@ouro.bot/cli 0.1.0-alpha.55 → 0.1.0-alpha.550

package/dist/heart/provider-state.js

@@ -0,0 +1,216 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateProviderState = validateProviderState;
+exports.getProviderStatePath = getProviderStatePath;
+exports.readProviderState = readProviderState;
+exports.writeProviderState = writeProviderState;
+exports.bootstrapProviderStateFromAgentConfig = bootstrapProviderStateFromAgentConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../nerves/runtime");
+const identity_1 = require("./identity");
+const LANES = ["outward", "inner"];
+const VALID_SOURCES = new Set(["bootstrap", "local"]);
+const VALID_READINESS = new Set(["ready", "failed", "stale", "unknown"]);
+function isProvider(value) {
+    return typeof value === "string" && Object.prototype.hasOwnProperty.call(identity_1.PROVIDER_CREDENTIALS, value);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function validateBinding(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`${label} must be an object`);
+    }
+    const record = value;
+    if (!isProvider(record.provider))
+        throw new Error(`${label}.provider must be a valid provider`);
+    if (!isNonEmptyString(record.model))
+        throw new Error(`${label}.model must be a non-empty string`);
+    if (!VALID_SOURCES.has(record.source)) {
+        throw new Error(`${label}.source must be bootstrap or local`);
+    }
+    if (!isNonEmptyString(record.updatedAt))
+        throw new Error(`${label}.updatedAt must be a non-empty string`);
+    return {
+        provider: record.provider,
+        model: record.model,
+        source: record.source,
+        updatedAt: record.updatedAt,
+    };
+}
+function validateReadiness(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`${label} must be an object`);
+    }
+    const record = value;
+    if (!VALID_READINESS.has(record.status)) {
+        throw new Error(`${label}.status must be ready, failed, stale, or unknown`);
+    }
+    if (!isProvider(record.provider))
+        throw new Error(`${label}.provider must be a valid provider`);
+    if (!isNonEmptyString(record.model))
+        throw new Error(`${label}.model must be a non-empty string`);
+    if (record.checkedAt !== undefined && typeof record.checkedAt !== "string") {
+        throw new Error(`${label}.checkedAt must be a string when present`);
+    }
+    if (record.credentialRevision !== undefined && typeof record.credentialRevision !== "string") {
+        throw new Error(`${label}.credentialRevision must be a string when present`);
+    }
+    if (record.error !== undefined && typeof record.error !== "string") {
+        throw new Error(`${label}.error must be a string when present`);
+    }
+    if (record.attempts !== undefined && typeof record.attempts !== "number") {
+        throw new Error(`${label}.attempts must be a number when present`);
+    }
+    return {
+        status: record.status,
+        provider: record.provider,
+        model: record.model,
+        ...(record.checkedAt !== undefined ? { checkedAt: record.checkedAt } : {}),
+        ...(record.credentialRevision !== undefined ? { credentialRevision: record.credentialRevision } : {}),
+        ...(record.error !== undefined ? { error: record.error } : {}),
+        ...(record.attempts !== undefined ? { attempts: record.attempts } : {}),
+    };
+}
+function validateProviderState(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("provider state must be an object");
+    }
+    const record = value;
+    if (record.schemaVersion !== 1)
+        throw new Error("schemaVersion must be 1");
+    if (!isNonEmptyString(record.machineId))
+        throw new Error("machineId must be a non-empty string");
+    if (!isNonEmptyString(record.updatedAt))
+        throw new Error("updatedAt must be a non-empty string");
+    if (!record.lanes || typeof record.lanes !== "object" || Array.isArray(record.lanes)) {
+        throw new Error("lanes must be an object");
+    }
+    const rawLanes = record.lanes;
+    const lanes = {
+        outward: validateBinding(rawLanes.outward, "outward"),
+        inner: validateBinding(rawLanes.inner, "inner"),
+    };
+    if (!record.readiness || typeof record.readiness !== "object" || Array.isArray(record.readiness)) {
+        throw new Error("readiness must be an object");
+    }
+    const rawReadiness = record.readiness;
+    const readiness = {};
+    for (const lane of LANES) {
+        if (rawReadiness[lane] !== undefined) {
+            readiness[lane] = validateReadiness(rawReadiness[lane], `${lane}.readiness`);
+        }
+    }
+    return {
+        schemaVersion: 1,
+        machineId: record.machineId,
+        updatedAt: record.updatedAt,
+        lanes,
+        readiness,
+    };
+}
+function getProviderStatePath(agentRoot) {
+    return path.join(agentRoot, "state", "providers.json");
+}
+function readProviderState(agentRoot) {
+    const statePath = getProviderStatePath(agentRoot);
+    let raw;
+    try {
+        if (!fs.existsSync(statePath)) {
+            return { ok: false, reason: "missing", statePath, error: "provider state not found" };
+        }
+    }
+    catch (error) {
