@ouro.bot/cli 0.1.0-alpha.56 → 0.1.0-alpha.560

package/dist/repertoire/mcp-manager.js

@@ -0,0 +1,362 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpManager = void 0;
+exports.getSharedMcpManager = getSharedMcpManager;
+exports.shutdownSharedMcpManager = shutdownSharedMcpManager;
+exports.resetSharedMcpManager = resetSharedMcpManager;
+const mcp_client_1 = require("./mcp-client");
+const identity_1 = require("../heart/identity");
+const runtime_1 = require("../nerves/runtime");
+const credential_access_1 = require("./credential-access");
+const MAX_RESTART_RETRIES = 5;
+const RESTART_DELAY_MS = 1000;
+class McpManager {
+    servers = new Map();
+    shuttingDown = false;
+    async start(servers) {
+        (0, runtime_1.emitNervesEvent)({
+            event: "mcp.manager_start",
+            component: "repertoire",
+            message: "starting MCP manager",
+            meta: { serverCount: Object.keys(servers).length },
+        });
+        const entries = Object.entries(servers);
+        for (const [name, config] of entries) {
+            await this.connectServer(name, config);
+        }
+    }
+    listAllTools() {
+        const result = [];
+        for (const [name, entry] of this.servers) {
+            result.push({ server: name, tools: entry.cachedTools });
+        }
+        return result;
+    }
+    async callTool(server, tool, args) {
+        let entry = this.servers.get(server);
+        if (!entry) {
+            throw new Error(`Unknown server: ${server}`);
+        }
+        if (!entry.client.isConnected()) {
+            await this.recoverStaleTransport(server, "pre-call disconnected");
+            entry = this.servers.get(server);
+            if (!entry?.client.isConnected()) {
+                throw new Error(`Server "${server}" is disconnected`);
+            }
+        }
+        try {
+            return await entry.client.callTool(tool, args);
+        }
+        catch (error) {
+            if (!(0, mcp_client_1.isMcpTransportError)(error)) {
+                throw error;
+            }
+            const reason = error instanceof Error ? error.message : String(error);
+            await this.recoverStaleTransport(server, reason);
+            const recovered = this.servers.get(server);
+            if (!recovered?.client.isConnected()) {
+                throw new Error(`Server "${server}" is disconnected after recovery: ${reason}`);
+            }
+            return recovered.client.callTool(tool, args);
+        }
+    }
+    async runCanaries() {
+        const results = [];
+        for (const [server, entry] of [...this.servers]) {
+            try {
+                if (!entry.client.isConnected()) {
+                    await this.recoverStaleTransport(server, "canary disconnected");
+                }
+                const current = this.servers.get(server);
+                if (!current?.client.isConnected()) {
+                    results.push({ server, ok: false, detail: "disconnected after recovery attempt" });
+                    continue;
+                }
+                const tools = await current.client.refreshTools();
+                current.cachedTools = tools;
+                current.consecutiveFailures = 0;
+                results.push({ server, ok: true, detail: `${tools.length} tools listed` });
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : String(error);
+                if ((0, mcp_client_1.isMcpTransportError)(error)) {
+                    await this.recoverStaleTransport(server, reason);
+                }
+                results.push({ server, ok: false, detail: reason });
+            }
+        }
+        return results;
+    }
+    /* v8 ignore start — reconcile: dynamic MCP server management, tested via integration @preserve */
+    /** Re-read agent config and connect new servers / disconnect removed ones. */
+    async reconcile() {
+        try {
+            const config = (0, identity_1.loadAgentConfig)();
+            const servers = config.mcpServers ?? {};
+            const currentNames = new Set(this.servers.keys());
+            const desiredNames = new Set(Object.keys(servers));
+            // Connect new servers
+            for (const [name, cfg] of Object.entries(servers)) {
+                if (!currentNames.has(name)) {
+                    (0, runtime_1.emitNervesEvent)({
+                        event: "mcp.server_added",
+                        component: "repertoire",
+                        message: `connecting new MCP server: ${name}`,
+                        meta: { server: name, command: cfg.command },
+                    });
+                    await this.connectServer(name, cfg);
+                }
+            }
+            // Disconnect removed servers
+            for (const name of currentNames) {
+                if (!desiredNames.has(name)) {
+                    (0, runtime_1.emitNervesEvent)({
+                        event: "mcp.server_removed",
+                        component: "repertoire",
+                        message: `disconnecting removed MCP server: ${name}`,
+                        meta: { server: name },
+                    });
+                    const entry = this.servers.get(name);
+                    if (entry)
+                        entry.client.shutdown();
+                    this.servers.delete(name);
+                }
+            }
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                event: "mcp.reconcile_error",
+                component: "repertoire",
+                message: "failed to reconcile MCP servers",
+                meta: { reason: error instanceof Error ? error.message : String(error) },
+            });
+        }
+    }
+    /* v8 ignore stop */
+    shutdown() {
+        this.shuttingDown = true;
+        // `_end` (not `_stop`) to pair with `mcp.manager_start` under the
+        // nerves audit start/end pairing rule.
