@ouro.bot/cli 0.1.0-alpha.8 → 0.1.0-alpha.800

package/dist/repertoire/credential-access.js

@@ -0,0 +1,178 @@
+"use strict";
+/**
+ * Credential access layer.
+ *
+ * Bitwarden/Vaultwarden is the sole runtime credential store. The only local
+ * secret is the vault unlock material held by an explicit local unlock store.
+ *
+ * Each agent owns one credential vault. getCredentialStore() returns that
+ * agent's vault directly; item names are not shared or namespaced across
+ * agents.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCredentialStore = getCredentialStore;
+exports.probeCredentialVaultAccess = probeCredentialVaultAccess;
+exports.resetCredentialStore = resetCredentialStore;
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../nerves/runtime");
+const identity = __importStar(require("../heart/identity"));
+const bitwarden_store_1 = require("./bitwarden-store");
+const vault_unlock_1 = require("./vault-unlock");
+let stores = new Map();
+function loadVaultSectionForAgent(agentName) {
+    const configPath = path.join(identity.getAgentRoot(agentName), "agent.json");
+    try {
+        const parsed = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+        return { configPath, vault: parsed.vault };
+    }
+    catch {
+        return { configPath };
+    }
+}
+function bitwardenAppDataDir(agentName, vaultConfig, homeDir = os.homedir()) {
+    const digest = crypto
+        .createHash("sha256")
+        .update(`${agentName}:${vaultConfig.serverUrl}:${vaultConfig.email}`)
+        .digest("hex")
+        .slice(0, 24);
+    return path.join(homeDir, ".ouro-cli", "bitwarden", digest);
+}
+function getCredentialStore(agentNameInput) {
+    const agentName = agentNameInput ?? identity.getAgentName();
+    if (agentName === "SerpentGuide") {
+        throw new Error("SerpentGuide does not have a persistent credential vault; hatch bootstrap uses provider credentials in memory only.");
+    }
+    const { configPath, vault } = loadVaultSectionForAgent(agentName);
+    if (!vault || typeof vault.email !== "string" || vault.email.trim().length === 0) {
+        throw new Error((0, vault_unlock_1.credentialVaultNotConfiguredError)(agentName, configPath));
+    }
+    const vaultConfig = identity.resolveVaultConfig(agentName, vault);
+    const cacheKey = `${agentName}:${vaultConfig.serverUrl}:${vaultConfig.email}`;
+    const cached = stores.get(cacheKey);
+    if (cached)
+        return cached;
+    const unlock = (0, vault_unlock_1.readVaultUnlockSecret)({
+        agentName,
+        email: vaultConfig.email,
+        serverUrl: vaultConfig.serverUrl,
+    });
+    const unlockConfig = { agentName, email: vaultConfig.email, serverUrl: vaultConfig.serverUrl };
+    const unlockSource = unlock.source ?? unlockConfig;
+    let invalidUnlockCleared = false;
+    let canonicalUnlockStored = false;
+    const store = new bitwarden_store_1.BitwardenCredentialStore(vaultConfig.serverUrl, vaultConfig.email, unlock.secret, {
+        appDataDir: bitwardenAppDataDir(agentName, vaultConfig),
+        onInvalidUnlockSecret: (error) => {
+            if (invalidUnlockCleared)
+                return;
+            invalidUnlockCleared = true;
+            (0, vault_unlock_1.clearVaultUnlockSecret)({
+                agentName,
+                email: unlockSource.email,
+                serverUrl: unlockSource.serverUrl,
+            });
+            stores.delete(cacheKey);
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                event: "repertoire.credential_store_invalid_unlock_cleared",
+                component: "repertoire",
+                message: "cleared rejected local vault unlock material",
+                meta: {
+                    agentName,
+                    serverUrl: vaultConfig.serverUrl,
+                    email: vaultConfig.email,
+                    sourceServerUrl: unlockSource.serverUrl,
+                    error: error.message,
