@ouro.bot/cli 0.1.0-alpha.69 → 0.1.0-alpha.691

package/dist/repertoire/graph-client.js

@@ -7,61 +7,20 @@ exports.graphRequest = graphRequest;
 exports.getProfile = getProfile;
 const api_error_1 = require("../heart/api-error");
 const runtime_1 = require("../nerves/runtime");
+const api_client_1 = require("./api-client");
 const GRAPH_BASE = "https://graph.microsoft.com/v1.0";
 // Generic Graph API request. Returns response body as pretty-printed JSON string.
 async function graphRequest(token, method, path, body) {
-    try {
-        (0, runtime_1.emitNervesEvent)({
-            event: "client.request_start",
-            component: "clients",
-            message: "starting Graph request",
-            meta: { client: "graph", method, path },
-        });
-        const url = `${GRAPH_BASE}${path}`;
-        const opts = {
-            method,
-            headers: {
-                Authorization: `Bearer ${token}`,
-                "Content-Type": "application/json",
-            },
-        };
-        if (body)
-            opts.body = body;
-        const res = await fetch(url, opts);
-        if (!res.ok) {
-            (0, runtime_1.emitNervesEvent)({
-                level: "error",
-                event: "client.error",
-                component: "clients",
-                message: "Graph request failed",
-                meta: { client: "graph", method, path, status: res.status },
-            });
-            return (0, api_error_1.handleApiError)(res, "Graph", "graph");
-        }
-        const data = await res.json();
-        (0, runtime_1.emitNervesEvent)({
-            event: "client.request_end",
-            component: "clients",
-            message: "Graph request completed",
-            meta: { client: "graph", method, path, success: true },
-        });
-        return JSON.stringify(data, null, 2);
-    }
-    catch (err) {
-        (0, runtime_1.emitNervesEvent)({
-            level: "error",
-            event: "client.error",
-            component: "clients",
-            message: "Graph request threw exception",
-            meta: {
-                client: "graph",
-                method,
-                path,
-                reason: err instanceof Error ? err.message : String(err),
-            },
-        });
-        return (0, api_error_1.handleApiError)(err, "Graph", "graph");
-    }
+    return (0, api_client_1.apiRequest)({
+        baseUrl: GRAPH_BASE,
+        method,
+        path,
+        token,
+        clientName: "graph",
+        serviceLabel: "Graph",
+        connectionName: "graph",
+        body,
+    });
 }
 // Backward-compatible thin wrapper: fetches /me and formats as human-readable text.
 async function getProfile(token) {

package/dist/repertoire/guardrails.js

@@ -36,9 +36,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.OURO_CLI_TRUST_MANIFEST = void 0;
 exports.guardInvocation = guardInvocation;
 const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
-const types_1 = require("../mind/friends/types");
+const path = __importStar(require("node:path"));
+const friends_1 = require("@ouro.bot/friends");
 const runtime_1 = require("../nerves/runtime");
+const store_1 = require("../commerce/store");
 const deny = (reason) => ({ allowed: false, reason });
 const allow = { allowed: true };
 // --- reason templates ---
@@ -48,7 +49,6 @@ const REASONS = {
     readBeforeOverwrite: "i need to read that file first before i can overwrite it.",
     protectedPath: "that path is protected — i can read it but not modify it.",
     destructiveCommand: "that command is too dangerous to run — it could cause irreversible damage.",
-    compoundCommand: "i can only run simple commands for you — no chaining with && or ;",
     // Trust reasons (vary by relationship)
     needsTrust: "i'd need a closer friend to vouch for you before i can do that.",
     needsTrustForWrite: "i'd need a closer friend to vouch for you before i can write files outside my home.",
@@ -56,17 +56,19 @@ const REASONS = {
 // --- read-only tools that never need guardrails ---
 const READ_ONLY_TOOLS = new Set(["read_file", "glob", "grep"]);
 // --- protected path detection ---
-const PROTECTED_PATH_SEGMENTS = [".git/"];
-function getProtectedAbsolutePrefixes() {
-    return [`${os.homedir()}/.agentsecrets/`];
-}
+const PROTECTED_PATH_SEGMENTS = [
+    ".git/",
+    ".ouro-cli/vault-unlock/",
+    ".ouro-cli/vault-unlock-dpapi/",
+];
+const PROTECTED_FILENAMES = ["agent.json"];
 function isProtectedPath(filePath) {
     for (const segment of PROTECTED_PATH_SEGMENTS) {
         if (filePath.includes(`/${segment}`) || filePath.startsWith(segment))
             return true;
     }
-    for (const prefix of getProtectedAbsolutePrefixes()) {
