@oracle-agent/oracle 0.21.0 → 0.22.1

package/dist/cli/commands/setup.mjs

@@ -1,34 +1,51 @@
-import{spawnSync as ve}from"node:child_process";import{stdin as h,stdout as Q}from"node:process";var j=Object.freeze([{key:"telegram",name:"telegram",hermes:["gateway","setup"],required:["TELEGRAM_BOT_TOKEN"],optional:["TELEGRAM_ALLOWED_USERS","TELEGRAM_PROXY"],note:"dms \xB7 groups \xB7 topics"},{key:"discord",name:"discord",hermes:["gateway","setup"],required:["DISCORD_BOT_TOKEN"],optional:["DISCORD_ALLOWED_USERS"],note:"dms \xB7 channels \xB7 threads"},{key:"slack",name:"slack",hermes:["gateway","setup"],required:["SLACK_BOT_TOKEN","SLACK_APP_TOKEN"],optional:["SLACK_ALLOWED_USERS"],note:"socket mode"},{key:"whatsapp",name:"whatsapp",hermes:["whatsapp"],required:[],optional:["WHATSAPP_ALLOWED_USERS","WHATSAPP_MODE"],note:"qr bridge"},{key:"whatsapp-cloud",name:"whatsapp cloud",hermes:["whatsapp-cloud"],required:[],optional:[],note:"business cloud api"},{key:"signal",name:"signal",hermes:["gateway","setup"],required:["SIGNAL_HTTP_URL","SIGNAL_ACCOUNT"],optional:["SIGNAL_ALLOWED_USERS"],note:"signal-cli rest bridge"},{key:"matrix",name:"matrix",hermes:["gateway","setup"],required:["MATRIX_HOMESERVER","MATRIX_ACCESS_TOKEN","MATRIX_USER_ID"],optional:["MATRIX_ALLOWED_USERS"],note:"rooms \xB7 dms"},{key:"mattermost",name:"mattermost",hermes:["gateway","setup"],required:["MATTERMOST_URL","MATTERMOST_TOKEN"],optional:["MATTERMOST_ALLOWED_USERS"],note:"channels \xB7 dms"},{key:"email",name:"email",hermes:["gateway","setup"],required:["EMAIL_ADDRESS","EMAIL_PASSWORD","EMAIL_IMAP_HOST","EMAIL_SMTP_HOST"],optional:[],note:"imap/smtp mailbox"},{key:"bluebubbles",name:"bluebubbles",hermes:["gateway","setup"],required:[],optional:[],note:"imessage via bluebubbles"},{key:"photon",name:"photon",hermes:["photon"],required:["PHOTON_PROJECT_ID","PHOTON_PROJECT_SECRET"],optional:["PHOTON_ALLOWED_USERS","PHOTON_HOME_CHANNEL"],note:"imessage via spectrum (no mac)"},{key:"homeassistant",name:"homeassistant",hermes:["gateway","setup"],required:["HASS_URL","HASS_TOKEN"],optional:[],note:"smart home"},{key:"webhook",name:"webhook",hermes:["gateway","setup"],required:[],optional:[],note:"http ingress"},{key:"api-server",name:"api server",hermes:["gateway","setup"],required:[],optional:[],note:"local http api"},{key:"dingtalk",name:"dingtalk",hermes:["gateway","setup"],required:[],optional:[],note:"dingtalk bot"},{key:"feishu",name:"feishu",hermes:["gateway","setup"],required:[],optional:[],note:"feishu / lark"},{key:"wecom",name:"wecom",hermes:["gateway","setup"],required:[],optional:[],note:"wecom"},{key:"weixin",name:"weixin",hermes:["gateway","setup"],required:[],optional:[],note:"weixin"},{key:"qqbot",name:"qqbot",hermes:["gateway","setup"],required:[],optional:[],note:"qq bot"}]);function B(r){return String(r||"").trim().toLowerCase().replace(/^\/+/,"").replace(/\s+/g,"-")}function L(){return j.slice()}function k(r){let t=B(r);if(!t)return null;for(let e of j)if(e.key===t||B(e.name)===t)return e;return null}function F({profile:r="oracle",statuses:t={}}={}){let e=["oracle setup","","one oracle. many models. every connected channel.",`profile: ${r}`,"","messaging platforms:",""];for(let n of j){let s=t[n.key]||"unset";e.push(`  ${n.key.padEnd(16)} ${String(s).padEnd(8)}  ${n.note}`)}return e.push(""),e.push("commands:"),e.push("  oracle setup                 this menu"),e.push("  oracle setup messaging       open hermes gateway setup"),e.push("  oracle setup telegram        configure telegram bot token"),e.push("  oracle setup discord         configure discord bot token"),e.push("  oracle setup status          show configured platforms (no secrets)"),e.push("  oracle setup gateway         start/status hermes gateway"),e.push("  /setup                       same menu inside chat"),e.push(""),e.push("notes:"),e.push("  tokens stay in the hermes profile .env on this machine"),e.push("  oracle never prints bot tokens or app secrets"),e.push("  after setup: hermes -p oracle gateway restart"),e.join(`
+import{spawnSync as Wt}from"node:child_process";import{stdin as P,stdout as ze}from"node:process";var ce=Object.freeze([{key:"telegram",name:"telegram",hermes:["gateway","setup"],required:["TELEGRAM_BOT_TOKEN"],optional:["TELEGRAM_ALLOWED_USERS","TELEGRAM_PROXY"],note:"dms \xB7 groups \xB7 topics"},{key:"discord",name:"discord",hermes:["gateway","setup"],required:["DISCORD_BOT_TOKEN"],optional:["DISCORD_ALLOWED_USERS"],note:"dms \xB7 channels \xB7 threads"},{key:"slack",name:"slack",hermes:["gateway","setup"],required:["SLACK_BOT_TOKEN","SLACK_APP_TOKEN"],optional:["SLACK_ALLOWED_USERS"],note:"socket mode"},{key:"whatsapp",name:"whatsapp",hermes:["whatsapp"],required:[],optional:["WHATSAPP_ALLOWED_USERS","WHATSAPP_MODE"],note:"qr bridge"},{key:"whatsapp-cloud",name:"whatsapp cloud",hermes:["whatsapp-cloud"],required:[],optional:[],note:"business cloud api"},{key:"signal",name:"signal",hermes:["gateway","setup"],required:["SIGNAL_HTTP_URL","SIGNAL_ACCOUNT"],optional:["SIGNAL_ALLOWED_USERS"],note:"signal-cli rest bridge"},{key:"matrix",name:"matrix",hermes:["gateway","setup"],required:["MATRIX_HOMESERVER","MATRIX_ACCESS_TOKEN","MATRIX_USER_ID"],optional:["MATRIX_ALLOWED_USERS"],note:"rooms \xB7 dms"},{key:"mattermost",name:"mattermost",hermes:["gateway","setup"],required:["MATTERMOST_URL","MATTERMOST_TOKEN"],optional:["MATTERMOST_ALLOWED_USERS"],note:"channels \xB7 dms"},{key:"email",name:"email",hermes:["gateway","setup"],required:["EMAIL_ADDRESS","EMAIL_PASSWORD","EMAIL_IMAP_HOST","EMAIL_SMTP_HOST"],optional:[],note:"imap/smtp mailbox"},{key:"bluebubbles",name:"bluebubbles",hermes:["gateway","setup"],required:[],optional:[],note:"imessage via bluebubbles"},{key:"photon",name:"photon",hermes:["photon"],required:["PHOTON_PROJECT_ID","PHOTON_PROJECT_SECRET"],optional:["PHOTON_ALLOWED_USERS","PHOTON_HOME_CHANNEL"],note:"imessage via spectrum (no mac)"},{key:"homeassistant",name:"homeassistant",hermes:["gateway","setup"],required:["HASS_URL","HASS_TOKEN"],optional:[],note:"smart home"},{key:"webhook",name:"webhook",hermes:["gateway","setup"],required:[],optional:[],note:"http ingress"},{key:"api-server",name:"api server",hermes:["gateway","setup"],required:[],optional:[],note:"local http api"},{key:"dingtalk",name:"dingtalk",hermes:["gateway","setup"],required:[],optional:[],note:"dingtalk bot"},{key:"feishu",name:"feishu",hermes:["gateway","setup"],required:[],optional:[],note:"feishu / lark"},{key:"wecom",name:"wecom",hermes:["gateway","setup"],required:[],optional:[],note:"wecom"},{key:"weixin",name:"weixin",hermes:["gateway","setup"],required:[],optional:[],note:"weixin"},{key:"qqbot",name:"qqbot",hermes:["gateway","setup"],required:[],optional:[],note:"qq bot"}]);function be(e){return String(e||"").trim().toLowerCase().replace(/^\/+/,"").replace(/\s+/g,"-")}function J(){return ce.slice()}function z(e){let t=be(e);if(!t)return null;for(let r of ce)if(r.key===t||be(r.name)===t)return r;return null}function Pe({profile:e="oracle",statuses:t={}}={}){let r=["oracle setup","","one oracle. many models. every connected channel.",`profile: ${e}`,"","messaging platforms:",""];for(let o of ce){let n=t[o.key]||"unset";r.push(`  ${o.key.padEnd(16)} ${String(n).padEnd(8)}  ${o.note}`)}return r.push(""),r.push("commands:"),r.push("  oracle setup                 this menu"),r.push("  oracle setup messaging       open hermes gateway setup"),r.push("  oracle setup telegram        configure telegram bot token"),r.push("  oracle setup discord         configure discord bot token"),r.push("  oracle setup status          show configured platforms (no secrets)"),r.push("  oracle setup gateway         start/status hermes gateway"),r.push("  /setup                       same menu inside chat"),r.push(""),r.push("notes:"),r.push("  tokens stay in the hermes profile .env on this machine"),r.push("  oracle never prints bot tokens or app secrets"),r.push("  after setup: hermes -p oracle gateway restart"),r.join(`
