@ouro.bot/cli 0.1.0-alpha.364 → 0.1.0-alpha.366

package/dist/repertoire/tools-vault.js

@@ -1,44 +1,7 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.vaultToolDefinitions = void 0;
-const crypto = __importStar(require("node:crypto"));
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
 const identity_1 = require("../heart/identity");
-const vault_setup_1 = require("./vault-setup");
 const runtime_1 = require("../nerves/runtime");
 exports.vaultToolDefinitions = [
     {
@@ -61,49 +24,16 @@ exports.vaultToolDefinitions = [
                 message: "vault_setup invoked",
                 meta: { tool: "vault_setup", agentName },
             });
-            try {
-                const config = (0, identity_1.loadAgentConfig)();
-                const { email, serverUrl } = (0, identity_1.resolveVaultConfig)(agentName, config.vault);
-                // Generate a strong random master password (32 bytes -> base64)
-                const masterPassword = crypto.randomBytes(32).toString("base64");
-                // Store master password in secrets.json BEFORE creating the account
-                // so it's not lost if the process crashes after registration
-                const secretsPath = (0, identity_1.getAgentSecretsPath)(agentName);
-                const secretsDir = path.dirname(secretsPath);
-                if (!fs.existsSync(secretsDir)) {
-                    fs.mkdirSync(secretsDir, { recursive: true, mode: 0o700 });
-                }
-                let secrets = {};
-                if (fs.existsSync(secretsPath)) {
-                    try {
-                        secrets = JSON.parse(fs.readFileSync(secretsPath, "utf-8"));
-                    }
-                    catch {
-                        // If secrets.json is corrupt, start fresh but don't lose the file
-                        secrets = {};
-                    }
-                }
-                secrets.vault = {
-                    ...(typeof secrets.vault === "object" && secrets.vault !== null ? secrets.vault : {}),
-                    masterPassword,
-                    email,
-                    serverUrl,
-                };
-                fs.writeFileSync(secretsPath, JSON.stringify(secrets, null, 2) + "\n", {
-                    mode: 0o600,
-                });
-                // Create the vault account
-                const result = await (0, vault_setup_1.createVaultAccount)(agentName, serverUrl, email, masterPassword);
-                if (!result.success) {
-                    return `Vault setup failed: ${result.error}`;
-                }
-                return `Vault created at ${serverUrl} for ${email}. Master password stored in secrets.json.`;
-            }
-            catch (err) {
-                /* v8 ignore next -- defensive: error handling @preserve */
-                const reason = err instanceof Error ? err.message : String(err);
-                return `Vault setup error: ${reason}`;
-            }
+            return [
+                "Vault setup is human-required.",
+                "",
+                "Why I cannot do it here:",
+                "  Creating or unlocking a vault requires secret entry that must stay out of agent context.",
+                "",
+                "Do this in a terminal:",
+                `  ouro vault create --agent ${agentName}`,
+                `  ouro vault unlock --agent ${agentName}`,
+            ].join("\n");
         },
         summaryKeys: [],
     },

