@openparachute/agent 0.1.2 → 0.2.0

package/.claude/skills/migrate-from-openclaw/scripts/extract-channel-credentials.ts

@@ -1,476 +0,0 @@
-/**
- * Extract a channel credential from an OpenClaw configuration and write it
- * directly to the NanoClaw .env file.
- *
- * Usage: pnpm exec tsx .claude/skills/migrate-from-openclaw/scripts/extract-channel-credentials.ts \
- *          --channel telegram --state-dir ~/.openclaw --write-env .env
- *
- * Handles OpenClaw SecretRef formats:
- *   - Plain string: "bot-token-value"
- *   - Env template: "${TELEGRAM_BOT_TOKEN}"
- *   - SecretRef object: { source: "env", provider: "default", id: "TELEGRAM_BOT_TOKEN" }
- *
- * Also reads <state-dir>/.env for env-based secrets.
- *
- * Credential values are NEVER emitted to stdout — only masked versions.
- * When --write-env is provided, the script writes credentials directly to
- * the target .env file so the agent never sees raw secrets.
- *
- * Emits a status block on stdout:
- *   === NANOCLAW MIGRATE: CREDENTIAL ===
- *   ...
- *   === END ===
- */
-
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-
-// ---------------------------------------------------------------------------
-// JSON5-tolerant parser (same as discover script)
-// ---------------------------------------------------------------------------
-
-function parseJson5(text: string): unknown {
-  let cleaned = text.replace(
-    /("(?:[^"\\]|\\.)*")|\/\/[^\n]*/g,
-    (match, str) => (str ? str : ''),
-  );
-  cleaned = cleaned.replace(
-    /("(?:[^"\\]|\\.)*")|\/\*[\s\S]*?\*\//g,
-    (match, str) => (str ? str : ''),
-  );
-  cleaned = cleaned.replace(/,\s*([}\]])/g, '$1');
-  return JSON.parse(cleaned);
-}
-
-// ---------------------------------------------------------------------------
-// Inline dotenv parser (reads key=value, skips comments)
-// ---------------------------------------------------------------------------
-
-function parseDotenv(filePath: string): Record<string, string> {
-  const env: Record<string, string> = {};
-  if (!fs.existsSync(filePath)) return env;
-
-  const lines = fs.readFileSync(filePath, 'utf-8').split('\n');
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
-    const eqIdx = trimmed.indexOf('=');
-    if (eqIdx === -1) continue;
-    const key = trimmed.slice(0, eqIdx).trim();
-    let value = trimmed.slice(eqIdx + 1).trim();
-    // Strip surrounding quotes
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-    env[key] = value;
-  }
-  return env;
-}
-
-// ---------------------------------------------------------------------------
-// Status block emitter
-// ---------------------------------------------------------------------------
-
-function emitStatus(fields: Record<string, string | number | boolean>): void {
-  const lines = ['=== NANOCLAW MIGRATE: CREDENTIAL ==='];
-  for (const [key, value] of Object.entries(fields)) {
-    lines.push(`${key}: ${value}`);
-  }
-  lines.push('=== END ===');
-  console.log(lines.join('\n'));
-}
-
-// ---------------------------------------------------------------------------
-// Credential masking
-// ---------------------------------------------------------------------------
-
-function maskCredential(value: string): string {
-  if (value.length < 10) return '****';
-  return `${value.slice(0, 4)}...${value.slice(-4)}`;
-}
-
-// ---------------------------------------------------------------------------
-// SecretRef resolution
-// ---------------------------------------------------------------------------
-
-interface SecretRef {
-  source: string;
-  provider?: string;
-  id: string;
-}
-
-function resolveSecretInput(