+                },
+            });
+        },
+        onLoginSuccess: () => {
+            if (canonicalUnlockStored)
+                return;
+            if (unlockSource.serverUrl === vaultConfig.serverUrl && unlockSource.email === vaultConfig.email)
+                return;
+            canonicalUnlockStored = true;
+            try {
+                (0, vault_unlock_1.storeVaultUnlockSecret)(unlockConfig, unlock.secret);
+                (0, vault_unlock_1.noteVaultUnlockSelfHeal)(unlockConfig, unlock.store.kind, unlockSource.serverUrl);
+            }
+            catch (error) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    event: "repertoire.vault_unlock_self_heal_failed",
+                    component: "repertoire",
+                    message: "failed to rewrite local unlock material using canonical vault coordinates",
+                    meta: {
+                        store: unlock.store.kind,
+                        email: vaultConfig.email,
+                        sourceServerUrl: unlockSource.serverUrl,
+                        targetServerUrl: vaultConfig.serverUrl,
+                        error: error instanceof Error ? error.message : String(error),
+                    },
+                });
+            }
+        },
+    });
+    stores.set(cacheKey, store);
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.credential_store_init",
+        component: "repertoire",
+        message: "credential store initialized",
+        meta: {
+            backend: "bitwarden",
+            agentName,
+            serverUrl: vaultConfig.serverUrl,
+            email: vaultConfig.email,
+        },
+    });
+    return store;
+}
+async function probeCredentialVaultAccess(agentNameInput, unlockSecret, options = {}) {
+    const agentName = agentNameInput;
+    const { configPath, vault } = loadVaultSectionForAgent(agentName);
+    if (!vault || typeof vault.email !== "string" || vault.email.trim().length === 0) {
+        throw new Error((0, vault_unlock_1.credentialVaultNotConfiguredError)(agentName, configPath));
+    }
+    const vaultConfig = identity.resolveVaultConfig(agentName, vault);
+    const store = new bitwarden_store_1.BitwardenCredentialStore(vaultConfig.serverUrl, vaultConfig.email, unlockSecret, { appDataDir: bitwardenAppDataDir(agentName, vaultConfig, options.homeDir) });
+    await store.get("__ouro_vault_probe__");
+}
+function resetCredentialStore() {
+    stores = new Map();
+}

package/dist/repertoire/data/ado-endpoints.json

@@ -35,6 +35,12 @@
         "description": "Delete a work item (moves to recycle bin)",
         "params": "destroy (boolean, permanently delete)"
     },
+    {
+        "path": "/{project}/_apis/wit/workitemtypes",
+        "method": "GET",
+        "description": "List all work item types available in a project (Bug, Task, Epic, User Story, etc.)",
+        "params": ""
+    },
     {
         "path": "/_apis/git/repositories",
         "method": "GET",
@@ -118,5 +124,187 @@
         "method": "GET",
         "description": "List saved work item queries (shared and personal)",
         "params": "$depth, $expand"
+    },
+    {
+        "path": "/_apis/groupentitlements?api-version=7.1",
+        "method": "GET",
+        "host": "vsaex.dev.azure.com",
+        "description": "List group entitlements (group rules that auto-assign licenses). Use host vsaex.dev.azure.com.",
+        "params": ""
+    },
+    {
+        "path": "/_apis/groupentitlements?api-version=7.1",
+        "method": "POST",
+        "host": "vsaex.dev.azure.com",
+        "description": "Create a group entitlement rule — maps an AAD group to an access level (e.g. Basic) and project membership. All members of the AAD group automatically get the specified license. Use host vsaex.dev.azure.com. This is the best way to bulk-provision users.",