 `)+`
-`}import f from"node:fs";import ae from"node:os";import N from"node:path";import O from"node:fs";import te from"node:os";import m from"node:path";import{fileURLToPath as re}from"node:url";var ne=m.dirname(re(import.meta.url)),be=m.resolve(ne,"../..");function _(){return process.env.ORACLE_FAKE_HOME||te.homedir()}function se(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function g(){return se()?process.env.ORACLE_CONFIG_DIR||m.join(_(),".config","oracle"):m.join(_(),".config","oracle")}function oe(){return m.join(g(),"desk.json")}function ie(){return m.join(g(),"env")}function E({force:r=!1}={}){if(E._done&&!r)return E._result||null;E._done=!0;let t={},e=(s,o)=>{if(o==null)return;let i=String(o).trim();i&&(process.env[s]!=null&&String(process.env[s]).trim()!==""||(process.env[s]=i,t[s]=i))};try{let s=ie();if(O.existsSync(s))for(let o of O.readFileSync(s,"utf8").split(/\r?\n/)){let i=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let a=i[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),e(i[1],a)}}catch{}try{let s=oe();if(O.existsSync(s)){let o=JSON.parse(O.readFileSync(s,"utf8"));o&&typeof o=="object"&&(e("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),e("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),e("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),e("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),e("ORACLE_EXEC_URL",o.execUrl),e("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let n=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return n&&(e("ORACLE_DESK_URL",n),e("ORACLE_DATA_URL",n),e("ORACLE_API_URL",n),e("ORACLE_PUBLIC_URL",n),e("MAD_DESK_URL",n)),E._result=Object.keys(t).length?t:null,E._result}try{E()}catch{}function x(){return process.env.HERMES_HOME?m.resolve(process.env.HERMES_HOME):m.join(_(),".hermes")}function y(r){return O.mkdirSync(r,{recursive:!0}),r}var ue=/(TOKEN|SECRET|PASSWORD|KEY|AUTH|PRIVATE|MNEMONIC|SEED)/i;function T(r="oracle"){return N.join(x(),"profiles",r,".env")}function ce(r){let t={};for(let e of String(r||"").split(/\r?\n/)){let n=e.trim();if(!n||n.startsWith("#"))continue;let s=n.indexOf("=");if(s<=0)continue;let o=n.slice(0,s).trim(),i=n.slice(s+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),t[o]=i}return t}function le(r="oracle"){let t=T(r);return f.existsSync(t)?ce(f.readFileSync(t,"utf8")):{}}function V(r,t,e){if(!t||ue.test(t)===!1&&/[^A-Z0-9_]/.test(t),!/^[A-Z][A-Z0-9_]*$/.test(t)){let c=new Error(`invalid env key '${t}'`);throw c.code="BAD_KEY",c}if(e==null||String(e).trim()===""){let c=new Error(`empty value for ${t}`);throw c.code="EMPTY",c}let n=T(r);y(N.dirname(n));let s=f.existsSync(n)?f.readFileSync(n,"utf8"):"",o=s?s.split(/\r?\n/):[],i=[],a=!1,u=`${t}=${String(e)}`;for(let c of o)c.startsWith(`${t}=`)?(i.push(u),a=!0):(c.length||i.length)&&i.push(c);for(a||(i.length&&i[i.length-1]!==""&&i.push(""),i.push(u));i.length&&i[i.length-1]==="";)i.pop();i.push(""),f.writeFileSync(n,i.join(`
-`),{mode:384});try{f.chmodSync(n,384)}catch{}return{path:n,key:t,set:!0}}function P(r="oracle"){let t=le(r),e={};for(let n of L()){if(!n.required.length){e[n.key]="manual";continue}let s=n.required.filter(o=>!String(t[o]||"").trim());e[n.key]=s.length?"unset":"ready"}return{profile:r,statuses:e,envPath:T(r)}}function b(r="oracle"){let{statuses:t}=P(r);return F({profile:r,statuses:t})}function Y(r,t,e,n={}){let s=k(t);if(!s){let i=new Error(`unknown platform '${t}'`);throw i.code="UNKNOWN_PLATFORM",i}if(!s.required.length){let i=new Error(`${s.key} uses hermes interactive setup (oracle setup messaging)`);throw i.code="NEEDS_INTERACTIVE",i}let o=s.required[0];V(r,o,e);for(let[i,a]of Object.entries(n||{}))a!=null&&String(a).trim()&&V(r,i,a);return{platform:s.key,set:s.required,profile:r,path:T(r)}}function pe(){return N.join(g(),"setup-state.json")}function U(r={}){y(g());let t=pe(),e={};if(f.existsSync(t))try{e=JSON.parse(f.readFileSync(t,"utf8"))}catch{e={}}let n={...e,...r,updatedAt:new Date().toISOString(),host:ae.hostname()};return f.writeFileSync(t,JSON.stringify(n,null,2)+`
-`,{mode:384}),n}import p from"node:fs";import l from"node:path";import{createHash as fe}from"node:crypto";import{spawnSync as v}from"node:child_process";var de="0.19.0",G=`hermes-agent==${de}`,I=[3,11],$=[3,14],A="3.13",D="0.12.1",M=Object.freeze({posix:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${D}/uv-installer.sh`,sha256:"d3f5412d38c99f9d024901843bf98206f0d2c6dbe64df40d0b740e2751ca62c1"}),windows:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${D}/uv-installer.ps1`,sha256:"b9ec035151bfbb11d616dbd69886498d885551489eddf095ea3c0ad59f640eb0"})});function me(r,{windows:t=process.platform==="win32"}={}){let e=Buffer.isBuffer(r)?r:Buffer.from(r),n=t?M.windows:M.posix,s=fe("sha256").update(e).digest("hex"),o=e.toString("utf8");return s===n.sha256&&o.length>=1e3&&o.includes(D)}function S(){return l.join(g(),"runtime")}function X(){return l.join(S(),"venv")}function q(r){let t=process.platform==="win32"?"Scripts":"bin",e=process.platform==="win32"?`${r}.exe`:r;return l.join(X(),t,e)}function C(){return q("hermes")}function he(){let r=q("python3");return p.existsSync(r)?r:q("python")}function R(){return l.join(S(),"uv",process.platform==="win32"?"uv.exe":"uv")}function w(r){let t=process.platform==="win32"&&!l.extname(r)?["",".exe",".cmd",".bat"]:[""];for(let e of(process.env.PATH||"").split(l.delimiter))if(e)for(let n of t){let s=l.join(e,`${r}${n}`);try{if(p.existsSync(s))return s}catch{}}return null}function ge(r){let t=/Python (\d+)\.(\d+)\.(\d+)/.exec(r||"");return t?[Number(t[1]),Number(t[2]),Number(t[3])]:null}function ye(r){if(!r)return!1;let[t,e]=r;return!(t<I[0]||t===I[0]&&e<I[1]||t>$[0]||t===$[0]&&e>=$[1])}function Se(){let r=[process.env.ORACLE_PYTHON,"python3.13","python3.12","python3.11","python3","python"].filter(Boolean);for(let t of r){let e=l.isAbsolute(t)?p.existsSync(t)?t:null:w(t);if(!e)continue;let n=v(e,["--version"],{encoding:"utf8",timeout:15e3}),s=ge(`${n.stdout||""}${n.stderr||""}`);if(ye(s))return{bin:e,version:s.join("."),source:"host"}}return null}function Ee(){return process.env.ORACLE_UV_BIN||w("uv")||(p.existsSync(l.join(_(),".local","bin","uv"))?l.join(_(),".local","bin","uv"):null)||(p.existsSync(R())?R():null)}function _e(r,t){let e=["const fs=require('node:fs');","const [url,dest]=process.argv.slice(1);","fetch(url).then(r=>{if(!r.ok)throw new Error('http '+r.status);return r.arrayBuffer()})",".then(b=>fs.writeFileSync(dest,Buffer.from(b)))",".catch(e=>{console.error(e.message);process.exit(1)});"].join("");return v(process.execPath,["-e",e,r,t],{encoding:"utf8",timeout:2*6e4})}function we({quiet:r=!1}={}){let t=Ee();if(t)return{ok:!0,bin:t,reused:!0};y(S());let e=process.platform==="win32",n=l.join(S(),e?"uv-install.ps1":"uv-install.sh"),s=e?M.windows:M.posix,o=_e(s.url,n);if(o.status!==0)return{ok:!1,reason:`could not download the uv installer (${o.status})`,stderr:(o.stderr||"").slice(-800)};let i=p.readFileSync(n);if(!me(i,{windows:e}))return{ok:!1,reason:`uv ${D} installer checksum mismatch`};let a=l.dirname(R());y(a);let u=e?w("powershell.exe")||w("powershell"):w("sh")||"/bin/sh";if(!u)return{ok:!1,reason:e?"PowerShell not found":"sh not found"};let d=v(u,e?