@ouro.bot/cli 0.1.0-alpha.226 → 0.1.0-alpha.228

package/dist/repertoire/bitwarden-client.js

@@ -1,290 +0,0 @@
-"use strict";
-/**
- * Bitwarden vault client for credential management.
- *
- * SDK-first approach: attempts dynamic import of @bitwarden/sdk-napi,
- * falls back to `bw` CLI with --session flag.
- *
- * Raw secrets are NEVER returned to callers except via getRawSecret(),
- * which is reserved for internal use by the credential gateway (apiRequest vaultKey).
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BitwardenClient = void 0;
-exports.getBitwardenClient = getBitwardenClient;
-exports.resetBitwardenClient = resetBitwardenClient;
-const child_process_1 = require("child_process");
-const runtime_1 = require("../nerves/runtime");
-class BitwardenClient {
-    sessionKey = null;
-    connected = false;
-    clientMode = null;
-    async connect(config) {
-        (0, runtime_1.emitNervesEvent)({
-            event: "client.vault_connect_start",
-            component: "clients",
-            message: "connecting to Bitwarden vault",
-            meta: { mode: config.mode ?? "auto" },
-        });
-        try {
-            if (config.mode === "cli") {
-                await this.connectCli(config);
-            }
-            else {
-                // Try SDK first, fall back to CLI
-                try {
-                    await this.connectSdk(config);
-                }
-                catch {
-                    (0, runtime_1.emitNervesEvent)({
-                        event: "client.vault_sdk_fallback",
-                        component: "clients",
-                        message: "SDK not available, falling back to bw CLI",
-                        meta: {},
-                    });
-                    await this.connectCli(config);
-                }
-            }
-            (0, runtime_1.emitNervesEvent)({
-                event: "client.vault_connect_end",
-                component: "clients",
-                message: "connected to Bitwarden vault",
-                meta: { mode: this.clientMode },
-            });
-        }
-        catch (err) {
-            (0, runtime_1.emitNervesEvent)({
-                level: "error",
-                event: "client.vault_connect_error",
-                component: "clients",
-                message: "failed to connect to Bitwarden vault",
-                /* v8 ignore next -- defensive: execCli always wraps in Error @preserve */
-                meta: { reason: err instanceof Error ? err.message : String(err) },
-            });
-            throw err;
-        }
-    }
-    async disconnect() {
-        this.sessionKey = null;
-        this.connected = false;
-        this.clientMode = null;
-        (0, runtime_1.emitNervesEvent)({
-            event: "client.vault_disconnect",
-            component: "clients",
-            message: "disconnected from Bitwarden vault",
-            meta: {},
-        });
-    }
-    isConnected() {
-        return this.connected;
-    }
-    async getItem(id) {
-        this.requireConnected();
-        return this.withNervesEvents("getItem", { id }, async () => {
-            const raw = await this.fetchRawItem(id);
-            return this.stripSecrets(raw);
-        });
-    }
-    async createItem(name, fields) {
-        this.requireConnected();
-        return this.withNervesEvents("createItem", { name }, async () => {
-            const itemFields = Object.entries(fields).map(([k, v]) => ({
-                name: k,
-                value: v,
-                type: 0, // text type
-            }));
-            const itemTemplate = {
-                type: 1, // login type
-                name,
-                fields: itemFields,
-                login: {},
-            };
-            const encoded = Buffer.from(JSON.stringify(itemTemplate)).toString("base64");
-            const stdout = await this.execCli(["create", "item", encoded]);
-            const parsed = this.parseCliResponse(stdout);
-            return { id: parsed.id, name: parsed.name, type: parsed.type };
-        });
-    }
-    async listItems(search) {
-        this.requireConnected();
-        return this.withNervesEvents("listItems", { search }, async () => {
-            const args = ["list", "items"];
-            if (search) {
-                args.push("--search", search);
-            }
-            const stdout = await this.execCli(args);
-            const parsed = this.parseCliResponse(stdout);
-            const items = Array.isArray(parsed.data) ? parsed.data : (Array.isArray(parsed) ? parsed : []);
-            return items.map((item) => ({ id: item.id, name: item.name, type: item.type }));
-        });
-    }
-    async deleteItem(id) {
-        this.requireConnected();
-        return this.withNervesEvents("deleteItem", { id }, async () => {
-            await this.execCli(["delete", "item", id]);
-        });
-    }
-    /**
-     * Internal: used by credential gateway (PR 5) to get raw secret for HTTP injection.
-     * NOT exposed via tools -- only called by apiRequest() internally.