+        return { ok: false, reason: "invalid", statePath, error: String(error) };
+    }
+    try {
+        raw = fs.readFileSync(statePath, "utf-8");
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT") {
+            return { ok: false, reason: "missing", statePath, error: "provider state not found" };
+        }
+        return { ok: false, reason: "invalid", statePath, error: String(error) };
+    }
+    try {
+        const state = validateProviderState(JSON.parse(raw));
+        (0, runtime_1.emitNervesEvent)({
+            component: "config/identity",
+            event: "config.provider_state_read",
+            message: "read provider state",
+            meta: { statePath, machineId: state.machineId },
+        });
+        return { ok: true, statePath, state };
+    }
+    catch (error) {
+        return { ok: false, reason: "invalid", statePath, error: String(error) };
+    }
+}
+function writeProviderState(agentRoot, state) {
+    const statePath = getProviderStatePath(agentRoot);
+    const validated = validateProviderState(state);
+    fs.mkdirSync(path.dirname(statePath), { recursive: true });
+    fs.writeFileSync(statePath, `${JSON.stringify(validated, null, 2)}\n`, "utf-8");
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.provider_state_written",
+        message: "wrote provider state",
+        meta: { statePath, machineId: validated.machineId },
+    });
+}
+function binding(provider, model, updatedAt) {
+    return {
+        provider,
+        model,
+        source: "bootstrap",
+        updatedAt,
+    };
+}
+function bootstrapProviderStateFromAgentConfig(input) {
+    const updatedAt = input.now.toISOString();
+    return {
+        schemaVersion: 1,
+        machineId: input.machineId,
+        updatedAt,
+        lanes: {
+            outward: binding(input.agentConfig.humanFacing.provider, input.agentConfig.humanFacing.model, updatedAt),
+            inner: binding(input.agentConfig.agentFacing.provider, input.agentConfig.agentFacing.model, updatedAt),
+        },
+        readiness: {},
+    };
+}

package/dist/heart/provider-visibility.js

@@ -0,0 +1,188 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAgentProviderVisibility = buildAgentProviderVisibility;
+exports.formatProviderVisibilityLine = formatProviderVisibilityLine;
+exports.formatAgentProviderVisibilityForPrompt = formatAgentProviderVisibilityForPrompt;
+exports.formatAgentProviderVisibilityForStartOfTurn = formatAgentProviderVisibilityForStartOfTurn;
+exports.formatAgentProviderVisibilityForPulse = formatAgentProviderVisibilityForPulse;
+exports.providerVisibilityStatusRows = providerVisibilityStatusRows;
+exports.isAgentProviderVisibility = isAgentProviderVisibility;
+const runtime_1 = require("../nerves/runtime");
+const provider_binding_resolver_1 = require("./provider-binding-resolver");
+const LANES = ["outward", "inner"];
+function credentialVisibility(binding) {
+    const credential = binding.credential;
+    if (credential.status === "present") {
+        return {
+            status: "present",
+            source: credential.source,
+            revision: credential.revision,
+        };
+    }
+    return {
+        status: credential.status,
+        ...("repair" in credential ? { repairCommand: credential.repair.command } : {}),
+    };
+}
+function readinessVisibility(binding) {
+    return {
+        status: binding.readiness.status,
+        ...(binding.readiness.checkedAt ? { checkedAt: binding.readiness.checkedAt } : {}),
+        ...(binding.readiness.error ? { error: binding.readiness.error } : {}),
+        ...(binding.readiness.reason ? { reason: binding.readiness.reason } : {}),
+        ...(binding.readiness.attempts !== undefined ? { attempts: binding.readiness.attempts } : {}),
+    };
+}
+function visibilityForLane(input, lane) {
+    const resolved = (0, provider_binding_resolver_1.resolveEffectiveProviderBinding)({ ...input, lane });
+    if (!resolved.ok) {
+        return {
+            lane,
+            status: "unconfigured",
+            provider: "unconfigured",
+            model: "-",
+            source: "missing",
+            readiness: {
+                status: "unknown",
+                reason: resolved.reason,
+            },
+            credential: {
+                status: "missing",
+                repairCommand: resolved.repair.command,
+            },
+            repairCommand: resolved.repair.command,
+            reason: resolved.reason,
+            warnings: resolved.warnings.map((warning) => warning.message),
+        };
+    }
+    return {
+        lane,
+        status: "configured",
+        provider: resolved.binding.provider,
+        model: resolved.binding.model,
+        source: resolved.binding.source,
+        readiness: readinessVisibility(resolved.binding),
+        credential: credentialVisibility(resolved.binding),
+        warnings: resolved.binding.warnings.map((warning) => warning.message),
+    };
+}
+function buildAgentProviderVisibility(input) {
+    const visibility = {
+        agentName: input.agentName,
+        lanes: LANES.map((lane) => visibilityForLane(input, lane)),
