@otto-code/server 0.5.0

package/dist/server/server/daemon-config-store.js

@@ -0,0 +1,530 @@
+import { loadPersistedConfig, savePersistedConfig, AgentPersonalityConfigSchema, } from "./persisted-config.js";
+import { ProviderOverrideSchema } from "./agent/provider-launch-config.js";
+import { MutableDaemonConfigSchema, MutableDaemonConfigPatchSchema, } from "@otto-code/protocol/messages";
+import { LocalSttModelIdSchema, LocalTtsModelIdSchema, resolveLocalTtsSpeakerId, } from "./speech/providers/local/models.js";
+function getLogger(logger) {
+    return logger?.child({ module: "daemon-config-store" });
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepMerge(current, patch) {
+    const next = { ...current };
+    for (const [key, patchValue] of Object.entries(patch)) {
+        if (patchValue === undefined) {
+            continue;
+        }
+        const currentValue = next[key];
+        if (isRecord(currentValue) && isRecord(patchValue)) {
+            next[key] = deepMerge(currentValue, patchValue);
+            continue;
+        }
+        next[key] = patchValue;
+    }
+    return next;
+}
+function getValueAtPath(config, path) {
+    return path
+        .split(".")
+        .reduce((value, segment) => (isRecord(value) ? value[segment] : undefined), config);
+}
+function isEqualValue(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+// A stand-in the daemon sends to clients in place of a stored host-provider
+// secret, so the real value never rides the wire (the settings UI already hides
+// it behind a secure field, but the plaintext was still echoed in the config
+// payload). A client saving the config unchanged sends the sentinel straight
+// back and patch() restores the stored value instead of overwriting it with the
+// placeholder. The settings UI's change-detection usually means an untouched
+// secret isn't re-sent at all, but a full-object patch would carry it — so the
+// restore is handled defensively rather than relying on the client.
+export const DAEMON_CONFIG_SECRET_SENTINEL = "__otto_secret_present__";
+// Wire paths (within the mutable config) of the secrets masked on the way to
+// clients. Deliberately narrow — only host-provider credentials.
+const SECRET_WIRE_PATHS = [
+    ["speech", "openai", "apiKey"],
+    ["gitHosting", "providers", "bitbucketCloud", "apiToken"],
+];
+function setValueAtPath(config, path, value) {
+    const [head, ...rest] = path;
+    const clone = { ...config };
+    if (rest.length === 0) {
+        clone[head] = value;
+    }
+    else if (isRecord(clone[head])) {
+        clone[head] = setValueAtPath(clone[head], rest, value);
+    }
+    return clone;
+}
+// Return a copy of the config with every stored secret replaced by the sentinel.
+// Structurally shares everything off the secret paths; only clones the branches
+// it rewrites, so this.current is never mutated. Empty/absent secrets are left
+// untouched so "not configured" still reads as empty on the client.
+export function redactDaemonConfigForClient(config) {
+    let next = config;
+    for (const path of SECRET_WIRE_PATHS) {
+        const value = getValueAtPath(next, path.join("."));
+        if (typeof value === "string" && value.length > 0) {
+            next = setValueAtPath(next, path, DAEMON_CONFIG_SECRET_SENTINEL);
+        }
+    }
+    return next;
+}
+// Drop any secret leaf whose value is the sentinel from an incoming patch, so
+// deepMerge preserves the stored secret (it skips undefined/absent keys) instead
+// of persisting the placeholder. Mutates the already-parsed patch in place.
+function stripRedactedSecretsFromPatch(patch) {
+    for (const path of SECRET_WIRE_PATHS) {
+        let container = patch;
+        for (let i = 0; i < path.length - 1; i += 1) {
+            container = isRecord(container) ? container[path[i]] : undefined;
+        }
+        const leafKey = path[path.length - 1];
+        if (isRecord(container) && container[leafKey] === DAEMON_CONFIG_SECRET_SENTINEL) {
+            delete container[leafKey];
+        }
+    }
+}
+export function applyMutableProviderConfigToOverrides(baseOverrides, mutableProviders) {
+    if (!baseOverrides && (!mutableProviders || Object.keys(mutableProviders).length === 0)) {
+        return undefined;
+    }
+    const nextOverrides = { ...baseOverrides };
+    for (const [providerId, providerConfig] of Object.entries(mutableProviders ?? {})) {