["-NoProfile","-ExecutionPolicy","Bypass","-File",n]:[n],{stdio:r?"pipe":"inherit",encoding:"utf8",timeout:5*6e4,env:{...process.env,UV_INSTALL_DIR:a,UV_NO_MODIFY_PATH:"1"}});return d.status!==0||!p.existsSync(R())?{ok:!1,reason:`uv install failed (${d.status})`,stderr:(d.stderr||"").slice(-800)}:{ok:!0,bin:R(),reused:!1}}function J({quiet:r=!1}={}){let t=we({quiet:r});if(!t.ok)return t;let e=t.bin,n={...process.env,UV_PYTHON_INSTALL_DIR:l.join(S(),"python"),UV_CACHE_DIR:l.join(S(),"cache")},s=v(e,["python","install","--no-bin",A],{stdio:r?"pipe":"inherit",encoding:"utf8",timeout:15*6e4,env:n});if(s.status!==0)return{ok:!1,reason:`uv python install ${A} failed (${s.status})`,stderr:(s.stderr||"").slice(-800)};let o=v(e,["python","find",A],{encoding:"utf8",timeout:6e4,env:n}),i=(o.stdout||"").trim().split(/\r?\n/)[0];return o.status!==0||!i||!p.existsSync(i)?{ok:!1,reason:`uv could not locate python ${A}`}:{ok:!0,bin:i,version:A,source:"uv"}}function z(){if(process.env.ORACLE_HERMES_BIN)return{ok:!0,bin:process.env.ORACLE_HERMES_BIN,source:"env"};let r=w("hermes");if(r)return{ok:!0,bin:r,source:"path"};let t=C();return p.existsSync(t)?{ok:!0,bin:t,source:"managed"}:{ok:!1,bin:null,source:null}}function H(r,t,{quiet:e}){return v(r,t,{stdio:e?"pipe":"inherit",encoding:"utf8",timeout:20*6e4})}function Z({quiet:r=!1,upgrade:t=!1}={}){let e=Se();if(!e){let c=J({quiet:r});if(c.ok)e={bin:c.bin,version:c.version,source:"uv"};else return{ok:!1,reason:`no supported python found (need 3.11-3.13) and uv could not provide one: ${c.reason}. install uv (https://docs.astral.sh/uv) or python 3.13, then re-run 'oracle bootstrap'`}}y(S());let n=X();if(p.existsSync(C())&&!t)return{ok:!0,bin:C(),reused:!0};if(!p.existsSync(l.join(n,"pyvenv.cfg"))){let c=H(e.bin,["-m","venv",n],{quiet:r});if(c.status!==0&&e.source!=="uv"){p.rmSync(n,{recursive:!0,force:!0});let d=J({quiet:r});if(d.ok)e={bin:d.bin,version:d.version,source:"uv"},c=H(e.bin,["-m","venv",n],{quiet:r});else return{ok:!1,reason:`python -m venv failed (${c.status}) and uv fallback failed: ${d.reason}`,stderr:(c.stderr||"").slice(-800)}}if(c.status!==0)return{ok:!1,reason:`isolated python -m venv failed (${c.status})`,stderr:(c.stderr||"").slice(-800)}}let o=he();if(!p.existsSync(o))return{ok:!1,reason:`venv python missing at ${o}`};let i=["-m","pip","install","--disable-pip-version-check"];t&&i.push("--upgrade"),i.push(G);let a=H(o,i,{quiet:r});if(a.status!==0)return{ok:!1,reason:`pip install ${G} failed (${a.status})`,stderr:(a.stderr||"").slice(-1200)};let u=C();return p.existsSync(u)?{ok:!0,bin:u,reused:!1,python:e.version}:{ok:!1,reason:`hermes entrypoint not found after install (${u})`}}function K(){return["oracle setup \u2014 wire messaging + local agent surface","","  oracle setup                      menu + platform status","  oracle setup status               same, machine-friendly with --json","  oracle setup messaging            open hermes gateway setup wizard","  oracle setup telegram             set TELEGRAM_BOT_TOKEN for profile","  oracle setup discord              set DISCORD_BOT_TOKEN for profile","  oracle setup slack                set slack tokens","  oracle setup <platform>           any supported hermes platform","  oracle setup gateway [status|restart|start|stop]","  oracle setup profile [name]       default: oracle","","chat:","  /setup","  /setup telegram","  /setup status","","tokens stay local in ~/.hermes/profiles/<profile>/.env","oracle never prints secrets."].join(`
-`)}function ke(r){let t=r.indexOf("--profile");if(t>=0&&r[t+1])return r[t+1];let e=r.indexOf("-p");return e>=0&&r[e+1]?r[e+1]:process.env.ORACLE_PROFILE||"oracle"}function Oe(r){let t=[];for(let e=0;e<r.length;e++){if(r[e]==="--profile"||r[e]==="-p"){e+=1;continue}t.push(r[e])}return t}function W(r,{inherit:t=!0,env:e=process.env}={}){let n=z();if(!n.ok&&process.stdin.isTTY&&process.stdout.isTTY&&process.env.ORACLE_NO_BOOTSTRAP!=="1"){process.stdout.write(`setting up oracle's local messaging runtime (one time)
+`}import _ from"node:fs";import nt from"node:os";import ue from"node:path";import H from"node:fs";import Ze from"node:os";import O from"node:path";import{fileURLToPath as Qe}from"node:url";var et=O.dirname(Qe(import.meta.url)),rr=O.resolve(et,"../..");function C(){return process.env.ORACLE_FAKE_HOME||Ze.homedir()}function tt(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function x(){return tt()?process.env.ORACLE_CONFIG_DIR||O.join(C(),".config","oracle"):O.join(C(),".config","oracle")}function rt(){return O.join(x(),"desk.json")}function ot(){return O.join(x(),"env")}function I({force:e=!1}={}){if(I._done&&!e)return I._result||null;I._done=!0;let t={},r=(n,s)=>{if(s==null)return;let i=String(s).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,t[n]=i))};try{let n=ot();if(H.existsSync(n))for(let s of H.readFileSync(n,"utf8").split(/\r?\n/)){let i=s.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let a=i[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),r(i[1],a)}}catch{}try{let n=rt();if(H.existsSync(n)){let s=JSON.parse(H.readFileSync(n,"utf8"));s&&typeof s=="object"&&(r("ORACLE_DESK_URL",s.deskUrl||s.dataUrl||s.url),r("ORACLE_DATA_URL",s.dataUrl||s.deskUrl||s.url),r("ORACLE_API_URL",s.apiUrl||s.dataUrl||s.deskUrl),r("ORACLE_PUBLIC_URL",s.publicUrl||s.deskUrl||s.dataUrl),r("ORACLE_EXEC_URL",s.execUrl),r("MAD_DESK_URL",s.deskUrl||s.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),I._result=Object.keys(t).length?t:null,I._result}try{I()}catch{}function q(){return process.env.HERMES_HOME?O.resolve(process.env.HERMES_HOME):O.join(C(),".hermes")}function A(e){return H.mkdirSync(e,{recursive:!0}),e}var st=/(TOKEN|SECRET|PASSWORD|KEY|AUTH|PRIVATE|MNEMONIC|SEED)/i;function Y(e="oracle"){return ue.join(q(),"profiles",e,".env")}function it(e){let t={};for(let r of String(e||"").split(/\r?\n/)){let o=r.trim();if(!o||o.startsWith("#"))continue;let n=o.indexOf("=");if(n<=0)continue;let s=o.slice(0,n).trim(),i=o.slice(n+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),t[s]=i}return t}function at(e="oracle"){let t=Y(e);return _.existsSync(t)?it(_.readFileSync(t,"utf8")):{}}function Te(e,t,r){if(!t||st.test(t)===!1&&/[^A-Z0-9_]/.test(t),!/^[A-Z][A-Z0-9_]*$/.test(t)){let u=new Error(`invalid env key '${t}'`);throw u.code="BAD_KEY",u}if(r==null||String(r).trim()===""){let u=new Error(`empty value for ${t}`);throw u.code="EMPTY",u}let o=Y(e);A(ue.dirname(o));let n=_.existsSync(o)?_.readFileSync(o,"utf8"):"",s=n?n.split(/\r?\n/):[],i=[],a=!1,c=`${t}=${String(r)}`;for(let u of s)u.startsWith(`${t}=`)?(i.push(c),a=!0):(u.length||i.length)&&i.push(u);for(a||(i.length&&i[i.length-1]!==""&&i.push(""),i.push(c));i.length&&i[i.length-1]==="";)i.pop();i.push(""),_.writeFileSync(o,i.join(`
+`),{mode:384});try{_.chmodSync(o,384)}catch{}return{path:o,key:t,set:!0}}function G(e="oracle"){let t=at(e),r={};for(let o of J()){if(!o.required.length){r[o.key]="manual";continue}let n=o.required.filter(s=>!String(t[s]||"").trim());r[o.key]=n.length?"unset":"ready"}return{profile:e,statuses:r,envPath:Y(e)}}function X(e="oracle"){let{statuses:t}=G(e);return Pe({profile:e,statuses:t})}function Re(e,t,r,o={}){let n=z(t);if(!n){let i=new Error(`unknown platform '${t}'`);throw i.code="UNKNOWN_PLATFORM",i}if(!n.required.length){let i=new Error(`${n.key} uses hermes interactive setup (oracle setup messaging)`);throw i.code="NEEDS_INTERACTIVE",i}let s=n.required[0];Te(e,s,r);for(let[i,a]of Object.entries(o||{}))a!=null&&String(a).trim()&&Te(e,i,a);return{platform:n.key,set:n.required,profile:e,path:Y(e)}}function ct(){return ue.join(x(),"setup-state.json")}function Z(e={}){A(x());let t=ct(),r={};if(_.existsSync(t))try{r=JSON.parse(_.readFileSync(t,"utf8"))}catch{r={}}let o={...r,...e,updatedAt:new Date().toISOString(),host:nt.hostname()};return _.writeFileSync(t,JSON.stringify(o,null,2)+`
