@ouro.bot/cli 0.1.0-alpha.18 → 0.1.0-alpha.181

package/dist/heart/daemon/auth-flow.js

@@ -0,0 +1,477 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readAgentConfigForAgent = readAgentConfigForAgent;
+exports.writeAgentProviderSelection = writeAgentProviderSelection;
+exports.loadAgentSecrets = loadAgentSecrets;
+exports.writeProviderCredentials = writeProviderCredentials;
+exports.writeAgentModel = writeAgentModel;
+exports.collectRuntimeAuthCredentials = collectRuntimeAuthCredentials;
+exports.resolveHatchCredentials = resolveHatchCredentials;
+exports.runRuntimeAuthFlow = runRuntimeAuthFlow;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const identity_1 = require("../identity");
+const migrate_config_1 = require("../migrate-config");
+const ANTHROPIC_SETUP_TOKEN_PREFIX = "sk-ant-oat01-";
+const ANTHROPIC_SETUP_TOKEN_MIN_LENGTH = 80;
+const DEFAULT_SECRETS_TEMPLATE = {
+    providers: {
+        azure: {
+            modelName: "gpt-4o-mini",
+            apiKey: "",
+            endpoint: "",
+            deployment: "",
+            apiVersion: "2025-04-01-preview",
+        },
+        minimax: {
+            model: "MiniMax-M2.7",
+            apiKey: "",
+        },
+        anthropic: {
+            model: "claude-opus-4-6",
+            setupToken: "",
+            refreshToken: "",
+            expiresAt: 0,
+        },
+        "openai-codex": {
+            model: "gpt-5.4",
+            oauthAccessToken: "",
+        },
+        "github-copilot": {
+            model: "claude-sonnet-4.6",
+            githubToken: "",
+            baseUrl: "",
+        },
+    },
+    teams: {
+        clientId: "",
+        clientSecret: "",
+        tenantId: "",
+    },
+    oauth: {
+        graphConnectionName: "graph",
+        adoConnectionName: "ado",
+        githubConnectionName: "",
+    },
+    teamsChannel: {
+        skipConfirmation: true,
+        port: 3978,
+    },
+    integrations: {
+        perplexityApiKey: "",
+        openaiEmbeddingsApiKey: "",
+    },
+};
+function deepMerge(defaults, partial) {
+    const result = { ...defaults };
+    for (const key of Object.keys(partial)) {
+        const left = result[key];
+        const right = partial[key];
+        if (right !== null &&
+            typeof right === "object" &&
+            !Array.isArray(right) &&
+            left !== null &&
+            typeof left === "object" &&
+            !Array.isArray(left)) {
+            result[key] = deepMerge(left, right);
+            continue;
+        }
+        result[key] = right;
+    }
+    return result;
+}
+function readJsonRecord(filePath, label) {
+    try {
+        const raw = fs.readFileSync(filePath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("expected object");
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new Error(`Failed to read ${label} at ${filePath}: ${String(error)}`);
+    }
+}
+function readAgentConfigForAgent(agentName, bundlesRoot = (0, identity_1.getAgentBundlesRoot)()) {
+    const agentRoot = path.join(bundlesRoot, `${agentName}.ouro`);
+    const configPath = path.join(agentRoot, "agent.json");
+    let parsed = readJsonRecord(configPath, "agent config");
+    // Inline migration: v1 -> v2
+    const version = typeof parsed.version === "number" ? parsed.version : 1;
+    if (version < 2) {
+        (0, migrate_config_1.migrateAgentConfigV1ToV2)(agentRoot);
+        parsed = readJsonRecord(configPath, "agent config");
+    }
+    // Validate v2 required facing fields
+    const humanFacing = parsed.humanFacing;
+    const agentFacing = parsed.agentFacing;
+    if (!humanFacing || typeof humanFacing !== "object") {
+        throw new Error(`agent.json at ${configPath} has unsupported provider '${String(parsed.provider)}'`);
+    }
+    const provider = humanFacing.provider;
+    if (provider !== "azure" &&
+        provider !== "anthropic" &&
+        provider !== "minimax" &&
+        provider !== "openai-codex" &&
+        provider !== "github-copilot") {
+        throw new Error(`agent.json at ${configPath} has unsupported provider '${String(provider)}'`);
+    }
+    if (!agentFacing || typeof agentFacing !== "object") {
