@ouro.bot/cli 0.1.0-alpha.6 → 0.1.0-alpha.600

package/dist/heart/config.js

@@ -35,61 +35,55 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadConfig = loadConfig;
 exports.resetConfigCache = resetConfigCache;
-exports.setTestConfig = setTestConfig;
+exports.cacheRuntimeConfigForTests = cacheRuntimeConfigForTests;
+exports.cacheMachineRuntimeConfigForTests = cacheMachineRuntimeConfigForTests;
+exports.patchRuntimeConfig = patchRuntimeConfig;
 exports.getAzureConfig = getAzureConfig;
 exports.getMinimaxConfig = getMinimaxConfig;
 exports.getAnthropicConfig = getAnthropicConfig;
 exports.getOpenAICodexConfig = getOpenAICodexConfig;
+exports.getGithubCopilotConfig = getGithubCopilotConfig;
 exports.getTeamsConfig = getTeamsConfig;
+exports.getTeamsSecondaryConfig = getTeamsSecondaryConfig;
 exports.getContextConfig = getContextConfig;
 exports.getOAuthConfig = getOAuthConfig;
+exports.resolveOAuthForTenant = resolveOAuthForTenant;
 exports.getTeamsChannelConfig = getTeamsChannelConfig;
 exports.getBlueBubblesConfig = getBlueBubblesConfig;
 exports.getBlueBubblesChannelConfig = getBlueBubblesChannelConfig;
 exports.getIntegrationsConfig = getIntegrationsConfig;
+exports.getSyncConfig = getSyncConfig;
 exports.getOpenAIEmbeddingsApiKey = getOpenAIEmbeddingsApiKey;
 exports.getLogsDir = getLogsDir;
+exports.sanitizeKey = sanitizeKey;
+exports.slugify = slugify;
+exports.resolveSessionPath = resolveSessionPath;
 exports.sessionPath = sessionPath;
 exports.logPath = logPath;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const os = __importStar(require("os"));
 const identity_1 = require("./identity");
+const provider_credentials_1 = require("./provider-credentials");
+const runtime_credentials_1 = require("./runtime-credentials");
 const runtime_1 = require("../nerves/runtime");
-const DEFAULT_SECRETS_TEMPLATE = {
-    providers: {
-        // Keep provider field ordering consistent: model first, then auth credentials,
-        // then provider-specific transport fields.
-        azure: {
-            modelName: "",
-            apiKey: "",
-            endpoint: "",
-            deployment: "",
-            apiVersion: "2025-04-01-preview",
-        },
-        minimax: {
-            model: "",
-            apiKey: "",
-        },
-        anthropic: {
-            model: "claude-opus-4-6",
-            setupToken: "",
-        },
-        "openai-codex": {
-            model: "gpt-5.2",
-            oauthAccessToken: "",
-        },
-    },
+const DEFAULT_LOCAL_RUNTIME_CONFIG = {
     teams: {
         clientId: "",
         clientSecret: "",
         tenantId: "",
+        managedIdentityClientId: "",
     },
     oauth: {
         graphConnectionName: "graph",
         adoConnectionName: "ado",
         githubConnectionName: "",
     },
+    teamsSecondary: {
+        clientId: "",
+        clientSecret: "",
+        tenantId: "",
+        managedIdentityClientId: "",
+    },
     teamsChannel: {
         skipConfirmation: true,
         port: 3978,
@@ -98,12 +92,16 @@ const DEFAULT_SECRETS_TEMPLATE = {
         serverUrl: "",
         password: "",
         accountId: "default",
+        ownHandles: [],
     },
     bluebubblesChannel: {
         port: 18790,
         webhookPath: "/bluebubbles-webhook",
         requestTimeoutMs: 30000,
     },
+    vault: {
+        masterPassword: "",
+    },
     integrations: {
         perplexityApiKey: "",
         openaiEmbeddingsApiKey: "",
@@ -111,26 +109,20 @@ const DEFAULT_SECRETS_TEMPLATE = {
 };
 function defaultRuntimeConfig() {
     return {
-        providers: {
-            azure: { ...DEFAULT_SECRETS_TEMPLATE.providers.azure },
-            minimax: { ...DEFAULT_SECRETS_TEMPLATE.providers.minimax },
-            anthropic: { ...DEFAULT_SECRETS_TEMPLATE.providers.anthropic },
-            "openai-codex": { ...DEFAULT_SECRETS_TEMPLATE.providers["openai-codex"] },
-        },
-        teams: { ...DEFAULT_SECRETS_TEMPLATE.teams },
-        oauth: { ...DEFAULT_SECRETS_TEMPLATE.oauth },
+        teams: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.teams },
+        teamsSecondary: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.teamsSecondary },
+        oauth: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.oauth },
         context: { ...identity_1.DEFAULT_AGENT_CONTEXT },
-        teamsChannel: { ...DEFAULT_SECRETS_TEMPLATE.teamsChannel },
-        bluebubbles: { ...DEFAULT_SECRETS_TEMPLATE.bluebubbles },
-        bluebubblesChannel: { ...DEFAULT_SECRETS_TEMPLATE.bluebubblesChannel },
