@openparachute/agent 0.1.2 → 0.2.2

package/src/modules/provider-credentials/spawn.test.ts

@@ -1,206 +0,0 @@
-import fs from 'fs';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-vi.mock('../../config.js', async () => {
-  const actual = await vi.importActual('../../config.js');
-  return { ...actual, DATA_DIR: '/tmp/paraclaw-test-provider-credentials' };
-});
-
-const TEST_DIR = '/tmp/paraclaw-test-provider-credentials';
-
-describe('getProviderCredentialsForSpawn', () => {
-  beforeEach(async () => {
-    if (fs.existsSync(TEST_DIR)) fs.rmSync(TEST_DIR, { recursive: true });
-    fs.mkdirSync(TEST_DIR, { recursive: true });
-    vi.resetModules();
-    const { initTestDb, runMigrations } = await import('../../db/index.js');
-    const db = initTestDb();
-    runMigrations(db);
-  });
-
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it('returns empty envelope when no row exists', async () => {
-    const { getProviderCredentialsForSpawn } = await import('./spawn.js');
-    const env = getProviderCredentialsForSpawn('ag-1');
-    expect(env.source).toBeNull();
-    expect(env.env).toEqual({});
-    expect(env.files).toEqual({});
-    expect(env.suppressSecretEnvKeys.size).toBe(0);
-  });
-
-  it('claude_setup_token → injects CLAUDE_CODE_OAUTH_TOKEN env, suppresses ANTHROPIC_API_KEY + ANTHROPIC_AUTH_TOKEN', async () => {
-    const { putProviderCredentials, DEFAULT_SCOPE_ID } = await import('./db.js');
-    putProviderCredentials({ scopeId: DEFAULT_SCOPE_ID, source: 'claude_setup_token', apiKey: 'sk-ant-oat01-paste' });
-
-    const { getProviderCredentialsForSpawn } = await import('./spawn.js');
-    const env = getProviderCredentialsForSpawn('ag-1');
-    expect(env.source).toBe('claude_setup_token');
-    expect(env.env).toEqual({ CLAUDE_CODE_OAUTH_TOKEN: 'sk-ant-oat01-paste' });
-    expect(env.files).toEqual({});
-    expect(env.suppressSecretEnvKeys.has('ANTHROPIC_API_KEY')).toBe(true);
-    expect(env.suppressSecretEnvKeys.has('ANTHROPIC_AUTH_TOKEN')).toBe(true);
-  });
-
-  it('claude_setup_token → empty env when token missing', async () => {
-    const { putProviderCredentials, DEFAULT_SCOPE_ID } = await import('./db.js');
-    putProviderCredentials({ scopeId: DEFAULT_SCOPE_ID, source: 'claude_setup_token', apiKey: null });
-
-    const { getProviderCredentialsForSpawn } = await import('./spawn.js');
-    const env = getProviderCredentialsForSpawn('ag-1');
-    expect(env.source).toBe('claude_setup_token');
-    expect(env.env).toEqual({});
-  });
-
-  it('anthropic_api_key → injects ANTHROPIC_API_KEY env, no files, no suppress', async () => {
-    const { putProviderCredentials, DEFAULT_SCOPE_ID } = await import('./db.js');
-    putProviderCredentials({ scopeId: DEFAULT_SCOPE_ID, source: 'anthropic_api_key', apiKey: 'sk-ant-api03-test' });
-
-    const { getProviderCredentialsForSpawn } = await import('./spawn.js');
-    const env = getProviderCredentialsForSpawn('ag-1');
-    expect(env.source).toBe('anthropic_api_key');
-    expect(env.env).toEqual({ ANTHROPIC_API_KEY: 'sk-ant-api03-test' });
-    expect(env.files).toEqual({});
-    expect(env.suppressSecretEnvKeys.size).toBe(0);
-  });
-
-  it('external_server → injects ANTHROPIC_API_KEY + ANTHROPIC_BASE_URL', async () => {
-    const { putProviderCredentials, DEFAULT_SCOPE_ID } = await import('./db.js');
-    putProviderCredentials({
-      scopeId: DEFAULT_SCOPE_ID,
-      source: 'external_server',
-      apiKey: 'or-key',
-      serverUrl: 'https://openrouter.ai/api/v1',
-    });
-