-  value: unknown,
-  dotenvVars: Record<string, string>,
-): { resolved: string | null; source: string; note?: string } {
-  if (!value) return { resolved: null, source: 'missing' };
-
-  // Plain string
-  if (typeof value === 'string') {
-    // Check for env template: "${VAR_NAME}"
-    const envMatch = value.match(/^\$\{([^}]+)\}$/);
-    if (envMatch) {
-      const envKey = envMatch[1];
-      const envVal =
-        dotenvVars[envKey] ?? process.env[envKey] ?? null;
-      if (envVal) {
-        return { resolved: envVal, source: 'env_template' };
-      }
-      return {
-        resolved: null,
-        source: 'env_template',
-        note: `Environment variable ${envKey} not found`,
-      };
-    }
-
-    // Plain literal value
-    return { resolved: value, source: 'plain' };
-  }
-
-  // SecretRef object
-  if (typeof value === 'object' && value !== null) {
-    const ref = value as SecretRef;
-    if (ref.source === 'env') {
-      const envVal =
-        dotenvVars[ref.id] ?? process.env[ref.id] ?? null;
-      if (envVal) {
-        return { resolved: envVal, source: 'env_ref' };
-      }
-      return {
-        resolved: null,
-        source: 'env_ref',
-        note: `Environment variable ${ref.id} not found`,
-      };
-    }
-    if (ref.source === 'file') {
-      return {
-        resolved: null,
-        source: 'file_ref',
-        note: `File-based secret (${ref.id}) — cannot auto-extract, add manually`,
-      };
-    }
-    if (ref.source === 'exec') {
-      return {
-        resolved: null,
-        source: 'exec_ref',
-        note: `Exec-based secret (${ref.id}) — cannot auto-extract, add manually`,
-      };
-    }
-  }
-
-  return { resolved: null, source: 'unknown' };
-}
-
-// ---------------------------------------------------------------------------
-// Channel credential mapping
-// ---------------------------------------------------------------------------
-
-interface ChannelCredentialSpec {
-  // Fields to look for in the channel config
-  fields: string[];
-  // Corresponding NanoClaw env var names
-  envVars: string[];
-}
-
-const CHANNEL_SPECS: Record<string, ChannelCredentialSpec> = {
-  telegram: {
-    fields: ['botToken'],
-    envVars: ['TELEGRAM_BOT_TOKEN'],
-  },
-  discord: {
-    fields: ['token'],
-    envVars: ['DISCORD_BOT_TOKEN'],
-  },
-  slack: {
-    fields: ['botToken', 'appToken'],
-    envVars: ['SLACK_BOT_TOKEN', 'SLACK_APP_TOKEN'],
-  },
-  whatsapp: {
-    fields: [], // Auth-state based, no token field
-    envVars: [],
-  },
-};
-
-// ---------------------------------------------------------------------------
-// CLI arg parsing
-// ---------------------------------------------------------------------------
-
-function parseArgs(): { channel: string; stateDir: string; writeEnv: string } {
-  const args = process.argv.slice(2);
-  let channel = '';
-  let stateDir = '';
-  let writeEnv = '';
-
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === '--channel' && args[i + 1]) {
-      channel = args[++i].toLowerCase();
-    }
-    if (args[i] === '--state-dir' && args[i + 1]) {
-      stateDir = args[++i];
-    }
-    if (args[i] === '--write-env' && args[i + 1]) {
-      writeEnv = args[++i];
-    }
-  }
-
-  if (!channel) {
-    console.error('Usage: --channel <name> --state-dir <path> [--write-env <path>]');
-    process.exit(1);
-  }
-
-  // Expand ~ prefix
-  if (stateDir.startsWith('~')) {
-    stateDir = path.join(os.homedir(), stateDir.slice(1));
-  }
-
-  // Default state dir
-  if (!stateDir) {
-    const home = os.homedir();
-    if (fs.existsSync(path.join(home, '.openclaw'))) {