-        integrations: { ...DEFAULT_SECRETS_TEMPLATE.integrations },
+        teamsChannel: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.teamsChannel },
+        bluebubbles: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.bluebubbles },
+        bluebubblesChannel: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.bluebubblesChannel },
+        vault: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.vault },
+        integrations: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.integrations },
     };
 }
-let _cachedConfig = null;
+let _runtimeConfigOverride = null;
 let _testContextOverride = null;
-function resolveConfigPath() {
-    return (0, identity_1.getAgentSecretsPath)();
-}
+let _providerConfigOverride = null;
 function deepMerge(defaults, partial) {
     const result = { ...defaults };
     for (const key of Object.keys(partial)) {
@@ -147,121 +139,115 @@ function deepMerge(defaults, partial) {
     }
     return result;
 }
+function localRuntimeFields(config) {
+    const { providers: _providers, context: _context, ...localFields } = config;
+    return localFields;
+}
 function loadConfig() {
-    if (_cachedConfig) {
-        (0, runtime_1.emitNervesEvent)({
-            event: "config.load",
-            component: "config/identity",
-            message: "config loaded from cache",
-            meta: { source: "cache" },
-        });
-        return _cachedConfig;
-    }
-    const configPath = resolveConfigPath();
-    // Auto-create config directory if it doesn't exist
-    const configDir = path.dirname(configPath);
-    fs.mkdirSync(configDir, { recursive: true });
-    let fileData = {};
-    try {
-        const raw = fs.readFileSync(configPath, "utf-8");
-        fileData = JSON.parse(raw);
-    }
-    catch (error) {
-        const errorCode = error &&
-            typeof error === "object" &&
-            "code" in error &&
-            typeof error.code === "string"
-            ? error.code
-            : undefined;
-        if (errorCode === "ENOENT") {
-            try {
-                fs.writeFileSync(configPath, JSON.stringify(DEFAULT_SECRETS_TEMPLATE, null, 2) + "\n", "utf-8");
-            }
-            catch (writeError) {
-                (0, runtime_1.emitNervesEvent)({
-                    level: "warn",
-                    event: "config_identity.error",
-                    component: "config/identity",
-                    message: "failed writing default secrets config",
-                    meta: {
-                        phase: "loadConfig",
-                        path: configPath,
-                        reason: writeError instanceof Error ? writeError.message : String(writeError),
-                    },
-                });
-            }
-        }
-        (0, runtime_1.emitNervesEvent)({
-            level: "warn",
-            event: "config_identity.error",
-            component: "config/identity",
-            message: "config read failed; defaults applied",
-            meta: {
-                phase: "loadConfig",
-                reason: error instanceof Error ? error.message : String(error),
-            },
-        });
-        // ENOENT or parse error -- use defaults
-    }
-    const sanitizedFileData = { ...fileData };
-    if ("context" in sanitizedFileData) {
-        delete sanitizedFileData.context;
-        (0, runtime_1.emitNervesEvent)({
-            level: "warn",
-            event: "config_identity.error",
-            component: "config/identity",
-            message: "ignored legacy context block in secrets config",
-            meta: {
-                phase: "loadConfig",
-                path: configPath,
-            },
-        });
-    }
-    _cachedConfig = deepMerge(defaultRuntimeConfig(), sanitizedFileData);
+    const agentName = (0, identity_1.getAgentName)();
+    const runtimeResult = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agentName);
+    const machineRuntimeResult = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agentName);
+    const vaultData = runtimeResult.ok ? localRuntimeFields(runtimeResult.config) : {};
+    const machineVaultData = machineRuntimeResult.ok ? localRuntimeFields(machineRuntimeResult.config) : {};
+    const mergedConfig = deepMerge(defaultRuntimeConfig(), vaultData);
+    const mergedWithMachineConfig = deepMerge(mergedConfig, machineVaultData);
+    const config = _runtimeConfigOverride
+        ? deepMerge(mergedWithMachineConfig, _runtimeConfigOverride)