+`,{mode:384}),o}import y from"node:fs";import w from"node:path";import{createHash as ut}from"node:crypto";import{spawnSync as j}from"node:child_process";var lt="0.19.0",Le=`hermes-agent==${lt}`,le=[3,11],pe=[3,14],B="3.13",ee="0.12.1",te=Object.freeze({posix:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${ee}/uv-installer.sh`,sha256:"d3f5412d38c99f9d024901843bf98206f0d2c6dbe64df40d0b740e2751ca62c1"}),windows:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${ee}/uv-installer.ps1`,sha256:"b9ec035151bfbb11d616dbd69886498d885551489eddf095ea3c0ad59f640eb0"})});function pt(e,{windows:t=process.platform==="win32"}={}){let r=Buffer.isBuffer(e)?e:Buffer.from(e),o=t?te.windows:te.posix,n=ut("sha256").update(r).digest("hex"),s=r.toString("utf8");return n===o.sha256&&s.length>=1e3&&s.includes(ee)}function T(){return w.join(x(),"runtime")}function Ie(){return w.join(T(),"venv")}function fe(e){let t=process.platform==="win32"?"Scripts":"bin",r=process.platform==="win32"?`${e}.exe`:e;return w.join(Ie(),t,r)}function Q(){return fe("hermes")}function dt(){let e=fe("python3");return y.existsSync(e)?e:fe("python")}function W(){return w.join(T(),"uv",process.platform==="win32"?"uv.exe":"uv")}function U(e){let t=process.platform==="win32"&&!w.extname(e)?["",".exe",".cmd",".bat"]:[""];for(let r of(process.env.PATH||"").split(w.delimiter))if(r)for(let o of t){let n=w.join(r,`${e}${o}`);try{if(y.existsSync(n))return n}catch{}}return null}function ft(e){let t=/Python (\d+)\.(\d+)\.(\d+)/.exec(e||"");return t?[Number(t[1]),Number(t[2]),Number(t[3])]:null}function ht(e){if(!e)return!1;let[t,r]=e;return!(t<le[0]||t===le[0]&&r<le[1]||t>pe[0]||t===pe[0]&&r>=pe[1])}function mt(){let e=[process.env.ORACLE_PYTHON,"python3.13","python3.12","python3.11","python3","python"].filter(Boolean);for(let t of e){let r=w.isAbsolute(t)?y.existsSync(t)?t:null:U(t);if(!r)continue;let o=j(r,["--version"],{encoding:"utf8",timeout:15e3}),n=ft(`${o.stdout||""}${o.stderr||""}`);if(ht(n))return{bin:r,version:n.join("."),source:"host"}}return null}function gt(){return process.env.ORACLE_UV_BIN||U("uv")||(y.existsSync(w.join(C(),".local","bin","uv"))?w.join(C(),".local","bin","uv"):null)||(y.existsSync(W())?W():null)}function wt(e,t){let r=["const fs=require('node:fs');","const [url,dest]=process.argv.slice(1);","fetch(url).then(r=>{if(!r.ok)throw new Error('http '+r.status);return r.arrayBuffer()})",".then(b=>fs.writeFileSync(dest,Buffer.from(b)))",".catch(e=>{console.error(e.message);process.exit(1)});"].join("");return j(process.execPath,["-e",r,e,t],{encoding:"utf8",timeout:2*6e4})}function yt({quiet:e=!1}={}){let t=gt();if(t)return{ok:!0,bin:t,reused:!0};A(T());let r=process.platform==="win32",o=w.join(T(),r?"uv-install.ps1":"uv-install.sh"),n=r?te.windows:te.posix,s=wt(n.url,o);if(s.status!==0)return{ok:!1,reason:`could not download the uv installer (${s.status})`,stderr:(s.stderr||"").slice(-800)};let i=y.readFileSync(o);if(!pt(i,{windows:r}))return{ok:!1,reason:`uv ${ee} installer checksum mismatch`};let a=w.dirname(W());A(a);let c=r?U("powershell.exe")||U("powershell"):U("sh")||"/bin/sh";if(!c)return{ok:!1,reason:r?"PowerShell not found":"sh not found"};let m=j(c,r?["-NoProfile","-ExecutionPolicy","Bypass","-File",o]:[o],{stdio:e?"pipe":"inherit",encoding:"utf8",timeout:5*6e4,env:{...process.env,UV_INSTALL_DIR:a,UV_NO_MODIFY_PATH:"1"}});return m.status!==0||!y.existsSync(W())?{ok:!1,reason:`uv install failed (${m.status})`,stderr:(m.stderr||"").slice(-800)}:{ok:!0,bin:W(),reused:!1}}function $e({quiet:e=!1}={}){let t=yt({quiet:e});if(!t.ok)return t;let r=t.bin,o={...process.env,UV_PYTHON_INSTALL_DIR:w.join(T(),"python"),UV_CACHE_DIR:w.join(T(),"cache")},n=j(r,["python","install","--no-bin",B],{stdio:e?"pipe":"inherit",encoding:"utf8",timeout:15*6e4,env:o});if(n.status!==0)return{ok:!1,reason:`uv python install ${B} failed (${n.status})`,stderr:(n.stderr||"").slice(-800)};let s=j(r,["python","find",B],{encoding:"utf8",timeout:6e4,env:o}),i=(s.stdout||"").trim().split(/\r?\n/)[0];return s.status!==0||!i||!y.existsSync(i)?{ok:!1,reason:`uv could not locate python ${B}`}:{ok:!0,bin:i,version:B,source:"uv"}}function Ce(){if(process.env.ORACLE_HERMES_BIN)return{ok:!0,bin:process.env.ORACLE_HERMES_BIN,source:"env"};let e=U("hermes");if(e)return{ok:!0,bin:e,source:"path"};let t=Q();return y.existsSync(t)?{ok:!0,bin:t,source:"managed"}:{ok:!1,bin:null,source:null}}function de(e,t,{quiet:r}){return j(e,t,{stdio:r?"pipe":"inherit",encoding:"utf8",timeout:20*6e4})}function Ue({quiet:e=!1,upgrade:t=!1}={}){let r=mt();if(!r){let u=$e({quiet:e});if(u.ok)r={bin:u.bin,version:u.version,source:"uv"};else return{ok:!1,reason:`no supported python found (need 3.11-3.13) and uv could not provide one: ${u.reason}. install uv (https://docs.astral.sh/uv) or python 3.13, then re-run 'oracle bootstrap'`}}A(T());let o=Ie();if(y.existsSync(Q())&&!t)return{ok:!0,bin:Q(),reused:!0};if(!y.existsSync(w.join(o,"pyvenv.cfg"))){let u=de(r.bin,["-m","venv",o],{quiet:e});if(u.status!==0&&r.source!=="uv"){y.rmSync(o,{recursive:!0,force:!0});let m=$e({quiet:e});if(m.ok)r={bin:m.bin,version:m.version,source:"uv"},u=de(r.bin,["-m","venv",o],{quiet:e});else return{ok:!1,reason:`python -m venv failed (${u.status}) and uv fallback failed: ${m.reason}`,stderr:(u.stderr||"").slice(-800)}}if(u.status!==0)return{ok:!1,reason:`isolated python -m venv failed (${u.status})`,stderr:(u.stderr||"").slice(-800)}}let s=dt();if(!y.existsSync(s))return{ok:!1,reason:`venv python missing at ${s}`};let i=["-m","pip","install","--disable-pip-version-check"];t&&i.push("--upgrade"),i.push(Le);let a=de(s,i,{quiet:e});if(a.status!==0)return{ok:!1,reason:`pip install ${Le} failed (${a.status})`,stderr:(a.stderr||"").slice(-1200)};let c=Q();return y.existsSync(c)?{ok:!0,bin:c,reused:!1,python:r.version}:{ok:!1,reason:`hermes entrypoint not found after install (${c})`}}import{createHash as vt,randomBytes as ge,timingSafeEqual as kt}from"node:crypto";import k from"node:fs";import E from"node:path";import St from"node:readline/promises";import{spawn as xt,spawnSync as At}from"node:child_process";var M=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.5",protocol:"responses"}}),_t=12e4;function Et(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function R(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(M))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function V(e){let t=R(e);return{id:t,...M[t]}}function v(e,t={}){if(!k.existsSync(e))return t;try{let r=JSON.parse(k.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${E.basename(e)}`)}}function De(e){A(e),process.platform!=="win32"&&k.chmodSync(e,448)}function b(e,t){De(E.dirname(e));let r=`${e}.${process.pid}.${ge(4).toString("hex")}.tmp`;k.writeFileSync(r,`${JSON.stringify(t,null,2)}