+        "params": "body: { group: { origin: 'aad', originId: '<AAD-group-object-id>', subjectKind: 'group' }, licenseRule: { licensingSource: 'account', accountLicenseType: 'express', licenseDisplayName: 'Basic' }, projectEntitlements: [{ group: { groupType: 'projectContributor' }, projectRef: { id: '<project-id>' } }] }"
+    },
+    {
+        "path": "/_apis/groupentitlements/{groupId}?api-version=7.1",
+        "method": "GET",
+        "host": "vsaex.dev.azure.com",
+        "description": "Get a specific group entitlement by ID. Use host vsaex.dev.azure.com.",
+        "params": ""
+    },
+    {
+        "path": "/_apis/groupentitlements/{groupId}?api-version=7.1",
+        "method": "PATCH",
+        "host": "vsaex.dev.azure.com",
+        "description": "Update a group entitlement (change license rule, project access). Use host vsaex.dev.azure.com.",
+        "params": "JSON Patch array: [{op, path, value}]"
+    },
+    {
+        "path": "/_apis/groupentitlements/{groupId}?api-version=7.1",
+        "method": "DELETE",
+        "host": "vsaex.dev.azure.com",
+        "description": "Delete a group entitlement rule. Use host vsaex.dev.azure.com.",
+        "params": ""
+    },
+    {
+        "path": "/_apis/memberentitlementmanagement/memberentitlements?api-version=7.1-preview.3",
+        "method": "GET",
+        "host": "vsapm.dev.azure.com",
+        "description": "List individual member entitlements (users and their access levels). Use host vsapm.dev.azure.com. For bulk provisioning, prefer the Group Entitlements API on vsaex.dev.azure.com instead.",
+        "params": "$top, $skip, $filter, $orderBy, $select"
+    },
+    {
+        "path": "/_apis/memberentitlementmanagement/memberentitlements?api-version=7.1-preview.3",
+        "method": "POST",
+        "host": "vsapm.dev.azure.com",
+        "description": "Add a single member entitlement. Use host vsapm.dev.azure.com. For bulk provisioning, prefer the Group Entitlements API on vsaex.dev.azure.com instead.",
+        "params": "body: { accessLevel: { accountLicenseType: 'express'|'stakeholder', licensingSource: 'account' }, user: { principalName: 'user@domain.com', subjectKind: 'user' }, projectEntitlements: [{ group: { groupType: 'projectContributor' }, projectRef: { id: projectId } }] }"
+    },
+    {
+        "path": "/_apis/memberentitlementmanagement/memberentitlements/{memberId}?api-version=7.1-preview.3",
+        "method": "PATCH",
+        "host": "vsapm.dev.azure.com",
+        "description": "Update a member entitlement (change access level, project access). Use host vsapm.dev.azure.com.",
+        "params": "JSON Patch array: [{op, path, value}]"
+    },
+    {
+        "path": "/_apis/memberentitlementmanagement/memberentitlements/{memberId}?api-version=7.1-preview.3",
+        "method": "DELETE",
+        "host": "vsapm.dev.azure.com",
+        "description": "Remove a member entitlement (revoke user access). Use host vsapm.dev.azure.com.",
+        "params": ""
+    },
+    {
+        "path": "/_apis/graph/users?api-version=7.1-preview.1",
+        "method": "GET",
+        "host": "vssps.dev.azure.com",
+        "description": "List users in the organization (Graph API). Use host vssps.dev.azure.com. IMPORTANT: include the full path with api-version as shown.",
+        "params": "subjectTypes (aad, msa, etc.), continuationToken"
+    },
+    {
+        "path": "/_apis/graph/groups?api-version=7.1-preview.1",
+        "method": "GET",
+        "host": "vssps.dev.azure.com",
+        "description": "List groups in the organization. Use host vssps.dev.azure.com. IMPORTANT: include the full path with api-version as shown.",
+        "params": "subjectTypes, continuationToken"
+    },
+    {
+        "path": "/_apis/graph/memberships/{subjectDescriptor}?api-version=7.1-preview.1",
+        "method": "GET",
+        "host": "vssps.dev.azure.com",
+        "description": "List group memberships for a user or group. Use host vssps.dev.azure.com. IMPORTANT: include the full path with api-version as shown.",