+        : mergedWithMachineConfig;
     (0, runtime_1.emitNervesEvent)({
         event: "config.load",
         component: "config/identity",
-        message: "config loaded from disk",
+        message: "config loaded from runtime credential cache",
         meta: {
-            source: "disk",
-            used_defaults_only: Object.keys(fileData).length === 0,
+            source: runtimeResult.ok ? "vault-cache" : "defaults",
+            used_defaults_only: !runtimeResult.ok,
+            machine_runtime_credentials: machineRuntimeResult.ok ? "available" : machineRuntimeResult.reason,
+            override_applied: _runtimeConfigOverride !== null,
+            runtime_credentials: runtimeResult.ok ? "available" : runtimeResult.reason,
         },
     });
-    return _cachedConfig;
+    return config;
 }
 function resetConfigCache() {
-    _cachedConfig = null;
+    _runtimeConfigOverride = null;
     _testContextOverride = null;
+    _providerConfigOverride = null;
+    (0, provider_credentials_1.resetProviderCredentialCache)();
+    (0, runtime_credentials_1.resetRuntimeCredentialConfigCache)();
+}
+function cacheRuntimeConfigForTests(agentName, config) {
+    (0, runtime_credentials_1.cacheRuntimeCredentialConfig)(agentName, config, new Date(0));
+}
+function cacheMachineRuntimeConfigForTests(agentName, config) {
+    (0, runtime_credentials_1.cacheMachineRuntimeCredentialConfig)(agentName, config, new Date(0), "machine_test");
+}
+function seedProviderCredentialCache(providers) {
+    if (!providers)
+        return;
+    _providerConfigOverride = deepMerge((_providerConfigOverride ?? {}), providers);
+    const records = Object.entries(_providerConfigOverride).map(([provider, rawConfig]) => {
+        const split = (0, provider_credentials_1.splitProviderCredentialFields)(provider, rawConfig);
+        return (0, provider_credentials_1.createProviderCredentialRecord)({
+            provider: provider,
+            credentials: split.credentials,
+            config: split.config,
+            provenance: { source: "manual" },
+            now: new Date(0),
+        });
+    });
+    (0, provider_credentials_1.cacheProviderCredentialRecords)((0, identity_1.getAgentName)(), records, new Date(0));
 }
-function setTestConfig(partial) {
-    loadConfig(); // ensure _cachedConfig exists
+function patchRuntimeConfig(partial) {
+    const { providers, ...runtimePartial } = partial;
+    seedProviderCredentialCache(providers);
     const contextPatch = partial.context;
     if (contextPatch) {
         const base = _testContextOverride ?? identity_1.DEFAULT_AGENT_CONTEXT;
         _testContextOverride = deepMerge(base, contextPatch);
     }
-    _cachedConfig = deepMerge(_cachedConfig, partial);
+    _runtimeConfigOverride = deepMerge((_runtimeConfigOverride ?? {}), runtimePartial);
+}
+function readProviderConfig(provider) {
+    const cached = (0, provider_credentials_1.readCachedProviderCredentialRecord)((0, identity_1.getAgentName)(), provider);
+    return cached.ok ? { ...cached.record.config, ...cached.record.credentials } : {};
 }
 function getAzureConfig() {
-    const config = loadConfig();
-    return { ...config.providers.azure };
+    const raw = readProviderConfig("azure");
+    return {
+        apiKey: typeof raw.apiKey === "string" ? raw.apiKey : "",
+        endpoint: typeof raw.endpoint === "string" ? raw.endpoint : "",
+        deployment: typeof raw.deployment === "string" ? raw.deployment : "",
+        apiVersion: typeof raw.apiVersion === "string" ? raw.apiVersion : "2025-04-01-preview",
+        managedIdentityClientId: typeof raw.managedIdentityClientId === "string" ? raw.managedIdentityClientId : "",
+    };
 }
 function getMinimaxConfig() {
-    const config = loadConfig();
-    return { ...config.providers.minimax };
+    const raw = readProviderConfig("minimax");
+    return { apiKey: typeof raw.apiKey === "string" ? raw.apiKey : "" };
 }
 function getAnthropicConfig() {
-    const config = loadConfig();
-    return { ...config.providers.anthropic };
+    const raw = readProviderConfig("anthropic");
+    return { setupToken: typeof raw.setupToken === "string" ? raw.setupToken : "" };
 }
 function getOpenAICodexConfig() {
-    const config = loadConfig();
-    return { ...config.providers["openai-codex"] };
+    const raw = readProviderConfig("openai-codex");
+    return { oauthAccessToken: typeof raw.oauthAccessToken === "string" ? raw.oauthAccessToken : "" };
+}