+        throw new Error(`agent.json at ${configPath} has unsupported provider '${String(parsed.provider)}'`);
+    }
+    return {
+        configPath,
+        config: parsed,
+    };
+}
+function writeAgentProviderSelection(agentName, facing, provider, bundlesRoot = (0, identity_1.getAgentBundlesRoot)()) {
+    const { configPath, config } = readAgentConfigForAgent(agentName, bundlesRoot);
+    const facingKey = facing === "human" ? "humanFacing" : "agentFacing";
+    const nextConfig = {
+        ...config,
+        [facingKey]: { ...config[facingKey], provider },
+    };
+    fs.writeFileSync(configPath, `${JSON.stringify(nextConfig, null, 2)}\n`, "utf8");
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.auth_provider_selected",
+        message: "updated agent provider selection after auth flow",
+        meta: { agentName, facing, provider, configPath },
+    });
+    return configPath;
+}
+function resolveAgentSecretsPath(agentName, deps = {}) {
+    if (deps.secretsRoot)
+        return path.join(deps.secretsRoot, agentName, "secrets.json");
+    const homeDir = deps.homeDir ?? os.homedir();
+    return (0, identity_1.getAgentSecretsPath)(agentName).replace(os.homedir(), homeDir);
+}
+function loadAgentSecrets(agentName, deps = {}) {
+    const secretsPath = resolveAgentSecretsPath(agentName, deps);
+    const secretsDir = path.dirname(secretsPath);
+    fs.mkdirSync(secretsDir, { recursive: true });
+    let onDisk = {};
+    try {
+        onDisk = readJsonRecord(secretsPath, "secrets config");
+    }
+    catch (error) {
+        const message = error.message;
+        if (!message.includes("ENOENT"))
+            throw error;
+    }
+    return {
+        secretsPath,
+        secrets: deepMerge(DEFAULT_SECRETS_TEMPLATE, onDisk),
+    };
+}
+function writeSecrets(secretsPath, secrets) {
+    fs.writeFileSync(secretsPath, `${JSON.stringify(secrets, null, 2)}\n`, "utf8");
+}
+function writeProviderCredentials(agentName, provider, credentials, deps = {}) {
+    const { secretsPath, secrets } = loadAgentSecrets(agentName, deps);
+    applyCredentials(secrets, provider, credentials);
+    writeSecrets(secretsPath, secrets);
+    return { secretsPath, secrets };
+}
+function writeAgentModel(agentName, facing, modelName, deps = {}) {
+    const { configPath, config } = readAgentConfigForAgent(agentName, deps.bundlesRoot);
+    const facingKey = facing === "human" ? "humanFacing" : "agentFacing";
+    const facingBlock = config[facingKey];
+    const previousModel = facingBlock.model;
+    const provider = facingBlock.provider;
+    const nextConfig = {
+        ...config,
+        [facingKey]: { ...facingBlock, model: modelName },
+    };
+    fs.writeFileSync(configPath, `${JSON.stringify(nextConfig, null, 2)}\n`, "utf8");
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.config_model_updated",
+        message: "updated agent model in agent.json",
+        meta: { agentName, facing, provider, modelName, previousModel, configPath },
+    });
+    return { configPath, provider, previousModel };
+}
+function readCodexAccessToken(homeDir) {
+    const authPath = path.join(homeDir, ".codex", "auth.json");
+    try {
+        const raw = fs.readFileSync(authPath, "utf8");
+        const parsed = JSON.parse(raw);
+        const token = parsed?.tokens?.access_token;
+        return typeof token === "string" ? token.trim() : "";
+    }
+    catch {
+        return "";
+    }
+}
+function ensurePromptInput(promptInput, provider) {
+    if (promptInput)
+        return promptInput;
+    throw new Error(`No prompt input is available for ${provider} authentication.`);
+}
+function validateAnthropicToken(token) {
+    const trimmed = token.trim();
+    if (!trimmed) {
+        throw new Error("No Anthropic setup token was provided.");
+    }
+    if (!trimmed.startsWith(ANTHROPIC_SETUP_TOKEN_PREFIX)) {
+        throw new Error(`Invalid Anthropic setup token format. Expected prefix ${ANTHROPIC_SETUP_TOKEN_PREFIX}.`);
+    }
+    if (trimmed.length < ANTHROPIC_SETUP_TOKEN_MIN_LENGTH) {
+        throw new Error("Anthropic setup token looks too short.");
+    }
+    return trimmed;
+}
+async function collectRuntimeAuthCredentials(input, deps) {
+    const spawnSync = deps.spawnSync ?? child_process_1.spawnSync;