+        nextOverrides[providerId] = {
+            ...nextOverrides[providerId],
+            ...ProviderOverrideSchema.strip().parse(providerConfig),
+        };
+    }
+    return nextOverrides;
+}
+export class DaemonConfigStore {
+    constructor(ottoHome, initial, logger) {
+        this.changeListeners = new Set();
+        this.fieldChangeHandlers = new Map();
+        this.ottoHome = ottoHome;
+        this.logger = getLogger(logger);
+        this.current = MutableDaemonConfigSchema.parse(initial);
+    }
+    get() {
+        return this.current;
+    }
+    /**
+     * Seed the shipped default Agent Personalities onto disk the first time this
+     * host runs the feature — but ONLY when the persisted config has never carried
+     * an agentPersonalities section. Once the section exists on disk (even as an
+     * empty roster the user cleared), this is a no-op, so deleting the whole team
+     * sticks across restarts instead of silently re-seeding. The in-memory config
+     * is seeded separately at construction (see bootstrap); this only records the
+     * one-time initialization on disk, writing just the personalities branch so
+     * unrelated defaults (speech, etc.) are never frozen onto disk as a side
+     * effect.
+     */
+    seedDefaultPersonalitiesIfAbsent(defaults) {
+        const persisted = loadPersistedConfig(this.ottoHome, this.logger);
+        if (persisted.agents?.agentPersonalities !== undefined) {
+            return;
+        }
+        savePersistedConfig(this.ottoHome, {
+            ...persisted,
+            agents: {
+                ...persisted.agents,
+                agentPersonalities: {
+                    personalities: [...defaults],
+                },
+            },
+        }, this.logger);
+        this.logger?.info(`Seeded ${defaults.length} default agent personalities`);
+    }
+    patch(partial) {
+        const parsedPatch = MutableDaemonConfigPatchSchema.parse(partial);
+        // A masked secret that comes back unchanged must not overwrite the stored
+        // value with the sentinel placeholder.
+        stripRedactedSecretsFromPatch(parsedPatch);
+        const { patch: prunedPatch, removedProviderIds } = extractProviderRemovals(parsedPatch);
+        const base = removedProviderIds.length
+            ? removeProviders(this.current, removedProviderIds)
+            : this.current;
+        const next = MutableDaemonConfigSchema.parse(deepMerge(base, prunedPatch));
+        const changedFieldPaths = Array.from(this.fieldChangeHandlers.keys()).filter((path) => {
+            return !isEqualValue(getValueAtPath(this.current, path), getValueAtPath(next, path));
+        });
+        if (changedFieldPaths.length === 0 && isEqualValue(this.current, next)) {
+            return this.current;
+        }
+        // Persist before updating in-memory state so that if persistence fails,
+        // runtime and disk stay consistent.
+        this.persistConfig(next, removedProviderIds);
+        this.current = next;
+        for (const path of changedFieldPaths) {
+            const handlers = this.fieldChangeHandlers.get(path);
+            if (!handlers) {
+                continue;
+            }
+            const value = getValueAtPath(next, path);
+            for (const handler of handlers) {
+                handler(value);
+            }
+        }
+        for (const listener of this.changeListeners) {
+            listener(next, { removedProviderIds });
+        }
+        return next;
+    }
+    onFieldChange(path, handler) {
+        const handlers = this.fieldChangeHandlers.get(path) ?? new Set();
+        handlers.add(handler);
+        this.fieldChangeHandlers.set(path, handlers);
+        return () => {
+            const currentHandlers = this.fieldChangeHandlers.get(path);
+            if (!currentHandlers) {
+                return;
+            }
+            currentHandlers.delete(handler);
+            if (currentHandlers.size === 0) {
+                this.fieldChangeHandlers.delete(path);
+            }
+        };
+    }
+    onChange(listener) {
+        this.changeListeners.add(listener);
+        return () => {
+            this.changeListeners.delete(listener);
+        };
+    }
+    persistConfig(config, removedProviderIds) {
+        const persisted = loadPersistedConfig(this.ottoHome, this.logger);