-     */
-    async getRawSecret(itemId, fieldName) {
-        this.requireConnected();
-        return this.withNervesEvents("getRawSecret", { itemId, fieldName }, async () => {
-            const raw = await this.fetchRawItem(itemId);
-            // Check custom fields first
-            if (raw.fields) {
-                const field = raw.fields.find((f) => f.name === fieldName);
-                if (field)
-                    return field.value;
-            }
-            // Check login.password
-            if (fieldName === "password" && raw.login?.password) {
-                return raw.login.password;
-            }
-            throw new Error(`field "${fieldName}" not found on vault item "${itemId}"`);
-        });
-    }
-    // --- Private methods ---
-    requireConnected() {
-        if (!this.connected) {
-            throw new Error("vault not connected -- call connect() first");
-        }
-    }
-    async withNervesEvents(operation, meta, fn) {
-        (0, runtime_1.emitNervesEvent)({
-            event: "client.request_start",
-            component: "clients",
-            message: `vault ${operation} starting`,
-            meta: { operation, ...meta },
-        });
-        try {
-            const result = await fn();
-            (0, runtime_1.emitNervesEvent)({
-                event: "client.request_end",
-                component: "clients",
-                message: `vault ${operation} complete`,
-                meta: { operation, ...meta },
-            });
-            return result;
-        }
-        catch (err) {
-            (0, runtime_1.emitNervesEvent)({
-                level: "error",
-                event: "client.error",
-                component: "clients",
-                message: `vault ${operation} failed`,
-                /* v8 ignore next -- defensive: callers always throw Error instances @preserve */
-                meta: { operation, reason: err instanceof Error ? err.message : String(err), ...meta },
-            });
-            throw err;
-        }
-    }
-    async connectSdk(_config) {
-        // Attempt dynamic import of SDK
-        // This will throw if the package is not installed
-        const sdk = await Promise.resolve(`${"@bitwarden/sdk-napi"}`).then(s => __importStar(require(s)));
-        /* v8 ignore start -- SDK not yet published; path tested when package becomes available @preserve */
-        const client = new sdk.BitwardenClient({ apiUrl: _config.serverUrl ?? "https://api.bitwarden.com" }, 0);
-        await client.auth().loginAccessToken(_config.accessToken, "");
-        this.connected = true;
-        this.clientMode = "sdk";
-        /* v8 ignore stop */
-    }
-    async connectCli(config) {
-        this.sessionKey = config.accessToken;
-        // Verify CLI is available and session key works
-        await this.execCli(["status"]);
-        this.connected = true;
-        this.clientMode = "cli";
-    }
-    async fetchRawItem(id) {
-        const stdout = await this.execCli(["get", "item", id]);
-        const parsed = this.parseCliResponse(stdout);
-        return parsed;
-    }
-    stripSecrets(raw) {
-        const item = {
-            id: raw.id,
-            name: raw.name,
-            type: raw.type,
-        };
-        if (raw.notes)
-            item.notes = raw.notes;
-        if (raw.fields)
-            item.fields = raw.fields;
-        if (raw.login) {
-            item.login = {};
-            if (raw.login.username)
-                item.login.username = raw.login.username;
-            if (raw.login.uris)
-                item.login.uris = raw.login.uris;
-            // password intentionally NOT copied
-        }
-        return item;
-    }
-    parseCliResponse(stdout) {
-        const parsed = JSON.parse(stdout);
-        // bw CLI with --response wraps in { success, data }
-        if (parsed.success !== undefined && parsed.data !== undefined) {
-            return parsed.data;
-        }
-        return parsed;
-    }
-    execCli(args) {
-        return new Promise((resolve, reject) => {
-            const fullArgs = [...args, "--session", this.sessionKey, "--response"];
-            (0, child_process_1.execFile)("bw", fullArgs, { timeout: 30_000 }, (err, stdout, _stderr) => {
-                if (err) {
-                    reject(new Error(`bw CLI error: ${err.message}`));
-                    return;
-                }
-                resolve(stdout);
-            });
-        });
-    }
-}
-exports.BitwardenClient = BitwardenClient;
-// Singleton accessor
-let _client = null;
-function getBitwardenClient() {
-    if (!_client) {
-        _client = new BitwardenClient();
-    }
-    return _client;
-}
-function resetBitwardenClient() {
-    _client = null;
-}

package/dist/repertoire/tools-vault.js

@@ -1,185 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.vaultToolDefinitions = void 0;
-const bitwarden_client_1 = require("./bitwarden-client");
-const runtime_1 = require("../nerves/runtime");
-exports.vaultToolDefinitions = [
-    {
-        tool: {
-            type: "function",
-            function: {
-                name: "vault_get",
-                description: "Retrieve a credential from the Bitwarden vault by ID or name. Returns metadata and fields but never raw passwords.",
-                parameters: {
-                    type: "object",
-                    properties: {
-                        id: { type: "string", description: "Vault item ID (preferred)" },
-                        name: {
-                            type: "string",
-                            description: "Search by name (less precise, uses first match)",
-                        },
-                    },
-                },
-            },
-        },
-        handler: async (args) => {
-            (0, runtime_1.emitNervesEvent)({
-                component: "repertoire",
-                event: "repertoire.vault_tool_call",
-                message: "vault_get invoked",
-                meta: { tool: "vault_get" },
-            });
-            try {
-                const client = (0, bitwarden_client_1.getBitwardenClient)();
-                if (args.id) {
-                    const item = await client.getItem(args.id);
