@karmaniverous/jeeves-server 3.2.0 → 3.3.0

package/CHANGELOG.md

@@ -2,13 +2,32 @@
 
 All notable changes to this project will be documented in this file. Dates are displayed in UTC.
 
-#### [3.2.0](https://github.com/karmaniverous/jeeves-server/compare/service/3.1.3...3.2.0)
+#### [3.3.0](https://github.com/karmaniverous/jeeves-server/compare/service/3.2.1...3.3.0)
+
+- feat: core v0.2.0 SDK adoption [`#111`](https://github.com/karmaniverous/jeeves-server/pull/111)
+- chore: release @karmaniverous/jeeves-server-openclaw v0.3.1 [`11309c1`](https://github.com/karmaniverous/jeeves-server/commit/11309c1c3d82f6950b3d0291546206b523df83fa)
+
+#### [service/3.2.1](https://github.com/karmaniverous/jeeves-server/compare/service/3.2.0...service/3.2.1)
+
+> 19 March 2026
+
+- fix(openclaw): bundle @karmaniverous/jeeves into plugin dist [`61fb7ac`](https://github.com/karmaniverous/jeeves-server/commit/61fb7ac3f91a036cef16720c16c33fe399f7c4e6)
+- chore: release @karmaniverous/jeeves-server v3.2.1 [`f13677b`](https://github.com/karmaniverous/jeeves-server/commit/f13677bd1cd020416ba510eaabc58ad85ee9aabf)
+- chore(openclaw): use resolveWorkspacePath from jeeves 0.1.4 [`71ddd58`](https://github.com/karmaniverous/jeeves-server/commit/71ddd588f1b5736f0cbd4d81d42bb0f9356eafe8)
+- chore(openclaw): update jeeves to 0.1.6, add servicePackage/pluginPackage [`1847ff7`](https://github.com/karmaniverous/jeeves-server/commit/1847ff750613b3770198b20b4bacd7e93bf0ec52)
+- chore(openclaw): update @karmaniverous/jeeves to 0.1.5 [`c8b040b`](https://github.com/karmaniverous/jeeves-server/commit/c8b040bfa945b3814cbde9395cf1d3f00cdd64a8)
+- chore(openclaw): update @karmaniverous/jeeves to 0.1.3 [`6de1c66`](https://github.com/karmaniverous/jeeves-server/commit/6de1c667a2f1b6de3660c92f96774fccbb927321)
+
+#### [service/3.2.0](https://github.com/karmaniverous/jeeves-server/compare/service/3.1.3...service/3.2.0)
+
+> 18 March 2026
 
 - feat(openclaw): adopt jeeves core component writer [`#105`](https://github.com/karmaniverous/jeeves-server/pull/105)
 - test(openclaw): expand coverage for openclawPaths, pluginRemove, serviceCommands [`b38ecac`](https://github.com/karmaniverous/jeeves-server/commit/b38ecaccc1fe1129630c1be993b6eafb31d86f6b)
 - chore(openclaw): update deps, clean knip config [`82cb058`](https://github.com/karmaniverous/jeeves-server/commit/82cb0585004163f0ee92f17d231795bffef2e5bb)
 - docs: full documentation pass with PlantUML diagrams [`537a9d7`](https://github.com/karmaniverous/jeeves-server/commit/537a9d79ff23ea978697c44cb0bb91c908b761de)
 - refactor(openclaw): resolve SOLID/DRY violations [`87df443`](https://github.com/karmaniverous/jeeves-server/commit/87df44307cb40eddbc9e1b217232eda194d2921b)
+- chore: release @karmaniverous/jeeves-server v3.2.0 [`fda70c6`](https://github.com/karmaniverous/jeeves-server/commit/fda70c6bbacb109f00e13468ebf9052176b045d9)
 - refactor(openclaw): use createAsyncContentCache from jeeves v0.1.1 [`9732ad9`](https://github.com/karmaniverous/jeeves-server/commit/9732ad9635c747e78f9fe2d6fd5b3b893f51efc4)
 - npm audit fix [`7c578d4`](https://github.com/karmaniverous/jeeves-server/commit/7c578d4bb588514019cddf758d9f43252b25fe42)
 - test(openclaw): cover service commands [`08f478c`](https://github.com/karmaniverous/jeeves-server/commit/08f478cd4ad8aa9a1d9e06dc595535ae2e869a11)