+        const nextPersisted = mergeMutableConfigIntoPersistedConfig({
+            persisted,
+            mutable: config,
+            removedProviderIds,
+        });
+        savePersistedConfig(this.ottoHome, nextPersisted, this.logger);
+    }
+}
+function extractProviderRemovals(patch) {
+    const providers = patch.providers;
+    if (!providers) {
+        return { patch, removedProviderIds: [] };
+    }
+    const removedProviderIds = Object.entries(providers)
+        .filter(([, value]) => value === null)
+        .map(([providerId]) => providerId);
+    if (removedProviderIds.length === 0) {
+        return { patch, removedProviderIds };
+    }
+    const remainingProviders = Object.fromEntries(Object.entries(providers).filter(([, value]) => value !== null));
+    return {
+        patch: { ...patch, providers: remainingProviders },
+        removedProviderIds,
+    };
+}
+function removeProviders(config, removedProviderIds) {
+    const removed = new Set(removedProviderIds);
+    return {
+        ...config,
+        providers: Object.fromEntries(Object.entries(config.providers).filter(([providerId]) => !removed.has(providerId))),
+    };
+}
+function mergeMutableConfigIntoPersistedConfig(params) {
+    const { persisted, mutable, removedProviderIds } = params;
+    const browserToolsEnabled = readBrowserToolsEnabled(mutable);
+    const metadataGenerationProviders = readMetadataGenerationProviders(mutable);
+    const agentPersonalities = readAgentPersonalities(mutable);
+    const removedProviders = new Set(removedProviderIds);
+    const persistedOverrides = persisted.agents?.providers;
+    const retainedOverrides = persistedOverrides && removedProviders.size > 0
+        ? Object.fromEntries(Object.entries(persistedOverrides).filter(([providerId]) => !removedProviders.has(providerId)))
+        : persistedOverrides;
+    const providerOverrides = applyMutableProviderConfigToOverrides(retainedOverrides, mutable.providers);
+    const persistedAgents = persisted.agents;
+    const persistedMetadataGeneration = {
+        providers: metadataGenerationProviders,
+    };
+    const shouldPersistMetadataGeneration = metadataGenerationProviders.length > 0 || persisted.agents?.metadataGeneration !== undefined;
+    let nextAgents = persisted.agents;
+    if (providerOverrides && Object.keys(providerOverrides).length > 0) {
+        nextAgents = {
+            ...persistedAgents,
+            providers: providerOverrides,
+            ...(shouldPersistMetadataGeneration
+                ? { metadataGeneration: persistedMetadataGeneration }
+                : {}),
+        };
+    }
+    else if (removedProviders.size > 0 && persistedOverrides) {
+        // The last provider override was removed — drop the providers key so the
+        // removed entry does not survive in config.json.
+        const { providers: _removed, ...agentsWithoutProviders } = persistedAgents ?? {};
+        nextAgents = {
+            ...agentsWithoutProviders,
+            ...(shouldPersistMetadataGeneration
+                ? { metadataGeneration: persistedMetadataGeneration }
+                : {}),
+        };
+    }
+    else if (shouldPersistMetadataGeneration) {
+        nextAgents = {
+            ...persistedAgents,
+            metadataGeneration: persistedMetadataGeneration,
+        };
+    }
+    // Fold the personality roster into agents.agentPersonalities.
+    nextAgents = withAgentPersonalities({
+        nextAgents,
+        persistedAgents,
+        hadPersonalities: persisted.agents?.agentPersonalities !== undefined,
+        personalities: agentPersonalities,
+    });
+    return {
+        ...persisted,
+        daemon: {
+            ...persisted.daemon,
+            mcp: {
+                ...persisted.daemon?.mcp,
+                injectIntoAgents: mutable.mcp.injectIntoAgents,
+            },
+            browserTools: {
+                ...persisted.daemon?.browserTools,
+                enabled: browserToolsEnabled,
+            },
+            autoArchiveAfterMerge: mutable.autoArchiveAfterMerge,
+            enableTerminalAgentHooks: mutable.enableTerminalAgentHooks,
+            appendSystemPrompt: mutable.appendSystemPrompt,
+            ...(mutable.terminalProfiles !== undefined
+                ? { terminalProfiles: mutable.terminalProfiles }
+                : {}),
+        },
+        agents: nextAgents,