+        (0, runtime_1.emitNervesEvent)({
+            event: "mcp.manager_end",
+            component: "repertoire",
+            message: "shutting down MCP manager",
+            meta: { serverCount: this.servers.size },
+        });
+        for (const [, entry] of this.servers) {
+            entry.client.shutdown();
+        }
+        this.servers.clear();
+    }
+    /**
+     * Resolve `vault:DOMAIN/FIELD` references in server env config.
+     * Returns resolved env or throws with a descriptive error.
+     */
+    async resolveVaultEnv(_serverName, env) {
+        const resolved = { ...env };
+        const store = (0, credential_access_1.getCredentialStore)();
+        for (const [key, value] of Object.entries(resolved)) {
+            const match = value.match(/^vault:([^/]+)\/(.+)$/);
+            if (!match)
+                continue;
+            const [, domain, field] = match;
+            try {
+                resolved[key] = await store.getRawSecret(domain, field);
+            }
+            catch (err) {
+                /* v8 ignore next -- reason @preserve */
+                const reason = err instanceof Error ? err.message : String(err);
+                // Classify the error for actionable messaging
+                let classification = "vault unreachable";
+                if (reason.includes("no credential found")) {
+                    classification = "item not found";
+                }
+                else if (reason.includes("field") && reason.includes("not found")) {
+                    classification = "field empty";
+                }
+                throw new Error(`vault:${domain}/${field} could not be resolved: ${classification}`);
+            }
+        }
+        return resolved;
+    }
+    async connectServer(name, config) {
+        // Resolve vault: references in env before spawning
+        let resolvedConfig = config;
+        if (config.env) {
+            try {
+                const resolvedEnv = await this.resolveVaultEnv(name, config.env);
+                resolvedConfig = { ...config, env: resolvedEnv };
+            }
+            catch (err) {
+                /* v8 ignore next -- reason @preserve */
+                const reason = err instanceof Error ? err.message : String(err);
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    event: "mcp.vault_resolve_error",
+                    component: "repertoire",
+                    message: `skipping MCP server "${name}": ${reason}`,
+                    meta: { server: name, reason },
+                });
+                return; // Skip this server, continue to next
+            }
+        }
+        const client = new mcp_client_1.McpClient(resolvedConfig);
+        const entry = {
+            name,
+            config,
+            client,
+            cachedTools: [],
+            consecutiveFailures: 0,
+        };
+        this.servers.set(name, entry);
+        client.onClose(() => {
+            if (this.shuttingDown)
+                return;
+            this.handleServerCrash(name);
+        });
+        try {
+            await client.connect();
+            const tools = await client.listTools();
+            entry.cachedTools = tools;
+            entry.consecutiveFailures = 0;
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                event: "mcp.connect_error",
+                component: "repertoire",
+                message: `failed to connect MCP server "${name}" (command: ${config.command}). Check that the command exists and is properly configured. Reason: ${reason}`,
+                meta: {
+                    server: name,
+                    command: config.command,
+                    args: config.args,
+                    reason,
+                },
+            });
+        }
+    }
+    handleServerCrash(name) {
+        const entry = this.servers.get(name);
+        /* v8 ignore next -- defensive: entry removed between close event and handler @preserve */
+        if (!entry)
+            return;
+        entry.consecutiveFailures++;
