _status(args) -> int:
+    from hermes_cli import gateway as hermes_gateway
+
+    token = (
+        hermes_gateway.get_env_value("INLINE_TOKEN")
+        or hermes_gateway.get_env_value("INLINE_BOT_TOKEN")
+    )
+    configured = bool(token)
+    probe_requested = bool(getattr(args, "probe", False))
+    probe = _probe_inline_token(token) if configured and probe_requested else None
+    node = _node_status()
+    sidecar = _sidecar_status(node)
+    sidecar_bundled = bool(
+        sidecar["exists"]
+        and sidecar["regularFile"]
+        and sidecar["readable"]
+        and sidecar["size"] > 0
+    )
+    runtime_usable = bool(sidecar["ok"] and node["ok"])
+    ready = runtime_usable and configured and (not probe_requested or bool(probe and probe.get("ok")))
+    result = {
+        "ok": ready,
+        "ready": ready,
+        "action": "inline.status",
+        "setupProtocolVersion": _MACHINE_SETUP_PROTOCOL_VERSION,
+        "pluginVersion": _plugin_version(),
+        "configured": configured,
+        "runtimeUsable": runtime_usable,
+        "sidecarBundled": sidecar_bundled,
+        "sidecar": sidecar,
+        "node": node,
+        "probeRequested": probe_requested,
+        **({"probe": probe} if probe is not None else {}),
+    }
+    if getattr(args, "json", False):
+        print(json.dumps(result, separators=(",", ":")))
+    else:
         print(f"Inline configured: {'yes' if configured else 'no'}")
-        print(f"Inline sidecar bundled: {'yes' if _SIDECAR_ENTRY.exists() else 'no'}")
-        print(f"Node available: {_node_status()}")
+        print(f"Inline sidecar usable: {'yes' if sidecar['ok'] else 'no'}")
+        print(f"Node available: {_node_status_text(node)}")
+        print(f"Inline runtime ready: {'yes' if ready else 'no'}")
         if not configured:
             print("Next: run `hermes inline setup` for guided bot setup.")
+        elif probe_requested:
+            print(f"Inline credential probe: {'ready' if ready else 'failed'}")
         print("Advanced diagnostics: inline-hermes doctor --json")
-        return 0
-    raise SystemExit(f"unknown inline command: {command}")
+    return 0 if runtime_usable and (not probe_requested or ready) else 1
+
+
+def _plugin_version() -> str:
+    """Read the separately installed plugin version without package-manager state."""
+    try:
+        for line in (Path(__file__).parent / "plugin.yaml").read_text(encoding="utf-8").splitlines():
+            key, separator, value = line.partition(":")
+            if separator and key.strip() == "version":
+                version = value.strip().strip("\"'")
+                if version:
+                    return version
+    except OSError:
+        pass
+    return "unknown"
+
+
+def _probe_inline_token(token: str) -> dict:
+    inline_bin = _find_inline_cli()
+    if not inline_bin:
+        return {"ok": False, "error": "Inline CLI was not found for the credential probe."}
+    env = os.environ.copy()
+    for name in ("INLINE_TOKEN", "INLINE_BOT_TOKEN", "INLINE_OWNER_TOKEN", "INLINE_ACCESS_TOKEN"):
+        env.pop(name, None)
+    env["INLINE_TOKEN"] = token
+    try:
+        result = subprocess.run(
+            [inline_bin, "--json", "--compact", "auth", "me"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+            timeout=30,
+            check=False,
+            env=env,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return {"ok": False, "error": "Inline credential probe could not run."}
+    if result.returncode != 0:
+        return {"ok": False, "error": "Inline rejected the configured credential."}
+    try:
+        payload = json.loads(result.stdout)
+    except (json.JSONDecodeError, TypeError):
+        return {"ok": False, "error": "Inline credential probe returned unreadable output."}
+    raw_id = payload.get("id") if isinstance(payload, dict) else None
+    bot_user_id = str(raw_id).strip() if raw_id is not None else ""
+    if not bot_user_id.isdigit() or int(bot_user_id) <= 0:
+        return {"ok": False, "error": "Inline credential probe returned no bot identity."}
+    username = str(payload.get("username") or "").strip().lstrip("@")
+    return {
+        "ok": True,
+        "botUserId": bot_user_id,
+        **({"botUsername": username} if username else {}),
+    }
 
 
 def _env_token_configured() -> bool:
@@ -339,10 +527,17 @@ def _find_node_bin() -> str | None:
     return shutil.which("node")
 