+`,{mode:384}),k.renameSync(r,e),process.platform!=="win32"&&k.chmodSync(e,384)}function Ot(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function he(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function D(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function bt(e={}){let t=e.file||E.join(x(),"oauth.json"),r=e.metadataFile||E.join(E.dirname(t),"oauth-meta.json"),o=e.linksFile||E.join(E.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),s=e.spawnFn||At,i=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&Ot(s),a=i?"linux-secret-service":"private-file",c=`${t}.lock`;async function u(h){De(E.dirname(c));let f;for(let l=0;l<400;l+=1)try{f=k.openSync(c,"wx",384);break}catch(p){if(p?.code!=="EEXIST")throw p;try{Date.now()-k.statSync(c).mtimeMs>3e5&&k.unlinkSync(c)}catch{}await new Promise(d=>setTimeout(d,25))}if(f===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await h()}finally{try{k.closeSync(f)}catch{}try{k.unlinkSync(c)}catch{}}}function m(h,f="oauth"){return["application","oracle","kind",f,"provider",h]}function F(h){if(!k.existsSync(o))return null;let l=v(o,{providers:{}}).providers?.[h];if(!Array.isArray(l))return null;let p=[];for(let d of l)if(E.isAbsolute(String(d||"")))try{let g=v(d,{});if(h==="anthropic-oauth"&&g.claudeAiOauth){let $=D(g.claudeAiOauth);p.push({...$,refreshToken:"",source:"external-access-only"});continue}let S=g.credential_pool&&typeof g.credential_pool=="object"?g.credential_pool:null;if(S){let $=S[h]||S[h.replace(/-oauth$/,"")]||[],Ge=Array.isArray($)?$:$?[$]:[];for(let ae of Ge)if(!(!ae||typeof ae!="object"))try{let Xe=D(ae);p.push({...Xe,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return p.length?p.find(d=>!d.expiresAt||d.expiresAt>n()+_t)||p[0]:null}function Ee(h){let f=R(h);if(i){let d=s("secret-tool",["lookup",...m(f)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!d.error&&d.status===0&&String(d.stdout||"").trim())try{return D(JSON.parse(String(d.stdout).trim()))}catch{}return F(f)}let p=v(t,{providers:{}}).providers?.[f];if(p)try{return D(p)}catch{}return F(f)}function Be(h,f){let l=R(h),p=D(f);if(i){let g=s("secret-tool",["store",`--label=Oracle ${l} OAuth`,...m(l)],{input:JSON.stringify(p),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(g.error||g.status!==0)throw new Error("OS credential store rejected OAuth credential");let S=v(r,{providers:{}});return S.providers||={},S.providers[l]={expiresAt:p.expiresAt,source:p.source},b(r,S),p}let d=v(t,{providers:{}});return d.providers||={},d.providers[l]=p,b(t,d),p}function We(h){let f=R(h);if(i){let d=s("secret-tool",["clear",...m(f)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),g=v(r,{providers:{}});return g.providers&&delete g.providers[f],b(r,g),!d.error&&d.status===0}let l=v(t,{providers:{}}),p=!!l.providers?.[f];return l.providers&&delete l.providers[f],b(t,l),p}function Oe(h){let f=he(h);if(i){let l=s("secret-tool",["lookup",...m(f,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return l.error||l.status!==0?"":String(l.stdout||"").trim()}return String(v(t,{apiKeys:{}}).apiKeys?.[f]||"").trim()}function Ve(h,f){let l=he(h),p=String(f||"").trim();if(!p)throw new Error("API key is empty");if(i){let g=s("secret-tool",["store",`--label=Oracle ${l} API key`,...m(l,"api-key")],{input:p,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(g.error||g.status!==0)throw new Error("OS credential store rejected API key");let S=v(r,{providers:{},apiKeys:{}});return S.apiKeys||={},S.apiKeys[l]={configured:!0},b(r,S),!0}let d=v(t,{providers:{},apiKeys:{}});return d.apiKeys||={},d.apiKeys[l]=p,b(t,d),!0}function Je(h){let f=he(h);if(i){let d=s("secret-tool",["clear",...m(f,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),g=v(r,{providers:{},apiKeys:{}});return g.apiKeys&&delete g.apiKeys[f],b(r,g),!d.error&&d.status===0}let l=v(t,{providers:{},apiKeys:{}}),p=!!l.apiKeys?.[f];return l.apiKeys&&delete l.apiKeys[f],b(t,l),p}function Ye(){let h={},f={};if(i){let l=v(r,{providers:{},apiKeys:{}});for(let[p,d]of Object.entries(l.providers||{}))h[p]={loggedIn:!!Ee(p),expiresAt:Number(d.expiresAt||0),source:String(d.source||"oracle"),storage:a};for(let p of Object.keys(l.apiKeys||{}))f[p]={configured:!!Oe(p),storage:a}}else{let l=v(t,{providers:{},apiKeys:{}});for(let[p,d]of Object.entries(l.providers||{}))h[p]={loggedIn:!!d?.accessToken,expiresAt:Number(d?.expiresAt||0),source:String(d?.source||"oracle"),storage:a};for(let[p,d]of Object.entries(l.apiKeys||{}))f[p]={configured:!!d,storage:a}}for(let l of Object.keys(M)){if(h[l])continue;let p=F(l);p&&(h[l]={loggedIn:!0,expiresAt:p.expiresAt,source:p.source,storage:"external-access-source"})}return{storage:a,providers:h,apiKeys:f}}return Object.freeze({file:t,storage:a,get:Ee,set:Be,remove:We,getApiKey:Oe,setApiKey:Ve,removeApiKey:Je,status:Ye,withLock:u})}var je;function N(){return je||=bt(),je}function me(e){return Buffer.from(e).toString("base64url")}function Pt(){let e=me(ge(32));return{verifier:e,challenge:me(vt("sha256").update(e).digest()),state:me(ge(24))}}function Tt(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&kt(r,o)}function Rt(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return xt(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function we(e){return new URLSearchParams(e).toString()}async function L(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function Lt(e){if(e)return String(await e()).trim();let t=St.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function ye(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return D({accessToken:r,refreshToken:o,expiresAt:Et(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function $t(e){let t=M["anthropic-oauth"],r=e.pkce||Pt(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let s=await Lt(e.inputFn),[i,a]=s.split("#",2);if(!i||!Tt(a,r.state))throw new Error("Claude OAuth state mismatch");let c=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:i,state:a,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return ye(await L(c,"Claude OAuth token exchange"),e)}async function It(e){let t=M["openai-codex"],r=await L(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),s;for(let a=0;a<Math.ceil(900/n);a+=1){await e.sleepFn(n*1e3);let c=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(c.ok){s=await L(c,"Codex device authorization");break}if(![403,404].includes(c.status))throw new Error(`Codex device authorization failed (HTTP ${c.status})`)}if(!s)throw new Error("Codex device authorization timed out");let i=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:we({grant_type:"authorization_code",code:s.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:s.code_verifier})});return ye(await L(i,"Codex OAuth token exchange"),e)}function re(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function Ct(e){let t=M["xai-oauth"],r=await L(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");re(r.authorization_endpoint);let o=re(r.token_endpoint),n=await L(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:we({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let s=re(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${s}`),e.output(`Code: ${n.user_code}`),e.openFn(s);let i=Math.max(1,Number(n.interval||5)),a=Math.ceil(Math.max(1,Number(n.expires_in||600))/i);for(let c=0;c<a;c+=1){let u=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:we({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(u.ok){let F=await L(u,"xAI OAuth token exchange");return ye(F,{...e,discovery:{authorization_endpoint:re(r.authorization_endpoint),token_endpoint:o}})}let m="";try{m=String((await u.json())?.error||"")}catch{}if(m==="slow_down")await e.sleepFn((i+1)*1e3);else if(m==="authorization_pending")await e.sleepFn(i*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${u.status}${m?`, ${m}`:""})`)}throw new Error("xAI device authorization timed out")}async function Me(e,t={}){let r=R(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(s=>setTimeout(s,n))),openFn:t.openFn||Rt,output:t.output||(n=>process.stdout.write(`${n}