package/dist/src/routes/config.js

@@ -0,0 +1,40 @@
+/**
+ * GET /config — query service configuration with optional JSONPath.
+ *
+ * Uses the core SDK's `createConfigQueryHandler()` for JSONPath support.
+ *
+ * @module routes/config
+ */
+import { createConfigQueryHandler } from '@karmaniverous/jeeves';
+import { getConfig } from '../config/index.js';
+/** Return a sanitized copy of the config (redact sensitive fields). */
+export function sanitizeConfig(config) {
+    return {
+        ...config,
+        sessionSecret: config.sessionSecret ? '[REDACTED]' : null,
+        internalInsiderKey: config.internalInsiderKey ? '[REDACTED]' : null,
+        googleAuth: config.googleAuth
+            ? {
+                clientId: config.googleAuth.clientId,
+                clientSecret: '[REDACTED]',
+            }
+            : null,
+        resolvedKeys: config.resolvedKeys.map((k) => ({
+            ...k,
+            seed: '[REDACTED]',
+        })),
+        resolvedInsiders: config.resolvedInsiders.map((i) => ({
+            ...i,
+            seed: '[REDACTED]',
+        })),
+    };
+}
+/** Register the GET /config route. */
+export function registerConfigRoute(app) {
+    const configHandler = createConfigQueryHandler(() => sanitizeConfig(getConfig()));
+    app.get('/config', async (request, reply) => {
+        const { path } = request.query;
+        const result = await configHandler({ path });
+        return reply.status(result.status).send(result.body);
+    });
+}

