@oriro/orirocli 0.1.2 → 0.1.4

package/README.md

@@ -2,21 +2,25 @@
 
 # ORIRO‑Terminal - **“Head | Memory | Eyeball for AI”**
 
-# **FREE TIER | BYOK** | **Works in 100 Languages | Live Security Gaurdian-V3 (MCP Watch)**
+# **FREE · KEYLESS · BYOK** | **Works in 100 Languages | Deterministic Security Guardian V3**
 
-A terminal coder that **sees the web**, **speaks and listens in 100 languages**, **guards itself**, and can wear a **floating avatar that talks back in its own voice** — all on‑device.
-
-A free, on-device-friendly terminal AI agent — built on the Pi agent harness (used as a library).
+A free, keyless terminal AI coder — built on the Pi agent harness (used as a library).
+It **writes and runs code** from a pool of free routers, works in **your language**, **guards every action**,
+can **inspect a live site's structure**, and greets you with an **avatar in its own on-device voice**.
 Your language, your machine, no paid keys required.
 
-## What's inside
-- **Keyless free-router Mux** — best-router selection + invisible failover across free providers, with an on-device floor. Never a paid key.
-- **100 languages** — type in your language; the model reasons in English; replies come back translated (on-device NLLB).
-- **Guardian V3** — a security gate on every tool call, default-on, fail-closed.
-- **Head** — goes out, inspects a live site, and reverse-engineers it to code.
-- **Scriber** — a consent-gated, self-healing local work journal (never leaves your machine).
-- **323 skills**, **multi-agent orchestration** on the free pool, and **MCP connectors**.
-- **Channels** — drive ORIRO from Telegram/Discord/WhatsApp with your own bot.
+## What's inside (this release)
+- **Keyless free-router Mux** — best-router selection + invisible failover across free providers, with an on-device floor. **Never a paid key.** BYOK optional (live-validated).
+- **100 languages** — pick yours at first run; the model works in English. On-device NLLB translation is an optional add-on (without it, your text passes through as-is).
+- **Guardian V3 (Lite)** — a **deterministic** security gate on every tool call (default-on, fail-closed): blocks `curl|sh` remote-exec, destructive wipes, reverse shells, and env/secret exfil. No weights, no tokenizer, no download.
+- **Head** — fetches a live site, detects its **sections/structure**, and reports the gaps to build from (the coder writes the code from that report).
+- **Scriber (memory)** — a consent-gated local work journal, **off by default**; turns are recalled across sessions and never leave your machine.
+- **323 skills** (CORE/TAIL tiered) + **multi-agent orchestration** on the free pool.
+- **MCP connector catalog** (59) and **Channels** — run ORIRO from Telegram/Discord/WhatsApp with **your own** bot.
+- **Avatar** — pick a face at onboarding; it greets you aloud in its paired on-device voice.
+
+## On the roadmap (not in this release)
+Full-page **screenshot → code** Head (Playwright), the **two-way voice loop** (speak + listen/STT), in-REPL **permission modes**, and **`oriro mcp`** guided setup. Today the Head is fetch/structure-based and voice is the avatar's spoken greeting.
 
 ## Install
 

package/dist/cli.js

@@ -475,6 +475,10 @@ var REVERSE_SHELL = [
 ];
 var SECRET_PATHS = /(\.ssh\/id_|\.ssh\/.*_rsa|\.aws\/credentials|\.oriro\/credentials|\.config\/gcloud|\.env(\.|\b)|\.netrc|id_ed25519|\.kube\/config|wallet\.dat|\.gnupg\/)/i;
 var NET_SINK = /\b(curl|wget|nc|ncat|socat|scp|rsync|ftp|tftp|invoke-webrequest|invoke-restmethod)\b/i;
+var ENV_EXFIL = [
+  /\$\(\s*(printenv|env)\b/i,
+  /\$\(\s*cat\b[^)]*(\.ssh|\.aws|\.env|\.netrc|credential|secret|token|id_rsa|id_ed25519)/i
+];
 var PERSISTENCE = [
   /\bcrontab\b\s+(-|\S+)/i,
   // crontab install
@@ -542,6 +546,14 @@ var DEFAULT_RULES = [
       return null;
     }
   },
+  {
+    id: "env-exfiltration",
+    description: "Block dumping env vars / secret files into a network request (curl \u2026$(printenv SECRET)).",
+    match: (c) => {
+      const cmd = norm(cmdOf(c));
+      return cmd && NET_SINK.test(cmd) && anyMatch(ENV_EXFIL, cmd) ? block("env-exfiltration", "Sending environment variables / secret files off the machine") : null;
+    }
+  },
   {
     id: "persistence",
     description: "Flag cron/rc/startup/service edits used for Trojan persistence.",
@@ -1527,6 +1539,48 @@ function scrubMessageIdentity(msg) {
   };
 }
 
