@ouro.bot/cli 0.1.0-alpha.6 → 0.1.0-alpha.600

package/dist/repertoire/mcp-tools.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * First-class MCP tool integration — converts MCP server tools into ToolDefinitions
+ * so the model can call them directly without shell indirection.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mcpToolsAsDefinitions = mcpToolsAsDefinitions;
+const runtime_1 = require("../nerves/runtime");
+/**
+ * Convert all tools from an McpManager into ToolDefinition objects.
+ * Each tool gets named `{server}_{tool}` (e.g., `browser_navigate`).
+ * The handler calls `mcpManager.callTool()` and returns concatenated text content.
+ */
+function mcpToolsAsDefinitions(mcpManager) {
+    if (!mcpManager)
+        return [];
+    return mcpManager.listAllTools().flatMap((entry) => entry.tools.map((tool) => ({
+        tool: {
+            type: "function",
+            function: {
+                name: tool.name.startsWith(`${entry.server}_`) || tool.name === entry.server
+                    ? tool.name
+                    : `${entry.server}_${tool.name}`,
+                description: tool.description || `MCP tool: ${tool.name} (server: ${entry.server})`,
+                parameters: tool.inputSchema ?? { type: "object", properties: {} },
+            },
+        },
+        handler: async (args) => {
+            (0, runtime_1.emitNervesEvent)({
+                event: "mcp.tool_start",
+                component: "repertoire",
+                message: `calling MCP tool ${entry.server}/${tool.name}`,
+                meta: { server: entry.server, tool: tool.name },
+            });
+            try {
+                const result = await mcpManager.callTool(entry.server, tool.name, args);
+                const text = result.content
+                    .filter((c) => c.type === "text" && c.text)
+                    .map((c) => c.text)
+                    .join("");
+                (0, runtime_1.emitNervesEvent)({
+                    event: "mcp.tool_end",
+                    component: "repertoire",
+                    message: `MCP tool ${entry.server}/${tool.name} completed`,
+                    meta: { server: entry.server, tool: tool.name },
+                });
+                return text;
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : String(error);
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    event: "mcp.tool_error",
+                    component: "repertoire",
+                    message: `MCP tool ${entry.server}/${tool.name} failed: ${reason}`,
+                    meta: { server: entry.server, tool: tool.name, reason },
+                });
+                return `[mcp error] ${entry.server}/${tool.name}: ${reason}`;
+            }
+        },
+        mcpServer: entry.server,
+    })));
+}

package/dist/repertoire/shell-sessions.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spawnBackgroundShell = spawnBackgroundShell;
+exports.getShellSession = getShellSession;
+exports.listShellSessions = listShellSessions;
+exports.tailShellSession = tailShellSession;
+exports.resetShellSessions = resetShellSessions;
+exports.detectDestructivePatterns = detectDestructivePatterns;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const runtime_1 = require("../nerves/runtime");
+const sessions = new Map();
+const MAX_OUTPUT_LINES = 200;
+function spawnBackgroundShell(command) {
+    const id = (0, crypto_1.randomUUID)();
+    const proc = (0, child_process_1.spawn)("sh", ["-c", command], {
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    const session = {
+        process: proc,
+        info: {
+            id,
+            command,
+            status: "running",
+            exitCode: null,
+            pid: proc.pid,
+            startedAt: Date.now(),
+            output: [],
+        },
+    };
+    const appendOutput = (data) => {
+        const lines = data.toString().split("\n");
+        for (const line of lines) {
+            if (line.length > 0 || session.info.output.length > 0) {