-    const { getProviderCredentialsForSpawn } = await import('./spawn.js');
-    const env = getProviderCredentialsForSpawn('ag-1');
-    expect(env.source).toBe('external_server');
-    expect(env.env).toEqual({
-      ANTHROPIC_API_KEY: 'or-key',
-      ANTHROPIC_BASE_URL: 'https://openrouter.ai/api/v1',
-    });
-  });
-
-  it('external_server → empty env when key or url missing', async () => {
-    const { putProviderCredentials, DEFAULT_SCOPE_ID } = await import('./db.js');
-    putProviderCredentials({ scopeId: DEFAULT_SCOPE_ID, source: 'external_server', apiKey: 'or-key', serverUrl: null });
-
-    const { getProviderCredentialsForSpawn } = await import('./spawn.js');
-    const env = getProviderCredentialsForSpawn('ag-1');
-    expect(env.source).toBe('external_server');
-    expect(env.env).toEqual({});
-  });
-
-  it('per-group override wins over default (paraclaw#86)', async () => {
-    const { putProviderCredentials, DEFAULT_SCOPE_ID } = await import('./db.js');
-    putProviderCredentials({ scopeId: DEFAULT_SCOPE_ID, source: 'anthropic_api_key', apiKey: 'install-default-key' });
-    putProviderCredentials({
-      scopeId: 'ag-special',
-      source: 'external_server',
-      apiKey: 'override-key',
-      serverUrl: 'https://override.test',
-    });
-
-    const { getProviderCredentialsForSpawn } = await import('./spawn.js');
-    const env = getProviderCredentialsForSpawn('ag-special');
-    expect(env.source).toBe('external_server');
-    expect(env.resolvedScope).toBe('group');
-    expect(env.env).toEqual({
-      ANTHROPIC_API_KEY: 'override-key',
-      ANTHROPIC_BASE_URL: 'https://override.test',
-    });
-  });
-
-  it('falls back to default when no per-group override exists (paraclaw#86)', async () => {
-    const { putProviderCredentials, DEFAULT_SCOPE_ID } = await import('./db.js');
-    putProviderCredentials({ scopeId: DEFAULT_SCOPE_ID, source: 'anthropic_api_key', apiKey: 'install-default-key' });
-
-    const { getProviderCredentialsForSpawn } = await import('./spawn.js');
-    const env = getProviderCredentialsForSpawn('ag-no-override');
-    expect(env.source).toBe('anthropic_api_key');
-    expect(env.resolvedScope).toBe('default');
-    expect(env.env).toEqual({ ANTHROPIC_API_KEY: 'install-default-key' });
-  });
-
-  it("one group's override does not leak into another group (paraclaw#86)", async () => {
-    const { putProviderCredentials, DEFAULT_SCOPE_ID } = await import('./db.js');
-    putProviderCredentials({ scopeId: DEFAULT_SCOPE_ID, source: 'anthropic_api_key', apiKey: 'install-default-key' });
-    putProviderCredentials({
-      scopeId: 'ag-private',
-      source: 'claude_setup_token',
-      apiKey: 'sk-ant-oat01-private',
-    });
-
-    const { getProviderCredentialsForSpawn } = await import('./spawn.js');
-    const privateEnv = getProviderCredentialsForSpawn('ag-private');
-    expect(privateEnv.resolvedScope).toBe('group');
-    expect(privateEnv.env).toEqual({ CLAUDE_CODE_OAUTH_TOKEN: 'sk-ant-oat01-private' });
-
-    const otherEnv = getProviderCredentialsForSpawn('ag-other');
-    expect(otherEnv.resolvedScope).toBe('default');
-    expect(otherEnv.env).toEqual({ ANTHROPIC_API_KEY: 'install-default-key' });
-  });
-
-  it('group override with empty secret slot still wins (paraclaw#86)', async () => {
-    const { putProviderCredentials, DEFAULT_SCOPE_ID } = await import('./db.js');
-    putProviderCredentials({ scopeId: DEFAULT_SCOPE_ID, source: 'anthropic_api_key', apiKey: 'install-default-key' });