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.provider_visibility_built",
+        message: "built provider visibility summary",
+        meta: {
+            agentName: input.agentName,
+            laneStatuses: visibility.lanes.map((lane) => `${lane.lane}:${lane.status}`).join(","),
+        },
+    });
+    return visibility;
+}
+function credentialLabel(credential) {
+    if (credential.status === "present")
+        return credential.source ?? "vault";
+    if (credential.status === "invalid-pool")
+        return "vault unavailable";
+    if (credential.status === "not-loaded")
+        return "checked previously";
+    return "missing";
+}
+function readinessLabel(readiness) {
+    if (readiness.status === "failed") {
+        return readiness.error ? `failed: ${readiness.error}` : "failed";
+    }
+    if (readiness.status === "stale") {
+        return readiness.reason ? `stale: ${readiness.reason}` : "stale";
+    }
+    if (readiness.status === "unknown") {
+        return readiness.reason ? `unknown: ${readiness.reason}` : "unknown";
+    }
+    return readiness.status;
+}
+function providerStatusDetail(lane) {
+    if (lane.credential.status === "missing" || lane.credential.status === "invalid-pool")
+        return undefined;
+    return lane.readiness.error;
+}
+function formatProviderVisibilityLine(lane) {
+    if (lane.status === "unconfigured") {
+        return `${lane.lane}: unconfigured (${lane.reason}); repair: ${lane.repairCommand}`;
+    }
+    const parts = [
+        readinessLabel(lane.readiness),
+        `source: ${lane.source}`,
+        `credentials: ${credentialLabel(lane.credential)}`,
+    ];
+    if (lane.credential.revision)
+        parts.push(`revision: ${lane.credential.revision}`);
+    if (lane.credential.repairCommand)
+        parts.push(`repair: ${lane.credential.repairCommand}`);
+    if (lane.warnings.length > 0)
+        parts.push(`warnings: ${lane.warnings.join("; ")}`);
+    return `${lane.lane}: ${lane.provider} / ${lane.model} [${parts.join("; ")}]`;
+}
+function formatAgentProviderVisibilityForPrompt(visibility) {
+    if (visibility.lanes.every((lane) => lane.status === "unconfigured")) {
+        return [
+            "provider bindings are not configured on this machine.",
+            ...visibility.lanes.map((lane) => `- ${formatProviderVisibilityLine(lane)}`),
+        ].join("\n");
+    }
+    return [
+        "runtime uses local provider bindings for this machine:",
+        ...visibility.lanes.map((lane) => `- ${formatProviderVisibilityLine(lane)}`),
+    ].join("\n");
+}
+function formatAgentProviderVisibilityForStartOfTurn(visibility) {
+    return visibility.lanes.map((lane) => `- ${formatProviderVisibilityLine(lane)}`).join("\n");
+}
+function formatAgentProviderVisibilityForPulse(visibility) {
+    return visibility.lanes.map((lane) => formatProviderVisibilityLine(lane)).join("; ");
+}
+function providerVisibilityStatusRows(visibility) {
+    return visibility.lanes.map((lane) => {
+        if (lane.status === "unconfigured") {
+            return {
+                agent: visibility.agentName,
+                lane: lane.lane,
+                provider: "unconfigured",
+                model: "-",
+                source: "missing",
+                readiness: "unknown",
+                detail: lane.repairCommand,
+                credential: "missing",
+            };
+        }
+        const detail = providerStatusDetail(lane);
+        return {
+            agent: visibility.agentName,
+            lane: lane.lane,
+            provider: lane.provider,
+            model: lane.model,
+            source: lane.source,
+            readiness: lane.readiness.status,
+            ...(detail ? { detail } : {}),
+            credential: credentialLabel(lane.credential),
+        };
+    });
+}
+function isAgentProviderVisibility(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    if (typeof record.agentName !== "string")
+        return false;
+    if (!Array.isArray(record.lanes))
+        return false;
+    return record.lanes.every((lane) => {
+        if (!lane || typeof lane !== "object" || Array.isArray(lane))
+            return false;
+        const laneRecord = lane;
+        return (laneRecord.lane === "outward" || laneRecord.lane === "inner")
+            && (laneRecord.status === "configured" || laneRecord.status === "unconfigured");
+    });
+}

package/dist/heart/providers/anthropic-token.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.needsRefresh = needsRefresh;
+exports.refreshAnthropicToken = refreshAnthropicToken;
+exports.persistTokenState = persistTokenState;
+exports.ensureFreshToken = ensureFreshToken;
+/* v8 ignore start -- OAuth token lifecycle: requires live API calls, tested via integration @preserve */
+const runtime_1 = require("../../nerves/runtime");
+const provider_credentials_1 = require("../provider-credentials");
+const OAUTH_TOKEN_ENDPOINT = "https://console.anthropic.com/v1/oauth/token";
+const OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+const REFRESH_MARGIN_MS = 5 * 60 * 1000; // refresh 5 minutes before expiry
+/**
+ * Check if the Anthropic OAuth token needs refreshing.