package/dist/repertoire/vault-unlock.js

@@ -0,0 +1,359 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveVaultUnlockStore = resolveVaultUnlockStore;
+exports.readVaultUnlockSecret = readVaultUnlockSecret;
+exports.storeVaultUnlockSecret = storeVaultUnlockSecret;
+exports.getVaultUnlockStatus = getVaultUnlockStatus;
+const node_child_process_1 = require("node:child_process");
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../nerves/runtime");
+const VAULT_UNLOCK_SERVICE = "ouro.vault";
+const PLAINTEXT_UNLOCK_DIR = path.join(".ouro-cli", "vault-unlock");
+const WINDOWS_DPAPI_UNLOCK_DIR = path.join(".ouro-cli", "vault-unlock-dpapi");
+const SUPPORTED_STORES = ["auto", "macos-keychain", "windows-dpapi", "linux-secret-service", "plaintext-file"];
+function platform(deps) {
+    return deps.platform ?? process.platform;
+}
+function spawnSync(deps) {
+    return deps.spawnSync ?? node_child_process_1.spawnSync;
+}
+function homeDir(deps) {
+    return deps.homeDir ?? os.homedir();
+}
+function vaultKey(config) {
+    return `${config.serverUrl}:${config.email}`;
+}
+function vaultLabel(config) {
+    return `${config.email} at ${config.serverUrl}`;
+}
+function plaintextUnlockPath(config, deps) {
+    const digest = crypto.createHash("sha256").update(vaultKey(config)).digest("hex").slice(0, 24);
+    return path.join(homeDir(deps), PLAINTEXT_UNLOCK_DIR, `${digest}.secret`);
+}
+function windowsDpapiUnlockPath(config, deps) {
+    const digest = crypto.createHash("sha256").update(vaultKey(config)).digest("hex").slice(0, 24);
+    const localAppData = process.env.LOCALAPPDATA;
+    const baseDir = localAppData && platform(deps) === "win32"
+        ? path.join(localAppData, "Ouro")
+        : path.join(homeDir(deps), WINDOWS_DPAPI_UNLOCK_DIR);
+    return path.join(baseDir, "vault-unlock", `${digest}.dpapi`);
+}
+function commandExists(command, deps) {
+    const result = spawnSync(deps)(command, ["--version"], { encoding: "utf8" });
+    const code = result.error?.code;
+    return code !== "ENOENT";
+}
+function missingSecureStoreMessage(config) {
+    const agentPart = config.agentName ? ` for ${config.agentName}` : "";
+    return [
+        `No supported secure local secret store was found on this machine${agentPart}.`,
+        "",
+        `Ouro knows the credential vault is ${vaultLabel(config)}, but it cannot cache the vault unlock secret here yet.`,
+        "",
+        "On macOS, Ouro uses Keychain automatically.",
+        "On Windows, Ouro uses a CurrentUser DPAPI-encrypted local file automatically.",
+        "On Linux/WSL, install and configure Secret Service/libsecret, or choose the explicit plaintext fallback on a trusted machine.",
+        "",
+        config.agentName
+            ? `Run \`ouro vault unlock --agent ${config.agentName} --store plaintext-file\` to store the vault unlock secret in a chmod 0600 local file.`
+            : "Run `ouro vault unlock --store plaintext-file` to store the vault unlock secret in a chmod 0600 local file.",
+    ].join("\n");
+}
+function lockedMessage(config, store) {
+    const agentPart = config.agentName ? ` for ${config.agentName}` : "";
+    const command = config.agentName
+        ? `ouro vault unlock --agent ${config.agentName}${store.kind === "plaintext-file" ? " --store plaintext-file" : ""}`
+        : `ouro vault unlock${store.kind === "plaintext-file" ? " --store plaintext-file" : ""}`;
+    return [
+        `Ouro credential vault is locked on this machine${agentPart}.`,
+        "",
+        `Vault: ${vaultLabel(config)}`,
+        `Local unlock store: ${store.kind} (${store.location})`,
+        "",
+        `Run \`${command}\` and enter the vault unlock secret from the operator password manager.`,
+    ].join("\n");
+}
+function validateStoreKind(store) {
+    const requested = store ?? "auto";
+    if (!SUPPORTED_STORES.includes(requested)) {
+        throw new Error(`unknown vault unlock store '${requested}'. Use auto|macos-keychain|windows-dpapi|linux-secret-service|plaintext-file.`);
+    }
+    return requested;
+}
+function resolveVaultUnlockStore(config, deps = {}) {
+    const requested = validateStoreKind(deps.store);
+    const currentPlatform = platform(deps);
+    if (requested === "macos-keychain") {
+        if (currentPlatform !== "darwin") {
+            throw new Error(`macos-keychain unlock store is only available on macOS; this machine is ${currentPlatform}.`);
+        }
+        return { kind: "macos-keychain", secure: true, location: "macOS Keychain" };
+    }
+    if (requested === "linux-secret-service") {
+        if (currentPlatform !== "linux") {
+            throw new Error(`linux-secret-service unlock store is only available on Linux/WSL; this machine is ${currentPlatform}.`);
+        }
+        if (!commandExists("secret-tool", deps)) {
+            throw new Error("linux-secret-service unlock store requires the `secret-tool` command from libsecret.");
+        }
+        return { kind: "linux-secret-service", secure: true, location: "Secret Service via secret-tool" };
+    }
+    if (requested === "windows-dpapi") {
+        if (currentPlatform !== "win32") {
+            throw new Error(`windows-dpapi unlock store is only available on Windows; this machine is ${currentPlatform}.`);
+        }
+        return { kind: "windows-dpapi", secure: true, location: windowsDpapiUnlockPath(config, deps) };
+    }
+    if (requested === "plaintext-file") {
+        return { kind: "plaintext-file", secure: false, location: plaintextUnlockPath(config, deps) };
+    }
+    if (currentPlatform === "darwin") {
+        return { kind: "macos-keychain", secure: true, location: "macOS Keychain" };
+    }
+    if (currentPlatform === "win32") {
+        return { kind: "windows-dpapi", secure: true, location: windowsDpapiUnlockPath(config, deps) };
+    }
+    if (currentPlatform === "linux" && commandExists("secret-tool", deps)) {
+        return { kind: "linux-secret-service", secure: true, location: "Secret Service via secret-tool" };
+    }
+    throw new Error(missingSecureStoreMessage(config));
+}
+function readFromMacosKeychain(config, deps) {
+    const result = spawnSync(deps)("security", [
+        "find-generic-password",
+        "-s",
+        VAULT_UNLOCK_SERVICE,
+        "-a",
+        vaultKey(config),
+        "-w",
+    ], { encoding: "utf8" });
+    const secret = typeof result.stdout === "string" ? result.stdout.trim() : "";
+    return result.status === 0 && secret ? secret : null;
+}
+function writeToMacosKeychain(config, secret, deps) {
+    const result = spawnSync(deps)("security", [
+        "add-generic-password",
+        "-U",
+        "-s",
+        VAULT_UNLOCK_SERVICE,
+        "-a",
+        vaultKey(config),
+        "-w",
+        secret,
+    ], { encoding: "utf8" });