-    putProviderCredentials({ scopeId: 'ag-broken', source: 'claude_setup_token', apiKey: null });
-
-    const { getProviderCredentialsForSpawn } = await import('./spawn.js');
-    const env = getProviderCredentialsForSpawn('ag-broken');
-    expect(env.source).toBe('claude_setup_token');
-    expect(env.resolvedScope).toBe('group');
-    expect(env.env).toEqual({});
-  });
-});
-
-describe('provider_credentials db round-trip', () => {
-  beforeEach(async () => {
-    if (fs.existsSync(TEST_DIR)) fs.rmSync(TEST_DIR, { recursive: true });
-    fs.mkdirSync(TEST_DIR, { recursive: true });
-    vi.resetModules();
-    const { initTestDb, runMigrations } = await import('../../db/index.js');
-    const db = initTestDb();
-    runMigrations(db);
-  });
-
-  it('encrypts api_key at rest, decrypts on read', async () => {
-    const { putProviderCredentials, readProviderCredentials, getProviderCredentialsRow, DEFAULT_SCOPE_ID } =
-      await import('./db.js');
-    putProviderCredentials({
-      scopeId: DEFAULT_SCOPE_ID,
-      source: 'anthropic_api_key',
-      apiKey: 'sk-ant-api03-secret',
-    });
-
-    const raw = getProviderCredentialsRow();
-    expect(raw?.api_key_encrypted).not.toBe('sk-ant-api03-secret');
-    expect(raw?.api_key_encrypted).toBeTruthy();
-
-    const plain = readProviderCredentials();
-    expect(plain?.apiKey).toBe('sk-ant-api03-secret');
-  });
-
-  it('upsert preserves unspecified fields (undefined = no-op, null = clear)', async () => {
-    const { putProviderCredentials, readProviderCredentials, DEFAULT_SCOPE_ID } = await import('./db.js');
-    putProviderCredentials({
-      scopeId: DEFAULT_SCOPE_ID,
-      source: 'external_server',
-      apiKey: 'k1',
-      serverUrl: 'https://a.test',
-    });
-    putProviderCredentials({ scopeId: DEFAULT_SCOPE_ID, source: 'external_server', serverUrl: 'https://b.test' });
-
-    const plain = readProviderCredentials();
-    expect(plain?.apiKey).toBe('k1');
-    expect(plain?.serverUrl).toBe('https://b.test');
-
-    putProviderCredentials({ scopeId: DEFAULT_SCOPE_ID, source: 'external_server', apiKey: null });
-    const cleared = readProviderCredentials();
-    expect(cleared?.apiKey).toBeNull();
-    expect(cleared?.serverUrl).toBe('https://b.test');
-  });
-});

package/src/modules/provider-credentials/spawn.ts

@@ -1,114 +0,0 @@
-/**
- * Resolve the credentials the host should hand the agent container at
- * spawn time. The container-runner calls `getProviderCredentialsForSpawn`
- * once per spawn and acts on the returned envelope:
- *
- *   - `env`: extra `-e KEY=VALUE` pairs to add to the container args.
- *   - `files`: file-content pairs to write into the per-group `.claude-shared`
- *              dir so they appear inside the container under `/home/node/.claude`.
- *              (Reserved for future sources; setup-token / api-key / external-server
- *              all inject via env vars only.)
- *   - `suppressSecretEnvKeys`: paraclaw secrets named here are dropped from
- *              the spawn's secret bag. Used so a residual `ANTHROPIC_API_KEY`
- *              secret can't override the operator's chosen `claude_setup_token`
- *              source — Claude Code's auth precedence puts ANTHROPIC_AUTH_TOKEN
- *              and ANTHROPIC_API_KEY ahead of CLAUDE_CODE_OAUTH_TOKEN.
- *
- * Source-specific behavior:
- *   - claude_setup_token: env `CLAUDE_CODE_OAUTH_TOKEN=<token>`. Suppress
- *     `ANTHROPIC_API_KEY` and `ANTHROPIC_AUTH_TOKEN` from the secret bag.
- *   - anthropic_api_key: env `ANTHROPIC_API_KEY=<plaintext>`.