+        if (entry.consecutiveFailures > MAX_RESTART_RETRIES) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                event: "mcp.connect_error",
+                component: "repertoire",
+                message: `MCP server "${name}" exceeded max restart retries (${MAX_RESTART_RETRIES}). Giving up — check that "${entry.config.command}" exists and is properly configured in agent.json mcpServers.`,
+                meta: { server: name, command: entry.config.command, failures: entry.consecutiveFailures },
+            });
+            return;
+        }
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "mcp.server_restart",
+            component: "repertoire",
+            message: `restarting crashed MCP server: ${name}`,
+            meta: { server: name, attempt: entry.consecutiveFailures },
+        });
+        /* v8 ignore start -- timer callback: covered by mcp-manager.test.ts via fake timers but v8 can't trace @preserve */
+        setTimeout(() => {
+            if (this.shuttingDown)
+                return;
+            this.restartServer(name).catch(() => {
+                // Error handling is inside restartServer
+            });
+        }, RESTART_DELAY_MS);
+        /* v8 ignore stop */
+    }
+    /* v8 ignore start -- called from timer callback: covered by mcp-manager.test.ts via fake timers but v8 can't trace @preserve */
+    async restartServer(name) {
+        const entry = this.servers.get(name);
+        if (!entry)
+            return;
+        // Remove old entry and reconnect
+        this.servers.delete(name);
+        entry.client.shutdown();
+        await this.connectServer(name, entry.config);
+        // Preserve failure count
+        const newEntry = this.servers.get(name);
+        if (newEntry) {
+            newEntry.consecutiveFailures = entry.consecutiveFailures;
+        }
+    }
+    /* v8 ignore stop */
+    async recoverStaleTransport(name, reason) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "mcp.transport_recovery",
+            component: "repertoire",
+            message: `recovering stale MCP transport: ${name}`,
+            meta: { server: name, reason },
+        });
+        await this.restartServer(name);
+    }
+}
+exports.McpManager = McpManager;
+let _sharedManager = null;
+let _sharedManagerPromise = null;
+/**
+ * Get or create a shared McpManager instance from the agent's config.
+ * Returns null if no mcpServers are configured.
+ * Safe to call from multiple senses — will only create one instance.
+ */
+async function getSharedMcpManager() {
+    // If manager exists, reconcile to pick up config changes (new/removed servers)
+    /* v8 ignore start — reconcile on existing manager @preserve */
+    if (_sharedManager) {
+        await _sharedManager.reconcile();
+        return _sharedManager;
+    }
+    /* v8 ignore stop */
+    /* v8 ignore next -- race guard: deduplicates concurrent initialization calls @preserve */
+    if (_sharedManagerPromise)
+        return _sharedManagerPromise;
+    // Always re-check config — agent may have added servers since last call
+    _sharedManagerPromise = (async () => {
+        try {
+            const config = (0, identity_1.loadAgentConfig)();
+            const servers = config.mcpServers;
+            if (!servers || Object.keys(servers).length === 0)
+                return null;
+            const manager = new McpManager();
+            await manager.start(servers);
+            _sharedManager = manager;
+            return manager;
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                event: "mcp.manager_start",
+                component: "repertoire",
+                message: "failed to initialize shared MCP manager",
+                /* v8 ignore next -- both branches tested: Error in wiring test, non-Error is defensive @preserve */
+                meta: { reason: error instanceof Error ? error.message : String(error) },
+            });
+            return null;
+        }
+        finally {
+            _sharedManagerPromise = null;
+        }
+    })();
+    return _sharedManagerPromise;
+}
+/**
+ * Shut down the shared MCP manager and clear the singleton.