+        features: mergeSpeechIntoPersistedFeatures(persisted, mutable.speech),
+        providers: mergeSpeechOpenAiIntoPersistedProviders(persisted, mutable.speech),
+        gitHosting: buildPersistedGitHosting(persisted, mutable.gitHosting),
+    };
+}
+// Host-level hosting credentials persist under gitHosting.providers in
+// config.json — one set per provider. The mutable config is the post-merge
+// source of truth; empty strings mean "remove" and a provider with no
+// remaining credentials is dropped so stale tokens never linger on disk.
+function buildPersistedGitHosting(persisted, gitHosting) {
+    if (!gitHosting) {
+        return persisted.gitHosting;
+    }
+    const email = gitHosting.providers?.bitbucketCloud?.email?.trim();
+    const apiToken = gitHosting.providers?.bitbucketCloud?.apiToken?.trim();
+    const bitbucketCloud = {
+        ...(email ? { email } : {}),
+        ...(apiToken ? { apiToken } : {}),
+    };
+    if (Object.keys(bitbucketCloud).length === 0) {
+        return undefined;
+    }
+    return { providers: { bitbucketCloud } };
+}
+// The speech OpenAI key lives at providers.openai.apiKey in config.json (the
+// path the speech config resolver reads). An empty string in the patch removes
+// the stored key; sibling fields (baseUrl, stt/tts endpoints) are preserved.
+function mergeSpeechOpenAiIntoPersistedProviders(persisted, speech) {
+    const apiKey = speech?.openai?.apiKey;
+    if (apiKey === undefined) {
+        return persisted.providers;
+    }
+    const trimmed = apiKey.trim();
+    const openai = { ...persisted.providers?.openai };
+    if (trimmed.length === 0) {
+        delete openai["apiKey"];
+    }
+    else {
+        openai["apiKey"] = trimmed;
+    }
+    const next = { ...persisted.providers };
+    if (Object.keys(openai).length > 0) {
+        next.openai = openai;
+    }
+    else {
+        delete next.openai;
+    }
+    return next;
+}
+function isSpeechEngineId(value) {
+    return value === "local" || value === "openai";
+}
+function nonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function buildPersistedSttFields(params) {
+    const { stt, existing } = params;
+    if (!stt) {
+        return { ...existing };
+    }
+    const provider = isSpeechEngineId(stt.provider) ? stt.provider : existing?.provider;
+    const model = provider === "local"
+        ? LocalSttModelIdSchema.safeParse(stt.model ?? "").data
+        : nonEmptyString(stt.model);
+    const language = nonEmptyString(stt.language) ?? existing?.language;
+    return {
+        ...existing,
+        ...(provider ? { provider } : {}),
+        // An unknown model id for the selected engine is dropped rather than
+        // persisted, so a bad patch can never wedge config.json.
+        ...(model ? { model } : {}),
+        ...(language ? { language } : {}),
+    };
+}
+function buildPersistedTtsFields(params) {
+    const { tts, existing } = params;
+    if (!tts) {
+        return { ...existing };
+    }
+    const provider = isSpeechEngineId(tts.provider)
+        ? tts.provider
+        : existing?.["provider"];
+    const next = {
+        ...existing,
+        ...(provider ? { provider } : {}),
+        ...(typeof tts.speed === "number" && Number.isFinite(tts.speed) ? { speed: tts.speed } : {}),
+    };
+    if (provider === "local") {
+        const localModel = LocalTtsModelIdSchema.safeParse(tts.model ?? "").data;
+        if (localModel) {
+            next["model"] = localModel;
+            const voiceName = nonEmptyString(tts.voice);
+            const speakerId = voiceName ? resolveLocalTtsSpeakerId(localModel, voiceName) : undefined;
+            if (speakerId !== undefined) {
+                next["speakerId"] = speakerId;
+            }
+        }
+        // The persisted `voice` field is OpenAI-only; local voices persist as speakerId.
+        delete next["voice"];
+        return next;
+    }
+    const model = nonEmptyString(tts.model);
+    if (model) {
+        next["model"] = model;
+    }
+    const voice = nonEmptyString(tts.voice);
+    if (voice) {
+        next["voice"] = voice;
+    }
+    delete next["speakerId"];
+    return next;
+}
+function mergeSpeechIntoPersistedFeatures(persisted, speech) {
+    if (!speech) {
+        return persisted.features;
+    }
+    const existing = persisted.features ?? {};
+    const dictation = speech.dictation
+        ? {