+                session.info.output.push(line);
+            }
+        }
+        // Keep only the last MAX_OUTPUT_LINES
+        if (session.info.output.length > MAX_OUTPUT_LINES) {
+            session.info.output = session.info.output.slice(-MAX_OUTPUT_LINES);
+        }
+    };
+    proc.stdout?.on("data", appendOutput);
+    proc.stderr?.on("data", appendOutput);
+    proc.on("close", (code) => {
+        session.info.status = "exited";
+        session.info.exitCode = code;
+        (0, runtime_1.emitNervesEvent)({
+            component: "repertoire",
+            event: "repertoire.shell.process_exit",
+            message: "background shell process exited",
+            meta: { id, command, exitCode: code, pid: proc.pid },
+        });
+    });
+    sessions.set(id, session);
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.shell.spawn",
+        message: "spawned background shell session",
+        meta: { id, command, pid: proc.pid },
+    });
+    return { ...session.info };
+}
+function getShellSession(id) {
+    const session = sessions.get(id);
+    if (!session)
+        return undefined;
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.shell.status_check",
+        message: "checked shell session status",
+        meta: { id, status: session.info.status, exitCode: session.info.exitCode },
+    });
+    return { ...session.info };
+}
+function listShellSessions() {
+    return Array.from(sessions.values()).map((s) => ({
+        id: s.info.id,
+        command: s.info.command,
+        status: s.info.status,
+        exitCode: s.info.exitCode,
+        pid: s.info.pid,
+        startedAt: s.info.startedAt,
+        output: [], // Don't include full output in listing
+    }));
+}
+function tailShellSession(id, lines = 50) {
+    const session = sessions.get(id);
+    if (!session)
+        return undefined;
+    const tail = session.info.output.slice(-lines);
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.shell.tail",
+        message: "tailed shell session output",
+        meta: { id, requestedLines: lines, returnedLines: tail.length },
+    });
+    return tail.join("\n");
+}
+/** Reset all sessions (for testing) */
+function resetShellSessions() {
+    for (const session of sessions.values()) {
+        if (session.info.status === "running") {
+            session.process.kill();
+        }
+    }
+    sessions.clear();
+}
+const DESTRUCTIVE_PATTERNS = [
+    { name: "rm -rf root/home", regex: /rm\s+-rf\s+[/~]/ },
+    { name: "git push --force", regex: /git\s+push\s+--force/ },
+    { name: "git reset --hard", regex: /git\s+reset\s+--hard/ },
+    { name: "git clean -f", regex: /git\s+clean\s+-f/ },
+    { name: "git branch -D", regex: /git\s+branch\s+-D/ },
+    { name: "fork bomb", regex: /:\(\)\s*\{/ },
+    { name: "write to raw device", regex: />\s*\/dev\/sd/ },
+    { name: "git checkout .", regex: /git\s+checkout\s+\./ },
+    { name: "git stash drop", regex: /git\s+stash\s+drop/ },
+];
+/**
+ * Detect destructive patterns in a shell command.
+ * Returns list of matched pattern names. Empty array = safe.
+ * This is a friction layer, not a hard block.
+ */
+function detectDestructivePatterns(command) {
+    const matched = [];
+    for (const pattern of DESTRUCTIVE_PATTERNS) {
+        if (pattern.regex.test(command)) {
+            matched.push(pattern.name);
+        }
+    }
+    return matched;
+}

package/dist/repertoire/skills.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSkillsDir = getSkillsDir;
+exports.getHarnessSkillsDir = getHarnessSkillsDir;
 exports.listSkills = listSkills;
 exports.loadSkill = loadSkill;
 exports.getLoadedSkills = getLoadedSkills;
@@ -50,9 +51,9 @@ function getSkillsDir() {
 function getProtocolMirrorDir() {
     return path.join(getSkillsDir(), "protocols");
 }
-// Canonical protocol source lives in {repoRoot}/subagents/.
-function getCanonicalProtocolsDir() {
-    return path.join((0, identity_1.getRepoRoot)(), "subagents");
+// Harness-level skills live in {repoRoot}/skills/ directory.