+`)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?$t(o):r==="openai-codex"?It(o):Ct(o)}import se from"node:fs";import ve from"node:path";var Ut=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","custom","anthropic-oauth","openai-codex","xai-oauth"]);function oe(e){return String(e||"").trim()||void 0}function jt(e,{required:t=!1}={}){let r=oe(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!Ut.has(r))throw new Error(`unsupported provider: ${r}`);return r}function Dt(e,{required:t=!1}={}){let r=oe(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function Mt(e){let t=oe(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function ne({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=jt(e),s=Dt(t,{required:o});if(n==="custom")return{provider:n,...s?{model:s}:{},baseUrl:Mt(r)};if(oe(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...s?{model:s}:{}}}var Nt=new Set(["auto","standalone","hermes","remote","arch"]);function Kt(){return ve.join(x(),"model.json")}function K(e){return String(e||"").trim()||void 0}function Ft(e={}){let t=K(e.backend)?.toLowerCase()||"auto",r=ne({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=K(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),s=K(e.reasoningEffort),i=K(e.computeHost||e.remoteHost),a=K(e.computeUser||e.remoteUser),c=K(e.computePath||e.remotePath);if(!Nt.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!i)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...s?{reasoningEffort:s}:{},...i?{computeHost:i}:{},...a?{computeUser:a}:{},...c?{computePath:c}:{}}}function Ne(e){let t=Ft(e),r=Kt();A(ve.dirname(r)),process.platform!=="win32"&&se.chmodSync(ve.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return se.writeFileSync(o,`${JSON.stringify(t,null,2)}
+`,{mode:384}),se.renameSync(o,r),process.platform!=="win32"&&se.chmodSync(r,384),t}var Ke=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.5"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},custom:{model:""}});function ke(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function zt(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function Ht(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",s),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
+`)},s=i=>{let a=String(i);for(let c of a){if(c==="\r"||c===`
+`){n(),t(o.trim());return}if(c===""){n(),r(new Error("cancelled"));return}c==="\x7F"||c==="\b"?o=o.slice(0,-1):o+=c}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",s)})}function Se(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...ne({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function Fe(e,t,r={}){return Ne(Se(e,t,r))}function qt(e){process.stdout.write(`storage: ${e.storage}
+`);let t=Object.entries(e.providers||{}),r=Object.entries(e.apiKeys||{});if(!t.length&&!r.length){process.stdout.write(`no credentials configured
+`);return}for(let[o,n]of t){let s=n.expiresAt?new Date(n.expiresAt).toISOString():"unknown";process.stdout.write(`${o}: ${n.loggedIn?"logged in":"missing"}, expires ${s}
+`)}for(let[o,n]of r)process.stdout.write(`${o}: API key ${n.configured?"configured":"missing"}
+`)}function Bt(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
+`)}var xe={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:Bt(),async run(e){let t=[...e.argv],r=t.shift()||"status",o=N();try{if(r==="status"){let n=o.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
+`):qt(n),0}if(r==="login"){let n=t.find(c=>!c.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let s=V(n),i=ke(t,"--model")||s.model;Se(s.id,i);let a=await Me(s.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await o.withLock(async()=>{let c=o.get(s.id);o.set(s.id,a);try{Fe(s.id,i)}catch(u){throw c?o.set(s.id,c):o.remove(s.id),u}}),process.stdout.write(`${s.id}: logged in, stored in ${o.storage}
+`),0}if(r==="api-key"){let n=String(t.find(c=>!c.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(Ke,n))throw new Error(`unsupported API-key provider: ${n}`);let s=ke(t,"--model")||Ke[n].model,i=ke(t,"--base-url");Se(n,s,{baseUrl:i});let a=t.includes("--stdin")?await zt():await Ht();return await o.withLock(async()=>{let c=o.getApiKey(n);o.setApiKey(n,a);try{Fe(n,s,{baseUrl:i})}catch(u){throw c?o.setApiKey(n,c):o.removeApiKey(n),u}}),process.stdout.write(`${n}: API key configured in ${o.storage}
+`),0}if(r==="logout"){let n=String(t.find(a=>!a.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let s=!1;try{s=o.remove(R(n))}catch{}let i=o.removeApiKey(n);if(!s&&!i)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
+`),0}throw new Error(`unknown auth action: ${r}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
+`),1}}};var Vt=Object.freeze([{alias:"claude",label:"Anthropic OAuth"},{alias:"codex",label:"OpenAI Codex OAuth"},{alias:"grok",label:"Grok / xAI OAuth"}]),qe=Object.freeze([{id:"openrouter",label:"OpenRouter"},{id:"openai",label:"OpenAI API"},{id:"anthropic",label:"Anthropic API"},{id:"xai",label:"xAI API"},{id:"deepseek",label:"DeepSeek"},{id:"gemini",label:"Google Gemini"},{id:"kimi",label:"Kimi"},{id:"mistral",label:"Mistral"}]);function ie(e=N().status()){let t=["standalone model OAuth (choose one)",""];for(let r of Vt){let o=V(r.alias),n=e.providers?.[o.id]?.loggedIn===!0;t.push(`  ${r.label.padEnd(18)} ${n?"connected":"not connected"}`,`    oracle setup model ${r.alias}`)}t.push("","OAuth uses your provider subscription. No API key is required.","","standalone API keys","");for(let r of qe){let o=e.apiKeys?.[r.id]?.configured===!0;t.push(`  ${r.label.padEnd(18)} ${o?"configured":"not configured"}`,`    oracle setup model ${r.id}`)}return t.push("","Any other OpenAI-compatible provider:","  oracle auth api-key custom --model MODEL --base-url https://provider.example/v1","","The selected provider is saved as backend=standalone in model.json.",""),t.join(`
+`)}function Ae(){return["oracle setup, configure standalone OAuth, messaging, and the local agent surface","","  oracle setup                      menu + platform status","  oracle setup status               same, machine-friendly with --json","  oracle setup model                show Claude/Codex/Grok OAuth choices","  oracle setup model claude         connect Anthropic OAuth + select standalone","  oracle setup model codex          connect OpenAI OAuth + select standalone","  oracle setup model grok           connect xAI OAuth + select standalone","  oracle setup model deepseek       securely add a provider API key","  oracle setup model kimi           securely add a Kimi API key","  oracle setup messaging            open hermes gateway setup wizard","  oracle setup telegram             set TELEGRAM_BOT_TOKEN for profile","  oracle setup discord              set DISCORD_BOT_TOKEN for profile","  oracle setup slack                set slack tokens","  oracle setup <platform>           any supported hermes platform","  oracle setup gateway [status|restart|start|stop]","  oracle setup profile [name]       default: oracle","","chat:","  /setup","  /setup telegram","  /setup status","","model credentials stay in the OS keychain or private ~/.config/oracle storage.","messaging tokens stay local in ~/.hermes/profiles/<profile>/.env","oracle never prints secrets."].join(`
+`)}function Jt(e){let t=e.indexOf("--profile");if(t>=0&&e[t+1])return e[t+1];let r=e.indexOf("-p");return r>=0&&e[r+1]?e[r+1]:process.env.ORACLE_PROFILE||"oracle"}function Yt(e){let t=[];for(let r=0;r<e.length;r++){if(e[r]==="--profile"||e[r]==="-p"){r+=1;continue}t.push(e[r])}return t}function _e(e,{inherit:t=!0,env:r=process.env}={}){let o=Ce();if(!o.ok&&process.stdin.isTTY&&process.stdout.isTTY&&process.env.ORACLE_NO_BOOTSTRAP!=="1"){process.stdout.write(`setting up oracle's local messaging runtime (one time)
 
-`);let o=Z();o.ok&&(n={ok:!0,bin:o.bin})}if(!n.ok)return process.stderr.write(`oracle setup needs the local runtime
+`);let s=Ue();s.ok&&(o={ok:!0,bin:s.bin})}if(!o.ok)return process.stderr.write(`oracle setup needs the local runtime
 run: oracle bootstrap