+ * Returns true if no expiresAt is set (legacy token) or if within 5 min of expiry.
+ */
+function needsRefresh(expiresAt) {
+    if (!expiresAt)
+        return true; // legacy token with no expiry — always try refresh
+    return Date.now() > expiresAt - REFRESH_MARGIN_MS;
+}
+/**
+ * Refresh an Anthropic OAuth access token using the refresh token.
+ * Returns the new token state or null if refresh fails.
+ */
+async function refreshAnthropicToken(refreshToken, fetchImpl = fetch) {
+    try {
+        const response = await fetchImpl(OAUTH_TOKEN_ENDPOINT, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "refresh_token",
+                refresh_token: refreshToken,
+                client_id: OAUTH_CLIENT_ID,
+            }),
+        });
+        if (!response.ok) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "engine",
+                event: "engine.anthropic_token_refresh_failed",
+                message: `token refresh failed: ${response.status}`,
+                meta: { status: response.status },
+            });
+            return null;
+        }
+        const json = await response.json();
+        if (!json.access_token) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "engine",
+                event: "engine.anthropic_token_refresh_failed",
+                message: "token refresh returned no access_token",
+                meta: {},
+            });
+            return null;
+        }
+        const state = {
+            accessToken: json.access_token,
+            refreshToken: json.refresh_token ?? refreshToken, // keep old if not returned
+            expiresAt: Date.now() + (json.expires_in ?? 28800) * 1000, // default 8h
+        };
+        (0, runtime_1.emitNervesEvent)({
+            component: "engine",
+            event: "engine.anthropic_token_refreshed",
+            message: "anthropic OAuth token refreshed",
+            meta: { expiresAt: new Date(state.expiresAt).toISOString() },
+        });
+        return state;
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "engine",
+            event: "engine.anthropic_token_refresh_error",
+            message: "token refresh threw",
+            meta: { error: error instanceof Error ? error.message : String(error) },
+        });
+        return null;
+    }
+}
+/**
+ * Persist refreshed token state back to the agent vault.
+ */
+async function persistTokenState(agentName, state) {
+    try {
+        await (0, provider_credentials_1.upsertProviderCredential)({
+            agentName,
+            provider: "anthropic",
+            credentials: {
+                setupToken: state.accessToken,
+                refreshToken: state.refreshToken,
+                expiresAt: state.expiresAt,
+            },
+            config: {},
+            provenance: { source: "auth-flow" },
+        });
+        /* v8 ignore start -- defensive: persistence failure must not crash the provider @preserve */
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "engine",
+            event: "engine.anthropic_token_persist_error",
+            message: "failed to persist refreshed token",
+            meta: { error: error instanceof Error ? error.message : String(error) },
+        });
+    }
+    /* v8 ignore stop */
+}
+/**
+ * Ensure the Anthropic token is fresh. If expired, refresh and persist.
+ * Returns the current valid access token, or null if refresh failed and
+ * the existing token is expired.
+ */
+async function ensureFreshToken(currentToken, refreshToken, expiresAt, agentName, fetchImpl) {
+    if (!needsRefresh(expiresAt)) {
+        return currentToken; // still fresh
+    }
+    if (!refreshToken) {
+        // No refresh token — use the current token as-is (may be expired)
+        return currentToken;
+    }
+    const newState = await refreshAnthropicToken(refreshToken, fetchImpl);
+    if (!newState) {
+        return currentToken; // refresh failed — try the old token
+    }
+    await persistTokenState(agentName, newState);
+    return newState.accessToken;
+}
+/* v8 ignore stop */