+            ...existing.dictation,
+            ...(speech.dictation.enabled !== undefined ? { enabled: speech.dictation.enabled } : {}),
+            ...(speech.dictation.stt
+                ? {
+                    stt: buildPersistedSttFields({
+                        stt: speech.dictation.stt,
+                        existing: existing.dictation?.stt,
+                    }),
+                }
+                : {}),
+        }
+        : existing.dictation;
+    const voiceMode = speech.voiceMode
+        ? {
+            ...existing.voiceMode,
+            ...(speech.voiceMode.enabled !== undefined ? { enabled: speech.voiceMode.enabled } : {}),
+            ...(speech.voiceMode.stt
+                ? {
+                    stt: buildPersistedSttFields({
+                        stt: speech.voiceMode.stt,
+                        existing: existing.voiceMode?.stt,
+                    }),
+                }
+                : {}),
+            ...(speech.voiceMode.tts
+                ? {
+                    tts: buildPersistedTtsFields({
+                        tts: speech.voiceMode.tts,
+                        existing: existing.voiceMode?.tts,
+                    }),
+                }
+                : {}),
+        }
+        : existing.voiceMode;
+    return {
+        ...existing,
+        ...(dictation ? { dictation } : {}),
+        ...(voiceMode ? { voiceMode } : {}),
+    };
+}
+// Attach the personality roster to the persisted agents section. Writes when
+// there is a roster to persist, or when a previously-written roster must be
+// cleared to empty (so deleting the last personality survives a restart).
+function withAgentPersonalities(params) {
+    const { nextAgents, persistedAgents, hadPersonalities, personalities } = params;
+    if (personalities.length === 0 && !hadPersonalities) {
+        return nextAgents;
+    }
+    // Spread the existing section so sibling keys written by a newer daemon
+    // round-trip instead of being dropped on every config write.
+    const baseAgents = nextAgents ?? persistedAgents;
+    const existingSection = isRecord(baseAgents?.["agentPersonalities"])
+        ? baseAgents["agentPersonalities"]
+        : {};
+    return {
+        ...baseAgents,
+        agentPersonalities: { ...existingSection, personalities },
+    };
+}
+function readBrowserToolsEnabled(mutable) {
+    const browserTools = mutable.browserTools;
+    if (!isRecord(browserTools)) {
+        return false;
+    }
+    return browserTools["enabled"] === true;
+}
+function readMetadataGenerationProviders(mutable) {
+    const metadataGeneration = mutable.metadataGeneration;
+    if (!isRecord(metadataGeneration)) {
+        return [];
+    }
+    const providers = metadataGeneration["providers"];
+    if (!Array.isArray(providers)) {
+        return [];
+    }
+    return providers.flatMap((entry) => {
+        if (!isRecord(entry) || typeof entry["provider"] !== "string") {
+            return [];
+        }
+        return [
+            {
+                provider: entry["provider"],
+                ...(typeof entry["model"] === "string" ? { model: entry["model"] } : {}),
+                ...(typeof entry["thinkingOptionId"] === "string"
+                    ? { thinkingOptionId: entry["thinkingOptionId"] }
+                    : {}),
+            },
+        ];
+    });
+}
+// Read the agent personality roster out of the mutable config, dropping entries
+// that lack the required identity fields (id/name/provider/model). Parsing each
+// entry through the persisted schema (which is .passthrough() at every level)
+// re-validates the known fields AND carries unknown fields through untouched —
+// so a personality field written by a newer daemon round-trips instead of being
+// silently stripped on the next patch. Effort/role validation happens at use
+// time against the daemon's live catalog, not here.
+function readAgentPersonalities(mutable) {
+    const section = mutable.agentPersonalities;
+    if (!isRecord(section)) {
+        return [];
+    }
+    const personalities = section["personalities"];
+    if (!Array.isArray(personalities)) {
+        return [];
+    }
+    return personalities.flatMap((entry) => {
+        const parsed = AgentPersonalityConfigSchema.safeParse(entry);
+        return parsed.success ? [parsed.data] : [];
+    });
+}
+//# sourceMappingURL=daemon-config-store.js.map