+    if (result.status !== 0) {
+        const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+        throw new Error(`failed to store vault unlock secret in macOS Keychain${stderr ? `: ${stderr}` : ""}`);
+    }
+}
+function readFromLinuxSecretService(config, deps) {
+    const result = spawnSync(deps)("secret-tool", [
+        "lookup",
+        "service",
+        VAULT_UNLOCK_SERVICE,
+        "account",
+        vaultKey(config),
+    ], { encoding: "utf8" });
+    const secret = typeof result.stdout === "string" ? result.stdout.trim() : "";
+    return result.status === 0 && secret ? secret : null;
+}
+function writeToLinuxSecretService(config, secret, deps) {
+    const result = spawnSync(deps)("secret-tool", [
+        "store",
+        "--label",
+        `Ouro credential vault ${vaultLabel(config)}`,
+        "service",
+        VAULT_UNLOCK_SERVICE,
+        "account",
+        vaultKey(config),
+    ], { encoding: "utf8", input: secret });
+    if (result.status !== 0) {
+        const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+        throw new Error(`failed to store vault unlock secret in Linux Secret Service${stderr ? `: ${stderr}` : ""}`);
+    }
+}
+function runWindowsDpapi(mode, payload, deps) {
+    const script = `
+$ErrorActionPreference = "Stop"
+$inputJson = [Console]::In.ReadToEnd()
+$payload = $inputJson | ConvertFrom-Json
+Add-Type -AssemblyName System.Security
+if ($payload.mode -eq "protect") {
+  $bytes = [Text.Encoding]::UTF8.GetBytes([string]$payload.secret)
+  $protected = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
+  [Console]::Out.Write([Convert]::ToBase64String($protected))
+} elseif ($payload.mode -eq "unprotect") {
+  $protected = [Convert]::FromBase64String([string]$payload.ciphertext)
+  $bytes = [Security.Cryptography.ProtectedData]::Unprotect($protected, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
+  [Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))
+} else {
+  throw "unknown DPAPI mode"
+}
+`;
+    const result = spawnSync(deps)("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        script,
+    ], {
+        encoding: "utf8",
+        input: JSON.stringify({ mode, ...payload }),
+    });
+    if (result.status !== 0) {
+        const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+        const error = result.error instanceof Error ? result.error.message : stderr;
+        throw new Error(`Windows DPAPI ${mode} failed${error ? `: ${error}` : ""}`);
+    }
+    return typeof result.stdout === "string" ? result.stdout : "";
+}
+function readFromWindowsDpapi(config, deps) {
+    const filePath = windowsDpapiUnlockPath(config, deps);
+    if (!fs.existsSync(filePath))
+        return null;
+    const ciphertext = fs.readFileSync(filePath, "utf8").trim();
+    if (!ciphertext)
+        return null;
+    const secret = runWindowsDpapi("unprotect", { ciphertext }, deps).trim();
+    return secret || null;
+}
+function writeToWindowsDpapi(config, secret, deps) {
+    const filePath = windowsDpapiUnlockPath(config, deps);
+    const ciphertext = runWindowsDpapi("protect", { secret }, deps).trim();
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, `${ciphertext}\n`, "utf8");
+}
+function readFromPlaintextFile(config, deps) {
+    const filePath = plaintextUnlockPath(config, deps);
+    if (!fs.existsSync(filePath))
+        return null;
+    if (platform(deps) !== "win32") {
+        const mode = fs.statSync(filePath).mode & 0o777;
+        if ((mode & 0o077) !== 0) {
+            throw new Error(`refusing to read plaintext vault unlock file at ${filePath} because permissions are too broad; run chmod 600 ${filePath}`);
+        }
+    }
+    const secret = fs.readFileSync(filePath, "utf8").trim();
+    return secret || null;
+}
+function writeToPlaintextFile(config, secret, deps) {
+    const filePath = plaintextUnlockPath(config, deps);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(filePath, secret, { encoding: "utf8", mode: 0o600 });
+    if (platform(deps) !== "win32") {
+        fs.chmodSync(path.dirname(filePath), 0o700);
+        fs.chmodSync(filePath, 0o600);
+    }
+}
+function readFromStore(config, store, deps) {
+    if (store.kind === "macos-keychain")
+        return readFromMacosKeychain(config, deps);
+    if (store.kind === "windows-dpapi")
+        return readFromWindowsDpapi(config, deps);
+    if (store.kind === "linux-secret-service")
+        return readFromLinuxSecretService(config, deps);
+    return readFromPlaintextFile(config, deps);
+}
+function writeToStore(config, store, secret, deps) {
+    if (store.kind === "macos-keychain") {
+        writeToMacosKeychain(config, secret, deps);
+        return;
+    }
+    if (store.kind === "linux-secret-service") {
+        writeToLinuxSecretService(config, secret, deps);
+        return;
+    }
+    if (store.kind === "windows-dpapi") {
+        writeToWindowsDpapi(config, secret, deps);
+        return;
+    }
+    writeToPlaintextFile(config, secret, deps);
+}
+function readVaultUnlockSecret(config, deps = {}) {
+    const store = resolveVaultUnlockStore(config, deps);
+    const secret = readFromStore(config, store, deps);
+    if (!secret) {
+        throw new Error(lockedMessage(config, store));
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.vault_unlock_loaded",
+        message: "loaded vault unlock material from local store",
+        meta: { store: store.kind, secure: store.secure, hasAgentName: !!config.agentName },
+    });
+    return { secret, store };
+}
+function storeVaultUnlockSecret(config, secret, deps = {}) {
+    const trimmed = secret.trim();
+    if (!trimmed) {
+        throw new Error("vault unlock secret is required");
+    }
+    const store = resolveVaultUnlockStore(config, deps);
+    writeToStore(config, store, trimmed, deps);
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.vault_unlock_stored",
+        message: "stored vault unlock material in local store",
+        meta: { store: store.kind, secure: store.secure, hasAgentName: !!config.agentName },
+    });
+    return store;
+}
+function getVaultUnlockStatus(config, deps = {}) {
+    try {
+        const store = resolveVaultUnlockStore(config, deps);
+        const stored = !!readFromStore(config, store, deps);
+        return {
+            configured: true,
+            stored,
+            store,
+            fix: stored
+                ? "Vault unlock secret is available on this machine."
+                : lockedMessage(config, store),
+        };
+    }
+    catch (error) {
+        return {
+            configured: false,
+            stored: false,
+            error: error instanceof Error ? error.message : String(error),
+            fix: error instanceof Error ? error.message : String(error),
+        };
+    }
+}