package/dist/src/routes/config.test.js

@@ -0,0 +1,107 @@
+/**
+ * Tests for GET /config route sanitization logic.
+ */
+import { describe, expect, it } from 'vitest';
+import { sanitizeConfig } from './config.js';
+/** Minimal RuntimeConfig fixture with sensitive fields populated. */
+function makeConfig(overrides = {}) {
+    return {
+        port: 1934,
+        eventTimeoutMs: 30_000,
+        eventLogPurgeMs: 604_800_000,
+        maxZipSizeMb: 100,
+        chromePath: '/usr/bin/chromium',
+        plantuml: { servers: [] },
+        outsiderPolicy: null,
+        events: {},
+        authModes: ['keys'],
+        resolvedKeys: [
+            {
+                name: 'primary',
+                seed: 'secret-key-seed-abc',
+                scopes: null,
+            },
+        ],
+        resolvedInsiders: [
+            {
+                email: 'jason@example.com',
+                seed: 'secret-insider-seed-xyz',
+                scopes: null,
+                keyCreatedAt: '2026-01-01T00:00:00Z',
+            },
+        ],
+        googleAuth: {
+            clientId: 'public-client-id',
+            clientSecret: 'super-secret-oauth-secret',
+        },
+        sessionSecret: 'session-hmac-secret',
+        internalInsiderKey: 'internal-key-seed',
+        configPath: '/etc/jeeves-server.config.json',
+        eventsLog: '/var/log/events.log',
+        stateFile: '/var/state.json',
+        eventQueuePath: '/var/queue.jsonl',
+        eventQueueCursorPath: '/var/cursor.json',
+        eventLogPath: '/var/event-log.jsonl',
+        ...overrides,
+    };
+}
+describe('sanitizeConfig', () => {
+    it('redacts sessionSecret', () => {
+        const result = sanitizeConfig(makeConfig());
+        expect(result.sessionSecret).toBe('[REDACTED]');
+    });
+    it('returns null for sessionSecret when not configured', () => {
+        const result = sanitizeConfig(makeConfig({ sessionSecret: null }));
+        expect(result.sessionSecret).toBeNull();
+    });
+    it('redacts internalInsiderKey', () => {
+        const result = sanitizeConfig(makeConfig());
+        expect(result.internalInsiderKey).toBe('[REDACTED]');
+    });
+    it('redacts googleAuth.clientSecret but preserves clientId', () => {
+        const result = sanitizeConfig(makeConfig());
+        const auth = result.googleAuth;
+        expect(auth.clientId).toBe('public-client-id');
+        expect(auth.clientSecret).toBe('[REDACTED]');
+    });
+    it('returns null for googleAuth when not configured', () => {
+        const result = sanitizeConfig(makeConfig({ googleAuth: null }));
+        expect(result.googleAuth).toBeNull();
+    });
+    it('redacts all key seeds', () => {
+        const config = makeConfig({
+            resolvedKeys: [
+                { name: 'a', seed: 'seed-a', scopes: null },
+                { name: 'b', seed: 'seed-b', scopes: null },
+            ],
+        });
+        const result = sanitizeConfig(config);
+        const keys = result.resolvedKeys;
+        expect(keys).toHaveLength(2);
+        expect(keys[0].name).toBe('a');
+        expect(keys[0].seed).toBe('[REDACTED]');
+        expect(keys[1].seed).toBe('[REDACTED]');
+    });
+    it('redacts all insider seeds but preserves other fields', () => {
+        const result = sanitizeConfig(makeConfig());
+        const insiders = result.resolvedInsiders;
+        expect(insiders[0].email).toBe('jason@example.com');
+        expect(insiders[0].seed).toBe('[REDACTED]');
+        expect(insiders[0].keyCreatedAt).toBe('2026-01-01T00:00:00Z');
+    });
+    it('preserves non-sensitive fields', () => {
+        const result = sanitizeConfig(makeConfig());
+        expect(result.port).toBe(1934);
+        expect(result.chromePath).toBe('/usr/bin/chromium');
+        expect(result.configPath).toBe('/etc/jeeves-server.config.json');
+    });
+    it('never leaks raw secret values', () => {
+        const config = makeConfig();
+        const json = JSON.stringify(sanitizeConfig(config));
+        expect(json).not.toContain('secret-key-seed-abc');
+        expect(json).not.toContain('secret-insider-seed-xyz');
+        expect(json).not.toContain('super-secret-oauth-secret');
+        expect(json).not.toContain('session-hmac-secret');
+        expect(json).not.toContain('internal-key-seed');
+    });
+});

package/dist/src/server.js

@@ -11,6 +11,7 @@ import Fastify from 'fastify';
 import { getConfig, initConfig, isConfigInitialized } from './config/index.js';
 import { apiRoute } from './routes/api/index.js';
 import { authRoute } from './routes/auth.js';
+import { registerConfigRoute } from './routes/config.js';
 import { eventRoute } from './routes/event.js';
 import { healthRoute } from './routes/health.js';
 import { keysRoute } from './routes/keys.js';
@@ -35,6 +36,7 @@ async function start() {
         // Register routes
         await fastify.register(staticRoutes);
         await fastify.register(healthRoute);
+        registerConfigRoute(fastify);
         await fastify.register(authRoute);
         await fastify.register(keysRoute);
         await fastify.register(eventRoute);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@karmaniverous/jeeves-server",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "Secure file browser, markdown viewer, and webhook gateway with PDF/DOCX export and expiring share links",
   "keywords": [
     "fastify",
@@ -47,6 +47,7 @@
   "license": "MIT",
   "dependencies": {
     "@commander-js/extra-typings": "^14.0.0",
+    "@karmaniverous/jeeves": "^0.2.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/static": "^8.3.0",
     "@karmaniverous/jsonmap": "^0.3.1",