+        "params": "direction (up = groups user belongs to, down = members of group)"
+    },
+    {
+        "path": "/_apis/graph/memberships/{subjectDescriptor}/{containerDescriptor}?api-version=7.1-preview.1",
+        "method": "PUT",
+        "host": "vssps.dev.azure.com",
+        "description": "Add a user to a group. Use host vssps.dev.azure.com. IMPORTANT: include the full path with api-version as shown.",
+        "params": ""
+    },
+    {
+        "path": "/_apis/graph/memberships/{subjectDescriptor}/{containerDescriptor}?api-version=7.1-preview.1",
+        "method": "DELETE",
+        "host": "vssps.dev.azure.com",
+        "description": "Remove a user from a group. Use host vssps.dev.azure.com. IMPORTANT: include the full path with api-version as shown.",
+        "params": ""
+    },
+    {
+        "path": "/_apis/projects/{projectId}/teams",
+        "method": "GET",
+        "description": "List teams in a project",
+        "params": "$top, $skip"
+    },
+    {
+        "path": "/_apis/projects/{projectId}/teams/{teamId}",
+        "method": "GET",
+        "description": "Get a specific team by ID",
+        "params": ""
+    },
+    {
+        "path": "/_apis/projects/{projectId}/teams",
+        "method": "POST",
+        "description": "Create a new team in a project",
+        "params": "name, description"
+    },
+    {
+        "path": "/_apis/projects/{projectId}/teams/{teamId}/members",
+        "method": "GET",
+        "description": "List members of a team",
+        "params": "$top, $skip"
+    },
+    {
+        "path": "/{project}/{team}/_apis/work/teamsettings/iterations",
+        "method": "GET",
+        "description": "List iterations (sprints) for a team",
+        "params": "$timeframe (current, past, future)"
+    },
+    {
+        "path": "/{project}/{team}/_apis/work/teamsettings/iterations",
+        "method": "POST",
+        "description": "Add an iteration to a team's sprint schedule",
+        "params": "id (iteration node ID)"
+    },
+    {
+        "path": "/{project}/{team}/_apis/work/teamsettings/iterations/{iterationId}",
+        "method": "DELETE",
+        "description": "Remove an iteration from a team's sprint schedule",
+        "params": ""
+    },
+    {
+        "path": "/{project}/_apis/wit/classificationnodes/iterations",
+        "method": "GET",
+        "description": "List iteration path tree (project-level iteration nodes)",
+        "params": "$depth"
+    },
+    {
+        "path": "/{project}/_apis/wit/classificationnodes/iterations",
+        "method": "POST",
+        "description": "Create a new iteration node (sprint)",
+        "params": "name, attributes: { startDate, finishDate }"
+    },
+    {
+        "path": "/{project}/_apis/wit/classificationnodes/areas",
+        "method": "GET",
+        "description": "List area path tree (project-level area nodes)",
+        "params": "$depth"
+    },
+    {
+        "path": "/{project}/_apis/wit/classificationnodes/areas",
+        "method": "POST",
+        "description": "Create a new area path node",
+        "params": "name"
+    },
+    {
+        "path": "/{project}/_apis/wit/classificationnodes/{structureGroup}/{path}",
+        "method": "DELETE",
+        "description": "Delete a classification node (area or iteration). structureGroup is 'areas' or 'iterations'.",
+        "params": "$reclassifyId (move items to this node before deleting)"
+    },
+    {
+        "path": "/_apis/hooks/subscriptions",
+        "method": "GET",
+        "description": "List service hook subscriptions (webhooks for events)",
+        "params": ""
+    },
+    {
+        "path": "/_apis/hooks/subscriptions",
+        "method": "POST",
+        "description": "Create a service hook subscription (webhook)",
+        "params": "publisherId, eventType, consumerId, consumerActionId, publisherInputs, consumerInputs"
     }
 ]