package/dist/server/server/daemon-keypair.d.ts

@@ -0,0 +1,8 @@
+import type pino from "pino";
+import { type KeyPair } from "@otto-code/relay/e2ee";
+export interface DaemonKeyPairBundle {
+    keyPair: KeyPair;
+    publicKeyB64: string;
+}
+export declare function loadOrCreateDaemonKeyPair(ottoHome: string, logger?: pino.Logger): Promise<DaemonKeyPairBundle>;
+//# sourceMappingURL=daemon-keypair.d.ts.map

package/dist/server/server/daemon-keypair.js

@@ -0,0 +1,42 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { generateKeyPair, exportPublicKey, exportSecretKey, importPublicKey, importSecretKey, } from "@otto-code/relay/e2ee";
+import { ensurePrivateFile, writePrivateFileAtomicSync } from "./private-files.js";
+const KeyPairSchema = z.object({
+    v: z.literal(2),
+    publicKeyB64: z.string().min(1),
+    secretKeyB64: z.string().min(1),
+});
+const KEYPAIR_FILENAME = "daemon-keypair.json";
+export async function loadOrCreateDaemonKeyPair(ottoHome, logger) {
+    const log = logger?.child({ module: "daemon-keypair" });
+    const filePath = path.join(ottoHome, KEYPAIR_FILENAME);
+    if (existsSync(filePath)) {
+        try {
+            ensurePrivateFile(filePath);
+            const raw = readFileSync(filePath, "utf8");
+            const parsed = KeyPairSchema.parse(JSON.parse(raw));
+            const publicKey = importPublicKey(parsed.publicKeyB64);
+            const secretKey = importSecretKey(parsed.secretKeyB64);
+            const publicKeyB64 = exportPublicKey(publicKey);
+            log?.info({ filePath }, "Loaded daemon keypair");
+            return { keyPair: { publicKey, secretKey }, publicKeyB64 };
+        }
+        catch (error) {
+            log?.warn({ err: error, filePath }, "Failed to load daemon keypair, regenerating");
+        }
+    }
+    const keyPair = generateKeyPair();
+    const publicKeyB64 = exportPublicKey(keyPair.publicKey);
+    const secretKeyB64 = exportSecretKey(keyPair.secretKey);
+    const payload = {
+        v: 2,
+        publicKeyB64,
+        secretKeyB64,
+    };
+    writePrivateFileAtomicSync(filePath, JSON.stringify(payload, null, 2) + "\n");
+    log?.info({ filePath }, "Saved daemon keypair");
+    return { keyPair, publicKeyB64 };
+}
+//# sourceMappingURL=daemon-keypair.js.map

package/dist/server/server/daemon-version.d.ts

@@ -0,0 +1,5 @@
+import { PackageVersionResolutionError } from "./package-version.js";
+export declare class DaemonVersionResolutionError extends PackageVersionResolutionError {
+}
+export declare function resolveDaemonVersion(moduleUrl?: string): string;
+//# sourceMappingURL=daemon-version.d.ts.map

package/dist/server/server/daemon-version.js

@@ -0,0 +1,22 @@
+import { PackageVersionResolutionError, resolvePackageVersion } from "./package-version.js";
+const SERVER_PACKAGE_NAME = "@otto-code/server";
+export class DaemonVersionResolutionError extends PackageVersionResolutionError {
+}
+export function resolveDaemonVersion(moduleUrl = import.meta.url) {
+    try {
+        return resolvePackageVersion({
+            moduleUrl,
+            packageName: SERVER_PACKAGE_NAME,
+        });
+    }
+    catch (error) {
+        if (error instanceof PackageVersionResolutionError) {
+            throw new DaemonVersionResolutionError({
+                moduleUrl,
+                packageName: SERVER_PACKAGE_NAME,
+            });
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=daemon-version.js.map

package/dist/server/server/daemon-worker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=daemon-worker.d.ts.map