 
-def _node_status() -> str:
+def _node_status() -> dict:
     node_bin = _find_node_bin()
     if not node_bin:
-        return "no"
+        return {
+            "ok": False,
+            "path": None,
+            "version": None,
+            "major": None,
+            "minimumMajor": _MIN_NODE_MAJOR,
+            "error": "Node.js was not found.",
+        }
     try:
         result = subprocess.run(
             [node_bin, "--version"],
@@ -353,12 +548,88 @@ def _node_status() -> str:
             check=False,
         )
     except Exception as exc:
-        return f"no ({exc})"
+        return {
+            "ok": False,
+            "path": node_bin,
+            "version": None,
+            "major": None,
+            "minimumMajor": _MIN_NODE_MAJOR,
+            "error": f"Node.js could not run: {exc}",
+        }
     version = (result.stdout or result.stderr or "").strip()
     if result.returncode != 0:
-        return f"no ({version or f'exited with status {result.returncode}'})"
+        return {
+            "ok": False,
+            "path": node_bin,
+            "version": version or None,
+            "major": None,
+            "minimumMajor": _MIN_NODE_MAJOR,
+            "error": f"Node.js exited with status {result.returncode}.",
+        }
     match = re.search(r"\bv?(\d+)(?:\.\d+){0,2}\b", version)
-    major = int(match.group(1)) if match else 0
-    if major < _MIN_NODE_MAJOR:
-        return f"no ({version or 'unknown version'}, requires >=20)"
-    return f"yes ({version})"
+    major = int(match.group(1)) if match else None
+    ok = major is not None and major >= _MIN_NODE_MAJOR
+    return {
+        "ok": ok,
+        "path": node_bin,
+        "version": version or None,
+        "major": major,
+        "minimumMajor": _MIN_NODE_MAJOR,
+        "error": None if ok else f"Node.js {version or 'version'} is incompatible; requires >= {_MIN_NODE_MAJOR}.",
+    }
+
+
+def _sidecar_status(node: dict) -> dict:
+    try:
+        info = _SIDECAR_ENTRY.stat()
+        exists = True
+        regular_file = _SIDECAR_ENTRY.is_file()
+        readable = os.access(_SIDECAR_ENTRY, os.R_OK)
+        size = info.st_size
+    except OSError:
+        exists = False
+        regular_file = False
+        readable = False
+        size = 0
+
+    syntax_checked = False
+    syntax_ok = False
+    error = None
+    if not exists:
+        error = "The packaged Inline sidecar is missing."
+    elif not regular_file or not readable or size <= 0:
+        error = "The packaged Inline sidecar is not a readable non-empty file."
+    elif node.get("ok"):
+        syntax_checked = True
+        try:
+            checked = subprocess.run(
+                [str(node["path"]), "--check", str(_SIDECAR_ENTRY)],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+                timeout=10,
+                check=False,
+            )
+            syntax_ok = checked.returncode == 0
+            if not syntax_ok:
+                error = "The packaged Inline sidecar failed Node.js syntax validation."
+        except (OSError, subprocess.TimeoutExpired):
+            error = "The packaged Inline sidecar could not be validated by Node.js."
+    else:
+        error = "The packaged Inline sidecar cannot run without compatible Node.js."
+
+    return {
+        "ok": bool(exists and regular_file and readable and size > 0 and syntax_checked and syntax_ok),
+        "exists": exists,
+        "regularFile": regular_file,
+        "readable": readable,
+        "size": size,
+        "syntaxChecked": syntax_checked,
+        "syntaxOk": syntax_ok,
+        "error": error,
+    }
+
+
+def _node_status_text(node: dict) -> str:
+    if node.get("ok"):
+        return f"yes ({node.get('version') or 'unknown version'})"
+    return f"no ({node.get('error') or 'unknown error'})"

package/plugin/inline/plugin.yaml

@@ -1,7 +1,7 @@
 name: inline-platform
 label: Inline
 kind: platform
-version: 0.0.6
+version: 0.0.8-alpha.0
 description: >
   Inline platform adapter for Hermes Agent. The adapter runs as a native
   Hermes Python platform plugin and supervises a local Node sidecar that uses