+    const homeDir = deps.homeDir ?? os.homedir();
+    if (input.provider === "github-copilot") {
+        let token = process.env.GH_TOKEN?.trim() || "";
+        if (!token) {
+            const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
+            token = (result.status === 0 && result.stdout ? result.stdout.trim() : "");
+        }
+        if (!token) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.auth_gh_login_start",
+                message: "starting gh auth login for runtime auth",
+                meta: { agentName: input.agentName },
+            });
+            const loginResult = spawnSync("gh", ["auth", "login"], { stdio: "inherit" });
+            if (loginResult.status !== 0) {
+                throw new Error("'gh auth login' failed. Install the GitHub CLI (gh) and try again.");
+            }
+            const retryResult = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
+            /* v8 ignore next -- branch: retry after login always succeeds in tests @preserve */
+            token = (retryResult.status === 0 && retryResult.stdout ? retryResult.stdout.trim() : "");
+            /* v8 ignore next -- defensive: gh auth login succeeded but token still missing @preserve */
+            if (!token) {
+                throw new Error("gh auth login completed but no token was found. Run `gh auth login` and try again.");
+            }
+        }
+        const response = await fetch("https://api.github.com/copilot_internal/user", {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        if (!response.ok) {
+            throw new Error(`GitHub Copilot endpoint discovery failed (HTTP ${response.status}). Ensure your GitHub account has Copilot access.`);
+        }
+        const body = await response.json();
+        const baseUrl = body?.endpoints?.api;
+        /* v8 ignore next -- defensive: valid response but missing endpoints field @preserve */
+        if (!baseUrl) {
+            throw new Error("GitHub Copilot endpoint discovery returned no endpoints.api. Ensure your GitHub account has Copilot access.");
+        }
+        return { githubToken: token, baseUrl };
+    }
+    if (input.provider === "openai-codex") {
+        let token = readCodexAccessToken(homeDir);
+        if (!token) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.auth_codex_login_start",
+                message: "starting codex login for runtime auth",
+                meta: { agentName: input.agentName },
+            });
+            const result = spawnSync("codex", ["login"], { stdio: "inherit" });
+            if (result.error) {
+                throw new Error(`Failed to run 'codex login': ${result.error.message}`);
+            }
+            if (result.status !== 0) {
+                throw new Error(`'codex login' exited with status ${result.status}.`);
+            }
+            token = readCodexAccessToken(homeDir);
+            if (!token) {
+                throw new Error("Codex login completed but no token was found in ~/.codex/auth.json. Re-run `codex login` and try again.");
+            }
+        }
+        return { oauthAccessToken: token };
+    }
+    if (input.provider === "anthropic") {
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.auth_claude_setup_start",
+            message: "starting claude setup-token for runtime auth",
+            meta: { agentName: input.agentName },
+        });
+        const result = spawnSync("claude", ["setup-token"], { stdio: "inherit" });
+        if (result.error) {
+            throw new Error(`Failed to run 'claude setup-token': ${result.error.message}`);
+        }
+        if (result.status !== 0) {
+            throw new Error(`'claude setup-token' exited with status ${result.status}.`);
+        }
+        const prompt = ensurePromptInput(input.promptInput, input.provider);
+        const setupToken = validateAnthropicToken(await prompt("Paste the setup token from `claude setup-token`: "));
+        // Exchange the setup token for an access+refresh token pair so auto-refresh works.
+        // The setup token IS the initial access token — we use it as a refresh token to
+        // get back a proper token pair from the OAuth endpoint.