-        if (filePath.startsWith(prefix))
+    for (const name of PROTECTED_FILENAMES) {
+        if (path.basename(filePath) === name)
             return true;
     }
     return false;
@@ -90,9 +92,6 @@ function splitShellCommands(command) {
         return [command];
     return command.split(COMPOUND_SEPARATORS).filter(Boolean);
 }
-function isCompoundCommand(command) {
-    return SUBSHELL_PATTERN.test(command) || splitShellCommands(command).length > 1;
-}
 // --- shell commands that write to protected paths ---
 function shellWritesToProtectedPath(command) {
     const redirectMatch = command.match(/>\s*(\S+)/);
@@ -159,19 +158,19 @@ exports.OURO_CLI_TRUST_MANIFEST = {
     whoami: "acquaintance",
     changelog: "acquaintance",
     "session list": "acquaintance",
-    "task board": "friend",
-    "task create": "friend",
-    "task update": "friend",
-    "task show": "friend",
-    "task actionable": "friend",
-    "task deps": "friend",
-    "task sessions": "friend",
     "friend list": "friend",
     "friend show": "friend",
     "friend create": "friend",
-    "reminder create": "friend",
+    "friend update": "family",
+    "config model": "friend",
+    "config models": "friend",
     "mcp list": "acquaintance",
     "mcp call": "friend",
+    auth: "family",
+    "auth verify": "family",
+    "auth switch": "family",
+    rollback: "family",
+    versions: "acquaintance",
 };
 // --- trust level comparison ---
 const LEVEL_ORDER = {
@@ -206,6 +205,26 @@ function resolveOuroSubcommand(command) {
         return tokens[0];
     return null;
 }
+// --- MCP server-specific trust rules ---
+const MCP_SERVER_TRUST = {
+    browser: { minTrust: "friend", blockGroupChat: true },
+};
+function checkMcpServerTrust(command, context) {
+    const match = command.match(/^ouro\s+mcp\s+call\s+(\S+)/);
+    if (!match)
+        return allow;
+    const serverName = match[1];
+    const rules = MCP_SERVER_TRUST[serverName];
+    if (!rules)
+        return allow; // no special rules for this server
+    if (!trustLevelSatisfied(rules.minTrust, context.trustLevel ?? "friend")) {
+        return deny(REASONS.needsTrust);
+    }
+    if (rules.blockGroupChat && context.isGroupChat) {
+        return deny("browser tools are only available in 1:1 conversations, not group chats.");
+    }
+    return allow;
+}
 function checkSingleShellCommandTrust(command, trustLevel) {
     const trimmed = command.trim();
     const tokens = trimmed.split(/\s+/);
@@ -231,11 +250,21 @@ function checkSingleShellCommandTrust(command, trustLevel) {
     return deny(REASONS.needsTrust);
 }
 function checkShellTrustGuardrails(command, trustLevel) {
-    // Compound commands: for untrusted users, reject entirely.
-    // This prevents "ouro whoami && rm -rf /" from smuggling dangerous commands.
-    if (isCompoundCommand(command))
-        return deny(REASONS.compoundCommand);
-    return checkSingleShellCommandTrust(command, trustLevel);
+    // Subshell patterns ($(), backticks) can't be reliably split — check as single command
+    /* v8 ignore next -- subshell branch: tested via guardrails.test.ts @preserve */
+    if (SUBSHELL_PATTERN.test(command)) {
+        return checkSingleShellCommandTrust(command, trustLevel);
+    }
+    // Compound commands: check each subcommand individually
+    const subcommands = splitShellCommands(command);
+    if (subcommands.length === 0)
+        return checkSingleShellCommandTrust(command, trustLevel);
+    for (const sub of subcommands) {
+        const result = checkSingleShellCommandTrust(sub, trustLevel);
+        if (!result.allowed)
+            return result;
+    }
+    return allow;
 }
 function checkWriteTrustGuardrails(toolName, args, context) {
     if (toolName !== "write_file" && toolName !== "edit_file")
@@ -247,9 +276,112 @@ function checkWriteTrustGuardrails(toolName, args, context) {
         return allow;
     return deny(REASONS.needsTrustForWrite);
 }
+// --- credential tool trust gating ---
+// Credential write tools: family only
+const CREDENTIAL_FAMILY_TOOLS = new Set([
+    "credential_generate_password", "credential_store", "credential_delete", "vault_setup",
+    // User profile tools: family only
+    "user_profile_store", "user_profile_get", "user_profile_delete",
+    // Payment tools: family only
+    "stripe_create_card", "stripe_deactivate_card", "stripe_list_cards",
+    // Booking tools that involve payment: family only
+    "flight_book", "flight_hold", "flight_cancel",
+]);
+// Credential read tools: friend+
+const CREDENTIAL_TRUSTED_TOOLS = new Set(["credential_get", "credential_list"]);
+// Travel tools: friend+ (weather_lookup accesses vault credentials indirectly;