+function getGithubCopilotConfig() {
+    const raw = readProviderConfig("github-copilot");
+    return {
+        githubToken: typeof raw.githubToken === "string" ? raw.githubToken : "",
+        baseUrl: typeof raw.baseUrl === "string" ? raw.baseUrl : "",
+    };
 }
 function getTeamsConfig() {
     const config = loadConfig();
     return { ...config.teams };
 }
+function getTeamsSecondaryConfig() {
+    const config = loadConfig();
+    return { ...config.teamsSecondary };
+}
 function getContextConfig() {
     if (_testContextOverride) {
         return { ..._testContextOverride };
@@ -282,6 +268,16 @@ function getOAuthConfig() {
     const config = loadConfig();
     return { ...config.oauth };
 }
+/** Resolve OAuth connection names for a specific tenant, falling back to defaults. */
+function resolveOAuthForTenant(tenantId) {
+    const base = getOAuthConfig();
+    const overrides = tenantId ? base.tenantOverrides?.[tenantId] : undefined;
+    return {
+        graphConnectionName: overrides?.graphConnectionName ?? base.graphConnectionName,
+        adoConnectionName: overrides?.adoConnectionName ?? base.adoConnectionName,
+        githubConnectionName: overrides?.githubConnectionName ?? base.githubConnectionName,
+    };
+}
 function getTeamsChannelConfig() {
     const config = loadConfig();
     const { skipConfirmation, flushIntervalMs, port } = config.teamsChannel;
@@ -289,17 +285,24 @@ function getTeamsChannelConfig() {
 }
 function getBlueBubblesConfig() {
     const config = loadConfig();
-    const { serverUrl, password, accountId } = config.bluebubbles;
+    const { serverUrl, password, accountId, ownHandles } = config.bluebubbles;
     if (!serverUrl.trim()) {
-        throw new Error("bluebubbles.serverUrl is required in secrets.json to run the BlueBubbles sense.");
+        throw new Error("bluebubbles.serverUrl is required in this machine's agent-vault runtime config. Run `ouro connect bluebubbles --agent <agent>`.");
     }
     if (!password.trim()) {
-        throw new Error("bluebubbles.password is required in secrets.json to run the BlueBubbles sense.");
+        throw new Error("bluebubbles.password is required in this machine's agent-vault runtime config. Run `ouro connect bluebubbles --agent <agent>`.");
+    }
+    const normalizedHandles = [];
+    for (const handle of ownHandles) {
+        const trimmed = handle.trim();
+        if (trimmed.length > 0)
+            normalizedHandles.push(trimmed);
     }
     return {
         serverUrl: serverUrl.trim(),
         password: password.trim(),
         accountId: accountId.trim() || "default",
+        ownHandles: normalizedHandles,
     };
 }
 function getBlueBubblesChannelConfig() {
@@ -311,20 +314,46 @@ function getIntegrationsConfig() {
     const config = loadConfig();
     return { ...config.integrations };
 }
+function getSyncConfig() {
+    try {
+        const agentConfig = (0, identity_1.loadAgentConfig)();
+        return {
+            enabled: agentConfig.sync?.enabled ?? false,
+            remote: agentConfig.sync?.remote ?? "origin",
+        };
+    }
+    catch {
+        /* v8 ignore next -- defensive: loadAgentConfig failure in test/bootstrap @preserve */
+        return { enabled: false, remote: "origin" };
+    }
+}
 function getOpenAIEmbeddingsApiKey() {
     return getIntegrationsConfig().openaiEmbeddingsApiKey;
 }
 function getLogsDir() {
-    return path.join(os.homedir(), ".agentstate", (0, identity_1.getAgentName)(), "logs");
+    return path.join((0, identity_1.getAgentRoot)(), "state", "logs");
 }
 function sanitizeKey(key) {
     return key.replace(/[/:]/g, "_");
 }
-function sessionPath(friendId, channel, key) {
-    const dir = path.join(os.homedir(), ".agentstate", (0, identity_1.getAgentName)(), "sessions", friendId, channel);
-    fs.mkdirSync(dir, { recursive: true });
+function slugify(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+/, "")
+        .replace(/-+$/, "");
+}
+function resolveSessionPath(friendId, channel, key, options) {
+    const dir = path.join((0, identity_1.getAgentRoot)(), "state", "sessions", friendId, channel);
+    if (options?.ensureDir) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
     return path.join(dir, sanitizeKey(key) + ".json");
 }
+function sessionPath(friendId, channel, key) {
+    return resolveSessionPath(friendId, channel, key, { ensureDir: true });
+}
 function logPath(channel, key) {
     return path.join(getLogsDir(), channel, sanitizeKey(key) + ".ndjson");
 }