+ * Called during daemon/agent shutdown.
+ */
+function shutdownSharedMcpManager() {
+    if (_sharedManager) {
+        _sharedManager.shutdown();
+        _sharedManager = null;
+    }
+}
+/** Reset for testing only */
+function resetSharedMcpManager() {
+    _sharedManager = null;
+    _sharedManagerPromise = null;
+}

package/dist/repertoire/mcp-tools.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * First-class MCP tool integration — converts MCP server tools into ToolDefinitions
+ * so the model can call them directly without shell indirection.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mcpToolsAsDefinitions = mcpToolsAsDefinitions;
+const runtime_1 = require("../nerves/runtime");
+/**
+ * Convert all tools from an McpManager into ToolDefinition objects.
+ * Each tool gets named `{server}_{tool}` (e.g., `browser_navigate`).
+ * The handler calls `mcpManager.callTool()` and returns concatenated text content.
+ */
+function mcpToolsAsDefinitions(mcpManager) {
+    if (!mcpManager)
+        return [];
+    return mcpManager.listAllTools().flatMap((entry) => entry.tools.map((tool) => ({
+        tool: {
+            type: "function",
+            function: {
+                name: tool.name.startsWith(`${entry.server}_`) || tool.name === entry.server
+                    ? tool.name
+                    : `${entry.server}_${tool.name}`,
+                description: tool.description || `MCP tool: ${tool.name} (server: ${entry.server})`,
+                parameters: tool.inputSchema ?? { type: "object", properties: {} },
+            },
+        },
+        handler: async (args) => {
+            (0, runtime_1.emitNervesEvent)({
+                event: "mcp.tool_start",
+                component: "repertoire",
+                message: `calling MCP tool ${entry.server}/${tool.name}`,
+                meta: { server: entry.server, tool: tool.name },
+            });
+            try {
+                const result = await mcpManager.callTool(entry.server, tool.name, args);
+                const text = result.content
+                    .filter((c) => c.type === "text" && c.text)
+                    .map((c) => c.text)
+                    .join("");
+                (0, runtime_1.emitNervesEvent)({
+                    event: "mcp.tool_end",
+                    component: "repertoire",
+                    message: `MCP tool ${entry.server}/${tool.name} completed`,
+                    meta: { server: entry.server, tool: tool.name },
+                });
+                return text;
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : String(error);
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    event: "mcp.tool_error",
+                    component: "repertoire",
+                    message: `MCP tool ${entry.server}/${tool.name} failed: ${reason}`,
+                    meta: { server: entry.server, tool: tool.name, reason },
+                });
+                return `[mcp error] ${entry.server}/${tool.name}: ${reason}`;
+            }
+        },
+        mcpServer: entry.server,
+    })));
+}

package/dist/repertoire/shell-sessions.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spawnBackgroundShell = spawnBackgroundShell;
+exports.getShellSession = getShellSession;
+exports.listShellSessions = listShellSessions;
+exports.tailShellSession = tailShellSession;
+exports.resetShellSessions = resetShellSessions;
+exports.detectDestructivePatterns = detectDestructivePatterns;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const runtime_1 = require("../nerves/runtime");
+const sessions = new Map();
+const MAX_OUTPUT_LINES = 200;
+function spawnBackgroundShell(command) {
+    const id = (0, crypto_1.randomUUID)();
+    const proc = (0, child_process_1.spawn)("sh", ["-c", command], {
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    const session = {
+        process: proc,
+        info: {
+            id,
+            command,
+            status: "running",
+            exitCode: null,
+            pid: proc.pid,
+            startedAt: Date.now(),
+            output: [],