-`),1;let s=ve(n.bin,r,{stdio:t?"inherit":"pipe",encoding:"utf8",env:e});return s.error?(process.stderr.write(`oracle setup: failed to run hermes: ${s.error.message}
-`),1):(t||(s.stdout&&process.stdout.write(s.stdout),s.stderr&&process.stderr.write(s.stderr)),typeof s.status=="number"?s.status:1)}async function ee(r){if(!h.isTTY||typeof h.setRawMode!="function"){let t=new Error("interactive token entry requires a tty");throw t.code="NO_TTY",t}return Q.write(`${r}: `),new Promise((t,e)=>{let n="",s=()=>{h.off("data",o),h.setRawMode(!1),h.pause(),Q.write(`
-`)},o=i=>{for(let a of String(i)){if(a==="\r"||a===`
-`){s(),t(n.trim());return}if(a===""){s(),e(new Error("cancelled"));return}a==="\x7F"||a==="\b"?n=n.slice(0,-1):n+=a}};h.setRawMode(!0),h.resume(),h.on("data",o)})}async function xe(r,t,e=[]){let n=k(t);if(!n)return process.stderr.write(`oracle setup: unknown platform '${t}'
-`),process.stderr.write(`known: ${L().map(u=>u.key).join(", ")}
-`),1;if(!n.required.length)return process.stdout.write(`opening hermes setup for ${n.key} (interactive)
-`),U({lastPlatform:n.key,profile:r}),W(["-p",r,...n.hermes||["gateway","setup"]]);let s={},o=[];for(let u=0;u<e.length;u++){let c=e[u];if(c==="--token"&&e[u+1]){s.token=e[++u];continue}if(c==="--allowed-users"&&e[u+1]){s.allowedUsers=e[++u];continue}if(c==="--app-token"&&e[u+1]){s.appToken=e[++u];continue}if(c.startsWith("-"))return process.stderr.write(`oracle setup: unknown flag ${c}
-`),1;o.push(c)}let i=s.token||o[0]||"";if(!i)try{i=await ee(`${n.key} bot token`)}catch(u){if(u?.code==="NO_TTY")return process.stderr.write(`oracle setup ${n.key}: pass --token <value> in non-interactive mode
-`),1;throw u}if(!i)return process.stderr.write(`aborted: empty token
-`),1;let a={};if(s.allowedUsers&&(n.key==="telegram"&&(a.TELEGRAM_ALLOWED_USERS=s.allowedUsers),n.key==="discord"&&(a.DISCORD_ALLOWED_USERS=s.allowedUsers),n.key==="slack"&&(a.SLACK_ALLOWED_USERS=s.allowedUsers)),s.appToken&&n.key==="slack"&&(a.SLACK_APP_TOKEN=s.appToken),n.key==="slack"&&!a.SLACK_APP_TOKEN){let u=s.appToken||o[1]||"";if(!u&&process.stdin.isTTY&&(u=await ee("slack app token (xapp-...)")),!u)return process.stderr.write(`slack needs bot token + app token
-`),1;a.SLACK_APP_TOKEN=u}try{let u=Y(r,n.key,i,a);return U({lastPlatform:n.key,profile:r,ready:!0}),process.stdout.write(`saved ${n.key} credentials for profile '${r}'
-path: ${u.path}
+`),1;let n=Wt(o.bin,e,{stdio:t?"inherit":"pipe",encoding:"utf8",env:r});return n.error?(process.stderr.write(`oracle setup: failed to run hermes: ${n.error.message}
+`),1):(t||(n.stdout&&process.stdout.write(n.stdout),n.stderr&&process.stderr.write(n.stderr)),typeof n.status=="number"?n.status:1)}async function He(e){if(!P.isTTY||typeof P.setRawMode!="function"){let t=new Error("interactive token entry requires a tty");throw t.code="NO_TTY",t}return ze.write(`${e}: `),new Promise((t,r)=>{let o="",n=()=>{P.off("data",s),P.setRawMode(!1),P.pause(),ze.write(`
+`)},s=i=>{for(let a of String(i)){if(a==="\r"||a===`
+`){n(),t(o.trim());return}if(a===""){n(),r(new Error("cancelled"));return}a==="\x7F"||a==="\b"?o=o.slice(0,-1):o+=a}};P.setRawMode(!0),P.resume(),P.on("data",s)})}async function Gt(e,t,r=[]){let o=z(t);if(!o)return process.stderr.write(`oracle setup: unknown platform '${t}'
+`),process.stderr.write(`known: ${J().map(c=>c.key).join(", ")}
+`),1;if(!o.required.length)return process.stdout.write(`opening hermes setup for ${o.key} (interactive)
+`),Z({lastPlatform:o.key,profile:e}),_e(["-p",e,...o.hermes||["gateway","setup"]]);let n={},s=[];for(let c=0;c<r.length;c++){let u=r[c];if(u==="--token"&&r[c+1]){n.token=r[++c];continue}if(u==="--allowed-users"&&r[c+1]){n.allowedUsers=r[++c];continue}if(u==="--app-token"&&r[c+1]){n.appToken=r[++c];continue}if(u.startsWith("-"))return process.stderr.write(`oracle setup: unknown flag ${u}
+`),1;s.push(u)}let i=n.token||s[0]||"";if(!i)try{i=await He(`${o.key} bot token`)}catch(c){if(c?.code==="NO_TTY")return process.stderr.write(`oracle setup ${o.key}: pass --token <value> in non-interactive mode
+`),1;throw c}if(!i)return process.stderr.write(`aborted: empty token
+`),1;let a={};if(n.allowedUsers&&(o.key==="telegram"&&(a.TELEGRAM_ALLOWED_USERS=n.allowedUsers),o.key==="discord"&&(a.DISCORD_ALLOWED_USERS=n.allowedUsers),o.key==="slack"&&(a.SLACK_ALLOWED_USERS=n.allowedUsers)),n.appToken&&o.key==="slack"&&(a.SLACK_APP_TOKEN=n.appToken),o.key==="slack"&&!a.SLACK_APP_TOKEN){let c=n.appToken||s[1]||"";if(!c&&process.stdin.isTTY&&(c=await He("slack app token (xapp-...)")),!c)return process.stderr.write(`slack needs bot token + app token
+`),1;a.SLACK_APP_TOKEN=c}try{let c=Re(e,o.key,i,a);return Z({lastPlatform:o.key,profile:e,ready:!0}),process.stdout.write(`saved ${o.key} credentials for profile '${e}'
+path: ${c.path}
 next: oracle setup gateway restart
-`),0}catch(u){return process.stderr.write(`oracle setup: ${u.message}
-`),1}}var Ze={name:"setup",summary:"configure telegram/discord/slack messaging platforms",group:"read",usage:K(),async run(r){let t=[...r.argv],e=t.includes("--json"),n=ke(t),s=Oe(t).filter(a=>a!=="--json"),o=(s[0]||"menu").toLowerCase(),i=s.slice(1);if(["-h","--help","help"].includes(o))return process.stdout.write(K()+`
-`),0;if(["menu","list","ls"].includes(o))return e?process.stdout.write(JSON.stringify(P(n),null,2)+`
-`):process.stdout.write(b(n)),0;if(["status","show"].includes(o)){let a=P(n);return e?process.stdout.write(JSON.stringify(a,null,2)+`
-`):(process.stdout.write(b(n)),process.stdout.write(`hermes root: ${x()}
-`)),0}if(["messaging","gateway-setup","platforms"].includes(o))return U({lastAction:"messaging",profile:n}),process.stdout.write(`opening hermes gateway setup wizard...
-`),W(["-p",n,"gateway","setup"]);if(o==="gateway"){let a=(i[0]||"status").toLowerCase();return["status","start","stop","restart","run","install"].includes(a)?W(["-p",n,"gateway",a]):(process.stderr.write(`usage: oracle setup gateway [status|start|stop|restart|run|install]
-`),1)}if(o==="profile"){let a=i[0]||n;return process.stdout.write(`profile: ${a}
-hermes: ${x()}/profiles/${a}
-`),process.stdout.write(b(a)),0}return k(o)?xe(n,o,i):(process.stderr.write(`oracle setup: unknown verb '${o}'
-${K()}
-`),1)}};export{Ze as default};
+`),0}catch(c){return process.stderr.write(`oracle setup: ${c.message}
+`),1}}var zr={name:"setup",summary:"configure standalone OAuth and messaging platforms",group:"read",usage:Ae(),async run(e){let t=[...e.argv],r=t.includes("--json"),o=Jt(t),n=Yt(t).filter(a=>a!=="--json"),s=(n[0]||"menu").toLowerCase(),i=n.slice(1);if(["-h","--help","help"].includes(s))return process.stdout.write(Ae()+`
+`),0;if(["menu","list","ls"].includes(s))return r?process.stdout.write(JSON.stringify({...G(o),modelAuth:N().status()},null,2)+`
+`):(process.stdout.write(ie()),process.stdout.write(X(o))),0;if(["status","show"].includes(s)){let a=G(o);return r?process.stdout.write(JSON.stringify({...a,modelAuth:N().status()},null,2)+`
+`):(process.stdout.write(ie()),process.stdout.write(X(o)),process.stdout.write(`hermes root: ${q()}
+`)),0}if(["model","oauth"].includes(s)){let a=String(i[0]||"").trim().toLowerCase();if(!a||["list","status","show"].includes(a))return process.stdout.write(ie()),0;if(qe.some(c=>c.id===a)||a==="custom")return xe.run({...e,argv:["api-key",a,...i.slice(1)]});try{return V(a),xe.run({...e,argv:["login",a,...i.slice(1)]})}catch(c){return process.stderr.write(`oracle setup model: ${c.message}
+`),process.stderr.write(ie()),1}}if(["messaging","gateway-setup","platforms"].includes(s))return Z({lastAction:"messaging",profile:o}),process.stdout.write(`opening hermes gateway setup wizard...