+// advisory and geocode are public APIs but gated for consistency)
+// Flight search is also friend+ (read-only, no payment)
+const TRAVEL_TRUSTED_TOOLS = new Set(["weather_lookup", "travel_advisory", "geocode_search", "flight_search"]);
+const A2A_TRUSTED_TOOLS = new Set(["a2a_list_peers", "a2a_send_message", "a2a_get_task"]);
+const COMMERCE_FAMILY_TOOLS = new Set(["commerce_checkout_preview", "commerce_checkout_commit", "commerce_receipt_get", "commerce_access_log"]);
+const COMMERCE_AUTHORITY_TOOLS = new Set(["stripe_create_card", "flight_hold", "flight_book"]);
+const MAIL_FAMILY_TOOLS = new Set(["mail_screener", "mail_decide", "mail_access_log", "mail_send", "mail_index_refresh"]);
+const MAIL_DELEGATED_READ_TOOLS = new Set(["mail_recent", "mail_search"]);
+function mailTrustGuardrail(toolName, args, context) {
+    if (MAIL_FAMILY_TOOLS.has(toolName)) {
+        if (context.trustLevel === undefined || context.trustLevel === "family")
+            return allow;
+        if (toolName === "mail_send")
+            return deny("outbound mail sends require family trust.");
+        return deny(toolName === "mail_decide"
+            ? "mail screener decisions require family trust."
+            : "delegated human mail requires family trust.");
+    }
+    if (MAIL_DELEGATED_READ_TOOLS.has(toolName)) {
+        const scope = (args.scope ?? "").trim().toLowerCase();
+        if (scope === "delegated" || scope === "all") {
+            if (context.trustLevel === undefined || context.trustLevel === "family")
+                return allow;
+            return deny("delegated human mail requires family trust.");
+        }
+    }
+    return allow;
+}
+function checkCredentialTrustGuardrails(toolName, context) {
+    if (CREDENTIAL_FAMILY_TOOLS.has(toolName) || COMMERCE_FAMILY_TOOLS.has(toolName)) {
+        if (context.trustLevel === "family")
+            return allow;
+        return deny(REASONS.needsTrust);
+    }
+    if (CREDENTIAL_TRUSTED_TOOLS.has(toolName) || TRAVEL_TRUSTED_TOOLS.has(toolName) || A2A_TRUSTED_TOOLS.has(toolName)) {
+        if ((0, friends_1.isTrustedLevel)(context.trustLevel))
+            return allow;
+        return deny(REASONS.needsTrust);
+    }
+    return allow;
+}
+function checkCommerceAuthorityGuardrails(toolName, args, context) {
+    if (!COMMERCE_AUTHORITY_TOOLS.has(toolName))
+        return allow;
+    if (!context.agentRoot)
+        return deny("commerce authority unavailable: agent root could not be resolved.");
+    const result = (0, store_1.validateCommerceAuthority)({
+        agentRoot: context.agentRoot,
+        token: args.commerce_authority,
+        toolName,
+        args,
+        friendId: context.friendId,
+    });
+    if (result.ok)
+        return allow;
+    return deny(`commerce authority required: ${result.reason}`);
+}
+function checkFirstClassMcpTrust(context) {
+    if (!context.mcpServerName)
+        return allow;
+    const rules = MCP_SERVER_TRUST[context.mcpServerName] ?? { minTrust: "friend", blockGroupChat: false };
+    if (!trustLevelSatisfied(rules.minTrust, context.trustLevel ?? "friend")) {
+        return deny(REASONS.needsTrust);
+    }
+    if (rules.blockGroupChat && context.isGroupChat) {
+        return deny("browser tools are only available in 1:1 conversations, not group chats.");
+    }
+    return allow;
+}
 function checkTrustLevelGuardrails(toolName, args, context) {
-    // Trusted levels (family/friend) — no trust guardrails. Undefined defaults to friend.
-    if ((0, types_1.isTrustedLevel)(context.trustLevel))
+    const mailResult = mailTrustGuardrail(toolName, args, context);
+    if (!mailResult.allowed)
+        return mailResult;
+    // Credential tools have their own trust rules that apply at all levels
+    const credentialResult = checkCredentialTrustGuardrails(toolName, context);
+    if (!credentialResult.allowed)
+        return credentialResult;
+    const commerceAuthorityResult = checkCommerceAuthorityGuardrails(toolName, args, context);
+    if (!commerceAuthorityResult.allowed)
+        return commerceAuthorityResult;
+    // First-class MCP tool trust (e.g. browser_navigate) — applies at all trust levels
+    const firstClassMcpResult = checkFirstClassMcpTrust(context);
+    if (!firstClassMcpResult.allowed)
+        return firstClassMcpResult;
+    // MCP server-specific trust via shell (e.g. ouro mcp call browser) — applies at all trust levels
+    if (toolName === "shell") {
+        const mcpResult = checkMcpServerTrust(args.command || "", context);
+        if (!mcpResult.allowed)
+            return mcpResult;
+    }
+    // Trusted levels (family/friend) — no further trust guardrails. Undefined defaults to friend.