+function getHarnessSkillsDir() {
+    return path.join((0, identity_1.getRepoRoot)(), "skills");
 }
 function listMarkdownBasenames(dir) {
     if (!fs.existsSync(dir))
@@ -63,7 +64,7 @@ function listMarkdownBasenames(dir) {
         .map((f) => path.basename(f, ".md"))
         .sort();
 }
-// in-memory store for loaded skills
+// process-local store for loaded skills
 const loadedSkills = [];
 function listSkills() {
     (0, runtime_1.emitNervesEvent)({
@@ -74,8 +75,10 @@ function listSkills() {
     });
     const baseSkills = listMarkdownBasenames(getSkillsDir());
     const protocolMirrors = listMarkdownBasenames(getProtocolMirrorDir());
-    const canonicalProtocols = listMarkdownBasenames(getCanonicalProtocolsDir());
-    const skills = [...new Set([...baseSkills, ...protocolMirrors, ...canonicalProtocols])].sort();
+    const harnessSkills = listMarkdownBasenames(getHarnessSkillsDir());
+    // Agent skills (base + protocol) come first; harness skills are fallback.
+    // Set deduplicates by name — agent overrides harness.
+    const skills = [...new Set([...baseSkills, ...protocolMirrors, ...harnessSkills])].sort();
     (0, runtime_1.emitNervesEvent)({
         event: "repertoire.load_end",
         component: "repertoire",
@@ -93,7 +96,7 @@ function loadSkill(skillName) {
     });
     const directSkillPath = path.join(getSkillsDir(), `${skillName}.md`);
     const protocolMirrorPath = path.join(getProtocolMirrorDir(), `${skillName}.md`);
-    const canonicalProtocolPath = path.join(getCanonicalProtocolsDir(), `${skillName}.md`);
+    const harnessSkillPath = path.join(getHarnessSkillsDir(), `${skillName}.md`);
     let resolvedPath = null;
     // 1) Direct agent skill.
     if (fs.existsSync(directSkillPath)) {
@@ -103,21 +106,9 @@ function loadSkill(skillName) {
     else if (fs.existsSync(protocolMirrorPath)) {
         resolvedPath = protocolMirrorPath;
     }
-    // 3) Canonical protocol fallback.
-    else if (fs.existsSync(canonicalProtocolPath)) {
-        (0, runtime_1.emitNervesEvent)({
-            level: "warn",
-            event: "repertoire.error",
-            component: "repertoire",
-            message: "protocol mirror missing; using canonical fallback",
-            meta: {
-                operation: "loadSkill",
-                skill: skillName,
-                mirrorPath: protocolMirrorPath,
-                canonicalPath: canonicalProtocolPath,
-            },
-        });
-        resolvedPath = canonicalProtocolPath;
+    // 3) Harness-level skill (ships with npm package).
+    else if (fs.existsSync(harnessSkillPath)) {
+        resolvedPath = harnessSkillPath;
     }
     if (!resolvedPath) {
         (0, runtime_1.emitNervesEvent)({
@@ -128,13 +119,13 @@ function loadSkill(skillName) {
             meta: {
                 operation: "loadSkill",
                 skill: skillName,
-                checkedPaths: [directSkillPath, protocolMirrorPath, canonicalProtocolPath],
+                checkedPaths: [directSkillPath, protocolMirrorPath, harnessSkillPath],
             },
         });
         throw new Error(`skill '${skillName}' not found in:\n` +
             `- ${directSkillPath}\n` +
             `- ${protocolMirrorPath}\n` +
-            `- ${canonicalProtocolPath}`);
+            `- ${harnessSkillPath}`);
     }
     const content = fs.readFileSync(resolvedPath, "utf-8");
     if (!loadedSkills.includes(skillName)) {

package/dist/repertoire/stripe-client.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * Thin wrapper around the Stripe Issuing API.
+ *
+ * Initializes with a restricted API key from the agent's vault.
+ * Card numbers are NEVER included in nerves events or log output.
+ * The `getCardDetails` method exists only for internal payment flows
+ * (e.g., passing card details to Duffel) — the returned data must
+ * never escape the calling function's scope.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createStripeClient = createStripeClient;
+const stripe_1 = __importDefault(require("stripe"));
+const credential_access_1 = require("./credential-access");
+const runtime_1 = require("../nerves/runtime");
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+function toCardInfo(card) {
+    return {
+        cardId: card.id,
+        last4: card.last4,
+        status: card.status,
+    };
+}
+/**
+ * Create a Stripe client initialized with a restricted key from the vault.