- *   - external_server: env `ANTHROPIC_API_KEY=<plaintext>` + `ANTHROPIC_BASE_URL=<server_url>`.
- *
- * Two-tier resolution (paraclaw#86): if a row keyed by the spawn's
- * `agentGroupId` exists, it wins; otherwise the install-wide default
- * (`__default__`) row is used. A group row with the secret slot empty
- * still wins — clear-the-override is a deliberate UI action that
- * deletes the row, not one that blanks out the secret.
- */
-import { log } from '../../log.js';
-import { DEFAULT_SCOPE_ID, readProviderCredentials, type ProviderSource } from './db.js';
-
-export interface ProviderSpawnEnvelope {
-  /** Source we resolved. `null` means no row + no auto-fallback — caller emits a warning. */
-  source: ProviderSource | null;
-  /** Which scope the resolved row came from — `'group'` if the per-group override won, `'default'` if it fell back. */
-  resolvedScope: 'group' | 'default' | null;
-  env: Record<string, string>;
-  /** Filename → contents. Filenames are joined under the per-group `.claude-shared/` dir. */
-  files: Record<string, string>;
-  /** Paraclaw-secret env-var names to suppress for this spawn. */
-  suppressSecretEnvKeys: Set<string>;
-}
-
-/**
- * Resolve the spawn envelope for an agent group. Reads the per-group
- * override first, then falls back to the install-wide default. Pure of
- * filesystem writes; the container-runner is the one that lays down
- * `files` on disk and threads `env` into spawn args.
- */
-export function getProviderCredentialsForSpawn(agentGroupId: string): ProviderSpawnEnvelope {
-  const empty: ProviderSpawnEnvelope = {
-    source: null,
-    resolvedScope: null,
-    env: {},
-    files: {},
-    suppressSecretEnvKeys: new Set(),
-  };
-
-  const groupRow = agentGroupId !== DEFAULT_SCOPE_ID ? readProviderCredentials(agentGroupId) : undefined;
-  const row = groupRow ?? readProviderCredentials(DEFAULT_SCOPE_ID);
-  const resolvedScope: 'group' | 'default' | null = groupRow ? 'group' : row ? 'default' : null;
-  if (!row) return empty;
-
-  switch (row.source) {
-    case 'claude_setup_token': {
-      if (!row.apiKey) {
-        log.warn('claude_setup_token selected but no token stored', { agentGroupId, resolvedScope });
-        return { ...empty, source: 'claude_setup_token', resolvedScope };
-      }
-      return {
-        source: 'claude_setup_token',
-        resolvedScope,
-        env: { CLAUDE_CODE_OAUTH_TOKEN: row.apiKey },
-        files: {},
-        // Claude Code's auth precedence: ANTHROPIC_AUTH_TOKEN and
-        // ANTHROPIC_API_KEY both win over CLAUDE_CODE_OAUTH_TOKEN. If
-        // either is sitting in the paraclaw secret bag, the operator's
-        // chosen setup-token source would be silently overridden.
-        suppressSecretEnvKeys: new Set(['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN']),
-      };
-    }
-    case 'anthropic_api_key': {
-      if (!row.apiKey) {
-        log.warn('anthropic_api_key selected but no key stored', { agentGroupId, resolvedScope });
-        return { ...empty, source: 'anthropic_api_key', resolvedScope };
-      }
-      return {
-        source: 'anthropic_api_key',
-        resolvedScope,
-        env: { ANTHROPIC_API_KEY: row.apiKey },
-        files: {},
-        suppressSecretEnvKeys: new Set(),
-      };
-    }
-    case 'external_server': {
-      if (!row.apiKey || !row.serverUrl) {
-        log.warn('external_server selected but key or url missing', {
-          agentGroupId,
-          resolvedScope,
-          hasKey: row.apiKey != null,
-          hasUrl: row.serverUrl != null,
-        });
-        return { ...empty, source: 'external_server', resolvedScope };
-      }
-      return {
-        source: 'external_server',
-        resolvedScope,
-        env: { ANTHROPIC_API_KEY: row.apiKey, ANTHROPIC_BASE_URL: row.serverUrl },
-        files: {},
-        suppressSecretEnvKeys: new Set(),
-      };
-    }
-  }
-}

package/src/modules/scheduling/actions.ts

@@ -1,113 +0,0 @@
-/**
- * Delivery action handlers for scheduling.