package/src/routes/config.test.ts

@@ -0,0 +1,132 @@
+/**
+ * Tests for GET /config route sanitization logic.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import type { RuntimeConfig } from '../config/types.js';
+import { sanitizeConfig } from './config.js';
+
+/** Minimal RuntimeConfig fixture with sensitive fields populated. */
+function makeConfig(overrides: Partial<RuntimeConfig> = {}): RuntimeConfig {
+  return {
+    port: 1934,
+    eventTimeoutMs: 30_000,
+    eventLogPurgeMs: 604_800_000,
+    maxZipSizeMb: 100,
+    chromePath: '/usr/bin/chromium',
+    plantuml: { servers: [] },
+    outsiderPolicy: null,
+    events: {},
+    authModes: ['keys'],
+    resolvedKeys: [
+      {
+        name: 'primary',
+        seed: 'secret-key-seed-abc',
+        scopes: null,
+      },
+    ],
+    resolvedInsiders: [
+      {
+        email: 'jason@example.com',
+        seed: 'secret-insider-seed-xyz',
+        scopes: null,
+        keyCreatedAt: '2026-01-01T00:00:00Z',
+      },
+    ],
+    googleAuth: {
+      clientId: 'public-client-id',
+      clientSecret: 'super-secret-oauth-secret',
+    },
+    sessionSecret: 'session-hmac-secret',
+    internalInsiderKey: 'internal-key-seed',
+    configPath: '/etc/jeeves-server.config.json',
+    eventsLog: '/var/log/events.log',
+    stateFile: '/var/state.json',
+    eventQueuePath: '/var/queue.jsonl',
+    eventQueueCursorPath: '/var/cursor.json',
+    eventLogPath: '/var/event-log.jsonl',
+    ...overrides,
+  };
+}
+
+describe('sanitizeConfig', () => {
+  it('redacts sessionSecret', () => {
+    const result = sanitizeConfig(makeConfig()) as Record<string, unknown>;
+    expect(result.sessionSecret).toBe('[REDACTED]');
+  });
+
+  it('returns null for sessionSecret when not configured', () => {
+    const result = sanitizeConfig(
+      makeConfig({ sessionSecret: null }),
+    ) as Record<string, unknown>;
+    expect(result.sessionSecret).toBeNull();
+  });
+
+  it('redacts internalInsiderKey', () => {
+    const result = sanitizeConfig(makeConfig()) as Record<string, unknown>;
+    expect(result.internalInsiderKey).toBe('[REDACTED]');
+  });
+
+  it('redacts googleAuth.clientSecret but preserves clientId', () => {
+    const result = sanitizeConfig(makeConfig()) as Record<string, unknown>;
+    const auth = result.googleAuth as {
+      clientId: string;
+      clientSecret: string;
+    };
+    expect(auth.clientId).toBe('public-client-id');
+    expect(auth.clientSecret).toBe('[REDACTED]');
+  });
+
+  it('returns null for googleAuth when not configured', () => {
+    const result = sanitizeConfig(makeConfig({ googleAuth: null })) as Record<
+      string,
+      unknown
+    >;
+    expect(result.googleAuth).toBeNull();
+  });
+
+  it('redacts all key seeds', () => {
+    const config = makeConfig({
+      resolvedKeys: [
+        { name: 'a', seed: 'seed-a', scopes: null },
+        { name: 'b', seed: 'seed-b', scopes: null },
+      ],
+    });
+    const result = sanitizeConfig(config) as Record<string, unknown>;
+    const keys = result.resolvedKeys as Array<{ name: string; seed: string }>;
+    expect(keys).toHaveLength(2);
+    expect(keys[0].name).toBe('a');
+    expect(keys[0].seed).toBe('[REDACTED]');
+    expect(keys[1].seed).toBe('[REDACTED]');
+  });
+
+  it('redacts all insider seeds but preserves other fields', () => {
+    const result = sanitizeConfig(makeConfig()) as Record<string, unknown>;
+    const insiders = result.resolvedInsiders as Array<{
+      email: string;
+      seed: string;
+      keyCreatedAt: string;
+    }>;
+    expect(insiders[0].email).toBe('jason@example.com');
+    expect(insiders[0].seed).toBe('[REDACTED]');
+    expect(insiders[0].keyCreatedAt).toBe('2026-01-01T00:00:00Z');
+  });
+
+  it('preserves non-sensitive fields', () => {
+    const result = sanitizeConfig(makeConfig()) as Record<string, unknown>;
+    expect(result.port).toBe(1934);
+    expect(result.chromePath).toBe('/usr/bin/chromium');
+    expect(result.configPath).toBe('/etc/jeeves-server.config.json');
+  });
+
+  it('never leaks raw secret values', () => {
+    const config = makeConfig();
+    const json = JSON.stringify(sanitizeConfig(config));
+    expect(json).not.toContain('secret-key-seed-abc');
+    expect(json).not.toContain('secret-insider-seed-xyz');
+    expect(json).not.toContain('super-secret-oauth-secret');
+    expect(json).not.toContain('session-hmac-secret');
+    expect(json).not.toContain('internal-key-seed');
+  });
+});