+        /* v8 ignore start -- token exchange: requires live Anthropic OAuth endpoint @preserve */
+        try {
+            const { refreshAnthropicToken } = await Promise.resolve().then(() => __importStar(require("../providers/anthropic-token")));
+            const tokenState = await refreshAnthropicToken(setupToken);
+            if (tokenState) {
+                return {
+                    setupToken: tokenState.accessToken,
+                    refreshToken: tokenState.refreshToken,
+                    expiresAt: tokenState.expiresAt,
+                };
+            }
+        }
+        catch {
+            // Exchange failed — use the raw setup token as-is (it'll work until expiry)
+        }
+        /* v8 ignore stop */
+        return { setupToken };
+    }
+    if (input.provider === "minimax") {
+        const prompt = ensurePromptInput(input.promptInput, input.provider);
+        const apiKey = (await prompt("MiniMax API key: ")).trim();
+        if (!apiKey)
+            throw new Error("MiniMax API key is required.");
+        return { apiKey };
+    }
+    const prompt = ensurePromptInput(input.promptInput, input.provider);
+    const apiKey = (await prompt("Azure API key: ")).trim();
+    const endpoint = (await prompt("Azure endpoint: ")).trim();
+    const deployment = (await prompt("Azure deployment: ")).trim();
+    if (!apiKey || !endpoint || !deployment) {
+        throw new Error("Azure API key, endpoint, and deployment are required.");
+    }
+    return { apiKey, endpoint, deployment };
+}
+async function resolveHatchCredentials(input) {
+    const prompt = input.promptInput;
+    const credentials = { ...(input.credentials ?? {}) };
+    if (input.provider === "github-copilot" && !credentials.githubToken && input.runAuthFlow) {
+        const result = await input.runAuthFlow({
+            agentName: input.agentName,
+            provider: "github-copilot",
+            promptInput: prompt,
+        });
+        Object.assign(credentials, result.credentials);
+    }
+    if (input.provider === "anthropic" && !credentials.setupToken && input.runAuthFlow) {
+        const result = await input.runAuthFlow({
+            agentName: input.agentName,
+            provider: "anthropic",
+            promptInput: prompt,
+        });
+        Object.assign(credentials, result.credentials);
+    }
+    if (input.provider === "anthropic" && !credentials.setupToken && prompt) {
+        credentials.setupToken = await prompt("Anthropic setup-token: ");
+    }
+    if (input.provider === "openai-codex" && !credentials.oauthAccessToken && input.runAuthFlow) {
+        const result = await input.runAuthFlow({
+            agentName: input.agentName,
+            provider: "openai-codex",
+            promptInput: prompt,
+        });
+        Object.assign(credentials, result.credentials);
+    }
+    if (input.provider === "openai-codex" && !credentials.oauthAccessToken && prompt) {
+        credentials.oauthAccessToken = await prompt("OpenAI Codex OAuth token: ");
+    }
+    if (input.provider === "minimax" && !credentials.apiKey && prompt) {
+        credentials.apiKey = await prompt("MiniMax API key: ");
+    }
+    if (input.provider === "azure") {
+        if (!credentials.apiKey && prompt)
+            credentials.apiKey = await prompt("Azure API key: ");
+        if (!credentials.endpoint && prompt)
+            credentials.endpoint = await prompt("Azure endpoint: ");
+        if (!credentials.deployment && prompt)
+            credentials.deployment = await prompt("Azure deployment: ");
+    }
+    return credentials;
+}
+function applyCredentials(secrets, provider, credentials) {
+    if (provider === "anthropic") {
+        secrets.providers.anthropic.setupToken = credentials.setupToken.trim();
+        /* v8 ignore start -- token refresh fields: populated when OAuth exchange succeeds @preserve */
+        if (credentials.refreshToken)
+            secrets.providers.anthropic.refreshToken = credentials.refreshToken;
+        if (credentials.expiresAt)
+            secrets.providers.anthropic.expiresAt = credentials.expiresAt;