-                    return JSON.stringify(item, null, 2);
-                }
-                if (args.name) {
-                    const items = await client.listItems(args.name);
-                    if (items.length === 0) {
-                        return `No vault item found matching "${args.name}". Try vault_list to see available items.`;
-                    }
-                    const item = await client.getItem(items[0].id);
-                    return JSON.stringify(item, null, 2);
-                }
-                return "Please provide either an id or name to look up a vault item.";
-            }
-            catch (err) {
-                /* v8 ignore next -- defensive: callers throw Error instances @preserve */
-                return `Vault error: ${err instanceof Error ? err.message : String(err)}`;
-            }
-        },
-        summaryKeys: ["id", "name"],
-    },
-    {
-        tool: {
-            type: "function",
-            function: {
-                name: "vault_store",
-                description: "Store a new credential in the Bitwarden vault. Supports login credentials, API keys, and structured fields.",
-                parameters: {
-                    type: "object",
-                    properties: {
-                        name: { type: "string", description: "Name for the credential" },
-                        username: { type: "string", description: "Username (optional)" },
-                        password: { type: "string", description: "Password (optional)" },
-                        uri: { type: "string", description: "URI/URL (optional)" },
-                        notes: { type: "string", description: "Notes (optional)" },
-                        fields: {
-                            type: "string",
-                            description: 'JSON string of custom fields, e.g. {"apiKey": "key123", "region": "us-east"}',
-                        },
-                    },
-                    required: ["name"],
-                },
-            },
-        },
-        handler: async (args) => {
-            (0, runtime_1.emitNervesEvent)({
-                component: "repertoire",
-                event: "repertoire.vault_tool_call",
-                message: "vault_store invoked",
-                meta: { tool: "vault_store", name: args.name },
-            });
-            try {
-                const client = (0, bitwarden_client_1.getBitwardenClient)();
-                const fields = {};
-                if (args.username)
-                    fields.username = args.username;
-                if (args.password)
-                    fields.password = args.password;
-                if (args.uri)
-                    fields.uri = args.uri;
-                if (args.notes)
-                    fields.notes = args.notes;
-                if (args.fields) {
-                    const parsed = JSON.parse(args.fields);
-                    Object.assign(fields, parsed);
-                }
-                const handle = await client.createItem(args.name, fields);
-                return JSON.stringify(handle, null, 2);
-            }
-            catch (err) {
-                /* v8 ignore next -- defensive: callers throw Error instances @preserve */
-                return `Vault error: ${err instanceof Error ? err.message : String(err)}`;
-            }
-        },
-        confirmationRequired: true,
-        summaryKeys: ["name"],
-    },
-    {
-        tool: {
-            type: "function",
-            function: {
-                name: "vault_list",
-                description: "List credentials in the Bitwarden vault. Returns names and IDs only, never secrets.",
-                parameters: {
-                    type: "object",
-                    properties: {
-                        search: {
-                            type: "string",
-                            description: "Optional search filter",
-                        },
-                    },
-                },
-            },
-        },
-        handler: async (args) => {
-            (0, runtime_1.emitNervesEvent)({
-                component: "repertoire",
-                event: "repertoire.vault_tool_call",
-                message: "vault_list invoked",
-                meta: { tool: "vault_list" },
-            });
-            try {
-                const client = (0, bitwarden_client_1.getBitwardenClient)();
-                const items = await client.listItems(args.search);
-                return JSON.stringify(items, null, 2);
-            }
-            catch (err) {
-                /* v8 ignore next -- defensive: callers throw Error instances @preserve */
-                return `Vault error: ${err instanceof Error ? err.message : String(err)}`;
-            }
-        },
-        summaryKeys: ["search"],
-    },
-    {
-        tool: {
-            type: "function",
-            function: {
-                name: "vault_delete",
-                description: "Delete a credential from the Bitwarden vault by ID.",
-                parameters: {
-                    type: "object",
-                    properties: {
-                        id: {
-                            type: "string",
-                            description: "ID of the vault item to delete",
-                        },
-                    },
-                    required: ["id"],
-                },
-            },
-        },
-        handler: async (args) => {
-            (0, runtime_1.emitNervesEvent)({
-                component: "repertoire",
-                event: "repertoire.vault_tool_call",
-                message: "vault_delete invoked",
-                meta: { tool: "vault_delete", id: args.id },
-            });
-            try {
-                const client = (0, bitwarden_client_1.getBitwardenClient)();
-                await client.deleteItem(args.id);
-                return `Vault item ${args.id} deleted successfully.`;
-            }
-            catch (err) {
-                /* v8 ignore next -- defensive: callers throw Error instances @preserve */
-                return `Vault delete failed: ${err instanceof Error ? err.message : String(err)}`;
-            }
-        },
-        confirmationRequired: true,
-        summaryKeys: ["id"],
-    },
-];