+// src/routers/tool-sanitize.ts
+var CONTROL_TOKEN = /<\|[^|]*\|>/g;
+var RECIPIENT_PREFIX = /^(?:to=)?(?:functions?|tools?|recipient)[.=]/i;
+var RECIPIENT = /(?:to=)?(?:functions?|tools?|recipient)[.=]([A-Za-z0-9_.:-]+)/i;
+var CLEAN_NAME = /^[A-Za-z0-9_.:-]+$/;
+function sanitizeToolName(raw) {
+  if (!raw) return raw;
+  if (!raw.includes("<|") && !RECIPIENT_PREFIX.test(raw)) return raw;
+  const base = (raw.split("<|")[0] ?? "").replace(RECIPIENT_PREFIX, "").trim();
+  if (base && CLEAN_NAME.test(base)) return base;
+  const recip = raw.match(RECIPIENT);
+  if (recip?.[1]) return recip[1];
+  const m = raw.replace(CONTROL_TOKEN, " ").match(/[A-Za-z_][A-Za-z0-9_.:-]*/);
+  return m ? m[0] : raw;
+}
+function sanitizeMessageToolCalls(msg) {
+  let changed = false;
+  const content = msg.content.map((c) => {
+    if (c.type === "toolCall") {
+      const name = sanitizeToolName(c.name);
+      if (name !== c.name) {
+        changed = true;
+        return { ...c, name };
+      }
+    }
+    return c;
+  });
+  return changed ? { ...msg, content } : msg;
+}
+function sanitizeEventToolCalls(ev) {
+  let next = ev;
+  if ("partial" in next && next.partial) {
+    const partial = sanitizeMessageToolCalls(next.partial);
+    if (partial !== next.partial) next = { ...next, partial };
+  }
+  if (next.type === "toolcall_end" && next.toolCall) {
+    const name = sanitizeToolName(next.toolCall.name);
+    if (name !== next.toolCall.name) next = { ...next, toolCall: { ...next.toolCall, name } };
+  }
+  return next;
+}
+
 // src/routers/mux-provider.ts
 var MUX_PROVIDER = "oriro-mux";
 var MUX_MODEL = "oriro-free";
@@ -1576,17 +1630,17 @@ async function driveMux(out, mux, byId, context, options) {
         committed = true;
         if (ev.type === "done") {
           mux.recordSuccess(id, Date.now() - t0);
-          const clean = scrubMessageIdentity(ev.message);
+          const clean = sanitizeMessageToolCalls(scrubMessageIdentity(ev.message));
           out.push({ type: "done", reason: ev.reason, message: clean });
           out.end(clean);
           return;
         }
         lastPartial = ev.partial;
-        out.push(ev);
+        out.push(sanitizeEventToolCalls(ev));
       }
       if (failedBeforeContent) continue;
       mux.recordSuccess(id, Date.now() - t0);
-      out.end(lastPartial ? scrubMessageIdentity(lastPartial) : void 0);
+      out.end(lastPartial ? sanitizeMessageToolCalls(scrubMessageIdentity(lastPartial)) : void 0);
       return;
     } catch (e) {
       mux.recordFailure(id, e);
@@ -2771,6 +2825,17 @@ function setupNllbTranslator(opts) {
 }
 