package/dist/senses/bluebubbles/client.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createBlueBubblesClient = createBlueBubblesClient;
 const node_crypto_1 = require("node:crypto");
@@ -533,13 +566,15 @@ function createBlueBubblesClient(config = (0, config_1.getBlueBubblesConfig)(),
                             throw new Error("VLM fallback requires a minimax credential for this agent — " +
                                 "configure one or switch to a vision-capable chat model");
                         }
-                        const { apiKey } = (0, config_1.getMinimaxConfig)();
+                        const { readProviderCredentialRecord } = await Promise.resolve().then(() => __importStar(require("../../heart/provider-credentials")));
+                        const credential = await readProviderCredentialRecord((0, identity_1.getAgentName)(), "minimax");
+                        const apiKey = credential.ok ? credential.record.credentials.apiKey : undefined;
                         if (!apiKey) {
-                            throw new Error("VLM fallback: minimax API key not found in secrets.json — " +
-                                "re-run credential setup or ask the user to add a minimax key");
+                            throw new Error("VLM fallback: minimax API key not found in the agent vault — " +
+                                "run `ouro auth --agent <agent> --provider minimax`");
                         }
                         return (0, minimax_vlm_1.minimaxVlmDescribe)({
-                            apiKey,
+                            apiKey: String(apiKey),
                             prompt: params.prompt,
                             imageDataUrl: params.imageDataUrl,
                             baseURL: minimax_1.MINIMAX_PROVIDER_BASE_URL,

package/dist/senses/pipeline.js

@@ -205,7 +205,6 @@ async function handleInboundTurn(input) {
                         model: failoverAction.model,
                         credentialRevision: failoverAction.credentialRevision,
                         source: failoverAction.source,
-                        contributedByAgent: failoverAction.contributedByAgent,
                     },
                 });
                 // Replace "switch to <provider>" with a context message for the agent.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.364",
+  "version": "0.1.0-alpha.366",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",