+        },
+    };
+    const appendOutput = (data) => {
+        const lines = data.toString().split("\n");
+        for (const line of lines) {
+            if (line.length > 0 || session.info.output.length > 0) {
+                session.info.output.push(line);
+            }
+        }
+        // Keep only the last MAX_OUTPUT_LINES
+        if (session.info.output.length > MAX_OUTPUT_LINES) {
+            session.info.output = session.info.output.slice(-MAX_OUTPUT_LINES);
+        }
+    };
+    proc.stdout?.on("data", appendOutput);
+    proc.stderr?.on("data", appendOutput);
+    proc.on("close", (code) => {
+        session.info.status = "exited";
+        session.info.exitCode = code;
+        (0, runtime_1.emitNervesEvent)({
+            component: "repertoire",
+            event: "repertoire.shell.process_exit",
+            message: "background shell process exited",
+            meta: { id, command, exitCode: code, pid: proc.pid },
+        });
+    });
+    sessions.set(id, session);
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.shell.spawn",
+        message: "spawned background shell session",
+        meta: { id, command, pid: proc.pid },
+    });
+    return { ...session.info };
+}
+function getShellSession(id) {
+    const session = sessions.get(id);
+    if (!session)
+        return undefined;
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.shell.status_check",
+        message: "checked shell session status",
+        meta: { id, status: session.info.status, exitCode: session.info.exitCode },
+    });
+    return { ...session.info };
+}
+function listShellSessions() {
+    return Array.from(sessions.values()).map((s) => ({
+        id: s.info.id,
+        command: s.info.command,
+        status: s.info.status,
+        exitCode: s.info.exitCode,
+        pid: s.info.pid,
+        startedAt: s.info.startedAt,
+        output: [], // Don't include full output in listing
+    }));
+}
+function tailShellSession(id, lines = 50) {
+    const session = sessions.get(id);
+    if (!session)
+        return undefined;
+    const tail = session.info.output.slice(-lines);
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.shell.tail",
+        message: "tailed shell session output",
+        meta: { id, requestedLines: lines, returnedLines: tail.length },
+    });
+    return tail.join("\n");
+}
+/** Reset all sessions (for testing) */
+function resetShellSessions() {
+    for (const session of sessions.values()) {
+        if (session.info.status === "running") {
+            session.process.kill();
+        }
+    }
+    sessions.clear();
+}
+const DESTRUCTIVE_PATTERNS = [
+    { name: "rm -rf root/home", regex: /rm\s+-rf\s+[/~]/ },
+    { name: "git push --force", regex: /git\s+push\s+--force/ },
+    { name: "git reset --hard", regex: /git\s+reset\s+--hard/ },
+    { name: "git clean -f", regex: /git\s+clean\s+-f/ },
+    { name: "git branch -D", regex: /git\s+branch\s+-D/ },
+    { name: "fork bomb", regex: /:\(\)\s*\{/ },
+    { name: "write to raw device", regex: />\s*\/dev\/sd/ },
+    { name: "git checkout .", regex: /git\s+checkout\s+\./ },
+    { name: "git stash drop", regex: /git\s+stash\s+drop/ },
+];
+/**
+ * Detect destructive patterns in a shell command.
+ * Returns list of matched pattern names. Empty array = safe.
+ * This is a friction layer, not a hard block.
+ */
+function detectDestructivePatterns(command) {
+    const matched = [];
+    for (const pattern of DESTRUCTIVE_PATTERNS) {
+        if (pattern.regex.test(command)) {
+            matched.push(pattern.name);
+        }
+    }
+    return matched;
+}

package/dist/repertoire/skills.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSkillsDir = getSkillsDir;
+exports.getHarnessSkillsDir = getHarnessSkillsDir;
 exports.listSkills = listSkills;
 exports.loadSkill = loadSkill;
 exports.getLoadedSkills = getLoadedSkills;
@@ -50,9 +51,9 @@ function getSkillsDir() {
 function getProtocolMirrorDir() {
     return path.join(getSkillsDir(), "protocols");
 }
-// Canonical protocol source lives in {repoRoot}/subagents/.