- *
- * The container can't write to inbound.db (host-owned). When the agent calls
- * schedule_task / cancel_task / etc. via MCP, the container writes a
- * `kind='system'` outbound message with an `action` field. The delivery path
- * reaches into this module via the delivery-action registry and we apply the
- * change to inbound.db here.
- */
-import type { Database } from '../../db/connection.js';
-
-import { wakeContainer } from '../../container-runner.js';
-import { getSession } from '../../db/sessions.js';
-import { log } from '../../log.js';
-import { writeSessionMessage } from '../../session-manager.js';
-import type { Session } from '../../types.js';
-import { cancelTask, insertTask, pauseTask, resumeTask, updateTask, type TaskUpdate } from './db.js';
-
-export async function handleScheduleTask(
-  content: Record<string, unknown>,
-  _session: Session,
-  inDb: Database,
-): Promise<void> {
-  const taskId = content.taskId as string;
-  const prompt = content.prompt as string;
-  const script = content.script as string | null;
-  const processAfter = content.processAfter as string;
-  const recurrence = (content.recurrence as string) || null;
-
-  insertTask(inDb, {
-    id: taskId,
-    processAfter,
-    recurrence,
-    platformId: (content.platformId as string) ?? null,
-    channelType: (content.channelType as string) ?? null,
-    threadId: (content.threadId as string) ?? null,
-    content: JSON.stringify({ prompt, script }),
-  });
-  log.info('Scheduled task created', { taskId, processAfter, recurrence });
-}
-
-export async function handleCancelTask(
-  content: Record<string, unknown>,
-  _session: Session,
-  inDb: Database,
-): Promise<void> {
-  const taskId = content.taskId as string;
-  cancelTask(inDb, taskId);
-  log.info('Task cancelled', { taskId });
-}
-
-export async function handlePauseTask(
-  content: Record<string, unknown>,
-  _session: Session,
-  inDb: Database,
-): Promise<void> {
-  const taskId = content.taskId as string;
-  pauseTask(inDb, taskId);
-  log.info('Task paused', { taskId });
-}
-
-export async function handleResumeTask(
-  content: Record<string, unknown>,
-  _session: Session,
-  inDb: Database,
-): Promise<void> {
-  const taskId = content.taskId as string;
-  resumeTask(inDb, taskId);
-  log.info('Task resumed', { taskId });
-}
-
-export async function handleUpdateTask(
-  content: Record<string, unknown>,
-  session: Session,
-  inDb: Database,
-): Promise<void> {
-  const taskId = content.taskId as string;
-  const update: TaskUpdate = {};
-  if (typeof content.prompt === 'string') update.prompt = content.prompt;
-  if (typeof content.processAfter === 'string') update.processAfter = content.processAfter;
-  if (content.recurrence === null || typeof content.recurrence === 'string') {
-    update.recurrence = content.recurrence as string | null;
-  }
-  if (content.script === null || typeof content.script === 'string') {
-    update.script = content.script as string | null;
-  }
-  const touched = updateTask(inDb, taskId, update);
-  log.info('Task updated', { taskId, touched, fields: Object.keys(update) });
-  if (touched === 0) {
-    // Notify the agent that update_task matched nothing. Replicates the
-    // old notifyAgent helper that used to live in delivery.ts — inlined
-    // here so scheduling doesn't depend on delivery's private helpers.
-    writeSessionMessage(session.agent_group_id, session.id, {
-      id: `sys-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
-      kind: 'chat',
-      timestamp: new Date().toISOString(),
-      platformId: session.agent_group_id,
-      channelType: 'agent',
-      threadId: null,
-      content: JSON.stringify({
-        text: `update_task: no live task matched id "${taskId}".`,
-        sender: 'system',
-        senderId: 'system',
-      }),
-    });
-    const fresh = getSession(session.id);
-    if (fresh) {
-      wakeContainer(fresh).catch((err) =>
-        log.error('Failed to wake container after update_task notification', { err }),
-      );
-    }
-  }
-}