+    if ((0, friends_1.isTrustedLevel)(context.trustLevel))
         return allow;
     if (toolName === "shell") {
         return checkShellTrustGuardrails(args.command || "", context.trustLevel);

package/dist/repertoire/mcp-client.js

@@ -1,11 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.McpClient = void 0;
+exports.isMcpTransportError = isMcpTransportError;
 const child_process_1 = require("child_process");
 const readline_1 = require("readline");
 const runtime_1 = require("../nerves/runtime");
+const runtime_cwd_1 = require("../heart/runtime-cwd");
 const MCP_PROTOCOL_VERSION = "2024-11-05";
+const DEFAULT_REQUEST_TIMEOUT = 10_000;
 const DEFAULT_TOOL_CALL_TIMEOUT = 30_000;
+function isMcpTransportError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const normalized = message.toLowerCase();
+    return normalized.includes("disconnected")
+        || normalized.includes("transport")
+        || normalized.includes("closed")
+        || normalized.includes("econnreset")
+        || normalized.includes("econnrefused")
+        || normalized.includes("enoent")
+        || normalized.includes("epipe")
+        || normalized.includes("broken pipe")
+        || normalized.includes("not writable");
+}
 class McpClient {
     config;
     process = null;
@@ -18,6 +34,9 @@ class McpClient {
         this.config = config;
     }
     async connect() {
+        if (this.connected)
+            return;
+        this.shutdownProcessOnly();
         (0, runtime_1.emitNervesEvent)({
             event: "mcp.connect_start",
             component: "repertoire",
@@ -25,9 +44,11 @@ class McpClient {
             meta: { command: this.config.command },
         });
         const env = { ...process.env, ...this.config.env };
+        const spawnCwd = this.config.cwd ?? (0, runtime_cwd_1.recoverRuntimeCwd)();
         this.process = (0, child_process_1.spawn)(this.config.command, this.config.args ?? [], {
             env,
             stdio: ["pipe", "pipe", "pipe"],
+            cwd: spawnCwd,
         });
         this.setupLineReader();
         this.setupProcessHandlers();
@@ -43,6 +64,7 @@ class McpClient {
         }
         catch (error) {
             this.connected = false;
+            this.shutdownProcessOnly();
             (0, runtime_1.emitNervesEvent)({
                 level: "error",
                 event: "mcp.connect_error",
@@ -75,6 +97,10 @@ class McpClient {
         this.cachedTools = allTools;
         return allTools;
     }
+    async refreshTools() {
+        this.cachedTools = null;
+        return this.listTools();
+    }
     async callTool(name, args, timeout = DEFAULT_TOOL_CALL_TIMEOUT) {
         (0, runtime_1.emitNervesEvent)({
             event: "mcp.tool_call_start",
@@ -138,7 +164,7 @@ class McpClient {
         });
         return result;
     }
-    sendRequest(method, params, timeout) {
+    sendRequest(method, params, timeout = DEFAULT_REQUEST_TIMEOUT) {
         return new Promise((resolve, reject) => {
             if (!this.process || !this.connected && method !== "initialize") {
                 reject(new Error("MCP client is disconnected"));
@@ -159,14 +185,21 @@ class McpClient {
                 method,
                 params,
             };
-            this.writeMessage(request);
+            if (!this.writeMessage(request)) {
+                this.pending.delete(id);
+                if (pending.timer) {
+                    clearTimeout(pending.timer);
+                }
+                reject(new Error(`MCP transport is not writable for request: ${method}`));
+            }
         });
     }
     writeMessage(message) {
-        /* v8 ignore next -- defensive: stdin always writable during active connection @preserve */
         if (this.process?.stdin?.writable) {
             this.process.stdin.write(JSON.stringify(message) + "\n");
+            return true;
         }
+        return false;
     }
     setupLineReader() {
         /* v8 ignore next -- defensive: stdout always exists after spawn @preserve */
@@ -250,5 +283,13 @@ class McpClient {
             this.pending.delete(id);
         }
     }
+    shutdownProcessOnly() {
+        this.rejectAllPending(new Error("MCP transport closed during reconnect"));
+        /* v8 ignore next -- defensive: process may already be absent @preserve */
+        if (this.process && !this.process.killed) {
+            this.process.kill();
+        }
+        this.process = null;
+    }
 }
 exports.McpClient = McpClient;