-      stateDir = path.join(home, '.openclaw');
-    } else if (fs.existsSync(path.join(home, '.clawdbot'))) {
-      stateDir = path.join(home, '.clawdbot');
-    } else {
-      console.error(
-        'No OpenClaw directory found. Use --state-dir to specify.',
-      );
-      process.exit(1);
-    }
-  }
-
-  return { channel, stateDir, writeEnv };
-}
-
-// ---------------------------------------------------------------------------
-// .env writer — appends or replaces a KEY=VALUE line
-// ---------------------------------------------------------------------------
-
-function writeEnvVar(envPath: string, key: string, value: string): void {
-  let content = '';
-  if (fs.existsSync(envPath)) {
-    content = fs.readFileSync(envPath, 'utf-8');
-  }
-
-  const pattern = new RegExp(`^${key}=.*$`, 'm');
-  const line = `${key}="${value}"`;
-
-  if (pattern.test(content)) {
-    content = content.replace(pattern, line);
-  } else {
-    content = content.trimEnd() + (content ? '\n' : '') + line + '\n';
-  }
-
-  fs.writeFileSync(envPath, content);
-}
-
-// ---------------------------------------------------------------------------
-// Main
-// ---------------------------------------------------------------------------
-
-function main(): void {
-  const { channel, stateDir, writeEnv } = parseArgs();
-  const spec = CHANNEL_SPECS[channel];
-
-  // Load dotenv from state dir
-  const dotenvVars = parseDotenv(path.join(stateDir, '.env'));
-
-  // Also check auth-profiles.json for API keys
-  const authProfilesPath = path.join(stateDir, 'auth-profiles.json');
-  let authProfiles: Record<string, unknown> = {};
-  if (fs.existsSync(authProfilesPath)) {
-    try {
-      authProfiles = JSON.parse(
-        fs.readFileSync(authProfilesPath, 'utf-8'),
-      ) as Record<string, unknown>;
-    } catch {
-      // Ignore parse errors
-    }
-  }
-
-  // WhatsApp special case: no token, auth-state based.
-  // OpenClaw stores Baileys auth at <stateDir>/credentials/whatsapp/<accountId>/
-  // using useMultiFileAuthState (same as NanoClaw). The files are directly compatible.
-  if (channel === 'whatsapp') {
-    const authPaths = [
-      path.join(stateDir, 'credentials', 'whatsapp', 'default'),
-      path.join(stateDir, 'credentials', 'whatsapp'),
-      path.join(stateDir, 'wa-auth'),
-    ];
-
-    // Also scan credentials/whatsapp/ for any account subdirectory
-    const waCredsDir = path.join(stateDir, 'credentials', 'whatsapp');
-    if (fs.existsSync(waCredsDir)) {
-      try {
-        for (const entry of fs.readdirSync(waCredsDir)) {
-          const candidate = path.join(waCredsDir, entry);
-          if (fs.statSync(candidate).isDirectory()) {
-            authPaths.push(candidate);
-          }
-        }
-      } catch {
-        // ignore
-      }
-    }
-    let authStatePath = '';
-    for (const p of authPaths) {
-      // Look for creds.json inside the directory — that confirms valid Baileys auth state
-      if (fs.existsSync(path.join(p, 'creds.json'))) {
-        authStatePath = p;
-        break;
-      }
-    }
-
-    emitStatus({
-      CHANNEL: 'whatsapp',
-      HAS_CREDENTIAL: false,
-      CREDENTIAL_SOURCE: 'auth_state',
-      NOTE: authStatePath
-        ? `Baileys auth state found at ${authStatePath}. May not be portable across versions — recommend re-authenticating.`
-        : 'No WhatsApp auth state found. Will need to authenticate during setup.',
-      AUTH_STATE_PATH: authStatePath || 'not_found',
-    });
-    return;
-  }
-
-  // Unknown channel
-  if (!spec) {
-    emitStatus({
-      CHANNEL: channel,