-function getCanonicalProtocolsDir() {
-    return path.join((0, identity_1.getRepoRoot)(), "subagents");
+// Harness-level skills live in {repoRoot}/skills/ directory.
+function getHarnessSkillsDir() {
+    return path.join((0, identity_1.getRepoRoot)(), "skills");
 }
 function listMarkdownBasenames(dir) {
     if (!fs.existsSync(dir))
@@ -63,7 +64,7 @@ function listMarkdownBasenames(dir) {
         .map((f) => path.basename(f, ".md"))
         .sort();
 }
-// in-memory store for loaded skills
+// process-local store for loaded skills
 const loadedSkills = [];
 function listSkills() {
     (0, runtime_1.emitNervesEvent)({
@@ -74,8 +75,10 @@ function listSkills() {
     });
     const baseSkills = listMarkdownBasenames(getSkillsDir());
     const protocolMirrors = listMarkdownBasenames(getProtocolMirrorDir());
-    const canonicalProtocols = listMarkdownBasenames(getCanonicalProtocolsDir());
-    const skills = [...new Set([...baseSkills, ...protocolMirrors, ...canonicalProtocols])].sort();
+    const harnessSkills = listMarkdownBasenames(getHarnessSkillsDir());
+    // Agent skills (base + protocol) come first; harness skills are fallback.
+    // Set deduplicates by name — agent overrides harness.
+    const skills = [...new Set([...baseSkills, ...protocolMirrors, ...harnessSkills])].sort();
     (0, runtime_1.emitNervesEvent)({
         event: "repertoire.load_end",
         component: "repertoire",
@@ -93,7 +96,7 @@ function loadSkill(skillName) {
     });
     const directSkillPath = path.join(getSkillsDir(), `${skillName}.md`);
     const protocolMirrorPath = path.join(getProtocolMirrorDir(), `${skillName}.md`);
-    const canonicalProtocolPath = path.join(getCanonicalProtocolsDir(), `${skillName}.md`);
+    const harnessSkillPath = path.join(getHarnessSkillsDir(), `${skillName}.md`);
     let resolvedPath = null;
     // 1) Direct agent skill.
     if (fs.existsSync(directSkillPath)) {
@@ -103,21 +106,9 @@ function loadSkill(skillName) {
     else if (fs.existsSync(protocolMirrorPath)) {
         resolvedPath = protocolMirrorPath;
     }
-    // 3) Canonical protocol fallback.
-    else if (fs.existsSync(canonicalProtocolPath)) {
-        (0, runtime_1.emitNervesEvent)({
-            level: "warn",
-            event: "repertoire.error",
-            component: "repertoire",
-            message: "protocol mirror missing; using canonical fallback",
-            meta: {
-                operation: "loadSkill",
-                skill: skillName,
-                mirrorPath: protocolMirrorPath,
-                canonicalPath: canonicalProtocolPath,
-            },
-        });
-        resolvedPath = canonicalProtocolPath;
+    // 3) Harness-level skill (ships with npm package).
+    else if (fs.existsSync(harnessSkillPath)) {
+        resolvedPath = harnessSkillPath;
     }
     if (!resolvedPath) {
         (0, runtime_1.emitNervesEvent)({
@@ -128,13 +119,13 @@ function loadSkill(skillName) {
             meta: {
                 operation: "loadSkill",
                 skill: skillName,
-                checkedPaths: [directSkillPath, protocolMirrorPath, canonicalProtocolPath],
+                checkedPaths: [directSkillPath, protocolMirrorPath, harnessSkillPath],
             },
         });
         throw new Error(`skill '${skillName}' not found in:\n` +
             `- ${directSkillPath}\n` +
             `- ${protocolMirrorPath}\n` +
-            `- ${canonicalProtocolPath}`);
+            `- ${harnessSkillPath}`);
     }
     const content = fs.readFileSync(resolvedPath, "utf-8");
     if (!loadedSkills.includes(skillName)) {