+ */
+async function createStripeClient() {
+    const store = (0, credential_access_1.getCredentialStore)();
+    const apiKey = await store.getRawSecret("stripe.com", "restrictedKey");
+    // StripeConstructor is a callable (not a class), cast the result
+    const stripe = (0, stripe_1.default)(apiKey);
+    return {
+        async createVirtualCard(opts) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.stripe_card_create_start",
+                message: "creating virtual card",
+                meta: { type: opts.type, currency: opts.currency },
+            });
+            const spendingControls = {
+                spending_limits: [
+                    {
+                        amount: opts.spendLimit * 100, // Stripe uses cents
+                        interval: opts.type === "single_use" ? "all_time" : "monthly",
+                    },
+                ],
+                ...(opts.merchantCategories
+                    ? { allowed_categories: opts.merchantCategories }
+                    : {}),
+            };
+            const card = await stripe.issuing.cards.create({
+                type: "virtual",
+                currency: opts.currency,
+                spending_controls: spendingControls,
+                status: "active",
+            });
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.stripe_card_create_end",
+                message: "virtual card created",
+                meta: { cardId: card.id, last4: card.last4 },
+            });
+            return toCardInfo(card);
+        },
+        async getCard(cardId) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.stripe_card_get",
+                message: "retrieving card info",
+                meta: { cardId },
+            });
+            const card = await stripe.issuing.cards.retrieve(cardId);
+            return toCardInfo(card);
+        },
+        async updateCard(cardId, updates) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.stripe_card_update",
+                message: "updating card",
+                meta: { cardId },
+            });
+            const card = await stripe.issuing.cards.update(cardId, updates);
+            return toCardInfo(card);
+        },
+        async deactivateCard(cardId) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.stripe_card_deactivate",
+                message: "deactivating card",
+                meta: { cardId },
+            });
+            const card = await stripe.issuing.cards.update(cardId, { status: "canceled" });
+            return toCardInfo(card);
+        },
+        async listCards() {
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.stripe_cards_list",
+                message: "listing cards",
+                meta: {},
+            });
+            const result = await stripe.issuing.cards.list();
+            return result.data.map(toCardInfo);
+        },
+        async getCardDetails(cardId) {
+            // This method retrieves sensitive card details for payment flows.
+            // The data must NEVER be logged, emitted, or returned to the model.
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.stripe_card_details_get",
+                message: "retrieving card details for payment flow",
+                meta: { cardId },
+            });
+            const card = await stripe.issuing.cards.retrieve(cardId, {
+                expand: ["number", "cvc"],
+            });
+            return {
+                cardId: card.id,
+                number: card.number,
+                cvc: card.cvc,
+                expMonth: card.exp_month,
+                expYear: card.exp_year,
+            };
+        },
+    };
+}

package/dist/repertoire/tasks/board.js

@@ -7,14 +7,21 @@ exports.boardDeps = boardDeps;
 exports.boardSessions = boardSessions;
 const runtime_1 = require("../../nerves/runtime");
 const transitions_1 = require("./transitions");
-const BOARD_STATUS_ORDER = [
+const BOARD_ACTIVE_ORDER = [
     "blocked",
     "processing",
     "collaborating",
     "drafting",
     "validating",