-      HAS_CREDENTIAL: false,
-      NOTE: `Channel "${channel}" is not supported by NanoClaw. Supported: telegram, discord, slack, whatsapp.`,
-    });
-    return;
-  }
-
-  // Load OpenClaw config
-  let config: Record<string, unknown> | null = null;
-  for (const name of ['openclaw.json', 'clawdbot.json']) {
-    const configPath = path.join(stateDir, name);
-    if (fs.existsSync(configPath)) {
-      try {
-        config = parseJson5(
-          fs.readFileSync(configPath, 'utf-8'),
-        ) as Record<string, unknown>;
-        break;
-      } catch {
-        // Try next
-      }
-    }
-  }
-
-  if (!config) {
-    emitStatus({
-      CHANNEL: channel,
-      HAS_CREDENTIAL: false,
-      NOTE: 'Could not load openclaw.json',
-    });
-    return;
-  }
-
-  const channels =
-    (config.channels as Record<string, unknown> | undefined) ?? {};
-  const channelConfig =
-    (channels[channel] as Record<string, unknown> | undefined) ?? {};
-
-  // Try to resolve each credential field
-  const results: Array<{
-    envVar: string;
-    resolved: string | null;
-    masked: string;
-    source: string;
-    note?: string;
-  }> = [];
-
-  for (let i = 0; i < spec.fields.length; i++) {
-    const field = spec.fields[i];
-    const envVar = spec.envVars[i];
-
-    // Check top-level channel config first
-    let rawValue = channelConfig[field];
-
-    // If not found, check first account
-    if (!rawValue && channelConfig.accounts) {
-      const accounts = channelConfig.accounts as Record<string, unknown>;
-      const firstAccount = Object.values(accounts)[0] as
-        | Record<string, unknown>
-        | undefined;
-      if (firstAccount) {
-        rawValue = firstAccount[field];
-      }
-    }
-
-    const { resolved, source, note } = resolveSecretInput(
-      rawValue,
-      dotenvVars,
-    );
-    results.push({
-      envVar,
-      resolved,
-      masked: resolved ? maskCredential(resolved) : '',
-      source,
-      note,
-    });
-  }
-
-  // Emit results for the primary credential
-  const primary = results[0];
-  if (!primary) {
-    emitStatus({
-      CHANNEL: channel,
-      HAS_CREDENTIAL: false,
-      NOTE: `No credential fields defined for ${channel}`,
-    });
-    return;
-  }
-
-  // If --write-env is set and credentials were resolved, write directly to .env.
-  // Credential values never appear in stdout.
-  let written = 0;
-  if (writeEnv) {
-    for (const r of results) {
-      if (r.resolved) {
-        writeEnvVar(writeEnv, r.envVar, r.resolved);
-        written++;
-      }
-    }
-  }
-
-  const fields: Record<string, string | number | boolean> = {
-    CHANNEL: channel,
-    HAS_CREDENTIAL: !!primary.resolved,
-    CREDENTIAL_SOURCE: primary.source,
-    CREDENTIAL_MASKED: primary.masked || 'none',
-    NANOCLAW_ENV_VAR: primary.envVar,
-  };
-
-  if (writeEnv && written > 0) {
-    fields.WRITTEN_TO = writeEnv;
-    fields.WRITTEN_COUNT = written;
-  }
-  if (primary.note) {
-    fields.NOTE = primary.note;
-  }
-
-  // Additional credentials (e.g. Slack has botToken + appToken)
-  if (results.length > 1) {
-    for (let i = 1; i < results.length; i++) {
-      const extra = results[i];
-      const suffix = `_${i + 1}`;
-      fields[`HAS_CREDENTIAL${suffix}`] = !!extra.resolved;
-      fields[`CREDENTIAL_SOURCE${suffix}`] = extra.source;
-      fields[`CREDENTIAL_MASKED${suffix}`] = extra.masked || 'none';
-      fields[`NANOCLAW_ENV_VAR${suffix}`] = extra.envVar;
-      if (extra.note) {
-        fields[`NOTE${suffix}`] = extra.note;
-      }
-    }
-  }
-
-  emitStatus(fields);
-}
-
-main();