+        /* v8 ignore stop */
+        return;
+    }
+    if (provider === "github-copilot") {
+        secrets.providers["github-copilot"].githubToken = credentials.githubToken.trim();
+        secrets.providers["github-copilot"].baseUrl = credentials.baseUrl.trim();
+        return;
+    }
+    if (provider === "openai-codex") {
+        secrets.providers["openai-codex"].oauthAccessToken = credentials.oauthAccessToken.trim();
+        return;
+    }
+    if (provider === "minimax") {
+        secrets.providers.minimax.apiKey = credentials.apiKey.trim();
+        return;
+    }
+    secrets.providers.azure.apiKey = credentials.apiKey.trim();
+    secrets.providers.azure.endpoint = credentials.endpoint.trim();
+    secrets.providers.azure.deployment = credentials.deployment.trim();
+}
+async function runRuntimeAuthFlow(input, deps = {}) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.auth_flow_start",
+        message: "starting runtime auth flow",
+        meta: { agentName: input.agentName, provider: input.provider },
+    });
+    const homeDir = deps.homeDir ?? os.homedir();
+    const credentials = await collectRuntimeAuthCredentials(input, deps);
+    const { secretsPath } = writeProviderCredentials(input.agentName, input.provider, credentials, { homeDir });
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.auth_flow_end",
+        message: "completed runtime auth flow",
+        meta: { agentName: input.agentName, provider: input.provider, secretsPath },
+    });
+    return {
+        agentName: input.agentName,
+        provider: input.provider,
+        secretsPath,
+        message: `authenticated ${input.agentName} with ${input.provider}`,
+        credentials,
+    };
+}

package/dist/heart/daemon/cadence.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CADENCE_MS = void 0;
+exports.parseCadenceToCron = parseCadenceToCron;
+exports.parseCadenceToMs = parseCadenceToMs;
+const runtime_1 = require("../../nerves/runtime");
+exports.DEFAULT_CADENCE_MS = 30 * 60 * 1000; // 30 minutes
+/**
+ * Parse a cadence shorthand (e.g. "30m", "2h", "1d") into a cron string.
+ * Also accepts raw cron strings (5 space-separated fields) and passes them through.
+ * Returns null for invalid input.
+ */
+function parseCadenceToCron(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const value = raw.trim();
+    if (!value)
+        return null;
+    // Cron format (minute hour day month weekday)
+    if (/^\S+\s+\S+\s+\S+\s+\S+\s+\S+$/.test(value)) {
+        return value;
+    }
+    const cadenceMatch = /^(\d+)(m|h|d)$/.exec(value);
+    if (!cadenceMatch)
+        return null;
+    const interval = Number.parseInt(cadenceMatch[1], 10);
+    if (!Number.isFinite(interval) || interval <= 0)
+        return null;
+    (0, runtime_1.emitNervesEvent)({
+        event: "daemon.cadence_parsed",
+        component: "daemon",
+        message: "parsed cadence shorthand to cron",
+        meta: { raw: value, interval, unit: cadenceMatch[2] },
+    });
+    const unit = cadenceMatch[2];
+    if (unit === "m")
+        return `*/${interval} * * * *`;
+    if (unit === "h")
+        return `0 */${interval} * * *`;
+    return `0 0 */${interval} * *`;
+}
+/**
+ * Parse a cadence shorthand (e.g. "30m", "2h", "1d") into milliseconds.
+ * Returns null for invalid input.
+ */
+function parseCadenceToMs(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const value = raw.trim();
+    if (!value)
+        return null;
+    const match = /^(\d+)(m|h|d)$/.exec(value);
+    if (!match)
+        return null;
+    const interval = Number.parseInt(match[1], 10);
+    if (!Number.isFinite(interval) || interval <= 0)
+        return null;
+    (0, runtime_1.emitNervesEvent)({
+        event: "daemon.cadence_parsed_ms",
+        component: "daemon",
+        message: "parsed cadence shorthand to milliseconds",
+        meta: { raw: value, interval, unit: match[2] },
+    });
+    const unit = match[2];
+    if (unit === "m")
+        return interval * 60 * 1000;
+    if (unit === "h")
+        return interval * 60 * 60 * 1000;
+    return interval * 24 * 60 * 60 * 1000;
+}