package/src/routes/config.ts

@@ -0,0 +1,49 @@
+/**
+ * GET /config — query service configuration with optional JSONPath.
+ *
+ * Uses the core SDK's `createConfigQueryHandler()` for JSONPath support.
+ *
+ * @module routes/config
+ */
+
+import { createConfigQueryHandler } from '@karmaniverous/jeeves';
+import type { FastifyInstance } from 'fastify';
+
+import { getConfig } from '../config/index.js';
+import type { RuntimeConfig } from '../config/types.js';
+
+/** Return a sanitized copy of the config (redact sensitive fields). */
+export function sanitizeConfig(config: RuntimeConfig): unknown {
+  return {
+    ...config,
+    sessionSecret: config.sessionSecret ? '[REDACTED]' : null,
+    internalInsiderKey: config.internalInsiderKey ? '[REDACTED]' : null,
+    googleAuth: config.googleAuth
+      ? {
+          clientId: config.googleAuth.clientId,
+          clientSecret: '[REDACTED]',
+        }
+      : null,
+    resolvedKeys: config.resolvedKeys.map((k) => ({
+      ...k,
+      seed: '[REDACTED]',
+    })),
+    resolvedInsiders: config.resolvedInsiders.map((i) => ({
+      ...i,
+      seed: '[REDACTED]',
+    })),
+  };
+}
+
+/** Register the GET /config route. */
+export function registerConfigRoute(app: FastifyInstance): void {
+  const configHandler = createConfigQueryHandler(() =>
+    sanitizeConfig(getConfig()),
+  );
+
+  app.get('/config', async (request, reply) => {
+    const { path } = request.query as { path?: string };
+    const result = await configHandler({ path });
+    return reply.status(result.status).send(result.body);
+  });
+}

package/src/server.ts

@@ -14,6 +14,7 @@ import Fastify from 'fastify';
 import { getConfig, initConfig, isConfigInitialized } from './config/index.js';
 import { apiRoute } from './routes/api/index.js';
 import { authRoute } from './routes/auth.js';
+import { registerConfigRoute } from './routes/config.js';
 import { eventRoute } from './routes/event.js';
 import { healthRoute } from './routes/health.js';
 import { keysRoute } from './routes/keys.js';
@@ -44,6 +45,7 @@ async function start() {
     // Register routes
     await fastify.register(staticRoutes);
     await fastify.register(healthRoute);
+    registerConfigRoute(fastify);
     await fastify.register(authRoute);
     await fastify.register(keysRoute);
     await fastify.register(eventRoute);