 // src/repl.ts
+function replHelp() {
+  return `
+  ${accent("ORIRO terminal \u2014 help")}
+  ${dim("Just type to chat; ORIRO writes and runs code for you (keyless, free).")}
+
+  ${accent("/help")}  this help     ${accent("/exit")} or ${accent("/quit")}  leave     ${dim("Ctrl-D / Ctrl-C also exit")}
+  ${dim("Run these OUTSIDE the chat (in your shell):")}
+  ${dim("oriro skills \xB7 routers \xB7 connectors \xB7 channels \xB7 scribe \xB7 language \xB7 avatar")}
+
+`;
+}
 async function runRepl() {
   if (isFirstRun()) await runOnboarding();
   else stdout4.write(banner());
@@ -2789,6 +2854,10 @@ async function runRepl() {
       }
       if (!line) continue;
       if (line === "/exit" || line === "/quit") break;
+      if (line === "/help" || line === "/?") {
+        stdout4.write(replHelp());
+        continue;
+      }
       const english = await translateForCoder(line, lang);
       let out = "";
       const unsub = session.subscribe((e) => {
@@ -4242,6 +4311,9 @@ function writeAdded(slugs) {
 function listConnectors(category) {
   return category ? CONNECTOR_CATALOG.filter((c) => c.category === category) : CONNECTOR_CATALOG;
 }
+function connectorCategories() {
+  return [...new Set(CONNECTOR_CATALOG.map((c) => c.category))].sort();
+}
 function addConnector(slug) {
   const entry = connectorBySlug(slug);
   if (!entry) return { ok: false, error: `unknown connector '${slug}' \u2014 run \`oriro connectors list\`` };
@@ -4255,13 +4327,20 @@ function addedConnectors() {
   return CONNECTOR_CATALOG.filter((c) => added.has(c.slug));
 }
 function removeConnector(slug) {
-  writeAdded(readAdded().filter((s) => s !== slug));
+  const before = readAdded();
+  if (!before.includes(slug)) return false;
+  writeAdded(before.filter((s) => s !== slug));
+  return true;
 }
 
 // src/commands/connectors.ts
 function registerConnectorsCommand(program2) {
   const connectors = program2.command("connectors").description("MCP connectors \u2014 add external tools/services (inert until used)");
   connectors.command("list [category]").description("list the connector catalog (optionally filtered by category)").action((category) => {
+    if (category && !connectorCategories().includes(category)) {
+      info(`unknown category '${category}' \u2014 categories: ${connectorCategories().join(", ")}`);
+      return;
+    }
     const entries = listConnectors(category);
     const added = new Set(addedConnectors().map((c) => c.slug));
     heading(category ? `Connectors \xB7 ${category}` : "Connectors");
@@ -4278,8 +4357,8 @@ function registerConnectorsCommand(program2) {
     ok(`added ${accent(slug)} \u2014 inert until a session uses it`);
   });
   connectors.command("remove <slug>").description("remove a connector").action((slug) => {
-    removeConnector(slug);
-    ok(`removed ${accent(slug)}`);
+    if (removeConnector(slug)) ok(`removed ${accent(slug)}`);
+    else info(`'${slug}' is not in your added list \u2014 nothing to remove`);
   });
 }
 
@@ -4529,6 +4608,10 @@ function registerChannelsCommand(program2) {
   });
   channels.command("remove <kind>").description("remove a configured channel").action((kind) => {
     if (!isKind(kind)) die(`unknown channel '${kind}' \u2014 one of: ${KINDS.join(", ")}`);
+    if (!readChannels().some((c) => c.kind === kind)) {
+      info(`no ${kind} channel configured \u2014 nothing to remove`);
+      return;
+    }
     removeChannel(kind);
     ok(`removed ${accent(kind)}`);
   });
@@ -4553,6 +4636,9 @@ function registerSkillsCommand(program2) {
 
 // src/commands/language.ts
 import { stdin as stdin5 } from "process";
+function resolveLanguage(input) {
+  return languageByCode(input) ?? LANGUAGES.find((l) => l.name.toLowerCase() === input.trim().toLowerCase());
+}
 function registerLanguageCommand(program2) {
   program2.command("language").description("show or change your terminal language").argument("[code]", "switch directly to this language (ISO code or name, e.g. es)").option("-a, --all", "list every available language").action(async (code, opts) => {
     if (opts.all) {
@@ -4565,7 +4651,7 @@ function registerLanguageCommand(program2) {
       return;
     }
     if (code) {
-      const lang = languageByCode(code);
+      const lang = resolveLanguage(code);
       if (!lang) die(`unknown language '${code}' \u2014 run \`oriro language --all\` to see the list`);
       setTerminalLanguage(lang);
       ok(`${accent(lang.name)} is now your terminal language.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oriro/orirocli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "ORIRO — a free, on-device-friendly terminal AI agent. Built on the Pi agent harness (used as a library).",
   "type": "module",
   "bin": {
@@ -22,8 +22,9 @@
     "dev": "tsx src/cli.ts",
     "build": "tsup",
     "typecheck": "tsc --noEmit",
+    "test:unit": "tsx scripts/test-tool-sanitize.ts && tsx scripts/test-guardian.ts",
     "smoke": "npm run build && node scripts/smoke.mjs",
-    "prepublishOnly": "npm run build && node scripts/smoke.mjs && node scripts/prepublish-check.mjs",
+    "prepublishOnly": "npm run build && npm run test:unit && node scripts/smoke.mjs && node scripts/prepublish-check.mjs",
     "start": "node dist/cli.js"
   },
   "dependencies": {