+`),_e(["-p",o,"gateway","setup"]);if(s==="gateway"){let a=(i[0]||"status").toLowerCase();return["status","start","stop","restart","run","install"].includes(a)?_e(["-p",o,"gateway",a]):(process.stderr.write(`usage: oracle setup gateway [status|start|stop|restart|run|install]
+`),1)}if(s==="profile"){let a=i[0]||o;return process.stdout.write(`profile: ${a}
+hermes: ${q()}/profiles/${a}
+`),process.stdout.write(X(a)),0}return z(s)?Gt(o,s,i):(process.stderr.write(`oracle setup: unknown verb '${s}'
+${Ae()}
+`),1)}};export{zr as default,ie as renderModelSetup};

package/dist/cli/commands/sign.mjs

@@ -1,37 +1,5 @@
-var D=Object.defineProperty;var J=(e,t,r)=>()=>{if(r)throw r[0];try{return e&&(t=e(e=0)),t}catch(n){throw r=[n],n}};var B=(e,t)=>{for(var r in t)D(e,r,{get:t[r],enumerable:!0})};var I={};B(I,{OPERATOR_BIN_NAMES:()=>h,OPERATOR_NOT_INSTALLED_MESSAGE:()=>w,SIGN_HINT:()=>S,SIGN_NOUNS:()=>N,default:()=>U,dispatchOperator:()=>$,printOperatorNotInstalled:()=>_,resolveOperator:()=>j});import g from"node:fs";import a from"node:path";import{spawnSync as H}from"node:child_process";import{createRequire as M}from"node:module";import{fileURLToPath as q}from"node:url";function A(e){let t={};for(let r of h){let n=[a.join(e,r),a.join(e,`${r}.mjs`),a.join(e,`${r}.js`)];for(let o of n)if(g.existsSync(o)&&g.statSync(o).isFile()){t[r]=o;break}}return t}function W(e){let t=a.dirname(e);for(;t!==a.dirname(t);){let r=a.join(t,"package.json");if(g.existsSync(r))try{let n=JSON.parse(g.readFileSync(r,"utf8"));if(n.name==="@oracle-agent/operator")return{root:t,pkg:n}}catch{}t=a.dirname(t)}return null}function z(e){for(let t of e)try{let r=M(a.join(t,"package.json")),n;try{let s=r.resolve("@oracle-agent/operator/package.json");n={root:a.dirname(s),pkg:JSON.parse(g.readFileSync(s,"utf8"))}}catch{let s=r.resolve("@oracle-agent/operator");n=W(s)}if(!n)continue;let{root:o,pkg:i}=n,p=i.bin||{},l={};for(let[s,c]of Object.entries(p))l[s]=a.resolve(o,c);let f=A(a.join(o,"bin"));for(let[s,c]of Object.entries(f))l[s]||(l[s]=c);return{ok:!0,binDir:a.join(o,"bin"),version:i.version||"unknown",bins:l,source:`require:${t}`}}catch{}return null}function j(){if(process.env.ORACLE_PUBLIC_DESKTOP==="1")return{ok:!1,source:"public-desktop"};let e=process.env.ORACLE_OPERATOR_BIN_DIR;if(e){let r=a.resolve(e);if(!g.existsSync(r))return{ok:!1};let n=A(r);if(!Object.keys(n).length)return{ok:!1};let o="unknown",i=a.resolve(r,"../package.json");if(g.existsSync(i))try{o=JSON.parse(g.readFileSync(i,"utf8")).version||o}catch{}return{ok:!0,binDir:r,version:o,bins:n,source:"env:ORACLE_OPERATOR_BIN_DIR"}}return z([process.cwd(),K])||{ok:!1}}function _(e=process.stderr){e.write(w),w.endsWith(`
-`)||e.write(`
-`)}function $(e,t=[],r={}){let n=j();if(!n.ok)return _(r.stderr||process.stderr),3;let o=n.bins[e];if(!o)return(r.stderr||process.stderr).write(`oracle: operator bin '${e}' not found in resolved operator (${n.source})
-`),3;let i=r.stdio||"inherit",p=/\.(mjs|cjs|js)$/.test(o),l=p?process.execPath:o,f=p?[o,...t]:[...t],s=H(l,f,{stdio:i,env:r.env||process.env,cwd:r.cwd||process.cwd(),encoding:i==="pipe"?"utf8":void 0});if(s.error)return(r.stderr||process.stderr).write(`oracle: failed to spawn ${e}: ${s.error.message}
-`),1;let c=typeof s.status=="number"?s.status:1;return c!==0&&r.appendHintOnError&&(r.stderr||process.stderr).write(S+`
-`),i==="pipe"?{code:c,stdout:s.stdout||"",stderr:s.stderr||""}:c}var G,K,h,N,w,S,U,P=J(()=>{G=a.dirname(q(import.meta.url)),K=a.resolve(G,"../.."),h=Object.freeze(["oracle-vault","oracle-credential","oracle-signer","oracle-runner","oracle-agentic-init","oracle-agentic-doctor","oracle-control-mcp","oracle-operator-caps"]),N=Object.freeze(["vault","credential","signer","runner","sign"]),w=`oracle: signing is unavailable in the public package.
-
-  The public 'oracle' package is prepare-only and never handles keys.
-  Owner-operated signing is private infrastructure and has no public npm install.
-  Review and sign prepared artifacts in your own wallet instead.
-
-  Nothing about your read/research/prepare setup is affected.
-`,S="hint: run 'oracle sign init' to provision keys, or 'oracle sign doctor --json' for detail.";U={resolveOperator:j,dispatchOperator:$,printOperatorNotInstalled:_,OPERATOR_NOT_INSTALLED_MESSAGE:w,SIGN_HINT:S,SIGN_NOUNS:N,OPERATOR_BIN_NAMES:h}});var ne={name:"sign",summary:"check signer status (key handling requires the operator package)",group:"sign",usage:"oracle sign <init|doctor|import> ...",async run(e){let t=e.argv[0];if(t==="init")return e.dispatchOperator("oracle-agentic-init",e.argv.slice(1),{appendHintOnError:!0});if(t==="doctor")return e.dispatchOperator("oracle-agentic-doctor",e.argv.slice(1),{appendHintOnError:!0});if(t==="import"){let{resolveOperator:r,printOperatorNotInstalled:n}=await Promise.resolve().then(()=>(P(),I));if(!r().ok)return n(e.stderr||process.stderr),3;let{createInterface:o}=await import("node:readline"),{writeFileSync:i,mkdirSync:p,existsSync:l,unlinkSync:f,readFileSync:s,statSync:c}=await import("node:fs"),{join:d,parse:V}=await import("node:path"),{homedir:F,platform:Y}=await import("node:os"),v=process.env.ORACLE_CONFIG_DIR||d(F(),".config","oracle"),O=d(v,"keys"),u=d(O,"evm.json"),m=e.argv.includes("--keyfile")?e.argv[e.argv.indexOf("--keyfile")+1]:null;if(m){if(!l(m))return process.stderr.write(`oracle sign: ${m} not found
-`),1;let y=s(m,"utf8").trim(),k=y.startsWith("{")&&JSON.parse(y).key||y;if(!k.startsWith("0x")||k.length<64)return process.stderr.write(`oracle sign: invalid private key in file
-`),1;if(l(u))return process.stderr.write(`oracle sign: ${u} already exists
-`),1;p(O,{recursive:!0,mode:448}),i(u,JSON.stringify({key:k},null,2)+`
-`,{mode:384}),process.stderr.write(`Saved to ${u} (0600)
-`);try{try{i(m,Buffer.alloc(c(m).size,0))}catch{}f(m)}catch{}let R=d(v,"exec.env");return i(R,`ORACLE_EXEC_ENABLED=1
-`,"utf8"),process.stderr.write(`Armed: ${R}
-`),await L(v,u),0}let b=o({input:process.stdin,output:process.stderr}),C=y=>new Promise(k=>b.question(y,k));process.stderr.write(`
-Your key stays local \u2014 Oracle never sends it anywhere.
-`),process.stderr.write(`Paste your EVM private key (0x...):
-> `);let T=await C("");b.close();let E=T.trim();if(!E.startsWith("0x")||E.length<64)return process.stderr.write(`oracle sign: invalid private key \u2014 must be 0x-prefixed hex
-`),1;if(l(u))return process.stderr.write(`oracle sign: ${u} already exists \u2014 remove it first or use 'oracle sign doctor'
-`),1;p(O,{recursive:!0,mode:448}),i(u,JSON.stringify({key:E},null,2)+`
-`,{mode:384}),process.stderr.write(`Saved to ${u} (0600)
-`);let x=d(v,"exec.env");return i(x,`ORACLE_EXEC_ENABLED=1
-`,"utf8"),process.stderr.write(`Armed: ${x}
-`),await L(v,u),0}return process.stderr.write(`usage: oracle sign <init|doctor|import> ...
+var i={name:"sign",summary:"check signer status (key handling requires the operator package)",group:"sign",usage:"oracle sign <init|doctor|import> ...",async run(r){let e=r.argv[0];return e==="init"?r.dispatchOperator("oracle-agentic-init",r.argv.slice(1),{appendHintOnError:!0}):e==="doctor"?r.dispatchOperator("oracle-agentic-doctor",r.argv.slice(1),{appendHintOnError:!0}):e==="import"?r.dispatchOperator("oracle-agentic-init",[],{appendHintOnError:!0}):(process.stderr.write(`usage: oracle sign <init|doctor|import> ...
   oracle sign init      provision keys + policy (interactive)
   oracle sign import    import an existing EVM private key
   oracle sign doctor    check local signer readiness
-`),1}};async function L(e,t){let{readFileSync:r,writeFileSync:n,existsSync:o}=await import("node:fs"),{join:i}=await import("node:path"),p=i(e,"signer.env"),l=o(p)?r(p,"utf8").split(`
-`):[],f=new Map(l.filter(c=>c.includes("=")).map(c=>c.split("=",2)));for(let c of["EVM_KEY_FILE","HL_KEY_FILE"])f.set(c,t);let s=[...f.entries()].map(([c,d])=>`${c}=${d}`).join(`
-`)+`
-`;n(p,s,"utf8"),process.stderr.write(`Wired ${t} into ${p}
-`)}export{ne as default};
+`),1)}};export{i as default};