     "paused",
+];
+const BOARD_TERMINAL_ORDER = [
     "done",
+    "cancelled",
+];
+const BOARD_STATUS_ORDER = [
+    ...BOARD_ACTIVE_ORDER,
+    ...BOARD_TERMINAL_ORDER,
 ];
 function compactName(task) {
     const suffix = task.stem.replace(/^\d{4}-\d{2}-\d{2}-\d{4}-/, "");
@@ -29,6 +36,7 @@ function groupByStatus(tasks) {
         paused: [],
         blocked: [],
         done: [],
+        cancelled: [],
     };
     for (const task of tasks) {
         grouped[task.status].push(compactName(task));
@@ -59,8 +67,26 @@ function activeSessionLines(tasks) {
     });
     return active.map((task) => task.stem).sort();
 }
+function activeBridgeLines(tasks) {
+    return tasks
+        .filter((task) => typeof task.frontmatter.active_bridge === "string" && String(task.frontmatter.active_bridge).trim())
+        .map((task) => `${task.stem} -> ${String(task.frontmatter.active_bridge).trim()}`)
+        .sort();
+}
+function buildHealthLine(issues) {
+    if (issues.length === 0)
+        return "health: clean";
+    const liveCount = issues.filter((i) => i.category === "live").length;
+    const migrationCount = issues.filter((i) => i.category === "migration").length;
+    const parts = [];
+    if (liveCount > 0)
+        parts.push(`${liveCount} live`);
+    if (migrationCount > 0)
+        parts.push(`${migrationCount} migration`);
+    return `health: ${parts.join(", ")}`;
+}
 function actionRequired(index, byStatus) {
-    const actions = [...index.parseErrors, ...index.invalidFilenames.map((filePath) => `bad filename: ${filePath}`)];
+    const actions = index.issues.map((issue) => `${issue.code}: ${issue.description} [${issue.target}]`);
     if (byStatus.blocked.length > 0) {
         actions.push(`blocked tasks: ${byStatus.blocked.join(", ")}`);
     }
@@ -77,14 +103,19 @@ function buildTaskBoard(index) {
         meta: { taskCount: index.tasks.length },
     });
     const byStatus = groupByStatus(index.tasks);
-    const counts = transitions_1.TASK_VALID_STATUSES.map((status) => `${status}:${byStatus[status].length}`).join(" ");
+    const activeCounts = BOARD_ACTIVE_ORDER.map((status) => `${status}:${byStatus[status].length}`).join(" ");
     const processing = byStatus.processing.length > 0 ? `\n processing: ${byStatus.processing.join(", ")}` : "";
     const blocked = byStatus.blocked.length > 0 ? `\n blocked: ${byStatus.blocked.join(", ")}` : "";
-    const compact = `[Tasks] ${counts}${processing}${blocked}`;
+    const terminalParts = BOARD_TERMINAL_ORDER
+        .filter((status) => byStatus[status].length > 0)
+        .map((status) => `${status}:${byStatus[status].length}`);
+    const terminalLine = terminalParts.length > 0 ? `\n terminal: ${terminalParts.join(" ")}` : "";
+    const healthLine = `\n ${buildHealthLine(index.issues)}`;
+    const compact = `[Tasks] ${activeCounts}${processing}${blocked}${terminalLine}${healthLine}`;
     const fullLines = [];
     for (const status of BOARD_STATUS_ORDER) {
         const names = byStatus[status];
-        if (status === "done" && names.length === 0)
+        if ((status === "done" || status === "cancelled") && names.length === 0)
             continue;
         fullLines.push(`## ${status}`);
         fullLines.push(names.length > 0 ? names.map((name) => `- ${name}`).join("\n") : "- (none)");
@@ -99,13 +130,20 @@ function buildTaskBoard(index) {
         fullLines.push("## active sessions");
         fullLines.push(active.map((line) => `- ${line}`).join("\n"));
     }
+    const activeBridges = activeBridgeLines(index.tasks);
+    if (activeBridges.length > 0) {
+        fullLines.push("## active bridges");
+        fullLines.push(activeBridges.map((line) => `- ${line}`).join("\n"));
+    }
     return {
         compact,
         full: fullLines.join("\n\n"),
         byStatus,
+        issues: index.issues,
         actionRequired: actionRequired(index, byStatus),
         unresolvedDependencies: unresolved,
         activeSessions: active,
+        activeBridges,
     };
 }
 function boardStatus(board, status) {